Patent ID: 12248793

DETAILED DESCRIPTION

This disclosure relates to a guardian circuit (e.g., a sub-circuit) for an external circuit, such as a finite state machine (FSM) implemented on a circuit (e.g., an IC chip). Some FSMs switch states on a rapid basis over a long period of time. For instance, in one example, a flow meter circuit might switch between a first state that measures flow and a second state that writes a value to memory characterizing the measured flow. In such situations, throughout a lifetime of the FSM, the FSM may get stuck between state transitions. For instance, in the example of a flow meter circuit, the transition between the first state (measuring the flow, an analog operation) and the second state (writing to memory, a digital operation) may include switching power modes. Such state transitions might slow down or hang-up operations of the circuit if the state transitions are not completed as expected. Moreover, area and power constraints might not provide sufficiently complex solutions to such problems.

The guardian circuit module receives a guardian clock signal that operates independently of other clock signals within the circuit. To increase the robustness of such a circuit, the guardian circuit detects a start of a state transition (e.g., based on a state signal and a next state signal) in the FSM and responds if a given period of time elapses before the state transition completes. In some examples, in response to detecting the state transition, the guardian circuit module asserts a trigger signal. The guardian circuit module is configured to assert a reset signal in response to the trigger signal being asserted for a threshold number of cycles in the guardian clock signal. The reset signal is employable to reset the FSM to a known safe state, such as an initial power-on state. Conversely, if the state transition is completed prior to the guardian clock signal cycling the threshold number of cycles, the trigger signal is de-asserted, and the reset signal is not asserted. In this manner, if a state transition takes too long (more than the threshold cycle count of the guardian clock signal), the guardian circuit module asserts the reset signal, which causes the FSM to reset.

FIG.1is a block diagram of a guardian circuit module100implemented as a circuit, such as a sub-circuit that is employable to monitor operations of an external circuit103, implemented on a circuit102, such as a system on a chip (SoC). The external circuit103is implemented, for example, by a controller operating on the SoC. In such a situation, the guardian circuit module100is implemented as a sub-circuit on the SoC. The guardian circuit module100is configured to assert a reset signal, RESET based on a status of input signals. The reset signal, RESET is implemented as a high priority reset signal. Accordingly, components (e.g., such as the external circuit103) of the circuit102are reset and restored to a safe state, such as an initial power-on state in response to the reset signal, RESET being asserted.

In some examples, the external circuit103is implemented as an FSM. In other examples, the external circuit103is implemented as a circuit to facilitate handshaking. In still other examples, the external circuit103is implemented as a power module. For purposes of simplification of explanation, examples are described wherein the external circuit103is implemented as an FSM. In any of these examples, and other examples, the external circuit103may have transitions (e.g., state transitions, signal transitions, feedback return signals, etc.) that could cause the external circuit103to delay or hang.

More particularly, in some examples, the external circuit103is implemented as a software defined FSM of the circuit102, particularly in situations where the circuit102is implemented as an SoC with an embedded controller. In other examples, the external circuit103is implemented as a hardware module within the circuit102. In either situation (and other situations), there may be race conditions and/or priority hierarchies that cause state transitions in the FSM to delay or hang. Additionally, even in situations where the external circuit103is relatively simple, power sags (e.g., brownouts) could cause sub-threshold voltage levels at the external circuit103, and such sub-threshold voltage levels may delay or prevent a transition from completing. For instance, in a situation where a transition includes changing power modes, a power sag could impede the external circuit103, implemented as an FSM, from completing a transitioning from a state with a low power mode to a state with a high power mode.

The guardian circuit module100receives a dedicated clock signal, GUARD CLK, which can alternatively be referred to as a guardian clock signal. In some examples, the dedicated clock signal, GUARD CLK, is implemented as a clock signal that is independent of other clock signals employed on the circuit102. In some examples, the guardian circuit module100includes components (e.g., a clock generator) for generating the guardian clock, GUARD CLK. In other examples, the guardian clock, GUARD CLK is generated by a component of the circuit102external to the guardian circuit module100. The dedicated clock signal, GUARD CLK has a clock counter interval that is longer than a maximum permitted time for a longest transition to complete in the external circuit103. For instance, in some examples, the dedicated clock signal, GUARD CLK is three orders of magnitude or more longer than a counter interval of a system clock signal of the circuit102that controls operations of the external circuit103. For instance, in some examples if the system clock signal drives operations on the external circuit103, and has a counter interval of about 1 microsecond (μs), the dedicated clock signal, GUARD CLK would have a counter interval of about 1 millisecond (ms) or more. In this manner, the dedicated clock signal, GUARD CLK is slower than the system clock signal.

