> Short of bit flipping due to environmental conditions Cosmic rays do flip bits. If you're making anything that might be safety-critical, your design needs to

> Short of bit flipping due to environmental conditions Cosmic rays do flip bits. If you're making anything that might be safety-critical, your design needs to fail safely when hit by a cosmic ray or any other hardware failure. If your device isn't controlling a 25 MeV linac, "failing safely" may be as simple as halting or otherwise indicating an error. If it is controlling something dangerous, multiple layers of defense are necessary. One layer might be error-correcting RAM. > Look at the old landline networks. As Aloha already described, the POTS network is one of the best examples of defense in depth. Every piece was designed to work around failures. They even guaranteed service for weeks after a major disaster that took out the entire electrical grid (they had backup generators and phones were self-powered by the phone line). The phone network is exactly the type of engineering we need for safety and reliability. > Look at vending machines. Vending machines have a simple enough problem that they don't actually need a full stored program computer. You can be (and have been) an electromechanical device implementing a finite state automata. Even if you use software, the necessary state machine is small enough that you can actually prove that the software is correct. Most problems are too complicated. Also, vending machines fail. They even fail safely; a locked up vending machine doesn't become a hazard to life and limb. [1] https://www.youtube.com/watch?v=vhiiia1_hC4 https://www.youtube.com/watch?v=vhiiia1_hC4 [2] https://en.wikipedia.org/wiki/Finite-state_machine https://en.wikipedia.org/wiki/Finite-state_machine