What does it mean when autoland is fail passive / fail operational?
The quoted explanation about "fail operational" and "fail passive" is correct, in that "fail operational" means the system will continue to function after an failure, and "fail passive" means the system will not misbehave after an failure.

The exact number of autopilots required to make this work, however, is debatable; and much depends on how you define it.

Let's take the Boeing 777 because it is easy to begin with. It has three autopilots. It will say "LAND 3" or "LAND 2" respectively. In a system of three, a failure can be detected if one disagrees with the other two. In a system of two, it is uncertain which one has failed, so all units come offline.

Now here comes the interesting part: what if I can distinguish a failed unit from a functional unit, without using another functional unit? In other words, what if I have something that can monitor the existing units, but is incapable of functioning the same as one of the monitored units on its own?

That is how fail operational can be implemented with two autopilots. For example, the Flight Management and Guidance System (FMGS) on the Airbus A320 can switch from "Dual Mode" to "Single Mode". The FCOM does not detail how it does that. (A320 FCOM - Aircraft Systems - Auto Flight - General)

But the FCOM does state a "CAT 3 DUAL" automatic landing is fail operational 


  the remaining part of the automatic system allows the aircraft to
  complete the approach, flare and landing


while a "CAT 3 SINGLE" landing is fail passive:


  there is no significant out-of-trim condition or deviation of flight
  path or attitude, bu the landing is not completed automatically


 A320 FCOM - Procedures - Normal Procedures - Landing Categories

The Boeing 737 has 3 inertial sources but only 2 autopilots. It implements fail operational on the inertial sources but fail passive on the autopilots.


  If a failure is detected, the flight controls respond to the A/P
  commanding the lesser control movement. If a failure occurs in one
  A/P, the failed channel is counteracted by the second channel such
  that both A/Ps disconnect with minimal airplane maneuvering and with
  aural and visual warnings to the pilot.


Boeing 737 FCOM volume 2 - Automatic Flight - System Description