Timer circuit with pin autonomous float and related systems, methods, and apparatuses

Abstract

An electrical system includes an integrated circuit device that includes an input / output (I / O) pin, a reset circuit, and an I / O circuit. The I / O circuit is operably coupled to the I / O pin. The I / O circuit is configured to selectively operate the I / O pin in an electrically floating state in response to a system reset signal emitted by the reset circuit. The I / O circuit is further configured to selectively operate the I / O pin in the electrically floating state in response to a signal provided by a timer circuit that is independent of the reset circuit.

Description

[0001] Cross Reference to Related Applications

[0002] This patent application claims priority to U.S. Provisional Patent Application No. 62 / 940,617, filed November 26, 2019, and titled “WATCHDOG WITH NON-MASKABLE INTERRUPT AND AUTONOMOUS FLOATING OF PINS AND RELATED SYSTEMS, METHODS, AND DEVICES,” the entire disclosure of which is incorporated herein by reference. TECHNICAL FIELD

[0003] The present disclosure relates generally to remedial measures taken in response to a fault detected in the operation of an integrated circuit, and more particularly to remedial measures taken in processing circuitry. BACKGROUND

[0004] Processing circuitry can use a reset controller to initiate a system reset of the processing circuitry. From a functional safety perspective, a system reset is intended to place the processing circuitry in a safe state, with input / output (I / O) pins set to an electrically floating state. In safety-critical systems, such processing circuitry can avoid unsafe operation of external devices that interact with the processing circuitry due to the operation of the I / O pins in the safe state. BRIEF DESCRIPTION OF DRAWINGS

[0005] While the present disclosure concludes with claims particularly pointing out and distinctly claiming that which is regarded as the present disclosure, various features and advantages of embodiments within the scope of the present disclosure can be more readily understood from the following description, taken in connection with the accompanying drawings, in which:

[0006] Figure 1 is a block diagram of an electrical system, in accordance with some embodiments;

[0007] Figure 2 is a block diagram of processing circuitry, in accordance with some embodiments;

[0008] Figure 3 is a flow diagram illustrating a method of operating an integrated circuit device, in accordance with some embodiments;

[0009] Figure 4 is a flow diagram illustrating a method of operating a timer circuit, in accordance with some embodiments; and

[0010] Figure 5 is a block diagram of circuitry that can be used to implement various functions, operations, acts, processes, and / or methods disclosed herein, in some embodiments. DETAILED DESCRIPTION

[0011] In the following detailed description, reference is made to the accompanying drawings, which form a part of this disclosure, and in which are shown, by way of illustration, specific examples in which embodiments of the disclosure can be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the disclosure. Other embodiments can be utilized, and structural, material, and process changes can be made without departing from the scope of the present disclosure.

[0012] The illustrations presented herein are not intended to be actual views of any particular method, system, device, or structure, but are merely idealized representations that are employed to describe the embodiments of the present disclosure. In some instances, similar structures or components in various drawings can be kept the same or similar numbering for the convenience of the reader; however, the similarity in numbering does not necessarily mean that the structures or components are identical in size, composition, configuration, or any other attribute.

[0013] The following description can include examples to help enable a person of ordinary skill in the art to practice the embodiments disclosed herein. The use of terms such as “exemplary,” “by way of example,” and “for example,” are intended to convey that the related description is illustrative, and does not limit the scope of the disclosure to the specified embodiments or examples, and such terms are not intended to convey that the alternative embodiments or examples embodied by other embodiments are less desirable than the particular embodiments or examples. The use of the terms “first,” “second,” and the like does not imply any particular order but are included to provide a clear description of the embodiments.

[0014] It will be readily understood that the components of the embodiments, as generally described and illustrated in the Figures herein, can be arranged and designed in a wide variety of different configurations. Thus, the following description of the various embodiments is not intended to limit the scope of the present disclosure but is merely representative of the various embodiments. While the various aspects of the embodiments can be presented in the Figures, the Figures are not necessarily drawn to scale, unless specifically indicated.

[0015] Furthermore, the particular implementations shown and described are illustrative examples only and are not intended to limit the scope of the present disclosure to these implementations, unless otherwise indicated. Elements, circuits, and functions can be shown in block diagram form in order not to obscure the concepts of the present disclosure. In this manner, block diagrams can show the particular implementation of the embodiments in a conceptual manner. In some instances, details of certain features can be omitted that would be particular to technical fields in order not to obscure the concepts of the present disclosure. Additionally, the order in which steps are presented is not necessarily the order in which they are performed, unless otherwise indicated.

[0016] Those of ordinary skill in the art will realize that information and signals can be represented using any of a variety of different technologies and techniques. For the sake of presentation, the various illustrative blocks, modules, and circuits described herein can be shown with lines for the convenience in explaining certain aspects. Those of ordinary skill in the art will recognize the lines are not intended to represent an actual wire but are meant to conceptualize the flow of information. Further, a block diagram can show a number of components coupled together, whereas in actual implementations, the components illustrated could be integrated together in an ultra-lattice fashion, or separately implemented as part of one or more microchips.

[0017] The various illustrative logical blocks, modules, and circuits described in connection with the embodiments disclosed herein can be implemented or performed with a general purpose processor, a special purpose processor, a Digital Signal Processor (DSP), an Integrated Circuit (IC), an Application-Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor (which can also be referred to herein as a "host processor" or simply "host") can be a microprocessor, but in the alternative, the processor can be any conventional processor, controller, microcontroller, or state machine. A processor can also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. A general purpose computer, including a processor, when appropriately programmed, can be considered to be a special purpose computer.

[0018] Embodiments can be described in terms of processes, flowcharts, flow diagrams, structure diagrams, or block diagrams. Although processes can be described in a sequential manner, many of the processes can be performed concurrently, in parallel, or in any order. Additionally, the order of the processes can be re-arranged. A process can correspond to a method, a thread, a function, a procedure, a subroutine, a subroutine, other structure, or combinations thereof. Furthermore, the processes disclosed herein can be implemented by hardware, software, or both. If implemented in software, the functions can be stored or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media include both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.

[0019] Any reference to an element or object herein using a designation such as "first," "second," and so forth does not limit the quantity or order of those elements, unless specifically stated herein. Rather, these designations can be used herein as a convenient method of distinguishing between two or more elements or instances of an element. Thus, a reference to first and second elements does not mean that only two elements can be employed, or that the first element must precede the second element. Also, unless otherwise specified herein, a set of elements can comprise one or more elements.

[0020] As used herein, the term "substantially" with respect to a given parameter, attribute, or condition means and includes a degree of variance from the given parameter, attribute, or condition that would be understood by one of ordinary skill in the art to be acceptable such as, for example, within acceptable manufacturing tolerances. By way of example, depending on the particular parameter, attribute, or condition that is substantially met, the parameter, attribute, or condition can be at least 90% met, at least 95% met, or even at least 99% met.

[0021] Some processing circuits (such as, but not limited to, microcontrollers) can include a built-in monitor circuit that is used to recover from faults that are not otherwise handled (such as, but not limited to, soft and / or hard faults, stack pointer faults, or unexpected program flow). Safety critical systems can experience and account for multiple point faults. One non-limiting example of a potential multiple point fault can be a critical fault that typically uses a reset controller to recover from the monitor circuit to reset the system combined with a fault in the reset controller. The reset controller can include logic that collects various (e.g., all but not limited to) reset sources and generates a master or system reset. However, a fault in the reset controller itself can compromise the intended system reset even in the absence of a fault in the monitor circuit itself. In other words, while the monitor circuit can be configured to detect faults that are not handled by other mechanisms and cause the reset circuit to trigger a system reset, an additional fault in the reset controller itself can prevent the processing circuit from transitioning the I / O pins to a floating state or prevent the processing circuit from initiating a system reset.

