# US 10,120,772 B2 · Operation of I/O in a safe system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,120,772 B2 - Document ID: US10120772B2 - Status: Granted - Kind: B2 - Application number: 15/651,023 - Filed: 2017-07-17 - Published: 2017-11-02 - Granted: 2018-11-06 - Earliest claimed: 2013-12-16 - Assignees: Artesyn Embedded Computing, Inc. - Applicants: Artesyn Embedded Computing, Inc. - Inventors: Pasi Jukka Petteri Vaananen; Martin Peter John Cornes; Shlomo Pri-Tal - Web page: https://patentgrep.com/patent/US10120772B2 ## CPC - G06F 11/3055: {Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available (error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction of the data by redundancy in operations G06F11/14; error detection or correction by redundancy in hardware G06F11/16)} - G06F 11/0739: {in a data processing system embedded in automotive or aircraft systems} - G06F 11/0757: {by exceeding a time limit, i.e. time-out, e.g. watchdogs} - G06F 11/1633: {using mutual exchange of the output between the redundant processing components} - G06F 11/1654: {where the output of only one of the redundant processing components can drive the attached hardware, e.g. memory or I/O} - G06F 11/2284: {by power-on test, e.g. power-on self test [POST]} - G06F 11/3495: {for systems} - G06F 11/1608: {Error detection by comparing the output signals of redundant hardware (G06F11/1629, G06F11/1666 take precedence; error detection or correction in information storage based on relative movement between record carrier and transducer G11B20/18; checking static stores for correct operation G11C29/00; for logic circuits H03K19/003, H03K19/007; for pulse counters or frequency dividers H03K21/40)} - G06F 11/202: {where processing functionality is redundant (redundant communication control functionality G06F11/2005, redundant storage control functionality G06F11/2089)} - G06F 11/2038: {with a single idle spare processing component} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A module health system includes a module health circuit comprising a hardware register that is set to a first value in response to the system starting, an application register that is set to the first value in response to the system starting and a watchdog timer register that is set to the first value in response to the system starting. The system further includes a power on self-test that determines whether the system has passed a plurality of tests and that selectively sets the hardware register to a second value based on the determination, an external software application that determines whether a safety critical system is healthy and selectively sets the application register based on the determination, a watchdog timer application that selectively sets the watchdog timer register, a central processing unit that determines whether to de-assert a module health signal. ## Claims ### Claim 1 A module health system comprising: a master CPU including: a module health circuit that includes: a first hardware (HW) register that is set to a first value in response to the system starting; a first application register that is set to the first value in response to the system starting; a first watchdog (WD) timer register that is set to the first value in response to the system starting; a first power on self-test (POST) that determines whether the system has passed a plurality of tests and that selectively sets the first HW register to a second value based on the determination; an external software application that determines whether a safety critical system external to and associated with the module health circuit is healthy and selectively sets the first application register based on the determination; a watchdog timer application that selectively sets the first WD timer register in response to receiving a watchdog signal; and a first central processing unit (CPU) that determines whether to de-assert a first module health signal based on the values of the first HW register, the first application register, and the first WD timer register; and a checker CPU including a second module health circuit, wherein the master CPU and the checker CPU each output respective health signals, and the respective health signals are compared to determine whether the module health system is operating properly. ### Claim 2 (depends on 1) The system of claim 1 wherein the POST sets the first HW register to the second value when the POST determines the system passed the plurality of tests. ### Claim 3 (depends on 1) The system of claim 1 wherein the POST does not set the HW register to the second value when the POST determines the system did not pass at least one of the plurality of tests. ### Claim 4 (depends on 1) The system of claim 1 wherein the software application sets the first application register to the second value when the software application determines the safety critical system is healthy. ### Claim 5 (depends on 1) The system of claim 1 wherein the software application does not set the first application register to the second value when the software application determines the safety critical system is not healthy. ### Claim 6 (depends on 1) The system of claim 1 wherein the watchdog timer application sets the first WD timer register to the second value when the watchdog timer application receives a watchdog timer signal within a predetermined period and wherein the watchdog timer application does not set the first WD timer register to the second value when the watchdog timer application does not receive the watchdog timer signal within the predetermined period. ### Claim 7 (depends on 1) The system of claim 1 wherein the first CPU determines not to de-assert the first module health signal when each of the first HW register, the first application register, and the first WD timer register are set to the second value. ### Claim 8 (depends on 1) The system of claim 1 wherein the first CPU determines to de-assert the first module health signal when at least one of the first HW register, the first application register, and the first WD timer register is set to the first value. ### Claim 9 (depends on 1) The system of claim 1 wherein the first CPU determines whether to de-assert a first chassis health signal in response to the determination of whether to de-assert the first module health signal. ### Claim 10 (depends on 1) The system of claim 1 further comprising a second CPU that determines whether to de-assert a second module health signal based on a value of a second HW register, a second application register, and a second WD timer register, wherein the second CPU determines whether to de-assert a second chassis health signal in response to the determination of whether to de-assert