Oh, wow, that&#x27;s amazing. Now I understand why avionics are so expensive - verifying the correctness of such a system sounds like a lot of &quot;fun,&quot; or at least a lot of time.<p>(I wonder if there are any systems built on multiple architectures where each unit is itself a redundant system with CPUs in lockstep.....)<p>Am I to intuit from this diagram that the watchdog watches all the components - power, I&#x2F;O, memory, and CPU? That&#x27;s very impressive. Or does it watch a central bus&#x2F;backplane everything is connected to?<p>Also, how does either side decide&#x2F;figure out the other side has failed? Simply deciding that the other half is wrong if it doesn&#x27;t match this half&#x27;s output could fail catastrophically if one of the sides reaches this conclusion after entering an invalid state (ie, it&#x27;s the other side that is correct, and this side is wrong).<p>I&#x27;m also mildly curious as to why the I&#x2F;O on one side has two connections to the actuators, while the other has only one.