[0022] The intended behavior of a typical monitor circuit if a critical fault occurs is to reset the microcontroller (such as, but not limited to, via the reset controller), which also causes the I / O pins (such as, but not limited to, all of the I / O pins) to float. Causing the I / O pins to float is considered a safe state in safety critical systems because it is the normal condition until the microcontroller has initiated. While the monitor circuit and the windowed monitor circuit trigger the reset controller (such as, but not limited to, internal to the processing circuit) for initiating a system reset, a fault in the reset controller itself can prevent triggering the safe state and can even prevent the system reset. As a non-limiting example, a fault in the reset controller can prevent the microcontroller from being placed in the safe state even if the monitor circuit detects the fault.

[0023] As used herein, the term "windowed watchdog circuit" refers to a watchdog circuit that triggers in both cases where the watchdog circuit timer overflows before it is cleared, or where the watchdog circuit timer is cleared at an earlier time than expected. In other words, if the watchdog circuit timer is cleared in a manner other than normal operation, including late or early watchdog circuit timer clear, the windowed watchdog circuit triggers a system reset.

[0024] Another non-limiting example of a potential multi-point failure can be a combination of a failure that normally uses the watchdog circuit to recover from the monitor circuit to interrupt the operation of the processing circuit (e.g., but not limited to, the operation of the central processing unit of the processing circuit) with a failure in the interrupt controller. However, even if the watchdog circuit itself is not faulty, a failure in the interrupt controller itself can compromise the intended interruption. In other words, although the watchdog circuit is configured to detect the failure and cause the interrupt circuit to trigger the interruption, an additional failure in the interrupt controller itself can prevent the interruption from occurring. Additionally, in some cases, the interruption of the interrupt controller itself can be disabled, or the MCU can be unable to service the interruption received from the interrupt controller, which can compromise the intended interruption even if the watchdog circuit itself is not faulty.

[0025] The embodiments disclosed herein include a timing circuit (e.g., but not limited to, a watchdog circuit) that is configured to independently trigger an electrical float (e.g., but not limited to, set to a safe state) of an I / O pin, a system reset, or a combination thereof without intervention from a reset circuit, a central processing unit (CPU), or an interrupt controller. Furthermore, the embodiments disclosed herein include a timing circuit that is configured to independently trigger a non-maskable interrupt (NMI) without intervention from a reset circuit, and independent of the state and configuration of the interrupt controller. As a non-limiting example, the timing circuit disclosed herein can trigger an electrical float of an I / O pin while the CPU is executing a main control loop without interrupting the CPU. As another non-limiting example, the timing circuit disclosed herein can trigger an electrical float of an I / O pin while the CPU is operating in a low power mode, as the timing circuit disclosed herein has sufficient circuitry (e.g., but not limited to, logic, memory) to trigger an electrical float of an I / O pin - here without waking up the CPU. As another non-limiting example, there can be a direct bus connection (e.g., but not limited to, a peripheral bus, or an event system using a peripheral bus) between the timing circuit disclosed herein and the I / O circuitry and / or the interrupt circuitry, which can be used to communicate signals without interrupting the operation of the CPU.

[0026] Embodiments disclosed herein can cause an unmaskable high-priority interrupt and float all I / O pins independent of an interrupt controller. The NMI can enable software (e.g., but not limited to, executed by a CPU or other processing core) to determine whether the I / O pins are properly floated. In some embodiments, a verification of proper operation of the monitor circuit under normal conditions can be performed. In the event of a fault, the NMI can not be assumed to operate properly (e.g., but not limited to, in the event that the CPU fault triggered the monitor circuit), so long as the I / O pins have been previously verified to be electrically floated.

[0027] A timing circuit (e.g., monitor circuit) configured to independently trigger an electrical float of an I / O pin, an NMI, a system reset, or a combination thereof can increase the safety of a safety-critical system. As a non-limiting example, if an intermediary component configured to perform one or more of a float of an I / O pin, an NMI, and a system reset experiences a fault, the timing circuit can still perform the float of the I / O pin, the NMI, or the system reset even in the presence of such a fault. In other words, embodiments disclosed herein can provide redundancy in triggering a float of an I / O pin, an NMI, and a system reset, thereby reducing the likelihood that the triggering of these safety features is unavailable to the integrated circuit device. Unsafe operation of the safety-critical system resulting from unmitigated faults in the operation of the integrated circuit device can be avoided. Additionally or alternatively, embodiments disclosed herein can reduce or eliminate critical double fault conditions (e.g., a fault of a reset circuit or an interrupt circuit in addition to another fault detected by the monitor circuit). The NMI can not be disabled and has a higher priority than other interrupts. Thus, the NMI will not be blocked and the interrupt circuit is required to service the NMI. In embodiments disclosed herein, the system will reach a safe state through the timing circuit even if the interrupt controller, reset controller, and / or CPU fail.

[0028] In some embodiments, a timing circuit (e.g., but not limited to, a monitor circuit) can be integrated within the integrated circuit device. In such embodiments, the need for an external (e.g., but not limited to, redundant) monitor circuit can be eliminated, thereby reducing system cost and enabling a more compact design. In some embodiments, the timing circuit can be implemented external to the integrated circuit device.

[0029] Additionally, embodiments of the present disclosure can increase testability and / or observability of functionality of an integrated circuit device. As a non-limiting example, embodiments of the present disclosure can enable a CPU of an integrated circuit device to read a count register (e.g., but not limited to, a timer circuit), set the count register to a predetermined state configured to quickly trigger an overflow event (e.g., but not limited to, for testing), pull a low reset pin to externally signal that a reset has occurred, and enable always-enabled functionality (e.g., but not limited to, through a fuse / config bit).

[0030] As used herein, the term “processing circuitry” refers to an integrated circuit device that includes electrically programmable logic. Examples of “processing circuitry” include, but are not limited to, a microcontroller, a programmable logic controller (PLC), a computer processing core, a field programmable gate array (FPGA), other circuitry configured to execute computer-readable instructions (e.g., software, firmware) or logic (e.g., hardware description language code), or a combination thereof.

[0031] As used herein, the term “pin” refers to an electrically conductive structure that electrically connects circuitry inside an integrated circuit device package (directly or via one or more intermediate devices (i.e., indirectly)) to circuitry outside the integrated circuit device package. Thus, a first end of a pin can be inside the integrated circuit device package and a second end of the pin can be outside the integrated circuit device package. A pin of an integrated circuit device can be operably coupled to a pad of a printed circuit board (PCB), which can include a trace electrically connected to the pad to enable connection of circuitry inside the integrated circuit device package to electrically interact with other components or devices electrically connected to the PCB through the pin, the pad, and the trace.

[0032] Figure 1is a block diagram of an electrical system 100 according to some embodiments. The electrical system 100 includes an integrated circuit device (such as, but not limited to, integrated circuit device 126 or integrated circuit device 114) and an external device 110 operably coupled to the integrated circuit device 114 or 126. In some embodiments, the integrated circuit device 114 or 126 can be implemented as a processing circuit, such as but not limited to, a microcontroller. The integrated circuit device 114 or 126 includes a main circuit 112, a reset circuit 104, an I / O circuit 106, an interrupt circuit 130, and pins 108. In the case of the integrated circuit device 126, the integrated circuit device 126 also includes a timer circuit 102. In the case of the integrated circuit device 114, the timer circuit 102 is external to the integrated circuit device 114 (such as, but not limited to, an external watchdog circuit), and the timer circuit 102 is configured to interact with the integrated circuit device 114 via the pins 108 (such as, but not limited to, a safety pin 138 configured to receive a safety signal 124 from the timer circuit 102, an interrupt pin 140 configured to receive an NMI signal 122 from the timer circuit 102, a reset pin 142 configured to receive a reset signal 128 from the timer circuit 102, one or more fault pins 146 configured to receive fault signals 134, 136 from the timer circuit 102, and a system reset pin configured to provide a system reset signal to the timer circuit 102). In other words, the electrical system 100 can include, according to different embodiments, the integrated circuit device 114 operably coupled to a timer circuit 102 external to the integrated circuit device 114 (indicated using dashed lines) or the integrated circuit device 126 including the timer circuit 102 within the package of the integrated circuit device 126 (indicated using dashed lines). The integrated circuit device 114 or 126 is configured to interact with the external device 110 using input / output signals (I / O signals 118) via one or more I / O pins 144 of the pins 108.

