On: How NASA Designed a Helicopter That Could Fly Auto...

[nynx]

I'm a little surprised they didn't go for three separate computers and compare them for every operation, or something like that, but I'm sure they have their reasons.

[teraflop → nynx]

I've never seen an off-the-shelf processor that has hardware support for doing that kind of cross-checking on every instruction. And doing it in software would probably add so much overhead that the error-checking would be much more likely to fail than the application code.

If you're willing to relax your real-time constraints a bit, and risk a brief period of incorrect behavior before the error is caught, the problem becomes vastly easier and cheaper to solve.

[trhway → teraflop]

>off-the-shelf processor that has hardware support for doing that kind of cross-checking on every instruction.

it is usually done with COTS CPU by either running the CPUs in lockstep (the simpler early generations of CPU) or by inserting hardware checkpoints at various points like branches, by number of instructions, etc. A recent such commercial system was the triple Itanium from Tandem/NonStop(HP).

[jack_h → teraflop]

There are the ARM Cortex-R series of processors which have two cores running in lockstep for fault tolerance.

[retSava → teraflop]

Perhaps the double-memory-and-checking is only done on the control algos and not on sensor fusion/object detection etc?

Kind of "Ok if we for a brief moment believe there's an obstacle in front of us, since it'll be gone next tick, but not ok to turn off motors".