> Yes, unless the system to detect that has malfunctioned. Are the systems that detect malfunction right now single-overseer systems that do sanity checks, or

> Yes, unless the system to detect that has malfunctioned. Are the systems that detect malfunction right now single-overseer systems that do sanity checks, or are they redundant driving systems that check to see if they agree? You'd probably want both, but it seems some arrangement of the latter (maybe 3-5 systems) would be likely to provide a better failover scenario: the driving systems constantly check if they agree, if they don't, there's a majority vote for short-term action and an alert to the driver that they should take over and get the car serviced. I'm sure there's still scenarios where that wouldn't work -- car-wide problems or outside interference impacting all systems at once, or even just improbable simultaneous failures that would happen with enough time -- but maybe it's what they have in mind.