[0033] In some embodiments, the electrical system 100 can be a safety-critical system. As used herein, the term "safety-critical system" or "safety system" refers to a system that can cause damage to people, equipment, and / or the environment in response to a failure of the safety-critical system. Thus, the external device 110 can include, but is not limited to, a device associated with medical treatment, weaponry, nuclear energy, transportation, safety equipment, or other safety-critical systems.

[0034] In safety systems, safety features are implemented that are intended to monitor and act on system states to operate in a safe manner. A fault in this context can be when a safety feature fails, which can result in a hazard to a user. In such a case, the fault can be detected and the system can be placed into a safe state to avoid the hazard. This mechanism ensures that even if a safety feature fails, the fault does not result in a hazard. This is also referred to as “functional safety” (i.e., safety is a function). An integrated circuit device (such as, but not limited to, integrated circuit device 114, integrated circuit device 126) is configured to perform various safety functions that are configured to mitigate or detect operational faults of the integrated circuit device 114 or 126 and respond to them safely. By way of example, the reset circuit 104 is configured to generate a system reset signal 120 (such as, but not limited to, in response to a first fault signal 134 generated by the timer circuit 102 and transmitted to the reset circuit 104 by the timer circuit 102) and transmit the system reset signal 120 to various other portions of the integrated circuit device to initiate a system reset of the integrated circuit device 114 or 126. By way of non-limiting example, the system reset signal 120 can include a command to initiate a system reset, information indicative of a condition of the integrated circuit device that requires a system reset to be triggered or some other signal configured to trigger a system reset. By way of non-limiting example, the reset circuit 104 can be configured to transmit the system reset signal 120 to the timer circuit 102, the I / O circuit 106, the interrupt circuit 130, and the main circuit 112. In response to the system reset signal 120, the I / O circuit 106 can be configured to control the I / O pin 144 to operate in an electrically floating state, i.e., the I / O circuit 106 can control the I / O pin 144 to set its state to an electrically floating state. When the I / O pin 144 is in the electrically floating state, the integrated circuit device is in a safe state, which is safe within a safety critical system.

[0035] In some cases, an additional fault of the reset circuit 104 itself can prevent a proper system reset from occurring. In such cases, the timer circuit 102 can determine that a previous first fault signal 134 should have triggered the reset circuit 104 to trigger a system reset, but the system reset did not occur. In such cases, the timer circuit 102 can generate and transmit a reset signal 128 that is configured to trigger a system reset independent of the reset circuit 104. By way of example, the timer circuit 102 can be configured to transmit the reset signal 128 to the reset circuit 104, the I / O circuit 106, the interrupt circuit 130, and the main circuit 112 to initiate a system reset. Thus, even in the case of an additional fault preventing the reset circuit 104 from triggering a system reset, i.e., the reset circuit 104 from enforcing the system reset signal 120, the timer circuit 102 itself can trigger a system reset independent of the reset circuit 104 by enforcing the reset signal 128.

[0036] Another security function of the integrated circuit device 114 or 126 is configured to perform an interruption of the operation of the main circuit 112. In some embodiments, the main circuit 112 includes one or more processing cores, such as a central processing unit (CPU). The interruption circuit 130 can be configured to generate an interruption 132 and transmit the interruption 132 to the main circuit 112 to interrupt the operation of the main circuit 112. As a non-limiting example, the interruption circuit 130 can be configured to generate the interruption 132 in response to the second fault signal 136 received from the timer circuit 102. The main circuit 112 can be configured to attempt to mitigate or eliminate the fault of the integrated circuit device 114 or 126 in response to the interruption 132.

[0037] In some cases, an additional fault of the interruption circuit 130 itself can prevent the interruption of the main circuit 112 from occurring (e.g., failing to provide the interruption 132 to the main circuit 112). In such cases, the timer circuit 102 can determine that the previous second fault signal 136 should have triggered the interruption circuit 130 to generate the interruption 132 in order to interrupt the main circuit 112, but the interruption 132 did not occur. As a non-limiting example, the interruption circuit 130 can be operating in a state or configuration that disables all or individual interruptions (e.g., due to proper operation of the interruption circuit 130 or due to an additional fault of the interruption circuit 130). Likewise, as a non-limiting example, the interruption circuit 130 can be busy processing another interruption (e.g., due to proper operation of the interruption circuit or due to an additional fault in the interruption circuit 130) that prevents the interruption circuit 130 from servicing the second fault signal 136 that should have triggered the interruption 132 in response to the second fault signal. In such cases, the timer circuit 102 can generate and transmit a non-maskable interruption signal (NMI signal 122) to the interruption circuit 130 to initiate an interruption independent of the state and configuration of the interruption circuit 130. Thus, even in cases where an additional fault prevents the interruption circuit 130 from triggering the interruption 132, the timer circuit 102 itself can trigger the interruption of the main circuit 112 by the interruption circuit 130 by generating and transmitting the NMI signal 122 to the interruption circuit 130. Regardless of whether the interruption is disabled, the NMI signal 122 can trigger the interruption circuit 130 to provide the interruption 132, and the interruption circuit 130 is configured to process the NMI signal 122 with a higher priority than other interruptions, which enables the interruption circuit 130 to provide the interruption 132 even in cases where the interruption circuit 130 is already servicing another interruption. Thus, the interruption circuit 130 can be configured to provide the interruption 132 in response to the NMI signal 122 regardless of the state and configuration of the interruption circuit 130.

[0038] Another safety feature of the electrical system 100 includes the ability of the timer circuit 102 to independently trigger the I / O pin 144 to operate in an electrically floating state. For example, the timer circuit 102 can be configured to generate a safety signal 124 and transmit the safety signal 124 to the I / O circuit 106. The safety signal 124 is configured to trigger the I / O circuit 106 to control the I / O pin 144 to operate in an electrically floating state. As a non-limiting example, the I / O circuit 106 can be configured to generate a pin control signal 116 that is configured to control an isolation circuit of the I / O pin 144. In some embodiments, such an isolation circuit of the I / O pin 144 can include a drive circuit configured to drive input and output signals at the I / O pin 144, and the pin control signal 116 can be configured to deactivate the drive circuit, thereby electrically isolating the I / O pin 144 from the rest of the circuit of the integrated circuit device 114 or 126.

[0039] Figure 2 is a block diagram of a processing circuit 200 according to some embodiments. The processing circuit 200 is an example of the integrated circuit device 126 of Figure 1 includes a timer circuit 204 similar to the timer circuit 102 integrated within the processing circuit 200 of Figure 1 The processing circuit 200 includes an I / O pin similar to the I / O pin 144 of Figure 1 Although not shown in Figure 2 the timer circuit 204 can include a monitor circuit. Figure 1

[0040] ​The processing circuit 200 also includes a CPU 202, a reset circuit 206, an interrupt circuit 208, an I / O circuit 210, and a data bus 224 operably coupled to the CPU 202 and the I / O circuit 210. The timer circuit 204 includes a count register 212, a control register 214, and a status register 216, each of which is operably coupled to the CPU 202 by the data bus 224, thereby operably coupling the timer circuit 204 to the data bus 224. In response to the timer circuit 204 detecting a fault, the timer circuit 204 can be configured to generate a fault signal (e.g., a first fault signal 220 in response to a fault causing a system reset, or a second fault signal 222 in response to a fault causing an interrupt of, for example, the CPU 202). As a non-limiting example, the fault can be detected by monitoring the count register 212, the threshold values of which can be controlled by the CPU 202 via the control register 214. The count register 212 can be configured to increment during the execution of a task (e.g., by the CPU 202) until the count register 212 is stopped (e.g., via the control register 214) upon completion of the task. If the value of the count register 212 upon completion of the task is outside of a predetermined range of values defined by one or more threshold values, the timer circuit 204 can determine that a fault has occurred. It should be noted that the timer circuit 204 can alternatively be implemented without the count register 212. As a non-limiting example, the timer circuit can be implemented with an analog timeout, such as an RC circuit.

