For information on the recovery node hardware see: RecoveryNodeLV2
Fail safe timer: Glenn thought we could do some kind of "watchdog-like" trick with the recovery node's failsafe timer: the FC sends a (N)Hz signal on the CAN bus saying "hey, I'm ok, and I'm calculating my position and thus sequencing the flight correctly". If the recovery node stops receiving these messages, then it arms the failsafe timer which is set to blow several seconds after the predicted apogee. But even then, should we make sure the failsafe timer fires no matter what if it's started, unless cancelled by a DTMF command?
Many independent little statemachines running the hardware: Li-Ion battery charging, monitoring the system power state, INT0 interrupt on the DTMF tones, intializing the radio's oscillator, checking for CAN messages, etc.