Five safety-mechanism archetypes, animated: majority voting that keeps running, the E-Gas three-level concept, a boot-time self-test that gates release, a plausibility check on the unit circle, and why a window beats a timeout.
The output never stops. Channel B drifts, the voter out-votes it 2-to-1, a DTC is logged — and the actuator keeps turning. Containment at the voter, availability preserved.
Two laps, two catches. Lap one: the function miscomputes torque — Level 2's redundant path cuts fuel. Lap two: the whole µC goes down — Level 3's independent module fails the Q&A and pulls the enable line itself.
No pass, no torque. Five self-tests run in order; only a clean sheet releases the safety path. Lap two fails the RAM march — the gate stays open and the machine stays inert.
sin² + cos² = 1, or else. The wheel keeps turning but the SIN line sticks — the operating point leaves the tolerance ring and the position is invalidated. Re-entry alone isn't enough: revalidation is qualified over time.
The runaway test. A hang trips both watchdogs. But runaway code that services in a tight loop keeps the naive timeout perfectly happy — only the window watchdog sees "too early" as the fault it is.