[0041] In the event that the timer circuit 204 determines that the detected fault causes a system reset to repair the fault (e.g., a critical fault), the timer circuit 204 can generate the first fault signal 220 and transmit the first fault signal 220 to the reset circuit 206. As a non-limiting example, the detected fault that can cause a system reset can include an overflow of the count register 212 before the CPU clears the indication task is complete or the count register 212 is cleared at the appropriate time. The reset circuit 206 is configured to receive the first fault signal 220 and generate and transmit a system reset signal 218 in response to the first fault signal 220. The system reset signal 218 can be transmitted to the CPU 202, the timer circuit 204, the interrupt circuit 208, and the I / O circuit 210.

[0042] In the event that the reset circuit 206 does not operate correctly, the reset circuit 206 can fail to properly provide the system reset signal 218. In such cases, the timer circuit 204 can be configured to initiate a system reset independent of the reset circuit 206. For example, the timer circuit 204 can be configured to generate and provide a reset signal 230 to the CPU 202, the reset circuit 206, the interrupt circuit 208, and the I / O circuit 210 to trigger a system reset. The system reset can cause the I / O circuit 210 to transition the I / O pins of the processing circuit 200 to an electrically floating state.

[0043] In the event that the timer circuit 204 determines that the detected fault causes an interrupt of the CPU 202, the timer circuit 204 can generate and transmit a second fault signal 222 to the interrupt circuit 208. The interrupt circuit 208 can generate and transmit an interrupt 232 to the CPU 222 to interrupt the CPU in response to the second fault signal 222. The interrupt 232 of the CPU 202 can be a first part of a two-part sequence that includes the interrupt 232 of the CPU 202 followed by a system reset. By way of non-limiting example, the detected fault that can cause an interrupt of the CPU 202 and optionally a system reset can include an overflow of the count register 212 before the CPU 202 clears the count register 212 or before the appropriate time to clear the count register 212. The interrupt of the CPU 202 can cause the CPU 202 to signal the I / O circuit 210 to transition the I / O pins of the processing circuit 200 to an electrically floating state. It should be noted that the interrupt of the CPU 202 by the timer circuit 204 through the validation of the second fault signal 222 can be accomplished as a first response to an incorrect clearing of the timer circuit 204 to allow the CPU 202 to gracefully shut down the system in preparation for the subsequent system reset (e.g., but not limited to, to save system state, make an error log entry, communicate the fault to other parts of the system). The system reset initiated by the timer circuit 204 can subsequently be the second part of the two-part sequence after the timer circuit 204 interrupts the CPU 202 through the interrupt circuit 208. Thus, by way of non-limiting example, the two sequences of operations can first include an interrupt by the timer circuit 204 (and the floating of the I / O pins) through the second fault signal 222 and the interrupt circuit 208 followed by a system reset by the timer circuit 204 through the first fault signal 220 and the reset circuit 206. The interrupt circuit 208 is configured to receive the second fault signal 222 and generate and transmit the interrupt 232 to the CPU 202 to interrupt the operation of the CPU 202.

[0044] In the event that the interrupt circuit 208 is not functioning properly, the interrupt circuit 208 can be unable to provide an interrupt to the CPU 202. In such cases, the timer circuit 204 can be configured to initiate an interrupt independent of the state and configuration of the interrupt circuit 208. For example, the timer circuit 204 can be configured to generate an NMI signal 228 and provide the NMI signal 228 to the interrupt circuit 208, which in turn can provide an interrupt 232 to the CPU 202 in response to the NMI signal 228.

[0045] In the event that the timer circuit 204 determines that a transition of an I / O pin of the processing circuit 200 enters an electrically floating state, the timer circuit 204 can generate a safety signal 226 similar to the safety signal 124 of Figure 1 and transmit the safety signal 226 to the I / O circuit 210. As a non-limiting example, a detected fault that can cause a transition of an I / O pin of the processing circuit 200 to enter an electrically floating state can include an overflow of the count register 212 before the CPU clears the count register or before the appropriate clear count register 212. The I / O circuit 210 is configured to receive the safety signal 226 and transition the I / O pin to an electrically floating state. In this way, the timer circuit 204 is configured to initiate the I / O circuit 210 to transition the I / O pin to an electrically floating state independent of the CPU 202 and the reset circuit 206.

[0046] Figure 3 is a flowchart illustrating a method 300 of operating an integrated circuit device, in accordance with some embodiments. At operation 302, the method 300 includes comparing a value indicated by a count register of a timer circuit (e.g., the count register 212 of the timer circuit 204 of Figure 1 or the timer circuit 102 of Figure 2 ) to one or more thresholds. As a non-limiting example, the count register can be configured to increment during the performance of a task until the count register is stopped after the completion of the task. If the completion value of the count register falls outside of a range defined by the one or more thresholds after the completion of the task, a fault can be determined to have occurred.

[0047] In some cases, a timer circuit can determine when an I / O pin of an integrated circuit device transitions into an electrically floating state. In such cases, at operation 304, method 300 includes, in response to detecting that a value indicated by a counter register exceeds one or more predetermined ranges defined by one or more thresholds, the timer circuit sends a safety signal to the input / output (I / O) circuitry. The sending of the safety signal is independent of the reset circuitry and the central processing unit (CPU) of the integrated circuit device. At operation 314, method 300 includes, in response to the safety signal, operating the I / O pins of the integrated circuit device in an electrically floating state. Therefore, regardless of whether the reset circuitry and / or the I / O circuitry experiences a fault, the I / O circuitry can still receive the safety signal from the timer circuitry and operate the I / O pins in the electrically floating state.

[0048] In some cases, the timer circuit can determine that a fault causes an interruption of CPU operation. In such cases, at operation 306, method 300 includes the timer circuit issuing an unmaskable interrupt (NMI) signal to an interrupt circuit that serves the NMI signal independently of the state and configuration of the interrupt circuit of the integrated circuit device. In such cases, method 300 also includes, at operation 308, interrupting CPU operation in response to the NMI signal. In response to an interruption of CPU operation, at operation 314, method 300 includes operating the I / O pins of the integrated circuit device in an electrically floating state. Returning to operation 306, if it is determined that the fault also causes a system reset (e.g., as a second part of a two-part sequence including a CPU interrupt and a system reset), then at operation 310, method 300 includes the timer circuit issuing a signal configured to operate independently of the reset circuit (e.g., ...). Figure 1 The reset circuit 104 and Figure 2 The reset circuit 206) triggers a system reset signal for the integrated circuit device (e.g., Figure 1 Reset signal 128 or Figure 2 (Reset signal 230). In this case, in operation 312, method 300 includes resetting the integrated circuit device in response to the reset signal. In response to a system reset, at operation 314, method 300 includes operating the I / O pins of the integrated circuit device in an electrically floating state.

[0049] Returning to operation 302, in some cases, the timer circuit can determine that a fault caused a system reset. At operation 310, method 300 includes the timer circuit being configured to emit independently of the reset circuit (e.g., ...). Figure 1 The reset circuit 104 and Figure 2 The reset circuit 206) triggers a system reset signal for the integrated circuit device (e.g., Figure 1 Reset signal 128 or Figure 2the reset signal 230). In such cases, at operation 312, the method 300 includes resetting the integrated circuit device in response to the reset signal. In response to the system reset, at operation 314, the method 300 includes operating the I / O pins of the integrated circuit device in an electrically floating state.

