Provided is an image recognition processor. The image recognition processor includes a plurality of nano cores each configured to perform a pattern recognition operation and arranged in rows and columns, an instruction memory configured to provide instructions to the plurality of nano cores in a row unit, a feature memory configured to provide input features to the plurality of nano cores in a row unit, a kernel memory configured to provide a kernel coefficient to the plurality of nano cores in a column unit, and a difference checker configured to receive a result of the pattern recognition operation of each of the plurality of nano cores, detect whether there is an error by referring to the received result, and provide a fault tolerance function that allows an error below a predefined level.

An apparatus 2 comprises at least three processing circuits 4 to perform redundant processing of a common thread of program instructions. Error detection circuitry 16 is provided comprising a number of comparators 22 for detecting a mismatch between signals on corresponding signal nodes 20 in the processing circuits 4. When a comparator 22 detects a mismatch, this triggers a recovery process. The error detection circuitry 16 generates an unresolvable error signal 36 indicating that a detected area is unresolvable by the recovery process when, during the recovery process, a mismatch is detected by one of the proper subset 34 of the comparators 22. By considering fewer comparators 22 during the recovery process than during normal operation, the chances of unrecoverable errors being detected can be reduced, increasing system availability.

Systems and methods for fault tolerant computing in accordance with various embodiments of the invention are disclosed. Fault tolerant computer systems in accordance with a number of embodiments of the invention include multiple processing systems supervised by a Fault Management Unit (FMU). The FMU can build a representation of the state of all of the multiple processing systems and then determines which of the processing systems to utilize to perform a particular function based upon this state representation.

A method, an apparatus, and a computer-readable storage medium having instructions for cancelling a redundancy of two or more redundant modules. Results of the two or more redundant modules are received; reliabilities of the results are ascertained; and, based on the ascertained reliabilities, an overall result is determined from the results. The overall result is output for further processing.

A consensus building method suitable when f Byzantine failure nodes (f is an integer equal to or larger than 1 and smaller than N/3) are assumed in a network having N nodes (N is an integer equal to or larger than 1) participating in consensus building, comprising the steps of: receiving a first message from other node which communicates that the other node determined a message including data subject to consensus building valid as a proposal, when the number of received first messages reach a predetermined value Q, transmitting a second message to each node which communicates that it is accepting the proposal, and when the number of received first messages do not reach the predetermined value Q, transmitting a third message to each node which communicates that it is dismissing the proposal, when the number of received second messages reach a predetermined value Q, transmitting a fourth message to each note which communicates that it is treating the proposal as agreed in the network, and when the number of received third messages reach a predetermined value Q, transmitting a fifth message for proceeding to a next round (a unit of consensus building process is called round.) to each node, wherein the predetermined value Q is an integer equal to or larger than (f+N+1)/2 when a value of f is known, and wherein when the number of received first message reaches a predetermined value Q, a lock is set to limit behaviors thereafter.

A method for managing data transfer for a plurality of processors. Transfer messages exchanged between processor units and an external node in an integrity manager located in hardware in communication with the processor units and the external node are received. An exchange of the transfer messages is managed by the processor units with the external node based on a selected mode in mixed integrity modes such that redundantly calculated outputs from the processor units in a high integrity mode match.

A method is provided by which a complex electronic system for controlling a safety-critical technical process, for example driving an autonomous vehicle, can be implemented. A distinction is made between simple and complex software, wherein the simple software is executed on error-tolerant hardware and wherein a plurality of diverse versions of the complex software are implemented simultaneously on independent fault containment units (FCU). A consolidated environmental model is developed from a number of different environmental models and represents the basis for trajectory planning.

A processing system encompasses several processing devices and a comparison device. A method for controlling the processing system encompasses: processing of identical information items by the processing devices using associated processing processes; furnishing a characteristic value of each processing process, respectively as a function of the processing that has occurred; and comparing the characteristic values by way of the comparison device and determining a defectively operating processing process on the basis of the comparison. The defectively operating processing process is replaced by a processing process restarted on the same processing device.

Techniques are disclosed for processor synchronization within a reconfigurable computing environment for processor array redundancy. Processing elements are configured within a reconfigurable fabric to implement two or more redundant processors, where the two or more redundant processors are enabled for coincident operation. An agent is loaded on each of the two or more redundant processors, where the agent performs a function requiring data validation. The agent is fired on each of the two or more redundant processors to commence coincident operation. The coincident operation can include a lockstep operation. An output data result from each of the two or more redundant processors is compared to enable a data validation result. The data validation result is propagated. The propagating the data validation result can be based on comparing valid output data or can be based on comparing invalid output data.

An approach is provided in which a system selects a first processor as a master Time of Day (TOD) processor in a first TOD topology in response to determining that the first processor is directed connected to an oscillator. The system then assigns a second processor as an alternate master TOD processor to a second TOD topology based upon determining that the second processor is on a different node than the first processor. The system configures to the first TOD topology and, when the system detects a TOD failure, the system re-configures to the second TOD topology.