The guardian circuit module100includes a guard trigger circuit, referred to as a guard trigger104. The guard trigger104is configured to assert a trigger signal, TRIGGER_N based on a status of input signals. In particular, the guard trigger104receives a state signal, STATE, and a next state signal, NEXT STATE that characterizes a present state of the external circuit103, implemented as an FSM and a next state of the external circuit103, respectively. The state signal, STATE, and the next state signal, NEXT STATE represent signals that are generated based on a comparison of state vectors for the external circuit103. The guard trigger104also receives a brownout signal, BROWNOUT that characterizes a power status of the circuit102. The brownout signal, BROWNOUT is asserted, for example, in situations where there is insufficient power to operate the circuit102and/or the circuit102is being reset. In some examples, the guard trigger104also receives a guard enable signal, GUARD ENABLE that is asserted to enable operation of the guard trigger104.

In the examples described herein, the term “asserted” (and its derivatives) in reference to a given signal refers to the given signal being assigned a logical 1 or a logical 0 depending on the type of the given signal. More particularly, if the given signal is an active high signal, assertion of the given signal sets the given signal to a logical 1. Additionally, if the given signal is an active low signal, assertion of the given signal sets the given signal to a logical 0. Conversely, the term “de-asserted” (and its derivatives) in reference to the given signal indicates that the given signal is assigned the opposite logical value from the logical value the given signal is assigned to assert the given signal. For instance, if the given signal is an active high signal, de-asserting the given signal sets the given signal to a logical 0. Additionally, if the given signal is an active low signal, de-asserting the given signal sets the given signal to a logical 1. Moreover, it is understood that in examples where a given signal is described as being active high or active low, respectively, in other examples, the given signal is implemented as active low or active high, respectively.

In some examples, the guard trigger is configured to assert the trigger signal, TRIGGER_N in response to detecting a state transition is in progress at the external circuit103. The state transition is indicated by a status of the state signal, STATE and the next state signal, NEXT state. More particularly, if the state signal, STATE is asserted and the next state signal, NEXT STATE is not asserted, or vice versa, the guard trigger104determines that the external circuit103is in a transition (e.g., a state transition), and the guard trigger104asserts the trigger signal, TRIGGER_N. Conversely, if the state signal, STATE and the next state signal, NEXT STATE are both asserted, the guard trigger104de-asserts the trigger signal, TRIGGER_N.

Additionally, a number of conditions can cause the guard trigger to inhibit (prevent) assertion of the trigger signal, TRIGGER_N. In particular, the guard trigger104is configured such that if the brownout signal, BROWNOUT is asserted, the guard trigger104de-asserts the trigger signal, TRIGGER_N. The brownout signal, BROWNOUT is asserted in situations where the circuit102is being reset, and components, including the external circuit103are being set to a safe state, such as an initial, power-on state. The guard trigger104is configured to de-assert the trigger signal, TRIGGER_N to allow for the external circuit103of the circuit102to be set to the initial, power on state without interruption.

Similarly, the guard trigger104is configured to inhibit assertion of the trigger signal if the guard enable signal, GUARD ENABLE is de-asserted. De-assertion of the guard enable signal, GUARD ENABLE indicates that the operations of the guardian circuit module100are to be disabled.

In some examples, the guard trigger104maintains the trigger signal, TRIGGER_N in the asserted state until (i) the state signal, STATE and the next state signal, NEXT STATE are asserted, (ii) the brownout signal, BROWNOUT is asserted or (iii) the guard enable signal, GUARD ENABLE is de-asserted. In response to detection one of the events (i)-(iii), the guard trigger104de-asserts the trigger signal, TRIGGER_N. In other examples, more or fewer events than events (i)-(iii) cause the guard trigger104to de-assert the trigger signal, TRIGGER_N.

The trigger signal, TRIGGER_N is provided to a reset synchronizer circuit, referred to as a reset synchronizer108and to a reset requestor circuit, referred to as a reset requestor112. The reset synchronizer108also receives the dedicated clock signal, GUARD CLK as an input. The reset synchronizer108is configured to assert a synchronization signal, SYNC_N if the trigger signal, TRIGGER_N is asserted for a predetermined number of cycles of the dedicated clock signal, GUARD CLK. In some examples, the reset synchronizer108is configured as a shift register. As one example, the reset synchronizer108is configured to assert the synchronization signal, SYNC_N in response to the trigger signal, TRIGGER_N being asserted for at least two cycles of the dedicated clock signal, GUARD CLK. In other examples, the reset synchronizer108is configured to assert the synchronization signal, SYNC_N after the trigger signal, TRIGGER_N has been asserted for more than two or less than two cycles of the dedicated clock signal, GUARD CLK.