[0050] The I / O pins can enter the electrically floating state (i.e., the safe state) in response to any one or more of the operation 304 (transmitting the safety signal), the operation 308 (interrupting operation of the CPU in response to the NMI signal), and the operation 312 (performing a system reset of the integrated circuit device in response to the reset signal), which can be triggered independently of one another. Thus, even if one or both of these operations fail, the system can be brought to the safe state via the remaining one or both of these operations.

[0051] Figure 4 is a flowchart illustrating a method 400 of operating a timer circuit (e.g., Figure 1 the timer circuit 102 or the timer circuit 204) in accordance with some embodiments. At operation 402, the method 400 includes detecting a failure in operation of the integrated circuit device. As non-limiting examples, the failure in operation of the integrated circuit device can include a soft failure, a hard failure, a stack pointer failure, a timer clear too late or too early, other failure, or a combination thereof. Also as non-limiting examples, the failure can be a failure in a reset controller (e.g., Figure 1 the reset circuit 104 or Figure 2 the reset circuit 206) of the integrated circuit device. The detected failure can result in any one or more of various remedial measures taken by the timer circuit, as will be discussed below.

[0052] In some cases, the failure can result in floating of I / O pins of the integrated circuit device. In such cases at operation 404, the method 400 includes causing a safety signal (e.g., Figure 1 the safety signal 124 or Figure 2 the safety signal 226) of an input / output (I / O) circuit (e.g., Figure 1 the I / O circuit 106 or Figure 2 the I / O circuit 210) of the integrated circuit device to take effect in response to detecting the failure to operate the I / O pins of the integrated circuit device in an electrically floating state independent of a central processing unit (CPU) and a reset circuit of the integrated circuit device. As non-limiting examples, the safety signal can be configured to trigger the I / O circuit to generate a pin control signal (e.g., Figure 1 the pin control signal 116) of an isolation circuit configured to control the I / O pins.

[0053] Returning to operation 402, in some cases, a detected fault may cause an interruption of the integrated circuit device. In such a case at operation 406, method 400 includes setting an NMI signal configured to be independent of the state of the interrupt circuitry of the integrated circuit device and configuring it to trigger an interruption of the integrated circuit device (e.g., Figure 1 NMI signal 122 or Figure 2 The NMI signal 228 is activated. As a non-limiting example, the NMI signal can be activated by a timer circuit, which may be included in or external to the integrated circuit device. Also as a non-limiting example, the NMI signal can be provided to an interrupt circuit, which in turn can provide an interrupt to the main circuitry, such as the processing core of a microcontroller (e.g., the CPU). In some cases where a detected fault causes an interrupt, the detected fault may also cause a system reset as part of a two-part sequence involving interruption and reset. In such cases, at operation 408, method 400 includes causing a reset signal (e.g., ) configured to trigger a system reset of the integrated circuit device independently of a reset circuit of the integrated circuit device. Figure 1 Reset signal 128 or Figure 2 The reset signal 230) takes effect.

[0054] Returning to operation 402, in some cases, a detected fault may cause a system reset. At operation 408, method 400 includes a reset signal (e.g., [missing information]) that causes a system reset of the integrated circuit device to be triggered independently of the reset circuitry of the integrated circuit device. Figure 1 Reset signal 128 or Figure 2 The reset signal 230) takes effect. As a non-limiting example, the reset signal may trigger one or more of the main circuitry (e.g., processing core), interrupt circuitry, and I / O circuitry of the integrated circuit device to trigger a system reset. Also as a non-limiting example, a timer circuit may be configured to enable the reset signal.

[0055] Those skilled in the art will understand that the functional elements (e.g., functions, operations, actions, processes, and / or methods) of the embodiments disclosed herein can be implemented in any suitable hardware, software, firmware, or a combination thereof. Figure 5 The examples shown are non-limiting embodiments of the functional elements disclosed herein. In some embodiments, some or all portions of the functional elements disclosed herein may be executed by hardware specifically configured to perform these functional elements.

[0056] Figure 5is a block diagram of a circuit 500 that can be used to implement various functions, operations, actions, processes and / or methods disclosed herein, in some embodiments. The circuit 500 includes one or more processors 502 (sometimes referred to herein as “processors 502”) that are operably coupled to one or more data storage devices (sometimes referred to herein as “storage devices 504”). The storage devices 504 include machine executable code 506 stored thereon, and the processors 502 include logic circuits 508. The machine executable code 506 includes information describing functional elements that can be implemented by the logic circuits 508 (e.g., performed by the logic circuits). The logic circuits 508 are adapted to implement (e.g., perform) the functional elements described by the machine executable code 506. When performing the functional elements described by the machine executable code 506, the circuit 500 should be considered a special purpose hardware configured to perform the functional elements disclosed herein. In some embodiments, the processors 502 can be configured to perform the functional elements described by the machine executable code 506 in sequence, simultaneously (e.g., on one or more different hardware platforms), or in one or more parallel process streams.

[0057] When implemented by the logic circuits 508 of the processors 502, the machine executable code 506 is configured to adjust the processors 502 to perform operations of the embodiments disclosed herein. For example, the machine executable code 506 can be configured to adjust the processors 502 to perform at least a portion or all of the method 300 and Figure 3 the method 400 of FIG. 4. As another example, the machine executable code 506 can be configured to adjust the processors 502 to perform at least a portion or all of the operations discussed with respect to the main circuit 112 of Figure 4 FIG. 3 (e.g., the main circuit 112 can be implemented at least in part by the processors 502). As another example, the machine executable code 506 can be configured to adjust the processors 502 to perform at least a portion or all of the operations discussed with respect to the CPU 202 of Figure 1 FIG. 2 (e.g., the CPU 202 can be implemented at least in part by the processors 502). Figure 2

[0058] ​The processor 502 can include a general-purpose processor, a special-purpose processor, a central processing unit (CPU), a microcontroller, a programmable logic controller (PLC), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, other programmable devices, or any combination thereof designed to perform the functions disclosed herein. A general-purpose computer including a processor is considered a special-purpose computer while the general-purpose computer is configured to perform functions corresponding to machine-executable code 506 (e.g., software code, firmware code, hardware code) that are associated with embodiments of the present disclosure. It should be noted that a general-purpose processor (which can also be referred to herein as a host processor or simply a host) can be a microprocessor, but in alternatives, the processor 502 can include any conventional processor, controller, microcontroller, or state machine. The processor 502 can also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.

[0059] In some embodiments, the storage device 504 includes a volatile data storage device (e.g., random access memory (RAM)), a non-volatile data storage device (e.g., flash memory, a hard disk drive, a solid-state drive, erasable programmable read-only memory (EPROM), etc.). In some embodiments, the processor 502 and the storage device 504 can be implemented as a single device (e.g., a semiconductor device product, a system on a chip (SOC), etc.). In some embodiments, the processor 502 and the storage device 504 can be implemented as separate devices.

[0060] In some embodiments, the machine-executable code 506 can include computer-readable instructions (e.g., software code, firmware code). As a non-limiting example, the computer-readable instructions can be stored by the storage device 504, accessed directly by the processor 502, and executed by the processor 502 using at least the logic circuitry 508. Also as a non-limiting example, the computer-readable instructions can be stored on the storage device 504, transferred to a memory device (not shown) for execution, and executed by the processor 502 using at least the logic circuitry 508. Thus, in some embodiments, the logic circuitry 508 includes logic circuitry 508 that is electrically configurable.

