ECC? Yes, but that's not all; safety-critical applications like automotive often use two cores running the same code in lockstep, each with their own memory. If the behavior of the two CPUs goes out of sync, the processor can be configured to take corrective actions, such as resetting, halting, and/or going into a failsafe mode.

TI has an overview of the safety features in their Hercules microcontrollers here:

http://www.ti.com/lit/wp/spry178/spry178.pdf

Don't you need at least three actors, such that in a single failure condition you can use an election algorithm? I guess two are enough if you do regular snapshotting and the worst case time to restore from a snapshot is lower than the real time bounds you need to comply with.

It depends if, when two processors disagree, you can perform a simple 'stop' action.

For example, if something goes wrong with the processor on your industrial robot arm, you just stop all the motors and activate all the brakes. No need to figure out which of the processors is right, have an engineer come out and fix the bug that caused the disagreement.

On the other hand, if something goes wrong with the processor during your space shuttle launch, it would not help to turn off all the rockets - better to have an election algorithm so things can keep working.

Is a self-driving car more like the first case or the second? Depends if the driver is ready to take the wheel :)

I'd argue the second case, generally.

There are far too many situations where a switchover time of [user initial reaction time + initial response time] is high enough to be rather dangerous.

Generally the system will fall back to a 'limp home mode' running on a simpler algorithm on a watchdog microcontroller. See for example, Freescale's reference design for an airbag controller.

http://www.freescale.com/webapp/sps/site/application.jsp?cod...

It's not really 'autonomous driving' so you might be overestimating the safety factor implied by the term 'autopilot'.

I'm not a car person or expert in the field but I've done a little bit of work on automotive systems. As the other responders pointed out these systems are designed to, ECC or not, do things like (at the slightest sign of inconsistency or error)

- reset and recover very quickly

- enter reduced functionality or failsafe modes

- fully disable themselves and anything that might cause you to rely on them

They're fundamentally built around the eventuality of them failing and with consideration of the things that need to happen when they fail. They don't usually rely on 'well, we'll just put in a somewhat more reliable component'.

TBH, assuming the system either has a relatively short log of the traffic situation, and / or does a few thousand calculations a second, I can't imagine how a random bit level error would severely influence the system. Unless, you know, it causes a full system crash, but I'm sure there's a lot of measures against that.