The synchronization signal, SYNC_N is provided to a timeout circuit116. The timeout circuit116also receives the dedicated clock signal, GUARD CLK. The timeout circuit116is configured to assert a timeout signal, TIMEOUT if the synchronization signal, SYNC_N is asserted for a predetermined number of cycles of the dedicated clock signal, GUARD CLK. In some examples, the timeout circuit116is configured as a shift register. As one example, the timeout circuit116is configured to assert the timeout signal, TIMEOUT in response to the synchronization signal, SYNC_N being asserted for at least three cycles of the dedicated clock signal, GUARD CLK. In other examples, the timeout circuit116is configured to assert the timeout signal, TIMEOUT after the synchronization signal, SYNC_N has been asserted for more than three or less than three cycles of the dedicated clock signal, GUARD CLK.

The timeout signal, TIMEOUT and the trigger signal, TRIGGER_N are provided to the reset requestor112. The reset requestor112generates a reset signal, RESET if both the trigger signal, TRIGGER_N and the timeout signal, TIMEOUT are asserted. As noted, the reset signal, RESET is implemented as a high-priority request signal that causes the circuit102to reset the external circuit103to an initial power-on state (or some other safe state).

By implementing the guardian circuit module100, a relatively simple and robust state transition monitoring circuit is provided for the external circuit103. In particular, the guardian circuit module100asserts the reset signal, RESET in situations where the external circuit103delays beyond a threshold number of cycles of the dedicated clock signal, GUARD CLK (e.g., for 5 cycles of the dedicated clock signal, GUARD CLK) between state transitions. By asserting the reset signal, RESET in this manner, the guardian circuit module100increases the robustness of the circuit102. Moreover, the guardian circuit module100obviates the need for a high-power, complex monitor of the transitions of the external circuit103.

FIG.2is a circuit diagram of a guardian circuit module200for an FSM. The guardian circuit module200is employable to implement the guardian circuit module100ofFIG.1. For purposes of simplification of explanation, the same signal and component names are employed inFIGS.1and2to denote the same signal or component.

The guardian circuit module200is implemented as a module of a circuit, such as the circuit102ofFIG.1. Unless otherwise noted, components of the guardian circuit module200are operable at sub-threshold levels. Thus, in situations where insufficient power is available to operate the FSM, the guardian circuit module200can still operate in the expected manner. The guardian circuit module200includes a guard trigger204that is employed to implement the guard trigger104ofFIG.1. The guard trigger204receives inputs characterizing a state of an FSM implemented on the circuit, such as the external circuit103ofFIG.1. More particularly, the guard trigger204receives a state signal, STATE and a next state signal, NEXT STATE that characterize a state of the FSM. In some examples, the state signal, STATE and a next state signal, NEXT STATE characterizes a comparison of state vectors for the FSM.

The state signal, STATE and a next state signal, NEXT STATE are coupled to inputs to an XNOR gate208of the guard trigger204. The XNOR gate208outputs a state transition trigger signal, STATE TRANSITION TRIGGER_N to an input of an OR gate212of the guard trigger204.

The term “couple” (and derivatives) is used throughout the specification. The term may cover connections, communications, or signal paths that enable a functional relationship consistent with the description of this disclosure. For example, if device A generates a signal to control device B to perform an action, in a first example device A is coupled to device B, or in a second example device A is coupled to device B through intervening component C if intervening component C does not substantially alter the functional relationship between device A and device B such that device B is controlled by device A through the control signal generated by device A.

A brownout signal, BROWNOUT is coupled to the OR gate212, and a guard enable signal, GUARD ENABLE is coupled to an inverted input of the OR gate212. In the illustrated example, the brownout signal, BROWNOUT and the guard enable signal, GUARD ENABLE are active high signals. Assertion of the brownout signal, BROWNOUT indicates that the FSM is being reset to a safe state, such as an initial power-on state. For instance, the brownout signal, BROWNOUT is asserted in situations where power to the FSM drops below a threshold level.

The OR gate212outputs a trigger signal, TRIGGER_N. In the example illustrated, the trigger signal, TRIGGER_N is an active low signal. The guard trigger204asserts the trigger signal (logical 0), TRIGGER_N in response to the state transition trigger signal, STATE TRANSITION TRIGGER_N being de-asserted, the brownout signal, BROWNOUT (logical 0) being de-asserted and the guard enable signal, GUARD ENABLE (logical 1) being asserted.

The trigger signal, TRIGGER_N is coupled to an input of a reset synchronizer216. A dedicated clock signal, GUARD CLK is coupled to a clock input of the reset synchronizer216. The dedicated clock signal, GUARD CLK, has counter interval that is longer than a maximum time for a longest transition in the FSM. For instance, in some examples, the dedicated clock signal, GUARD CLK has a counter interval that is three orders of magnitude longer than a system clock signal of the circuit that is employed to drive operations of the FSM. For instance, if the system clock signal has a counter interval of about 100 nanoseconds (ns), the dedicated clock signal, GUARD CLK has a counter interval of about 100 μs. In other examples, the difference between the counter interval of the system clock signal and the dedicated clock signal, GUARD CLK are different. The reset synchronizer216is configured to assert a synchronization signal, SYNC_N (logical 0) if the trigger signal, TRIGGER_N is asserted (logical 0) for at least two cycles of the dedicated clock signal, GUARD CLK. In the example illustrated, the synchronization signal, SYNC_N is an active low signal. Conceptually, the reset synchronizer216receives an asynchronous signal, namely, the trigger signal, TRIGGER_N and outputs a signal synchronized with the dedicated clock signal, GUARD CLK, namely the synchronization signal SYNC_N.

