What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Diverse lockstep is a processor-level safety technique: two processing paths execute the same safety-relevant work, and hardware checks for disagreement. By making those paths different in selected ways—not merely duplicating an identical core design—it can reduce susceptibility to some correlated hardware faults. It does not guarantee correct ADAS decisions, make an entire ECU ASIL-D compliant, or provide cybersecurity on its own. Those outcomes depend on the exact MCU and on the wider system design.
That distinction matters when choosing an MCU for radar, sensor fusion, braking, steering, or a domain controller. Diverse lockstep can strengthen fault detection, but it is one mechanism in a safety architecture, not a replacement for safety analysis, fault response, or security controls.
How lockstep works
In a conventional lockstep arrangement, two processor instances execute the same workload. A comparison mechanism checks selected states or outputs; a mismatch can signal a fault in computation, control flow, timing, or hardware. The device can then raise an alarm and trigger a defined reaction, such as isolating a function, entering a degraded mode, or resetting.
Lockstep does not necessarily compare every internal transistor state. The comparison point, resources duplicated, timing, memory arrangement, and available fault reactions are implementation-specific. Engineers need the documentation for the exact device, not just a family-level description.
#1 Best Overall
What makes lockstep “diverse”?
Infineon describes its AURIX diverse-lockstep approach as adding implementation differences between the main and checker paths. These can include physical separation, an execution delay, instruction-level differences, and circuit-, timing-, layout-, clock-, and reset-network diversity, together with a designed comparison path. The aim is to make it less likely that one physical defect or disturbance affects both paths identically. The details and coverage remain device-specific; “diverse” does not mean the two paths are independent in every respect. See Infineon’s Automotive Application Guide.
| Approach | Potential strength | Important trade-off |
|---|---|---|
| Single core with software diagnostics | Can use less hardware area and cost | Detection may be slower or less comprehensive, depending on the diagnostics |
| Conventional lockstep | Can quickly detect many processor divergences | Closely similar paths may be more exposed to some correlated faults |
| Diverse lockstep | Can reduce susceptibility to selected common-cause or correlated faults | Adds design complexity and still relies on shared resources and system-level safeguards |
| Independent redundant MCUs | Can provide greater physical separation | Raises board, power, synchronization, software-integration, and cost burdens |
Why it matters in ADAS
ADAS controllers process data and make or supervise decisions under real-time constraints. A processor fault in a radar controller, camera or vision ECU, sensor-fusion path, emergency-braking function, steering or braking coordinator, or actuator monitor can have safety consequences. Lockstep can help detect certain faults in the CPU execution path quickly enough for the system to react according to its safety concept.
Infineon positions AURIX products for applications including radar, lidar, camera-based systems, braking, power steering, domain control, and data fusion. Its TC39xXA ADAS page describes a radar-oriented platform with lockstep cores and other safety and security features. Those features can support an ECU design; they do not establish that the complete vehicle function is safe.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What diverse lockstep can—and cannot—detect
When a fault affects one execution path but not the other, a comparison may expose the resulting divergence. Depending on the implementation and fault, this can include certain transient computation errors, control-flow errors, timing discrepancies, and faults in core datapaths or control logic. Detection depends on where the fault occurs, whether it manifests at the comparison point, and how the device’s checker and fault-management logic behave.
Redundancy has boundaries. Potential blind spots and common-cause cases include:
- Shared hardware: A common power supply, clock or reset source, bus, memory interface, comparator, or other shared resource may affect both paths. Diversity in selected core implementation layers does not automatically diversify the whole MCU.
- Identical software defects: If both paths execute the same faulty algorithm or requirements, they can produce the same wrong answer. Lockstep is not an independent algorithmic cross-check.
- Bad inputs: A corrupted sensor frame, calibration value, or network message can be processed identically by both paths. Input plausibility checks and end-to-end data protection remain important.
- Logic outside the checked CPU path: Faults in DMA, peripherals, interconnects, accelerators, external memory, or other non-duplicated resources need their own protections and diagnostics.
- Checker and latent faults: Comparator or monitoring failures, and faults that do not immediately cause a mismatch, need to be addressed by the wider diagnostic strategy.
Infineon’s TC3xx functional-safety documentation explains that memory coverage is not simply equivalent to CPU lockstep coverage. It identifies additional monitoring considerations when non-lockstep CPU memories are used for ASIL-D operations. Check the safety manual and documentation for the selected part and software configuration.
Detection is only the start of the safety response
A mismatch matters only if the ECU responds appropriately and within the timing assumed by its safety concept. The design must define how the fault is reported, classified, and handled. Depending on the application, this can involve notification to the Safety Management Unit (SMU) or equivalent fault manager, isolation or shutdown of an affected function, transition to a safe or degraded mode, and diagnostic reporting to a vehicle supervisor. A fail-operational function may need to preserve controllability rather than simply stop.
Recommended Free Tools
The device’s safety manual describes available mechanisms and constraints; the application safety concept determines what reaction is appropriate. Detection by itself is not recovery, and the required reaction differs between, for example, a radar processing path and a braking actuator controller.
ASIL-D claims need context
ASIL is assigned to a safety goal or item through the ISO 26262 process. An MCU containing lockstep is not automatically “ASIL-D” for every use. A device may be developed and documented to support applications up to ASIL-D, while the integrator remains responsible for applying it correctly in the system.
