Operation of I/O in a safe system

• US 10,120,772 B2
• Filed: 07/17/2017
• Issued: 11/06/2018
• Est. Priority Date: 12/16/2013
• Status: Active Grant

• Current Assignee: SMART Embedded Computing, Inc. (Smart Global Holdings Incorporated)
• Original Assignee: Artesyn Embedded Computing Inc. (Smart Global Holdings Incorporated)
• Inventors: Vaananen, Pasi Jukka Petteri, Cornes, Martin Peter John, Pri-Tal, Shlomo
• Primary Examiner(s): Duncan, Marc
• Assistant Examiner(s): Gibson, Jonathan D
• Application Number:
  US15/651,023
• Publication Number:
  US 20170315896A1
• Time in Patent Office: 477 Days
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/1608 Error detection by comparing the output signals of redundant hardware G06F11/1629, G06F11/1666 take precedence; error detection or correction in information storage based on relative movement between record carrier and transducer G11B20/18; checking static stores for correct operation G11C29/00; for logic circuits H03K19/003, H03K19/007; for pulse counters or frequency dividers H03K21/40
• CPC Class Codes: G06F 11/1633 using mutual exchange of the output between the redundant processing components
• CPC Class Codes: G06F 11/1654 where the output of only one of the redundant processing components can drive the attached hardware, e.g. memory or I/O
• CPC Class Codes: G06F 11/202 where processing functionality is redundant redundant communication control functionality G06F11/2005, redundant storage control functionality G06F11/2089
• CPC Class Codes: G06F 11/2038 with a single idle spare processing component
• CPC Class Codes: G06F 11/2284 by power-on test, e.g. power-on self test [POST]
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/3495 for systems

Abstract

A module health system includes a module health circuit comprising a hardware register that is set to a first value in response to the system starting, an application register that is set to the first value in response to the system starting and a watchdog timer register that is set to the first value in response to the system starting. The system further includes a power on self-test that determines whether the system has passed a plurality of tests and that selectively sets the hardware register to a second value based on the determination, an external software application that determines whether a safety critical system is healthy and selectively sets the application register based on the determination, a watchdog timer application that selectively sets the watchdog timer register, a central processing unit that determines whether to de-assert a module health signal.

Claims

1. A module health system comprising:

a master CPU including;

a module health circuit that includes;

a first hardware (HW) register that is set to a first value in response to the system starting;

a first application register that is set to the first value in response to the system starting;

a first watchdog (WD) timer register that is set to the first value in response to the system starting;

a first power on self-test (POST) that determines whether the system has passed a plurality of tests and that selectively sets the first HW register to a second value based on the determination;

an external software application that determines whether a safety critical system external to and associated with the module health circuit is healthy and selectively sets the first application register based on the determination;

a watchdog timer application that selectively sets the first WD timer register in response to receiving a watchdog signal; and

a first central processing unit (CPU) that determines whether to de-assert a first module health signal based on the values of the first HW register, the first application register, and the first WD timer register; and

a checker CPU including a second module health circuit,

wherein the master CPU and the checker CPU each output respective health signals, and the respective health signals are compared to determine whether the module health system is operating properly.

2. The system of claim 1 wherein the POST sets the first HW register to the second value when the POST determines the system passed the plurality of tests.

3. The system of claim 1 wherein the POST does not set the HW register to the second value when the POST determines the system did not pass at least one of the plurality of tests.

4. The system of claim 1 wherein the software application sets the first application register to the second value when the software application determines the safety critical system is healthy.

5. The system of claim 1 wherein the software application does not set the first application register to the second value when the software application determines the safety critical system is not healthy.

6. The system of claim 1 wherein the watchdog timer application sets the first WD timer register to the second value when the watchdog timer application receives a watchdog timer signal within a predetermined period and wherein the watchdog timer application does not set the first WD timer register to the second value when the watchdog timer application does not receive the watchdog timer signal within the predetermined period.

7. The system of claim 1 wherein the first CPU determines not to de-assert the first module health signal when each of the first HW register, the first application register, and the first WD timer register are set to the second value.

8. The system of claim 1 wherein the first CPU determines to de-assert the first module health signal when at least one of the first HW register, the first application register, and the first WD timer register is set to the first value.

9. The system of claim 1 wherein the first CPU determines whether to de-assert a first chassis health signal in response to the determination of whether to de-assert the first module health signal.

