Processing system, related device and method

A vehicle comprising:

• a plurality of processing systems, each processing system comprising:
• a non-volatile memory configured to store a count value;
• a safety monitor circuit configured to monitor an operation of the processing system and generate a safety error signal;
• a fault collection and error management circuit configured to generate one or more reaction signals as a function of a further error signal;
• and
• a hardware safety-time monitor circuit comprising a counter configured to configured to selectively increase a counter count value, wherein the hardware safety-time monitor circuit is configured to:
• generate the further error signal as a function of the safety error signal;
• in response the processing system switching on, transfer the stored count value from the non-volatile memory to the counter;
• determine whether the safety error signal is asserted;
• in response to determining that the safety error signal is asserted, increase via the counter the counter count value;
• determine whether the counter count value reaches or exceeds a maximum value;
• in response to determining that the counter count value reaches or exceeds the maximum value, assert the further error signal;
• and
• in response to determining the processing system switching off and/or periodically, transfer the counter count value from the counter to the non-volatile memory, wherein the counter count value is a cumulative count value;
• and
• a further communication system connecting the processing systems to each other.

A method of operating a processing system comprising a non-volatile memory, a safety monitor circuit, a fault collection and error management circuit, and a hardware safety-time monitor circuit, the method comprising:

• in response to the processing system switching on, transferring, by the hardware safety-time monitor circuit, a stored count value from the non-volatile memory to a counter in the hardware safety-time monitor circuit;
• asserting, by the safety monitor circuit, a safety error signal;
• increasing, by the hardware safety-time monitor circuit via the counter, a counter count value;
• determining, by the hardware safety-time monitor circuit, whether the counter count value reaches or exceeds a maximum value;
• in response to determining that the counter count value reaches or exceeds the maximum value, asserting, by the hardware safety-time monitor circuit, a further error signal;
• and
• in response to the processing system switching off and/or periodically, transferring, by the hardware safety-time monitor circuit, the counter count value from the counter to the non-volatile memory, the counter count value being a cumulative count value.