In some examples, the reset synchronizer216is configured as a shift register. More particularly, in the example illustrated, the reset synchronizer216is implemented with two cascading D flip-flops, namely a first D flip-flop220and a second D flip-flop224. The trigger signal, TRIGGER_N is coupled to a preset input, PR of the first D flip-flop220and the second D flip-flop224. The dedicated clock signal, GUARD CLK is coupled to a clock input of the first D flip-flop220and the second D flip-flop. A tie low input228(e.g., about 0 Volts) is coupled to a data input, D of the first D flip-flop220to apply a logical 0 to the data input, D of the first D flip-flop220. A non-inverted output, Q of the first D flip-flop220is coupled to a data input, D of the second D flip-flop220. A non-inverted output, Q of the second D flip-flop224outputs the synchronization signal, SYNC_N of the reset synchronizer216.

The synchronization signal, SYNC_N is coupled to an input of a timeout circuit232. Additionally, the dedicated clock signal, GUARD CLK is coupled to a clock input of the timeout circuit232. The timeout circuit232is configured to assert a timeout signal, TIMEOUT (logical 1) if the synchronization signal, SYNC_N is asserted (logical 0) for three or more cycles of the dedicated clock signal, GUARD CLK. In the example illustrated, the timeout signal, TIMEOUT is an active high signal.

In some examples, the timeout circuit232is implemented as a shift register. More particularly, the timeout circuit232may be implemented with three cascaded D flip-flops, namely a first D flip-flop236, a second D flip-flop240and a third D flip-flop244. In other examples, the timeout circuit232is implemented with a different number of D flip-flops.

The dedicated clock signal, GUARD CLK is coupled to a clock input of the first D flip-flop236, the second D flip-flop240and the third D flip-flop244of the timeout circuit232. The synchronization signal, SYNC_N is coupled to a clear input, CL of the first D flip-flop236, the second D flip-flop240and the third D flip-flop244of the timeout circuit232. The timeout circuit232includes a tie high input248that asserts a logical 1 on a data input, D of the first D flip-flop236.

A non-inverted output, Q of the first D flip-flop236is coupled to a data input, D of the second D flip-flop240. Similarly, a non-inverted output, Q of the second D flip-flop240is coupled to a data input, D of the third D flip-flop244. Moreover, a non-inverted output, Q of the third D flip-flop244provides the timeout signal, TIMEOUT.

The timeout signal, TIMEOUT is coupled to an input of a reset requestor250. The trigger signal, TRIGGER_N is also coupled to an input of the reset requestor250. The reset requestor250asserts a reset signal, RESET (logical 1) in response to the timeout signal, TIMEOUT and the trigger signal, TRIGGER_N being asserted concurrently. In the illustrated example, the reset signal, RESET is an active high signal.

In the illustrated example, the reset requestor250is implemented with an AND gate254with an inverted input. In other examples, the reset requestor250is implemented with more logical gates and/or other circuit components. The trigger signal, TRIGGER_N is coupled to the inverted input of the AND gate254. The timeout signal, TIMEOUT is coupled to a non-inverted input of the AND gate254.

In the example illustrated, the state signal, STATE and the next state signal, NEXT STATE are active high signals and the state transition trigger signal, STATE TRANSITION TRIGGER_N is an active low signal. In situations where the FSM is remaining in the same state, both the state signal, STATE and the next state signal, NEXT STATE are asserted (logical 1). In situations where the FSM is transitioning between states, either the state signal, STATE or the next state signal, NEXT STATE is de-asserted (logical 0). If either (or both) of the state signals, STATE or the next state signal, NEXT STATE are de-asserted (logical 0), the state transition trigger signal, STATE TRANSITION TRIGGER_N is asserted (logical 0). The guard trigger204asserts the trigger signal (logical 0), TRIGGER in response to the state transition trigger signal, STATE TRANSITION TRIGGER_N (logical 0) being asserted, the brownout signal, BROWNOUT (logical 0) being de-asserted and the guard enable signal, GUARD ENABLE (logical 1) being asserted. Conversely, the guard trigger204de-asserts the trigger signal, TRIGGER_N (logical 1) in response the state transition trigger signal, STATE TRANSITION TRIGGER_N (logical 1) being de-asserted, the brownout signal, BROWNOUT (logical 1) being asserted or the guard enable signal, GUARD ENABLE (logical 0) being de-asserted.