Infineon describes TC3xx as a Safety Element out of Context (SEooC): the device is developed with assumed use conditions, but the system integrator must establish that those assumptions hold in the actual application. A safety case still requires the relevant item definition, hazard and risk analysis, safety concept, allocation and implementation, software and tool evidence, fault analysis, and system validation. “Supports ASIL-D,” “developed according to ISO 26262,” and “certified for this particular vehicle function” are not interchangeable statements.
Infineon documentation says that, depending on the device, up to four TC3xx CPUs can be protected by lockstep mechanisms and support applications up to ASIL-D or SIL 3 under stated conditions. That is not a blanket claim for every TC3xx part or configuration. Verify the exact part number, safety manual, assumptions, and evidence before using a safety claim.
Functional safety is not cybersecurity
Functional safety addresses hazards arising from malfunction, including random hardware faults and systematic failures, and the mechanisms that detect faults and enable a safe response. Cybersecurity addresses threats such as unauthorized code execution, malicious messages, compromised sensors, firmware tampering, and key theft. The disciplines interact, but one does not substitute for the other.
A lockstep comparator can reveal disagreement between processing paths. It does not inherently authenticate firmware, prevent a validly executing malicious payload, manage cryptographic keys, secure an update, or protect a debug port. Those needs call for separate hardware and software measures: secure boot, authenticated updates, key isolation and lifecycle management, access controls, debug protection, and threat analysis. A hardware security module (HSM) or security engine can provide building blocks, but secure system configuration and operation are still required.
AURIX product pages list HSM and other security capabilities alongside safety features; NXP describes a hardware security engine for secure boot, security services, and key management in its S32N55 platform information. Neither the presence of an HSM nor lockstep alone makes an ECU secure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.AURIX examples—and why exact variants matter
Infineon’s AURIX TC3xx family combines multicore TriCore MCUs with scalable memory, communications, and safety and security features. Implementations vary substantially across part numbers; lockstep core counts, memory, accelerators, interfaces, and security features should not be assumed universal. The TC3x family page lists applications including chassis and powertrain control, radar, lidar, camera systems, domain control, and data fusion.
- TC33xDA is positioned for radar-related designs and lists a radar signal-processing unit, lock-stepped and non-lock-stepped cores, Full-EVITA HSM support, and automotive communications.
- TC39xXA is an ADAS-oriented example whose described variant lists four lock-stepped and two non-lock-stepped cores, radar acceleration, and HSM support.
These are examples, not interchangeable specifications for every device in either family. Confirm core configuration, memory protection, temperature grade, package, interface set, and safety scope in the latest datasheet and safety documentation for the precise orderable part.
How to evaluate an MCU for a safety-critical ADAS ECU
Do not select a part solely because its marketing materials say “diverse lockstep.” Evaluate whether its evidence and integration model fit the item, workloads, and organization.
| Area | Questions to resolve |
|---|---|
| Safety evidence | What safety manual, FMEDA, diagnostic coverage, safety metrics, assumptions, and fault-reaction descriptions are available for this exact part? Are fault-injection results available and relevant? |
| Coverage boundaries | Which cores, memories, buses, peripherals, accelerators, and interfaces are covered or monitored? What protections are required for non-lockstep resources and mixed-criticality software? |
| Fault response | What is the mismatch-to-reaction time? Can the ECU enter the required safe or degraded state? How are faults reported, logged, and recovered from? |
| Workload and timing | Does the device meet deterministic latency, throughput, interrupt, DMA, memory-bandwidth, and sensor-fusion needs? Does it include the radar or vision acceleration the design actually requires? |
| Interfaces and physical fit | Are the required automotive networks, I/O, package, temperature range, power, and trace bandwidth supported by the selected variant? |
| Cybersecurity | Are secure boot, key isolation, authenticated updates, debug lifecycle controls, protected storage, and required cryptographic services available and usable in the intended configuration? |
| Software and tools | Are qualified compiler evidence, AUTOSAR MCAL, safety libraries, self-test software, debugger and trace tools, and integration support available for the project? |
| Program risk | Does the vendor provide appropriate safety and field support, product longevity and supply information, evaluation hardware, and a feasible toolchain migration path? |
Infineon provides AURIX entry points for development tools and getting started; availability of drivers, AUTOSAR software, safety collateral, and support depends on the specific product and program. Include collateral, tool qualification, integration effort, and vendor support in the project’s total-cost assessment. Avoid assuming that fewer ECUs or an integrated safety mechanism automatically lowers development cost.
Alternatives and architecture fit
Infineon explicitly markets diverse lockstep as an AURIX technology. NXP’s S32N55 is a relevant alternative platform: NXP describes Arm Cortex-R52 real-time cores that can operate in split or lockstep modes, together with a hardware security engine. The available product information does not establish that this is equivalent to Infineon’s specific diverse-lockstep implementation. Compare the safety manuals, architecture, evidence, software ecosystem, and fit to your workload rather than treating the terminology as interchangeable.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →An integrated lockstep MCU may suit designs seeking processor-level diagnostics without duplicating an entire ECU. Independent MCUs may be appropriate where the safety concept requires greater physical independence, while adding synchronization, board, power, and software burdens. Neither choice is universally safer: the right architecture follows the safety goals, failure analysis, and system constraints.
Bottom line for engineering teams
Diverse lockstep can improve detection of selected processor faults and reduce exposure to certain correlated implementation failures. Its value for an ADAS ECU depends on what is genuinely diverse, what resources remain shared, how faults are detected and handled, and whether the rest of the data path and software are protected. Treat it as one useful element of a safety architecture; pair it with system-level diagnostics, fault containment, validated software, and separate cybersecurity controls.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
