Abstract: A fail-safe interface for a by-wire vehicle control system merges driver commands and external commands developed by a by-wire control unit to form a failure-tolerant actuator command that never diminishes a driver command. External commands are passed through a fault detection circuit that filters out aberrant cyclical and constant command signals from the by-wire control unit, and the actuator command is determined according to the higher or maximum of the driver-generated and external commands. The interface is powered by vehicle power supply, and is electro-optically isolated from the external control unit so that if the external control unit loses power, the actuator command faithfully follows the driver command.