The trigger signal, TRIGGER_N (logical 1) being de-asserted causes the first D flip-flop220and the second D flip-flop224on the reset synchronizer216to operate in a preset mode. In the preset mode, both the first D flip-flop220and the second D flip-flop220output a logical 1 on the respective non-inverted output, Q. Thus, if the trigger signal, TRIGGER_N is de-asserted (logical 1), the synchronization signal, SYNC_N is also de-asserted (logical 1).

The synchronization signal, SYNC_N (logical 1) being de-asserted, causes the first D flip-flop236, the second D flip-flop240and the third D flip-flop244of the timeout circuit232to operate in a clear mode. In the clear mode, the first D flip-flop236, the second D flip-flop240and the third D flip-flop244of the timeout circuit232output a logical 0 on the respective non-inverted outputs, Q. As noted, the non-inverted output Q of the third D flip-flop244of the timeout circuit232provides the timeout signal, TIMEOUT that is coupled to the AND gate254of the reset requestor250at a non-inverted input, Q. Additionally, the trigger signal, TRIGGER_N is coupled to the inverted input of the AND gate254of the reset requestor250. The timeout signal, TIMEOUT (logical 0) being de-asserted and the trigger signal, TRIGGER_N (logical 1) being de-asserted causes the AND gate254to de-assert the reset signal, RESET (logical 0). Accordingly, the trigger signal, TRIGGER_N (logical 1) being de-asserted causes the reset signal, RESET to be de-asserted (logical 0).

Conversely, the trigger signal, TRIGGER_N (logical 0) being asserted, causes the first D flip-flop220and the second D flip-flop224of the reset synchronizer216to operate in shift mode. In shift mode, the logical 0 applied by the tie low input228is released into the cascade of D flip-flops of the reset synchronizer216. In such a situation, the non-inverted output, Q of the first D flip-flop220of the reset synchronizer216is set to a logical 0 in response to a next pulse of the dedicated clock signal, GUARD CLK. Subsequently, in response to receipt of the logical 0 at the data input, D of the second D flip-flop224, the second D flip-flop outputs a logical 0 on the non-inverted output, Q in response to a next pulse of the dedicated clock signal, GUARD CLK. As noted, the non-inverted output, Q on the second D flip-flop224of the reset synchronizer216provides the synchronization signal, SYNC_N to the timeout circuit232, such that the synchronization signal, SYNC_N is asserted (logical 0).

In summary, the reset synchronizer216is configured to assert the synchronization signal, SYNC_N (logical 0) if the trigger signal, TRIGGER_N is asserted (logical 0) for at least two cycles of the dedicated clock signal, GUARD CLK. Additionally, if the trigger signal, TRIGGER_N is de-asserted (logical 1) prior to completion of the at least two clock cycles of the dedicated clock signal, GUARD CLK, the first D flip-flop220and the second D flip-flop224both transition to the preset mode, and the synchronization signal, SYNC_N is de-asserted (logical 1).

Assertion of the synchronization signal, SYNC_N (logical 0) sets the clear input, CL of the first D flip-flop236, the second D flip-flop240and the third D flip-flop244of the timeout circuit232to a logical 0. In response, each of the first D flip-flop236, the second D flip-flop240and the third D flip-flop244of the timeout circuit232operate in a shift mode. In the shift mode, the tie high input248applies a logical 1 on the data input, D of the first D flip-flop236. In response to a next pulse of the dedicated clock signal, GUARD CLK, the first D flip-flop236outputs a logical 1 on the non-inverted output Q, which is coupled to the data input, D of the second D flip-flop240.

Subsequently, if the data input, D of the second D flip-flop240is set to a logical 1, the second D flip-flop240outputs a logical 1 on the non-inverted output Q of the second D flip-flop240in response to a next clock pulse of the dedicated clock signal, GUARD CLK. As noted, the non-inverted output Q of the second D flip-flop240is coupled to the data input, D of the third D flip-flop244. If the data input, D of the third D flip-flop244is set to a logical 1, the third D flip-flop244outputs a logical 1 on the non-inverted output Q of the third D flip-flop244in response to a next clock pulse of the dedicated clock signal, GUARD CLK. As noted, the non-inverted output, Q of the third D flip-flop244is the timeout signal, TIMEOUT.

In summary, the timeout circuit232is configured to assert the timeout signal, TIMEOUT (logical 1) if the synchronization signal, SYNC_N is asserted (logical 0) for at least three cycles of the dedicated clock signal, GUARD CLK. Additionally, if the synchronization signal, SYNC_N is de-asserted (logical 1) prior to completion of the at least three clock cycles of the dedicated clock signal, GUARD CLK, the first D flip-flop236, the second D flip-flop240and the third D flip-flop244transition to the clear mode, and the timeout signal, TIMEOUT is de-asserted (logical 0). In response to the timeout signal, TIMEOUT (logical 1) being asserted and the trigger signal, TRIGGER_N (logical 0) being asserted, the reset requestor250asserts the reset signal, RESET.