[0061] In some embodiments, the machine executable code 506 can describe hardware (e.g., circuitry) to be implemented in the logic circuit 508 to perform the functional elements. The hardware can be described at any of a variety of abstraction levels, from low-level transistor layouts to high-level description languages. At a high level of abstraction, a hardware description language (HDL) such as IEEE Standard Hardware Description Language (HDL) can be used. As a non-limiting example, Verilog TM , SystemVerilog TM , or Very Large Scale Integration (VLSI) Hardware Description Language (VHDL TM ) can be used.

[0062] HDL descriptions can be converted to descriptions at any of a variety of other abstraction levels as needed. As a non-limiting example, high-level descriptions can be converted to logic-level descriptions such as Register Transfer Language (RTL), gate-level (GL) descriptions, layout-level descriptions, or mask-level descriptions. As a non-limiting example, micro-operations performed by hardware logic circuitry (e.g., but not limited to, gates, flip-flops, registers) of the logic circuit 508 can be described in RTL and then converted to GL descriptions by a synthesis tool, and GL descriptions can be converted to layout-level descriptions by placement and routing tools that correspond to a physical layout of integrated circuits, discrete gate or transistor logic components, discrete hardware components, or combinations thereof of programmable logic devices. Thus, in some embodiments, the machine executable code 506 can include HDL, RTL, GL descriptions, mask-level descriptions, other hardware descriptions, or any combination thereof.

[0063] In embodiments in which the machine executable code 506 includes hardware descriptions (at any level of abstraction), a system (not shown, but including the storage 504) can be configured to implement the hardware descriptions described by the machine executable code 506. As a non-limiting example, the processor 502 can include a programmable logic device (e.g., FPGA or PLC), and the logic circuit 508 can be electrically controlled to implement circuitry corresponding to the hardware descriptions into the logic circuit 508. Also as a non-limiting example, the logic circuit 508 can include hardwired logic components manufactured according to the hardware descriptions of the machine executable code 506 by a manufacturing system (not shown, but including the storage 504).

[0064] Regardless of whether the machine executable code 506 includes computer-readable instructions or hardware descriptions, the logic circuit 508 is adapted to perform the functional elements described by the machine executable code 506 in implementing the functional elements of the machine executable code 506. Note that while hardware descriptions can not directly describe functional elements, the hardware descriptions indirectly describe functional elements that the hardware elements described by the hardware descriptions are capable of performing.

[0065] Examples

[0066] The following is a non-exhaustive, non-limiting list of example embodiments. Not every example embodiment listed below is expressly and clearly indicated as combinable with every other example embodiment listed below, as well as with all other embodiments described above. However, it is intended to be a combination of all example embodiments with all other example embodiments and embodiments described above, unless it is readily apparent to one of ordinary skill in the art that the embodiments are not combinable.

[0067] Example 1 : An electrical system comprising: a timer circuit; and an integrated circuit device comprising: an input / output (I / O) pin configured to conduct an I / O signal between an internal circuit of the integrated circuit device and a device external to the integrated circuit device; a reset circuit configured to emit a system reset signal in response to a fault signal received from the timer circuit, the system reset signal to trigger a system reset of the integrated circuit device; an I / O circuit operably coupled to the I / O pin, the I / O circuit configured to selectively operate the I / O pin in an electrically floating state in response to the system reset of the integrated circuit device, the I / O circuit further configured to selectively operate the I / O pin in the electrically floating state in response to a signal provided by the timer circuit independent of the reset circuit in response to the system reset of the integrated circuit device.

[0068] Example 2: The electrical system of Example 1, wherein the signal provided by the timer circuit comprises a safety signal.

[0069] Example 3: The electrical system of any one of Examples 1 and 2, wherein the integrated circuit device further comprises a central processing unit (CPU) and an interrupt circuit, the interrupt circuit configured to receive a non-maskable interrupt signal from the timer circuit, and the interrupt circuit configured to trigger an interrupt of the CPU in response to the received non-maskable interrupt signal independent of a state and configuration of the interrupt circuit.

[0070] Example 4: The electrical system of any one of Examples 1 to 3, wherein the integrated circuit device further comprises the timer circuit.

[0071] Example 5: The electrical system of any one of Examples 1 to 3, wherein the timer circuit is external to the integrated circuit device.

[0072] Example 6: The electrical system of Example 5, further comprising a safety pin operably coupled to the timer circuit, wherein the timer circuit is configured to provide a safety signal to the I / O circuit via the safety pin as the signal provided by the timer circuit.

[0073] Example 7: The electrical system of any one of Examples 5 and 6, further comprising an interrupt pin operably coupled to the timer circuit, wherein the timer circuit is configured to provide a non-maskable interrupt signal to an interrupt circuit of the integrated circuit device via the interrupt pin.

[0074] Example 8: The electrical system of any one of Examples 5 and 7, further comprising a reset pin operably coupled to the timer circuit, wherein the timer circuit is configured to provide a reset signal to the integrated circuit device via the reset pin as the signal provided by the timer circuit, the reset signal configured to trigger the system reset of the integrated circuit device independent of the system reset signal.

[0075] Example 9: A processing circuit, comprising: an input / output (I / O) pin configured to conduct an I / O signal between the processing circuit and a device external to the processing circuit; an I / O circuit configured to selectively operate the I / O pin in an electrically floating state; a reset circuit configured to emit a system reset signal configured to initiate a system reset of the processing circuit, the system reset signal further configured to trigger the I / O circuit to operate the I / O pin in the electrically floating state; and a timer circuit operably coupled to the I / O circuit, the timer circuit configured to emit a safety signal to the I / O circuit, the safety signal configured to trigger the I / O circuit to operate the I / O pin in the electrically floating state independent of the system reset signal.

[0076] Example 10: The processing circuit of Example 9, further comprising: a central processing unit (CPU) operably coupled to the timer circuit; and an interrupt circuit operably coupled to the timer circuit and to the CPU, wherein the timer circuit is further configured to emit a non-maskable interrupt signal to the interrupt circuit, the interrupt circuit configured to interrupt the CPU independent of a state and configuration of the interrupt circuit.

[0077] Embodiment 11 : The processing circuitry of any one of embodiments 9 and 10, further comprising an interrupt circuit and a central processing unit (CPU), each operably coupled to the timer circuit, wherein the timer circuit is further configured to transmit a reset signal to the CPU, the I / O circuit, and the interrupt circuit, wherein the reset signal is configured to trigger the system reset of the processing circuitry independent of the system reset signal of the reset circuit.

[0078] Embodiment 12: The processing circuitry of any one of embodiments 9-11, wherein the timer circuit is further configured to transmit a fault signal to the reset circuit in response to detecting a fault of the processing circuitry.

[0079] Embodiment 13: A method of operating an integrated circuit device, the method comprising: comparing a value indicated by a count register of a timer circuit to one or more threshold values; in response to detecting that the value indicated by the count register is outside one or more predetermined ranges of values defined by the one or more threshold values, the timer circuit transmitting a safety signal to an input / output (I / O) circuit, the transmission of the safety signal being independent of a reset circuit and a central processing unit (CPU) of the integrated circuit device; and in response to the safety signal, operating an I / O pin of the integrated circuit device in an electrically floating state.

[0080] Embodiment 14: The method of embodiment 13, further comprising in response to a determination that the detected fault causes an interruption of operation of the CPU, transmitting, by the timer circuit, a non-maskable interrupt signal to an interrupt circuit of the integrated circuit device.

[0081] Embodiment 15: The method of embodiment 14, further comprising: transmitting, by the timer circuit, a reset signal configured to trigger a system reset of the integrated circuit device independent of the reset circuit in response to a determination that the detected fault causes the system reset.

[0082] Embodiment 16: The method of embodiment 15, wherein the non-maskable interrupt signal is transmitted prior to transmitting the reset signal.

