There isn't just one OS in these cars running a monolithic instance of DRIVE.EXE. If one sensor sees a person and another sensor does not, the car doesn't flip

There isn't just one OS in these cars running a monolithic instance of DRIVE.EXE. If one sensor sees a person and another sensor does not, the car doesn't flip a coin before driving through that spot. It doesn't drive through that spot. The real failure mode for automated cars will be how easy it is to make them stop in their tracks because someone fooled just one of the sensors into seeing a human.