A device for controlling an automated driving operation of a vehicle may have at least two brake systems, at least two steering systems, an engine controller, a first automated drive controller, a second automated drive controller, a surroundings sensor assembly, and inertial sensors. A third automated drive controller at least controls the vehicle into a standstill. The device is configured such that the automated driving operation is initiated and/or maintained only when the brake systems, steering systems, and at least two of the automated drive controllers are functional and such that the automated driving operation is interrupted if only one of the automated drive controllers is functional and/or if one of the brake systems and/or steering systems is not functional and/or if the engine controller is not functional, in which case the still functional automated drive controller assumes control of the vehicle and guides the vehicle into a standstill.

A parallel processing system includes at least three processors operating in parallel, state monitoring circuitry, and state reload circuitry. The state monitoring circuitry couples to the at least three parallel processors and is configured to monitor runtime states of the at least three parallel processors and identify a first processor of the at least three parallel processors having at least one runtime state error. The state reload circuitry couples to the at least three parallel processors and is configured to select a second processor of the at least three parallel processors for state reload, access a runtime state of the second processor, and load the runtime state of the second processor into the first processor. Monitoring and reload may be performed only on sub-systems of the at least three parallel processors. During reload, clocks and supply voltages of the processors may be altered. The state reload may relate to sub-systems.

A method, computer program product, and computing system for operating an autonomous vehicle; monitoring the operation of a plurality of computing devices within the autonomous vehicle; and in response to detecting the failure of one or more of the plurality of computing devices, switching the autonomous vehicle from a nominal autonomous operational mode to a degraded autonomous operational mode.

A graphics processing system for performing tile-based rendering of a scene that includes safety-related primitives has a plurality of graphics processing units (GPUs), each configured to i) receive tile data identifying one or more protected tiles comprising at least part of a safety-related primitive, ii) process two respective sets of protected tiles, and iii) based on said processing, generate two respective checksums for each respective set of protected tiles. The two respective sets of protected tiles are mutually exclusive, and each respective set and each protected tile being processed by two different GPUs. The system includes a comparison unit configured to compare one or more pairs of checksums, each pair comprising a respective checksum generated based on a same respective set of protected tiles and generated by different GPUs.

An input circuit for reading in an analog input signal of a sensor comprises: first and second input ports connectable to the sensor; a first current-measuring signal converter connected to the first input port and comprising a current-measuring apparatus to determine a first output signal from the analog input signal; a current-limiting apparatus inside the first current-measuring signal converter for limiting a maximum current flowing through the first current-measuring signal converter; and a second current-measuring signal converter connected to the second input port and comprising a current-measuring apparatus to determine a second output signal from the analog input signal, wherein the first and second current-measuring signal converters are connected in series; and a testing apparatus for comparing the first and second output signals to detect faults of the first and second current-measuring signal converters in response to deviations between the first and second output signals exceeding a limit value.

A physical server with an offload card including a SoC (system-on-chip) and a FPGA (field programmable gate array) is disclosed. According to one set of embodiments, the SoC can be configured to offload one or more hypervisor functions from a CPU complex of the server that are suited for execution in software, and the FPGA can be configured to offload one or more hypervisor functions from the CPU complex that are suited for execution in hardware.

A parallel processing system includes at least three parallel processors, state monitoring circuitry, and state reload circuitry. The state monitoring circuitry couples to the at least three parallel processors and is configured to monitor runtime states of the at least three parallel processors and identify a first processor of the at least three parallel processors having at least one runtime state error. The state reload circuitry couples to the at least three parallel processors and is configured to select a second processor of the at least three parallel processors for state reload, access a runtime state of the second processor, and load the runtime state of the second processor into the first processor. Monitoring and reload may be performed only on sub-systems of the at least three parallel processors. During reload, clocks and supply voltages of the processors may be altered. The state reload may relate to sub-systems.

A method to a computer program containing instructions and to a module for monitoring a component of a control system for a transport. In a first step, a function call is sent to the component to execute a function used by the component using defined input data. Then a response from the component to the function call is received. The response is subsequently compared with an expected response. Finally, an action is performed in response to a result of the comparison.

A method for controlling operation of a medical device in a medical system having a medical device, a communication device including a remote control for the medical device, and a safety device adapted for data communication with the communication device. Input data is provided and processed by a first calculation to thereby provide a first calculation result. The input data is processed by a second calculation executed separately from first calculation to thereby provide a second calculation result. The first and second calculation results are compared. When the first and second calculation results are found equal, remote control of the medical device by a medical device application running on the communication device is allowed. When the first and second calculation results are found not equal, the medical device application running on the communication device for remote control of the medical device is prevented.

An automatic processing system, a system on chip and a method for monitoring a processing module are described herein. The automatic driving processing system comprises: an automatic driving processing module, configured for receiving an input data stream and processing the input data stream based on a deep learning model so as to generate a processing result; a fault detection module, configured for generating a control signal and a fault detection stimulating data stream, and receiving the processing result from the automatic driving processing module; and a multi-way selection module, configured for receiving an automatic driving data stream as well as the control signal and the fault detection stimulating data stream, and selectively outputting the automatic driving data stream or the fault detection stimulating data stream to the automatic driving processing module based on the control signal, as an input data stream.