Taken together, the reset synchronizer216, the timeout circuit232and the reset requestor250assert the reset signal, RESET (logical 1) if the trigger signal, TRIGGER_N remains asserted (logical 0) for a threshold number of cycles of the dedicated clock signal, GUARD CLK (e.g., at least five cycles of the guardian clock cycle, GUARD CLK).

In some examples, the reset signal, RESET is a high priority reset request. Thus, in response to the RESET request being asserted, the FSM is set to an initial-power on state, or other safe state. Accordingly, the guardian circuit module200is a relatively simple and robust state transition monitor circuit for the FSM. In particular, the guardian circuit module200asserts the reset signal, RESET in situations where the FSM delays too long (e.g., for 5 cycles of the dedicated clock signal, GUARD CLK) between state transitions. The guardian circuit module200obviates the need for a high-power, complex monitor of the state transitions of the FSM.

FIG.3illustrates an example of a circuit300(e.g., an SoC) that includes a guardian circuit module304that monitors transitions of states in an FSM308. The circuit300is employable to implement the circuit102ofFIG.1. More particularly, the guardian circuit module304is employable to implement the guardian circuit module100ofFIG.1and/or the guardian circuit module200ofFIG.2.

In the present example, the FSM308operates as a software instantiated FSM operating on a controller312of the circuit300. In some examples, the controller312is implemented as a computing platform that includes a general-purpose processor with embedded instructions for implementing the FSM308. In various examples, the FSM308is implemented as a Mealy state machine, a Moore state machine or a Medvedev state machine or a combination thereof.

In the example illustrated, the controller312communicates with a sensor316. In some examples, the sensor316is an analog sensor, such as a flow meter, a temperature sensor, an accelerometer, etc. In any such situation, it is presumed that the FSM308controls operations of the sensor316. For instance, in one example, in a given state the FSM308causes the sensor316to measure an external condition (e.g., flow, temperature, acceleration, etc.) and in another state, the FSM308writes data characterizing the measured condition to a non-transitory memory of the controller312. In such an example, in a given state, the FSM308operates in a high power mode, and in the other state, the FSM308operates in a low power mode. Accordingly, in this example, switching between the given state and the other state includes switching power modes. In some instances, switching between power modes impedes or prevents the FSM308from completing a state transition.

The controller312includes an FSM state logic module320. The FSM state logic module320is implemented as a gate network that monitors a state of the FSM308. As an example, the FSM state logic module320compares state vectors of the FSM308to generate a state signal, STATE characterizing a current state of the FSM308and a next state signal, NEXT STATE characterizing a next state of the FSM308. The state signal, STATE and the next state signal, NEXT STATE are provided to the guardian circuit module304.

In some examples, the controller312provides a brownout signal, BROWNOUT. The brownout signal, BROWNOUT characterizes a power status of the circuit300. The brownout signal, BROWNOUT is asserted, for example, in situations where there is insufficient power to operate the circuit300and/or the FSM308is being reset. In some examples, the controller312also provides the guardian circuit module304with a guard enable signal, GUARD ENABLE that is asserted to enable operation of the guardian circuit module304.

The circuit300also includes a clock generator324that generates a dedicated clock signal, GUARD CLK. The dedicated clock signal, GUARD CLK operates independently of other clock signals in the circuit, including, but not limited to a system clock signal, SYS CLK that is generated by a system clock generator326(or other component) of the controller312that controls operations of the FSM308. The dedicated clock signal, GUARD CLK has a counter interval that is longer than a maximum transition time for a state transition of the FSM308. In some examples, the dedicated clock signal, GUARD CLK has a cycle time (period) that is three orders of magnitude (or more) longer than the cycle time of the system clock signal, SYS CLK. Thus, if the system clock signal, SYS CLK has a cycle time of 20 μs, the dedicated clock signal, GUARD CLK has a cycle time of 20 ms or longer. In other examples, other relationships between the cycle time of the dedicated clock signal, GUARD CLK, and the system clock signal, SYS CLK are selected.

The guardian circuit module304is configured to assert a reset signal, RESET in certain conditions, as described herein. More particularly, the guardian circuit module304is configured to assert the reset signal, RESET in situations where the guard enable signal, GUARD ENABLE is asserted, the brownout signal, BROWNOUT is de-asserted, and the state signal, STATE and the next state signal, NEXT STATE indicate that the FSM308is in a state transition for at least a threshold number of cycles (e.g., five clock cycles) of the dedicated clock signal, GUARD CLK. The reset signal, RESET is provided to the controller312. In response to assertion of the reset signal, RESET, the controller312commands the FSM308to transition to a safe state, such as an initial power on state.

