[Mankaninen]

A modern car has >100 ECUs, blink is distributed to a few ECUs, think: front body, rear body, left door, right door plus instrument cluster and maybe a trailer control ECU. It does not look premium if they do not blink in phase so you send CAN command for blinking. (A separate cable introduce cost, weight and faults due to corrosion that are tricky to diagnose, in total you want to avoid that.) If something disturb CAN or an ECU reboots you would get the described behavior. But it is not obvious (at least not to me) that it must be a software error - could easily be hardware designed with too small margins. (I have not worked with this issue at Volvo and do not know the actual cause of the problem.)

[jeffrallen]

Alternatively, you could design the system to fail in a way that was less dangerous.

For example, an ECU that controls blinkers does it with a 555 timer, based on a "start blinking" CAN bus command. It resyncs on each new "start blinking " command. It times out after 50 blinks, if no "stop blinking" command comes.

This makes each ECU autonomous and responsible for doing "the safe thing", once it has been commanded to.

Finding all the new subtle horrible timing problems in this design is left as an exercise for the reader. :)