Operation of I/O in a safe system

A method comprising:

• in a master CPU:
• setting, in response to a module health system starting, a hardware (HW) register to a first value;
• setting, in response to the system starting, an application register to the first value;
• setting, in response to the system starting, a watchdog (WD) timer register;
• selectively setting the HW register to a second value in response to a determination of whether the system has passed a plurality of tests;
• selectively setting the application register to the second value in response to a determination of whether a safety critical system external to and associated with the module health system is healthy;
• selectively setting the WD timer register to the second value in response to receiving a watchdog signal;
• and
• determining whether to de-assert a module health signal based on a value of the HW register, the application register, and the WD timer register;
• and
• in a checker CPU, providing a second module health circuit,
• wherein the master CPU and the checker CPU each output respective health signals, and the respective health signals are compared to determine whether the module health system is operating properly.

A module health system comprising:

• a module health circuit that includes:
• a first hardware (HW) register that is set to a first value in response to the system starting;
• a first application register that is set to the first value in response to the system starting;
• a first watchdog (WD) timer register that is set to the first value in response to the system starting;
• a first power on self-test (POST) that determines whether the system has passed a plurality of tests and that selectively sets the first HW register to a second value based on the determination;
• an external software application that determines whether a safety critical system external to and associated with the module health circuit is healthy and selectively sets the first application register based on the determination;
• a watchdog timer application that selectively sets the first WD timer register in response to receiving a watchdog signal;
• and
• a first central processing unit (CPU) that determines whether to de-assert a first module health signal based on the values of the first HW register, the first application register, and the first WD timer register.