FIG.4illustrates a state diagram400that depicts an example of possible states for the FSM308ofFIG.3. The state diagram400illustrates four possible states, namely, state0, S0, state1, S1, state2, S2and state3, S3. Additionally, it is presumed that the state machine also includes an end state, EU that is not shown. The design of state machines, including the FSM implemented by the state diagram400often rely on inaccurate assumptions. In particular, some such FSMs presume that time only elapses when the FSM is in a discrete state, namely when the FSM is in state0, S0state1, S1state2, S2or state3, S3. Additionally, FSMs are often designed with the inaccurate presumption that state transitions are logically instantaneous, such that only actions taken during a transition are the setting of flag and variables and/or the sending of signals. In such a situation, these actions are taken before the FSM enters the next state. Further still, FSMs are often designed with the presumption that each time a state is entered, the actions of that state are started. Accordingly, a state transition that points back to the same state causes actions to be repeated from the beginning of entry into the state, and that each action started upon entry into a state completes before any tests are made to exit the state. Such presumptions simplify design of the FSM, but can lead to metastable conditions that can impede or prevent the FSM from completing a transition from one state to another.

In the state diagram400, it is presumed that the FSM includes variables that impact a state of the FSM. In the present example, such variables include, a reset variable, RESET, an up-count variable, UPCNT, a down-count variable, DNCNT, an enable variable, EN and an error variable ERR. Additionally, in the state diagram400, operations are listed in a vertical axis of each state according to a priority of the operation. Thus, if two operations are possible, based on the state of the variables, the operation with the highest priority on a respective state is executed, and the lower priority operation is not executed. Thus, the priority of operations impacts the state transitions, as described herein.

In state0, S0, at404, the FSM detects that the reset variable, RESET has been set to a logical 1. In such a situation, no matter the previous or current state, the FSM transitions to state0, S0, indicated by the state vector, ALL:S0. State0, S0is the initial power-on state where variables are set to known values. In the example illustrated inFIG.4, it is presumed that assertion of the reset signal, RESET illustrated inFIG.3sets the reset variable, RESET to a logical 1. Additionally, in state0, S0, at408if the up-count variable, UPCNT and the enable variable, EN are both set to true (logical 1), the FSM transitions to state1, S1, as indicated by the state vector S0:S1. Further, in state0, S0at412if the down-count variable, DNCNT or the error variable, ERR are set to true (logical 1), the FSM stays in state0, S0as indicated by the state vector, S0:S0. Additionally, in state0, S0it is presumed that the up-count variable, UPCNT has a higher priority than the down-count variable, DNCNT, when both the up-count variable, UPCNT and the down-count variable, DNCNT are true (logical 1). Thus, if both the up-count variable, UPCNT and the down-count variable, DNCNT are true (logical 1) the operation at408is executed, and the FSM transitions to state1, S1.

In state1, S1, at416, if the down-count variable, DNCNT is true (logical 1), the FSM transitions to state0, S0, as indicated by the state vector S1:S0. Additionally in state1, S1, at420, if the up-count variable, UPCNT and the enable variable, EN are true (logical 1) the FSM transitions to state2, S2, as indicated by the state vector, S1:S2. In state1, S1it is presumed that the down-count variable, DNCNT has a higher priority than the up-count variable, UPCNT. Accordingly, if both the up-count variable, UPCNT and the down-count variable, DNCNT are true (logical 1) the operation at416is executed, and the FSM transitions to state0, S0.

In state2, S2at424, if the up-count variable, UPCNT is true (logical 1), the FSM transitions to state3, S3, as indicated by the state vector S2:S3. In state2, S2, at428if the down-count variable, DNCNT is true (logical 1), the FSM transitions to state1, S1, as indicated by the state vector S2:S1. In state2, at operation432, if the up-count variable, UPCNT and the enable variable, EN are true (logical 1), the FSM transitions to state EU (not shown), as indicated by the state vector, S2:E0. However, in state2, S2the state transition to EU at operation432is not executed because in both operations424and432, the up-count variable, UPCNT is set to true (logical 1) and the operation at424has a higher priority than the operation at432. Accordingly, the operation at432is presumed to be superfluous.

In state3, S3, at436, at operation436, if the up-count variable, UPCNT and the enable variable, EN are true (logical 1), the FSM transitions to state EU (not shown). In state3, S3, at440, if the down-count variable, DNCNT is true (logical 1), the FSM transitions to state2, as indicated by the state vector S3:S2. In state3, S3at operation444, if the up-count variable, UPCNT is true (logical 1), the FSM transitions to the end state, EU, as indicated by the state vector S3:E0. Moreover, in state3because the operation at436has a higher priority than the operation at444, the operation at444would only be executed if the enable variable, EN is false (logical 0) and the up-count variable, UPCNT is true (logical 1).

