We have already explained how a self-driving car thinks — turning a sensed model of the world into a planned course of action. A plan, though, is not yet a movement: something has to turn “brake now” into an actual, physical deceleration of the car, reliably, every single time. This final stage of the sense, think, act pipeline looks, on paper, like the easiest of the three — cars have had electronic throttles and electric power steering for decades — but it hides the one requirement that makes Level 4 fundamentally different from everything that came before it: there is no longer a human being to catch a failure.
From mechanical link to electronic command
We’ve already covered how power steering evolved from hydraulic assistance to a fully electric system, and that shift is exactly what makes automated actuation possible at all: once steering, braking and acceleration are commanded electronically rather than through a direct mechanical or hydraulic link to the driver’s inputs, a computer can issue the same commands a human foot or hands would, with no physical modification to the car’s basic architecture. This family of systems is broadly called drive-by-wire, and it is the actuation layer that “think” outputs actually reach.
Fail-safe is not good enough anymore
In a Level 2 car, if a steering or braking actuator glitches, the system can simply hand control back to the driver, or bring the car to a gentle stop with the driver’s hands already on the wheel — that’s a fail-safe design: when something breaks, defer to the human. A Level 4 car, by definition, may have no attentive human available at the exact moment something breaks. That single fact forces a completely different engineering standard, called fail-operational: the car has to keep behaving safely, on its own, for long enough to reach a stop, using degraded but still-functioning hardware, not a human backup. In practice, that means duplicating almost everything that could take the car down if it failed alone: two independent power supplies so one electrical fault doesn’t blind every actuator at once, redundant steering and braking actuation paths, and redundant compute and communication buses running the control software itself, so a single failed component degrades the car’s capability rather than removing it entirely.
The architecture matters as much as the redundancy
Simply bolting a second component next to the first isn’t enough if both share a single point of failure somewhere upstream — a shared power rail, a shared software bug, a shared compromised communication channel. This is why the electronic and software architecture underneath actuation has become its own research problem, not just a hardware bill of materials: how control functions are partitioned, how safely a system can be updated over its lifetime without introducing new faults, and how resistant the whole chain is to a cyberattack that could otherwise turn redundancy into a single shared weakness.
Where the state of the art is heading: EU research on control architecture
The most complete demonstration to date that perception, decision-making and control need to be engineered as one connected fail-operational system, not three separate problems bolted together, came from NewControl (2019-2023, €10.91M, coordinated by AVL List in Austria, under the ECSEL Joint Undertaking): it built virtualised platforms covering perception, cognition and control together for highly automated driving, deliberately centred on “safety by design” so the whole chain, not just individual components, could be shown to degrade gracefully rather than fail outright. Two further, currently active projects are tackling the architecture question from opposite directions. EEA4CCAM (2025-2028, €5.99M, coordinated by Infineon Technologies in Germany, Horizon Europe CCAM Partnership) is developing a centralised, upgradable in-vehicle electronic control architecture, integrating hardware and software co-design specifically to enable safe, cyber-secure operation and smart data flows across a car’s control systems. Shift2SDV (2025-2028, €19.24M — one of the largest single projects cited anywhere in this Focus series — coordinated by Virtual Vehicle Research in Austria, funded through the Chips Joint Undertaking) is building the complementary software layer at industry scale: a common middleware and API framework meant to let the entire European automotive value chain — carmakers, Tier-1 suppliers and software specialists alike — develop and update software-defined vehicle control software as interchangeable modules, rather than each firm maintaining its own closed, monolithic system.
Why it matters beyond the spec sheet
None of the perception or decision-making covered in the earlier parts of this series matters if the last few milliseconds — command to actuator, actuator to wheel — can’t be trusted to work when something has already gone wrong elsewhere in the car. That is precisely why “act” is judged by a different standard than the rest of the pipeline: not how well it performs when everything works, but how gracefully it degrades when something doesn’t, with no one behind the wheel to notice.
Photo: © Car-Shooters