10. The system of claim 1 further comprising a second CPU that determines whether to de-assert a second module health signal based on a value of a second HW register, a second application register, and a second WD timer register, wherein the second CPU determines whether to de-assert a second chassis health signal in response to the determination of whether to de-assert the second module health signal.

11. A method comprising:

in a master CPU;

setting, in response to a module health system starting, a hardware (HW) register to a first value;

setting, in response to the system starting, an application register to the first value;

setting, in response to the system starting, a watchdog (WD) timer register;

selectively setting the HW register to a second value in response to a determination of whether the system has passed a plurality of tests;

selectively setting the application register to the second value in response to a determination of whether a safety critical system external to and associated with the module health system is healthy;

selectively setting the WD timer register to the second value in response to receiving a watchdog signal; and

determining whether to de-assert a module health signal based on a value of the HW register, the application register, and the WD timer register; and

in a checker CPU, providing a second module health circuit,

wherein the master CPU and the checker CPU each output respective health signals, and the respective health signals are compared to determine whether the module health system is operating properly.

12. The method of claim 11 further comprising setting the HW register to the second value in response to a determination that the system passed the plurality of tests.

13. The method of claim 11 further comprising not setting the HW register to the second value in response to a determination that the system did not pass at least one of the plurality of tests.

14. The method of claim 11 further comprising setting the application register to the second value in response to a determination that the safety critical system is healthy.

15. The method of claim 11 further comprising not setting the application register to the second value in response to a determination that the safety critical system is not healthy.

16. The method of claim 11 further comprising setting the WD timer register to the second value in response to receiving the watchdog signal within a predetermined period.

17. The method of claim 16 further comprising not setting the WD timer register to the second value in response to not receiving a watchdog timer signal within the predetermined period.

18. The method of claim 11 further comprising determining not to de-assert the module health signal when each of the HW register, the application register, and the WD timer register are set to the second value.

19. The method of claim 11 further comprising determining to de-assert the module health signal when at least one of the HW register, the application register, and the WD timer register is set to the first value.

20. The method of claim 11 further comprising determining whether to de-assert a chassis health signal in response to the determination of whether to de-assert the module health signal.

21. A module health system comprising:

a module health circuit that includes;

a first hardware (HW) register that is set to a first value in response to the system starting;

a first application register that is set to the first value in response to the system starting;

a first watchdog (WD) timer register that is set to the first value in response to the system starting;

a first power on self-test (POST) that determines whether the system has passed a plurality of tests and that selectively sets the first HW register to a second value based on the determination;

an external software application that determines whether a safety critical system external to and associated with the module health circuit is healthy and selectively sets the first application register based on the determination;

a watchdog timer application that selectively sets the first WD timer register in response to receiving a watchdog signal; and

a first central processing unit (CPU) that determines whether to de-assert a first module health signal based on the values of the first HW register, the first application register, and the first WD timer register.

22. The system of claim 21 wherein the POST sets the first HW register to the second value when the POST determines the system passed the plurality of tests.

23. The system of claim 21 wherein the POST does not set the HW register to the second value when the POST determines the system did not pass at least one of the plurality of tests.

24. The system of claim 21 wherein the software application sets the first application register to the second value when the software application determines the safety critical system is healthy.

25. The system of claim 21 wherein the software application does not set the first application register to the second value when the software application determines the safety critical system is not healthy.

26. The system of claim 21 wherein the watchdog timer application sets the first WD timer register to the second value when the watchdog timer application receives a watchdog timer signal within a predetermined period and wherein the watchdog timer application does not set the first WD timer register to the second value when the watchdog timer application does not receive the watchdog timer signal within the predetermined period.

27. The system of claim 21 wherein the first CPU determines not to de-assert the first module health signal when each of the first HW register, the first application register, and the first WD timer register are set to the second value.

28. The system of claim 21 wherein the first CPU determines to de-assert the first module health signal when at least one of the first HW register, the first application register, and the first WD timer register is set to the first value.

29. The system of claim 21 wherein the first CPU determines whether to de-assert a first chassis health signal in response to the determination of whether to de-assert the first module health signal.

30. The system of claim 21 further comprising a second CPU that determines whether to de-assert a second module health signal based on a value of a second HW register, a second application register, and a second WD timer register, wherein the second CPU determines whether to de-assert a second chassis health signal in response to the determination of whether to de-assert the second module health signal.