the second module health signal. ### Claim 11 A method comprising: in a master CPU: setting, in response to a module health system starting, a hardware (HW) register to a first value; setting, in response to the system starting, an application register to the first value; setting, in response to the system starting, a watchdog (WD) timer register; selectively setting the HW register to a second value in response to a determination of whether the system has passed a plurality of tests; selectively setting the application register to the second value in response to a determination of whether a safety critical system external to and associated with the module health system is healthy; selectively setting the WD timer register to the second value in response to receiving a watchdog signal; and determining whether to de-assert a module health signal based on a value of the HW register, the application register, and the WD timer register; and in a checker CPU, providing a second module health circuit, wherein the master CPU and the checker CPU each output respective health signals, and the respective health signals are compared to determine whether the module health system is operating properly. ### Claim 12 (depends on 11) The method of claim 11 further comprising setting the HW register to the second value in response to a determination that the system passed the plurality of tests. ### Claim 13 (depends on 11) The method of claim 11 further comprising not setting the HW register to the second value in response to a determination that the system did not pass at least one of the plurality of tests. ### Claim 14 (depends on 11) The method of claim 11 further comprising setting the application register to the second value in response to a determination that the safety critical system is healthy. ### Claim 15 (depends on 11) The method of claim 11 further comprising not setting the application register to the second value in response to a determination that the safety critical system is not healthy. ### Claim 16 (depends on 11) The method of claim 11 further comprising setting the WD timer register to the second value in response to receiving the watchdog signal within a predetermined period. ### Claim 17 (depends on 16) The method of claim 16 further comprising not setting the WD timer register to the second value in response to not receiving a watchdog timer signal within the predetermined period. ### Claim 18 (depends on 11) The method of claim 11 further comprising determining not to de-assert the module health signal when each of the HW register, the application register, and the WD timer register are set to the second value. ### Claim 19 (depends on 11) The method of claim 11 further comprising determining to de-assert the module health signal when at least one of the HW register, the application register, and the WD timer register is set to the first value. ### Claim 20 (depends on 11) The method of claim 11 further comprising determining whether to de-assert a chassis health signal in response to the determination of whether to de-assert the module health signal. ### Claim 21 A module health system comprising: a module health circuit that includes: a first hardware (HW) register that is set to a first value in response to the system starting; a first application register that is set to the first value in response to the system starting; a first watchdog (WD) timer register that is set to the first value in response to the system starting; a first power on self-test (POST) that determines whether the system has passed a plurality of tests and that selectively sets the first HW register to a second value based on the determination; an external software application that determines whether a safety critical system external to and associated with the module health circuit is healthy and selectively sets the first application register based on the determination; a watchdog timer application that selectively sets the first WD timer register in response to receiving a watchdog signal; and a first central processing unit (CPU) that determines whether to de-assert a first module health signal based on the values of the first HW register, the first application register, and the first WD timer register. ### Claim 22 (depends on 21) The system of claim 21 wherein the POST sets the first HW register to the second value when the POST determines the system passed the plurality of tests. ### Claim 23 (depends on 21) The system of claim 21 wherein the POST does not set the HW register to the second value when the POST determines the system did not pass at least one of the plurality of tests. ### Claim 24 (depends on 21) The system of claim 21 wherein the software application sets the first application register to the second value when the software application determines the safety critical system is healthy. ### Claim 25 (depends on 21) The system of claim 21 wherein the software application does not set the first application register to the second value when the software application determines the safety critical system is not healthy. ### Claim 26 (depends on 21) The system of claim 21 wherein the watchdog timer application sets the first WD timer register to the second value when the watchdog timer application receives a watchdog timer signal within a predetermined period and wherein the watchdog timer application does not set the first WD timer register to the second value when the watchdog timer application does not receive the watchdog timer signal within the predetermined period. ### Claim 27 (depends on 21) The system of claim 21 wherein the first CPU determines not to de-assert the first module health signal when each of the first HW register, the first application register, and the first WD timer register are set to the second value. ### Claim 28 (depends on 21) The system of claim 21 wherein the first CPU determines to de-assert the first module health signal when at least one of the first HW register, the first application register, and the first WD timer register is set to the first value. ### Claim 29 (depends on 21) The system of claim 21 wherein the first CPU determines whether to de-assert a first chassis health signal in response to the determination of whether to de-assert the first module health signal. ### Claim 30 (depends on 21) The system of claim 21 further comprising a second CPU that determines whether to de-assert a second module health signal based on a value of a second HW register, a second application register, and a second WD timer register, wherein the second CPU determines whether to de-assert a second chassis health signal in response to the determination of whether to de-assert the second module health signal.