A computer system that has two or more processing engines (PE), each capable of performing one or more operations on one or more operands but one or more of the PEs performs the operations unreliably. Initial results of each operation are debiased to create a debiased result used by the system instead of the initial result. The debiased result has an expected value equal to a correct output where the correct output is the initial result the respective operation would have produced if the respective operation performed was reliable.

Techniques are provided for neutralizing replication errors. An operation is executed upon a first storage object and is replicated as a replicated operation for execution upon a second storage object. A first error may be received for the replicated operation. Instead of transitioning to an out of sync state and aborting the operation, a wait is performed until a result of the attempted execution of the operation is received. If the first error is the same as a second error returned for the operation, then the operation and replicated operation are considered successful and a synchronous replication relationship is kept in sync. If the first error and the second error are different errors, then an error response is returned for the operation and the synchronous replication relationship is transitioned to out of sync.

An apparatus comprises a plurality of redundant processing units (4) to perform data processing redundantly in lockstep; common mode fault detection circuitry *6, 22) to detect an event indicative of a potential common mode fault affecting each of the plurality of redundant processing units; a memory (10) shared between the plurality of redundant processing units; and memory checking circuitry (30) to perform a memory scanning operation to scan at least part of the memory for errors; in which the memory checking circuitry (30) performs the memory scanning operation in response to a common mode fault signal generated by the common mode fault detection circuitry (6, 22) indicating that the event indicative of a potential common mode fault has been detected.

In an embodiment, a computing node includes a computing circuit, a comparing circuit, and an indicator circuit. The computing circuit is configured to receive each of at least one input-data message. The comparing circuit is configured to compare each of the at least one received input-data message to a list of input-data-message identifiers. And the indicator circuit is configured, for each of the at least one input-data message that corresponds to a respective input-data-message identifier, to generate a respective portion of a first status message, the respective portion indicating that the input-data message was received. For example, such computing node can determine the congruency of a received input-data message between coupled redundancy circuits with reduced processing overhead, reduced message delay, and reduced message latency as compared to existing computer nodes.

Systems and methods are disclosed for checker cores for fault tolerant processing. For example, an integrated circuit (e.g., a processor) for executing instructions includes a processor core configured to execute instructions of an instruction set; an outer memory system configured to store instructions and data; and a checker core configured to receive committed instruction packets from the processor core and check the committed instruction packets for errors, wherein the checker core is configured to utilize a memory pathway of the processor core to access the outer memory system by receiving instructions and data read from the outer memory system as portions of committed instruction packets from the processor core. For example, data flow from the processor core to the checker core may be limited to committed instruction packets received via dedicated a wire bundle.

The invention provides a device for controlling a vehicle module based on a status signal of a power processor that acquires and evaluates sensor signals. Based on the status signal of the power processor, the vehicle module is controlled with either the power processor or a fallback processor. The fallback processor enables an emergency operation of the vehicle module. Furthermore, a device for controlling a vehicle module with a safety processor is provided, via which the vehicle module is controlled with sensor signals evaluated by either the first or second power processor, based on a state of a first and second power processor. A driver assistance system process is also provided, in which one of the devices according to the invention is used.

The controlling apparatus for an industrial product of this disclosure has a couple of microcomputers each of which has a CPU and a memory and each of which runs the same controlling program as well as the same diagnostic program sequence parallelly and simultaneously. After the CPU of the microcomputer writes the calculated result of the diagnostic program sequence in the predetermined area of the storing area for monitoring value, such CPU send the same calculated result to the other one of the microcomputers (receiving microcomputer). The CPU of the receiving microcomputer makes a diagnosis for finding whether or not the received result is identical with its own calculated result.

Fire-prevention control unit including several circuit boards and a dedicated communication bus for communication between the circuit boards, the circuit boards including at least one processing board, at least one input board and at least one output board. The at least one processing board is intended to process input data received from the at least one input board and to generate commands to send to the at least one output board, the at least one input board and the at least one output board being intended to communicate with one or more devices to be monitored or controlled. Each circuit board has two identical and physically distinct functional logic units, the functional logic units being adapted to perform the same function, each functional logic unit having a unit for direct communication with the communication bus according to a configurable architecture.

Provided is an autonomous driving assistance system for vehicles that has redundancy without posing any problem in diversity. The autonomous driving assistance system includes: a sensor configured to acquire surroundings information; a downstream device including an actuator configured to control a vehicle; and a driving assistance device configured to calculate a control amount for the downstream device on the basis of the surroundings information. The downstream device further includes a diagnosis unit configured to: perform comparison between at least two control amounts that include the control amount calculated in the driving assistance device and a control amount calculated in the downstream device on the basis of the surroundings information; and determine, if the control amounts are equal to each other, that the control amounts are normal, and determine, if the control amounts are different from each other, that the control amounts are abnormal.

In an embodiment, a computing node includes a computing circuit, a comparing circuit, and an indicator circuit. The computing circuit is configured to generate a first redundant message that corresponds to, and that is independent of, a source message propagating over a network during at least one time period. The comparing circuit is configured to compare information content of one or more corresponding portions of the source message and the first redundant message during each of the at least one time period to generate a comparison result. And the indicator circuit is configured to indicate whether the source message is valid or invalid in response to the comparison result. For example, such computing node can determine the validity of a redundant result with reduced processing overhead, reduced message delay, and reduced message latency as compared to existing computer nodes.