lift and allowing it to settle onto the runway. For CAT IIIc, the flight control computer will continue to accept deviations from the localizer and use the rudder to maintain the aircraft on the localizer (which is aligned with the runway centerline.) On landing the spoilers will deploy (these are surfaces on the top of the wing towards the trailing edge) which causes airflow over the wing to become turbulent, destroying lift. At the same time the autobrake system will apply the brakes. The anti-skid system will modulate brake pressure to keep all wheels turning. As the speed decreases, the rudder will lose effectiveness and the pilot will need to control the direction of the airplane using nose wheel steering, a system which typically is not connected to the flight control computer. From an avionics safety perspective, a CAT IIIc landing is the worst-case scenario for safety analysis because a failure of the automatic systems from flare through the roll-out could easily result in a "hard over" (where a control surface deflects fully in one direction.) This would happen so fast that the flight crew may not effectively respond. For this reason autoland systems are designed to incorporate a high degree of redundancy so that a single failure of any part of the system can be tolerated (fail active) and a second failure can be detected – at which point the autoland system will turn itself off (uncouple, fail passive). One way of accomplishing this is to have "three of everything." Three ILS receivers, three radio altimeters, three flight control computers, and three ways of controlling the flight surfaces. The three flight control computers all work in parallel and are in constant cross communications, comparing their inputs (ILS receivers and radio altimeters) with those of the other two flight control computers. If there is a difference in inputs, then a computer can "vote out" the deviant input and will notify the other computers that (for instance) "RA1 is faulty." If the outputs don't match, a computer can declare itself as faulty and, if possible, take itself off line. When the pilot arms the system (prior to capture of either the localizer or glideslope) the flight control computers perform an extensive series of built-in tests. For a CAT III landing, all the sensors and all the flight computers must be in good health before the pilot receives an "AUTOLAND ARM" indication