Redundancy isn't the hard part of steer-by-wire: arbitration is

In December 2025, BMW recalled 36,922 X3 SUVs built between August 2024 and October 2025. The fault: unintended steering wheel movement, caused not by a missing sensor but by software that could not always correctly interpret a fault between two sensor channels that were already there. If the steering torque sensor's second channel failed while the car sat stationary, either at startup or stopped in drive, the diagnostic logic could miss the condition. The fix is an over-the-air software update, and BMW says it knows of no crashes or injuries linked to the fault. No one was hurt. But the recall is worth sitting with, because it is the clearest recent illustration of a problem the automotive industry is about to make much harder for itself: redundant hardware does not make a steering system safe. The logic that arbitrates between redundant channels does.

This matters now because steer-by-wire, in the true sense of a steering system with no mechanical link at all between the wheel and the road wheels, is moving from a single production outlier into mainstream adoption. Tesla's Cybertruck has shipped without a steering column since late 2023. Mercedes-Benz confirmed on 2 April 2026 that the new EQS will offer steer-by-wire a few months after its market launch, making it the first German manufacturer to put the technology into production. BMW's X3 is not itself steer-by-wire; it is electric power steering with a redundant torque sensor and a mechanical column still sitting behind it as an ultimate backup. That distinction is exactly what makes the recall instructive. If a diagnostic gap can slip through validation in a system that still has a mechanical fallback, the same class of fault becomes a far more serious problem in a system that has none.

What fail-operational actually requires

Steering control is classified ASIL D under ISO 26262, the highest functional safety risk tier the standard defines, because a steering failure while the vehicle is moving carries about as much harm potential as an automotive system failure can. Meeting that classification for a steer-by-wire system means designing to be fail-operational rather than merely fail-safe: the system cannot simply shut down and hand control back to a driver who no longer has a mechanical connection to fall back on. It has to keep steering, in some degraded but controllable form, through the failure.

That requirement is where the engineering difficulty actually concentrates, and it is not primarily a hardware problem. Duplicating sensors and actuators is comparatively straightforward; automotive suppliers have been building redundant channels into safety-critical systems for years. The hard part is the arbitration layer sitting between the redundant channels and the actuator: the logic that has to detect a fault, decide which channel or channels to trust, and commit to a safe fallback action within a hard time budget, correctly, across every plausible fault mode and every vehicle state. Published fail-operational safety concepts for automated driving systems put figures on this kind of switch-over in the region of 200 milliseconds from fault detection to a controlled fallback response. Whatever the exact number for a given architecture, the point is that this is a real-time control problem with a deadline, not a static design checklist. And it has to cover the awkward edge cases, standstill, ignition transitions, gear engagement, that are precisely where validation coverage tends to be thinnest and where BMW's software reportedly got the call wrong.

Three architectures, one shared dependency

Look at how the current wave of production systems actually handles this, and the pattern is consistent even though the hardware differs. Tesla's Cybertruck carries triple redundancy on road-wheel position sensing, a primary and secondary magnetic sensor plus a third inductive sensor, arbitrated by two-out-of-three voting, backed by dual steering motors and a dual redundant 48-volt Ethernet loop connecting the controllers. Mercedes' EQS system uses a simpler dual-path signal architecture with duplicated actuators and its own backup power supply, plus a second, independent layer of defence: if the steering path itself fails outright, rear-axle steering and individual-wheel braking can still keep the car controllable without any steering rack input at all. BMW's X3, the simplest of the three by some distance, uses just two torque sensor channels feeding conventional electric power steering.

The number of channels varies from two to three, and the fallback strategies range from pure electronic redundancy to an entirely different control path through braking and rear steering. But in every case, the safety case rests on the same layer: software that has to arbitrate correctly between disagreeing or silent channels, under time pressure, without getting to ask the driver. More channels do not remove that dependency, they add more inputs the arbitration logic has to reconcile correctly. BMW's recall shows what happens when that reconciliation misses an edge case even with only two channels to manage.

The regulatory door has opened

The reason this is a live industry question rather than a hypothetical one is regulatory. UNECE Regulation No. 79 has been amended to permit steering systems with no positive mechanical connection between the steering control and the steering transmission, formally clearing a path for full steer-by-wire across UNECE member markets rather than leaving it as a US-only, Tesla-specific curiosity. As more manufacturers follow Mercedes towards production steer-by-wire under that cleared regulatory path, a BMW-style diagnostic miss stops being a recall notice and becomes a much harder failure mode to recover from, because there is no steering column left to fall back on.

What to watch

The practical signal to look for is not how many redundant channels a manufacturer advertises, but how they demonstrate diagnostic coverage of the arbitration logic itself, particularly around the low-speed and transition states where BMW's system fell short. Formal verification of voting and fallback logic, treating the arbitration layer as a provable real-time system rather than a conventional software module tested against a fixed set of scenarios, is a meaningful marker of engineering maturity here, and worth watching for in supplier technical disclosures and safety case documentation as more steer-by-wire programmes reach production. So is how regulators evaluate full steer-by-wire safety cases now that UNECE R79 no longer requires a mechanical backup: whether type-approval processes start demanding evidence of arbitration correctness specifically, rather than being satisfied by sensor and actuator counts on a specification sheet.

Redundant hardware is the part of steer-by-wire that is easy to show a customer. Arbitration logic is the part that has to be right every single time, in milliseconds, with no mechanical column left to catch the mistake. As the industry follows Mercedes and Tesla towards removing that column altogether, is validation testing for arbitration and voting logic actually keeping pace with how fast the mechanical fallback is disappearing, or is it still being treated as a lesser problem than the hardware redundancy it depends on?

---

This piece first appeared in ASG's Hello, Auto! newsletter on LinkedIn.