[0083] Example 17: A method of operating a timer circuit, the method comprising: detecting an operational fault of an integrated circuit device; responsive to determining that the detected fault causes a floating of an I / O pin, asserting a safety signal configured to trigger an input / output (I / O) circuit of the integrated circuit device to operate an I / O pin of the integrated circuit device in an electrically floating state independent of a central processing unit (CPU) and a reset circuit of the integrated circuit device; responsive to determining that the detected fault causes an interrupt of the integrated circuit device, asserting a non-maskable interrupt signal configured to trigger an interrupt of the integrated circuit device independent of a state and configuration of an interrupt circuit of the integrated circuit device; and responsive to determining that the detected fault causes a system reset, asserting a reset signal configured to trigger a system reset of the integrated circuit device independent of the reset circuit of the integrated circuit device.

[0084] Example 18: The method of example 17, wherein the timer circuit is external to the integrated circuit device.

[0085] Example 19: The method of example 17, wherein the integrated circuit device comprises the timer circuit.

[0086] Example 20: An electrical system comprising: an integrated circuit device comprising: a pin configured to conduct an input / output (I / O) signal between an internal circuit of the integrated circuit device and a device external to the integrated circuit device; a reset circuit configured to emit a system reset signal in response to a fault signal received from the timer circuit, the system reset signal configured to trigger a system reset of the integrated circuit device; an I / O circuit operably coupled to the pin, the I / O circuit configured to selectively operate the pin in response to the system reset signal emitted by the reset circuit, the I / O circuit further configured to selectively operate the pin in the electrically floating state in response to a safety signal received from the timer circuit independent of the system reset signal, the reset circuit, and a central processing unit (CPU) of the integrated circuit device.

[0087] Example 21 : The processing circuit of example 20, wherein the integrated circuit device is implemented as a microcontroller.

[0088] Example 22: The processing circuit of any one of examples 20 and 21, wherein the CPU is configured to receive a non-maskable interrupt signal from the timer circuit, the non-maskable interrupt signal configured to trigger a non-maskable interrupt of the CPU independent of an interrupt circuit of the integrated circuit device.

[0089] Embodiment 23: The processing circuit of any one of embodiments 20-22, wherein the integrated circuit device further comprises the timer circuit.

[0090] Embodiment 24: The processing circuit of any one of embodiments 20-22, further comprising the timer circuit, wherein the timer circuit is external to the integrated circuit device.

[0091] Embodiment 25: The processing circuit of embodiment 24, wherein the pin comprises a safety pin operably coupled to the timer circuit, wherein the timer circuit is configured to provide the safety signal to the I / O circuit via the safety pin.

[0092] Embodiment 26: The processing circuit of any one of embodiments 24 and 25, wherein the pin comprises an interrupt pin operably coupled to the timer circuit, wherein the timer circuit is configured to provide an unmaskable interrupt signal to the CPU via the interrupt pin independent of an interrupt circuit of the integrated circuit device.

[0093] Embodiment 27: The processing circuit of any one of embodiments 24-26, wherein the pin comprises a reset pin operably coupled to the timer circuit, wherein the timer circuit is configured to provide a reset signal to the integrated circuit device via the reset pin, the reset signal configured to trigger a system reset of the integrated circuit device.

[0094] Embodiment 28: A processing circuit comprising: a pin configured to conduct an input / output (I / O) signal between the processing circuit and a device external to the processing circuit; an I / O circuit configured to selectively operate the pin in an electrically floating state; a reset circuit configured to emit a system reset signal, the system reset signal configured to initiate a system reset of the processing circuit, the system reset signal further configured to trigger the I / O circuit to operate the pin in the electrically floating state; and a monitor circuit operably coupled to the I / O circuit, the monitor circuit configured to emit a safety signal to the I / O circuit, the safety signal configured to trigger the I / O circuit to operate the pin in the electrically floating state independent of the reset circuit and the system reset signal.

[0095] Embodiment 29: The processing circuit of embodiment 28, further comprising a central processing unit (CPU) operably coupled to the monitor circuit, wherein: the monitor circuit is further configured to emit an unmaskable interrupt signal to the CPU independent of an interrupt circuit of the processing circuit; and the interrupt circuit is configured to initiate an unmaskable interrupt of the CPU in response to the unmaskable interrupt signal received from the monitor circuit.

[0096] Embodiment 30: The processing circuitry of any of embodiments 28 and 29, further comprising a central processing unit (CPU) operably coupled to the monitor circuitry, wherein the monitor circuitry is further configured to transmit a reset signal to the CPU, the I / O circuitry, and an interrupt circuitry, wherein the reset signal is configured to trigger the system reset independently of the system reset signal, the reset circuitry, and the CPU.

[0097] Embodiment 31 : The processing circuitry of any of embodiments 28 to 30, wherein the monitor circuitry is further configured to transmit a fault signal to the reset circuitry in response to detecting a fault of the processing circuitry.

[0098] Embodiment 32: The processing circuitry of any of embodiments 28 to 31, wherein the processing circuitry is implemented as a microcontroller.

[0099] Embodiment 33: A method of operating an input / output device, the method comprising: comparing a value indicated by a count register of a timer circuitry to one or more threshold values; in response to detecting that the value indicated by the count register is outside one or more predetermined ranges of values defined by the one or more threshold values, the timer circuitry transmitting a safety signal of an input / output (I / O) circuitry to an input / output (I / O) circuitry, the transmission of the safety signal being independent of a reset circuitry and a central processing unit (CPU) of the integrated circuit device; and operating a pin of the integrated circuit device in an electrically floating state in response to the safety signal.

[0100] Embodiment 34: The method of embodiment 33, further comprising transmitting, by the timer circuitry, a non-maskable interrupt signal to the CPU independent of an interrupt circuitry of the integrated circuit device.

[0101] Embodiment 35: The method of embodiment 34, further comprising transmitting, by the timer circuitry, a reset signal configured to trigger a system reset of the integrated circuit device independent of the reset circuitry.

[0102] Embodiment 36: The method of embodiment 35, wherein the non-maskable interrupt signal is transmitted prior to the reset signal to enable the CPU to confirm that the pin is operated in the electrically floating state.

[0103] Embodiment 37: The method of embodiment 35, wherein the non-maskable interrupt signal is transmitted prior to the reset signal to enable the CPU to control the I / O circuitry to operate the pin in the electrically floating state in case the pin is not operated in the electrically floating state.

[0104] Example 38: A method of operating a timer circuit, the method comprising: detecting an operational failure of an integrated circuit device; in response to detecting the failure, asserting a safety signal configured to trigger an input / output (I / O) circuit of the integrated circuit device to operate a pin of the integrated circuit device in an electrically floating state independent of a central processing unit (CPU) and a reset circuit of the integrated circuit device; asserting a non-maskable interrupt signal configured to trigger an interrupt of the integrated circuit device independent of an interrupt circuit of the integrated circuit device; and asserting a reset signal configured to trigger a system reset of the integrated circuit device independent of the reset circuit of the integrated circuit device.

[0105] Conclusions

[0106] As used in the present disclosure, the term “module” or “component” can refer to a specific hardware implementation configured to perform the actions of a module or component and / or software object or software routine that can be stored on and / or executed by general-purpose hardware (e.g., computer-readable media, processing devices, etc.) of a computing system. In some embodiments, the different components, modules, engines, and services described in the present disclosure can be implemented as objects or processes executing on the computing system (e.g., as separate threads). While some of the systems and methods described in the present disclosure are generally described as being implemented in software (stored on and / or executed by general-purpose hardware), specific hardware implementations or combinations of software and specific hardware implementations are also possible and contemplated.

[0107] As used in the present disclosure, the term “combination” in reference to a plurality of elements can include any one of a combination of all of the elements or any one of a variety of different subcombinations of some of the elements. For example, the phrase “A, B, C, D, or a combination thereof’ can refer to any one of A, B, C, or D; a combination of each of A, B, C, and D; and any subcombination of A, B, C, or D, such as A, B, and C; A, B, and D; A, C, and D; B, C, and D; A and B; A and C; A and D; B and C; B and D; or C and D.