As demonstrated by the state diagram400, even a simple FSM can have complexities that can lead to unexpected behavior, particularly if the FSM is designed without full regard to priorities of operation. Moreover, if power to the FSM goes to a sub-threshold level, some of the variables may be set to a metastable state, which can impede or prevent the FSM from completing the transition between states.

In the state diagram400, it is presumed that a guardian circuit module, such as the guardian circuit module100ofFIG.1, the guardian circuit module200ofFIG.2, and/or the guardian circuit module304ofFIG.3is configured to monitor transitions between the states, S0-S3. In such a situation, the guardian clock module asserts a trigger signal in response to detecting a state transition (indicated by the illustrated state vectors). If a state transition does not complete within a threshold number of cycles of a dedicated clock signal provided to the guardian circuit module, the guardian circuit module asserts a reset signal, which causes the FSM characterized in the state diagram400to execute operation404, such that the FSM transitions to state0, S0.

Referring back toFIG.3, as demonstrated inFIGS.1and2, the guardian circuit module304is implemented with a simple design. In fact, as demonstrated inFIG.4, the guardian circuit module304has logic that is simpler than the FSM308. Additionally, as demonstrated inFIG.4, assertion of the reset signal, RESET causes the FSM to enter a safe state (state0, S0, inFIG.4), if FSM308does not complete a state transition within a threshold number (e.g., five) of clock cycles of the guardian clock cycle, GUARD CLK.

FIG.5illustrates a flowchart of an example method500for monitoring operations of an external circuit. In some examples, the method500is implemented by a circuit, such as the guardian circuit module100ofFIG.1, the guardian circuit module200ofFIG.2, and/or the guardian circuit module304ofFIG.3. In some examples, the external circuit is implemented with the external circuit103ofFIG.1. In such a situation, the external circuit is implemented as an FSM.

At505, the circuit monitors the operations of the external circuit. At510, a determination is made by a guard trigger circuit (e.g., the guard trigger104ofFIG.1) of the circuit as to whether a transition in the external circuit is in progress. In some examples, the determination at510is made based on a comparison of signals, such as the state signal, STATE, the next state signal, NEXT STATE, the brownout signal, BROWNOUT and/or the guard enable signal, GUARD ENABLE ofFIG.1. In other examples, other combinations and/or subsets of signals are employable to enable the detection at510. If the determination at510is negative (e.g., NO) the method500returns to505). If the determination at510is positive (e.g., YES), the method500proceeds to515.

At515, the guard trigger circuit of the circuit asserts a first signal, such as the trigger signal, TRIGGER_N ofFIG.1. At517, a determination is made as to whether the transition is still in progress. If the determination at517is negative (e.g., NO), the method500proceeds to519. If the determination at517is positive (e.g., YES), the method proceeds to520. At519, the first signal is de-asserted, indicating that the transition has completed, and the method500returns to505.

At520, a determination is made as to whether the first signal has been asserted for a first predetermined number of clock cycles of a dedicated clock signal. The determination at520is made, for example, by a reset synchronizer circuit of the circuit, such as the reset synchronizer108ofFIG.1. If the determination at520is negative (e.g., NO), the method500returns to517. If the determination at520is positive (e.g., YES), the method500proceeds to525.

At525, the reset synchronizer circuit of the circuit asserts a second signal, such as the synchronization signal, SYNC_N ofFIG.1. At527, another determination is made as to whether the transition is still in progress. If the determination at527is negative (e.g., NO), the method500proceeds to529. If the determination at527is positive (e.g., YES), the method proceeds to530. At529, the second signal is de-asserted, indicating that the transition has completed, and the method500returns to519.

At530, a determination is made as to whether the second signal has been asserted for a second predetermined number of clock cycles of the dedicated clock signal. The determination at530is made, for example, by a timeout circuit of the circuit, such as the timeout circuit116ofFIG.1. If the determination at530is negative (e.g., NO), the method500returns to527. If the determination at530is positive (e.g., YES), the method500proceeds to535.

At535, the timeout circuit of the circuit asserts a third signal, such as the timeout signal, TIMEOUT ofFIG.1. At540, yet another determination is made as to whether the transition is still in progress. The determination at540is made, for example, by a reset requestor circuit of the circuit, such as the reset requestor112ofFIG.1comparing the first signal and the third signal. For instance, if the reset requestor determines that the third signal and the first signal are both asserted concurrently, the determination at540is positive, and the determination at540is negative if either (or both) the third signal or the first signal are de-asserted. If the determination at540is negative (e.g., NO), the method500proceeds to542. If the determination at540is positive (e.g., YES), the method500proceeds to545. At542, the third signal is de-asserted and the method500returns to529. At545, the reset requestor asserts an output signal, such as the reset signal, RESET ofFIG.1. In some examples, the output signal is provided to an input node of a controller that includes the external circuit, such as the controller312ofFIG.3.

Modifications are possible in the described examples, and other examples are possible, within the scope of the claims.