A lockstep controller operates a lockstep system of three or more CPU-GPU pairs, comparing the outputs from the CPU-GPU pairs and, by way of a majority vote, provides the output for the lockstep system. Based on comparing the outputs, if one of the CPU-GPU pairs provides outputs that disagree with the majority outputs, it can be switched out of the lockstep system. The removed CPU is replaced by a backup CPU. So that the backup CPU can be part of a CPU-GPU pair, a portion of the address space from the GPU of one of the other CPU-GPU pairs is assigned to the backup CPU to operate as a replacement CPU-GPU pair, while the CPU already associated with this GPU retains another portion of the GPU's address space to continue operating as a CPU-GPU pair.

A safety communication scheme for a safety-critical system which includes two or more higher level units that have voting capabilities and one or two sets of lower level units that do not have voting capabilities, involves using one channel between the high and low level units for safety and two channels for redundancy.

A method, an apparatus, and a computer-readable storage medium having instructions for cancelling a redundancy of two or more redundant modules. Results of the two or more redundant modules are received; reliabilities of the results are ascertained; and, based on the ascertained reliabilities, an overall result is determined from the results. The overall result is output for further processing.

Techniques for system recovery using a failover processor are disclosed. A first processor, with a first instruction set, is configured to execute operations of a first type; and a second processor, with a second instruction set different from the first instruction set, is configured to execute operations of a second type. A determination is made that the second processor has failed to execute at least one operation of the second type within a particular period of time. Responsive to determining that the second processor has failed to execute at least one operation of the second type within the particular period of time, the first processor is configured to execute both the operations of the first type and the operations of the second type.

A first controller includes a plurality of computation units and a diagnosis unit. A second controller is disposed on a signal path between the first controller and an actuator, and includes an output unit. Each of the computation units supplies a first control signal for controlling the actuator to the output unit. The diagnosis unit performs an abnormal diagnosis of each of the computation units. The output unit outputs a second control signal for controlling the actuator based on the first control signals supplied from the computation units and diagnosis results of the computation units obtained by the diagnosis unit.

Each of three or more computation units supplies a first control signal showing a target output of an actuator to an output unit. A determination unit assigns the target output shown by the first control signal supplied from each of the computation units with a weight based on the degree of reliability of the first control signal, and performs a majority vote of the target outputs. The output unit outputs a second control signal for controlling the actuator based on first control signals supplied from the computation units and a result of the majority vote of the target outputs by the determination unit.

There is disclosed a computing/data processing device comprising: a plurality of computing units, each computing unit comprising a computing resource; the computing device comprising at least three computing units, each computing unit comprising a/the same computing resource; each computing unit further comprising a computing unit access manager, each unit access manager being adapted to control access to the computing resource of the respective computing unit in response to at least one request; wherein, the computing unit access manager only allows a response to the at least one request if a majority of the computing units provide a same response to the at least one request; and wherein, the computing device comprising a network-on-a-chip, is provided on a chip and/or comprises an integrated chip (IC) or microprocessor. The IC beneficially comprises a Field-Programmable Gate Array (FPGA) device. In a preferred embodiment, the unit access manager controls access to the computing resource based on a token; the token comprising: a pointer to the respective computing resource, a set of rights relating to that computing resource, and a numerical representation of that computing resource.

The present disclosure relates to an assembly including a first processor having a first core, a second core and a controller, and a second processor having a first core, and wherein the first core and the second core of the first processor, and the first core of the second processor are configured to execute a first procedure. The controller of the first processor is configured to compare a first result from executing the first procedure on the first core of the first processor with a second result from executing the first procedure on the second core of the first processor; and comparing each of the first and second results with a third result from executing the first procedure on the first core of the second processor, if the first and second results differ from one another.

A triple modular redundancy (TMR) flip-flop includes a set of master-gate-latch circuits including a first set of inputs to receive a first digital signal, and a second set of inputs to receive a clock; and a voting logic circuit including a set of inputs coupled to a set of outputs of the set of master-gate-latch circuits, and an output to generate a second digital signal based on the first digital signal. Another TMR flip-flop includes a set of master-gate-latch circuits to receive a set of digital signals in response to a first edge of a clock, respectively; and latch the set of digital signals in response to a second edge of the clock, respectively; and a voting logic circuit to receive the latched set of digital signals; and generate a second digital signal based on a majority of logic levels of the latched first set of digital signals, respectively.

A triple modular redundancy (TMR) flip-flop includes a set of master-gate-latch circuits including a first set of inputs to receive a first digital signal, and a second set of inputs to receive a clock; and a voting logic circuit including a set of inputs coupled to a set of outputs of the set of master-gate-latch circuits, and an output to generate a second digital signal based on the first digital signal. Another TMR flip-flop includes a set of master-gate-latch circuits to receive a set of digital signals in response to a first edge of a clock, respectively; and latch the set of digital signals in response to a second edge of the clock, respectively; and a voting logic circuit to receive the latched set of digital signals; and generate a second digital signal based on a majority of logic levels of the latched first set of digital signals, respectively.