The invention relates to network nodes comprising: a first computing unit (CPU.sub.a); at least one second computing unit (CPU.sub.b); an internal switch (Sw.sub.i); and an external switch (Sw.sub.e), wherein the internal switch (Sw.sub.i) is connected to the first computing Nunit (CPU.sub.a), the at least second computing unit (CPU.sub.b) and to the external switch (Sw.sub.e) and wherein the external switch (Sw.sub.e) has at least one port for data originating from other network nodes. The invention also relates to a control module and an Ethernet ring.

A vehicle safety electronic control system includes a first microcontroller having a lockstep architecture with a lockstep core and a second microcontroller having at least two processing cores. The lockstep core of the first microcontroller is configured to monitor and control outputs of said at least two cores of the second microcontroller.

A graphics processing system includes a plurality of processing units for processing tasks, each processing unit being configured to process a task independently from any other processing unit of the plurality of processing units; a check unit operable to form a signature which is characteristic of an output of a processing unit on processing a task; and a fault detection unit operable to compare signatures formed at the check unit; wherein the graphics processing system is configured to process each task of a first type first and second times at the plurality of processing units so as to, respectively, generate first and second processed outputs, wherein the check unit is configured to form first and second signatures which are characteristic of, respectively, the first and second processed outputs, and wherein the fault detection unit is configured to compare the first and second signatures and raise a fault signal if the first and second signatures do not match.

A graphics processing system includes a plurality of processing units for processing tasks, each processing unit being configured to process a task independently from any other processing unit of the plurality of processing units; a check unit operable to form a signature which is characteristic of an output of a processing unit on processing a task; and a fault detection unit operable to compare signatures formed at the check unit; wherein the graphics processing system is configured to process each task of a first type first and second times at the plurality of processing units so as to, respectively, generate first and second processed outputs, wherein the check unit is configured to form first and second signatures which are characteristic of, respectively, the first and second processed outputs, and wherein the fault detection unit is configured to compare the first and second signatures and raise a fault signal if the first and second signatures do not match.

A lockstep testing system includes a lockstep controller that generates various control signals. The lockstep testing system further includes various lockstep circuitries, with each lockstep circuitry including primary and redundant functional circuits that are operable in a lockstep mode, and a fault injection circuit that receives a control signal from the lockstep controller and injects a transient fault in the corresponding lockstep circuitry. The transient fault can be injected at one of input and output stages of the primary and redundant functional circuits. Each lockstep circuitry further includes a checker circuit that tests whether the corresponding lockstep circuitry is faulty (i.e., whether the injected fault is accurately detected), and generates and provides, to the lockstep controller, a fault indication signal indicating whether the corresponding lockstep circuitry is faulty.

A graphics processing system includes a plurality of processing units for processing tasks, each processing unit being configured to process a task independently from any other processing unit of the plurality of processing units; a check unit operable to form a signature which is characteristic of an output of a processing unit on processing a task; and a fault detection unit operable to compare signatures formed at the check unit; wherein the graphics processing system is configured to process each task of a first type first and second times at the plurality of processing units so as to, respectively, generate first and second processed outputs, wherein the check unit is configured to form first and second signatures which are characteristic of, respectively, the first and second processed outputs, and wherein the fault detection unit is configured to compare the first and second signatures and raise a fault signal if the first and second signatures do not match.

A network includes a plurality of nodes and a plurality of links communicatively coupling each of the nodes to at least one respective adjacent node via a first communication channel and to another respective adjacent node via a second communication channel. The nodes and links have a braided ring topology. First and second nodes of the plurality of nodes source data, are adjacent nodes, and at least one is a source node. The first node sends a first communication to the second node via a third node that is adjacent the first node and via a fourth node that is adjacent the second node. The second node sends a second communication to the first node via the third node and via the fourth node. At least one of the first and second nodes terminates transmission of the first and second communications when the first and second communications do not match.

In part, the disclosure relates to a real-time fault tolerant system. The system may include a first computing device, a second computing, and a hardware interconnect. The first computing device may include one or more memory devices, one or more processors, a first network interface operable to receive device data and transmit output data over a time-slot-based bus, wherein the output data is generated from processing device data, and a first real-time checkpoint engine. The second computing device may include similar components or the same components as the first computing device. The hardware interconnect is operable to permit data exchange between the first computing device and the second computing device. Checkpoints may be generated by checkpoint engines during lower-priority communication time slots allocated on the time slot-based bus to avoid interfering with any real-time communications to or from the first and second computing devices.

In part, the disclosure relates to a real-time fault tolerant system. The system may include a first computing device, a second computing, and a hardware interconnect. The first computing device may include one or more memory devices, one or more processors, a first network interface operable to receive device data and transmit output data over a time-slot-based bus, wherein the output data is generated from processing device data, and a first real-time checkpoint engine. The second computing device may include similar components or the same components as the first computing device. The hardware interconnect is operable to permit data exchange between the first computing device and the second computing device. Checkpoints may be generated by checkpoint engines during lower-priority communication time slots allocated on the time slot-based bus to avoid interfering with any real-time communications to or from the first and second computing devices.

The invention relates to a method for providing a fault-tolerant global time via a time server in a distributed real-time computer system, wherein the time server comprises four components which are connected to one another via a bi-directional communication channel. At a priori defined periodic, internal synchronization times, each of the four components transmits an internal synchronization message, which is simultaneously transmitted to the other three components, from which each internal computer of a component determines a correction term for the tick counter contained in its component and corrects the reading of the local tick counter by this correction term.