Techniques are provided for metadata management for enabling automated switchover. An initial quorum vote may be performed before a node executes an operation associated with metadata comprising operational information and switchover information. After the initial quorum vote is performed, the node executes the operation upon one or more mailbox storage devices. Once the operation has executed, a final quorum vote is performed. The final quorum vote and the initial quorum vote are compared to determine whether the operation is to be designated as successful or failed, and whether any additional actions are to be performed.

An apparatus comprises a plurality of redundant processing units to perform data processing redundantly in lockstep; common mode fault detection circuitry to detect an event indicative of a potential common mode fault affecting each of the plurality of redundant processing units; a memory shared between the plurality of redundant processing units; and memory checking circuitry to perform a memory scanning operation to scan at least part of the memory for errors; in which the memory checking circuitry performs the memory scanning operation in response to a common mode fault signal generated by the common mode fault detection circuitry indicating that the event indicative of a potential common mode fault has been detected.

A parallel processing system includes at least three parallel processors, state monitoring circuitry, and state reload circuitry. The state monitoring circuitry couples to the at least three parallel processors and is configured to monitor runtime states of the at least three parallel processors and identify a first processor of the at least three parallel processors having at least one runtime state error. The state reload circuitry couples to the at least three parallel processors and is configured to select a second processor of the at least three parallel processors for state reload, access a runtime state of the second processor, and load the runtime state of the second processor into the first processor. Monitoring and reload may be performed only on sub-systems of the at least three parallel processors. During reload, clocks and supply voltages of the processors may be altered. The state reload may relate to sub-systems.

A fault detecting multi-thread pipeline processor with fault detection is operative with a single pipeline stage which generates branch status comprising at least one of branch taken/not_taken, branch direction, and branch target. A first thread has control and data instructions, the control instructions comprising loop instructions including unconditional and conditional branch instructions, loop initialization instructions, loop arithmetic instructions, and no operation (NOP) instructions. A second thread has only control instructions and either has the non-control instructions replaced with NOP instructions, or removed entirely. A fault detector compares the branch status of the first thread and second thread and asserts a fault output when they do not match.

Disclosed embodiments relate to adjusting vehicle Electronic Control Unit (ECU) software versions. Operations may include receiving a prompt to adjust an ECU of a vehicle from executing a first version of ECU software to a second version of ECU software; configuring, in response to the prompt and based on a delta file corresponding to the second version of ECU software, the second version of ECU software on the ECU in the vehicle for execution; and configuring, in response to the prompt, the first version of ECU software on the ECU in the vehicle to become non-executable.

A circuit device 100 includes an interface circuit 160 that receives image data and information for image check and a processing circuit 105 that performs image check processing. The information for image check includes information for designating an image check method for a region to be subjected to image check and position information of the region to be subjected to image check. The processing circuit 105 performs the image check processing on the image data of the region to be subjected to image check specified by the position information, using the image check method designated by the designation information.

Disclosed embodiments relate to identifying Electronic Control Unit (ECU) anomalies in a vehicle. Operations may include monitoring, in the vehicle, data representing real-time processing activity of the ECU; accessing, in the vehicle, historical data relating to processing activity of the ECU, the historical data representing expected processing activity of the ECU; comparing, in the vehicle, the real-time processing activity data with the historical data, to identify at least one anomaly in the real-time processing activity of the ECU; and implementing a control action for the ECU when the at least one anomaly is identified.

An integrated circuit includes a safety processor and a secure computing module including a secure processor, first and second cryptographic units for encrypting and decrypting data, and first and second data transfer units for transferring data between a memory and the first and second cryptographic units respectively. The first cryptographic unit and the first data transfer unit provide a first cryptographic data handling system and the second cryptographic unit and the second data transfer unit provide a second cryptographic data handling system. The secure computing module includes selector circuitry for selectively coupling and uncoupling the first and second cryptographic units in response to control signals from a switch. In a first mode, the first and second cryptographic data handling systems are uncoupled and operable independently of each other. In a second mode, the first and second cryptographic data handling system are coupled and operable together to provide hardware redundancy.

An embodiment device comprises a first processing unit configured to process an initial data line and deliver a first processed data line, a first delay unit coupled to the output of the first processing unit and configured to deliver a delayed first processed data line delayed by a first delay, a second delay unit configured to deliver the delayed initial data line delayed by a second delay, a second processing unit coupled to the output of the second delay unit and configured to process the delayed initial data line and deliver a delayed second processed data line, and a comparison unit configured to compare the contents of the delayed first and second processed data lines and deliver a non-authentication signal if the contents are not identical, the first and second delays being equal to a variable value.

An error recovery method and apparatus, and a system are disclosed. At least two CPUs in a lockstep mode can exit the lockstep mode when an error occurs in at least one CPU, and the CPU in which the error occurs and a type of the error are determined. When the error can be recovered, the CPU in which the error occurs can be recovered according to a correctly running CPU. This helps the at least two CPUs run again at a position at which a service program is interrupted.