[0108] For the present disclosure, and in particular the appended claims, the terms (e.g., the body of the appended claims) are generally intended to be interpreted as “open” terms (e.g., the term “comprising” should be interpreted as “including but not limited to,” the term “having” should be interpreted as “having at least,” the term “including” should be interpreted as “including but not limited to,” etc.).

[0109] In addition, where a particular number of introduced claim recitations is intended, such intention will be explicitly recited in the claim, and otherwise the claim will be read as including either the particular integer recited or any integer dependencies. For example, a statement that a composition comprises "at least one of A and B" shall be construed to mean that the composition comprises solely A, solely B, or both A and B. Likewise, a statement that a composition comprises "at least one of A, B, and C" shall be construed to mean that the composition comprises solely A, solely B, solely C, or any combination of A, B, and C.

[0110] In addition, even if a specific number of introduced claim recitations is explicitly recited, one of ordinary skill in the art will recognize that such recitation should be interpreted to mean either the specific number of recitations or any number of recitations greater than or equal to the specific number. For example, a statement that a composition comprises "at least two of A, B, and C" shall be construed to mean that the composition comprises solely A, solely B, solely C, or any combination of A, B, and C.

[0111] In addition, any disjunctive word or phrase presenting two or more alternative terms shall be construed to include each of the terms individually, each of the terms in any combination, or any combination of the terms in any order. For example, the phrase "A or B" shall be construed to mean "A, B, or A and B."

[0112] While the application has been described herein with respect to certain illustrated embodiments, those of ordinary skill in the art will recognize and appreciate the meritorious aspects of the application are not limited to the illustrated embodiments. Rather, many additions, deletions and modifications to the illustrated embodiments, as well as other embodiments, can be made by those skilled in the art without departing from the scope of the application as set forth in the following claims and their equivalents thereof, and it is intended that such additions, deletions and modifications be within the scope of the application.

Claims

1. An electrical system comprising: a timer circuit; and an integrated circuit device, the integrated circuit device comprising an input / output (I / O) pin, a reset circuit, an I / O circuit, wherein the I / O pin is configured to conduct I / O signals between internal circuits of the integrated circuit device and devices external to the integrated circuit device; wherein the reset circuit is configured to emit a system reset signal in response to a fault signal received from the timer circuit, the system reset signal triggering a system reset of the integrated circuit device; wherein the I / O circuit is coupled to the I / O pin, the I / O circuit configured to selectively operate the I / O pin in an electrically floating state in response to the system reset of the integrated circuit device, the I / O circuit further configured to selectively operate the I / O pin in the electrically floating state in response to a safety signal provided by the timer circuit independent of the reset circuit, the safety signal being different from the fault signal.

2. The electrical system of claim 1, wherein the fault signal is provided in response to an overflow of a count register of the timer circuit.

3. The electrical system of claim 1, wherein the integrated circuit device further comprises a central processing unit (CPU) and an interrupt circuit, the interrupt circuit configured to receive a non-maskable interrupt signal from the timer circuit, and the interrupt circuit configured to trigger an interrupt of the CPU in response to the received non-maskable interrupt signal even if an interrupt of the interrupt circuit is disabled or the interrupt circuit has serviced another interrupt.

4. The electrical system of claim 1, wherein the timer circuit is external to the integrated circuit device.

5. The electrical system of claim 4, further comprising a safety pin coupled to the timer circuit, wherein the timer circuit is configured to provide the safety signal to the I / O circuit via the safety pin.

6. The electrical system of claim 4, further comprising an interrupt pin coupled to the timer circuit, wherein the timer circuit is configured to provide a non-maskable interrupt signal to an interrupt circuit of the integrated circuit device via the interrupt pin.

7. The electrical system of claim 4, further comprising a reset pin coupled to the timer circuit, wherein the timer circuit is configured to provide a reset signal to the integrated circuit device via the reset pin, the reset signal configured to trigger the system reset of the integrated circuit device independent of the system reset signal.

8. A processing circuit comprising: an input / output (I / O) pin, the I / O pin configured to conduct I / O signals between a processing circuit and devices external to the processing circuit; an I / O circuit, the I / O circuit configured to selectively operate the I / O pin in an electrically floating state; a reset circuit configured to emit a system reset signal in response to a fault signal, the system reset signal configured to initiate a system reset of the processing circuit, the system reset signal further configured to trigger the I / O circuit to operate the I / O pin in the electrically floating state; and a timer circuit coupled to the I / O circuit, the timer circuit configured to emit a safety signal to the I / O circuit and a fault signal to the reset circuit, the safety signal configured to trigger the I / O circuit to operate the I / O pin in the electrically floating state independent of the system reset signal, the safety signal being different from the fault signal.

9. The processing circuit of claim 8, further comprising: a central processing unit (CPU) coupled to the timer circuit; and an interrupt circuit coupled to the timer circuit and the CPU, wherein the timer circuit is further configured to emit a non-maskable interrupt signal to the interrupt circuit, the interrupt circuit configured to interrupt the CPU even if interrupts of the interrupt circuit are disabled or the interrupt circuit has serviced another interrupt.

10. The processing circuit of claim 8, further comprising an interrupt circuit and a central processing unit (CPU), each coupled to the timer circuit, wherein the timer circuit is further configured to emit a reset signal to the CPU, the I / O circuit, and the interrupt circuit, wherein the reset signal is configured to trigger the system reset of the processing circuit independent of the system reset signal of the reset circuit.

11. The processing circuit of claim 8, wherein the timer circuit is further configured to emit a fault signal to the reset circuit in response to detecting a fault of the processing circuit.

12. A method of operating an integrated circuit device, the method comprising: comparing a value indicated by a count register of a timer circuit to one or more thresholds; in response to detecting that the value indicated by the count register is outside one or more predetermined ranges of values defined by the one or more thresholds, emitting, by the timer circuit, a safety signal to an input / output (I / O) circuit, the emission of the safety signal being independent of a reset circuit and a central processing unit (CPU) of the integrated circuit device, the safety signal being different from a fault signal emitted by the timer circuit to the reset circuit to trigger the reset circuit to initiate a system reset; and in response to the safety signal, operating an I / O pin of the integrated circuit device in an electrically floating state.

13. The method of claim 12, further comprising, in response to determining that the detected fault causes an interruption of operation of the CPU, emitting, by the timer circuit, a non-maskable interrupt signal to an interrupt circuit of the integrated circuit device.

14. The method of claim 13, further comprising transmitting, by the timer circuit, a reset signal configured to trigger the system reset of the integrated circuit device independently of the reset circuit in response to determining that the detected fault causes the system reset.

15. The method of claim 14, wherein the unmaskable interrupt signal is transmitted prior to transmitting the reset signal.

16. A method of operating a timer circuit, the method comprising: detecting an operational fault of an integrated circuit device: in response to determining that the detected fault causes a floating of an I / O pin, asserting a safety signal configured to trigger an input / output (I / O) circuit of the integrated circuit device to operate I / O pins of the integrated circuit device in an electrically floating state independently of a central processing unit (CPU) and a reset circuit of the integrated circuit device, the safety signal being distinct from a fault signal transmitted by the timer circuit to the reset circuit to trigger the reset circuit to initiate a system reset; in response to determining that the detected fault causes an interrupt of the integrated circuit device, asserting an unmaskable interrupt signal configured to trigger the interrupt of the integrated circuit device even if an interrupt of an interrupt circuit of the integrated circuit device is disabled or the interrupt circuit has serviced another interrupt; and in response to determining that the detected fault causes a system reset, asserting a reset signal configured to trigger the system reset of the integrated circuit device independently of the reset circuit of the integrated circuit device.

17. The method of claim 16, wherein the timer circuit is external to the integrated circuit device.

18. The method of claim 16, wherein the integrated circuit device comprises the timer circuit. ​

Images