topic Re: How to prevent MCU reset loop and go to Deep-Failsafe in Power Management

How to prevent MCU reset loop and go to Deep-Failsafe

tam11 — Wed, 22 Nov 2023 22:14:31 GMT

Hi
I am using FS26 and FS84 for 2 different AUTOSAR projects. Both have same problem.

In theory when FLT_ERR_CNT reaches maximum value, then SBC must enter into Deep fail safe mode. But this seems unreachable when some fault occurs during runtime (e.g. watchdog fault).

Its because SW is initialized with FLT_ERR_CNT cleared and FS0B released.

Lets assume below scenario:
1. A program flow issue occurs during run time 2 min after start (e.g. an unexpected infinite loop) which causes watchdog error.
2. So in SBC watchdog timeout happens which resets MCU and SBC goes for INIT_FS mode.
3. SW initializes SBC (FLT_ERR_CNT cleared and FS0B released)
4. Step 1 repeats.

What is correct strategy to avoid such uncontrolled MCU reset loop and go to Deep failsafe when such scenario occurs?

I am looking for solution for both FS26 and FS84.

Thanks

Re: How to prevent MCU reset loop and go to Deep-Failsafe

guoweisun — Thu, 23 Nov 2023 04:46:00 GMT

About your question:

During the run mode of SBC, if it has watchdog fault and the FLT_ERR_CNT reaches maximum value then SBC enter into LPOFF or assert RSTB, you don't need this function, right?

Re: How to prevent MCU reset loop and go to Deep-Failsafe

tam11 — Thu, 23 Nov 2023 10:17:05 GMT

Thanks for reply.

During the run mode of SBC, if it has watchdog fault and the FLT_ERR_CNT reaches maximum value then SBC enter into LPOFF or assert RSTB, you don't need this function, right?

When FLT_ERR_CNT reaches maximum value SBC enters into Deep Fail safe mode (not LPOFF).

When watchdog fault occurs, I want to do the reset. This part is OK.

But after the reset SW re-initializes SBC and clears the FLT_ERR_CNT (as recommended in datasheet).

So FLT_ERR_CNT will never reach in maximum value. This part is problem. Because we will end up in reset loop if same watchdog fault happens again and again.

Re: How to prevent MCU reset loop and go to Deep-Failsafe

guoweisun — Thu, 23 Nov 2023 12:27:10 GMT

That should be protection for MCU and system, you need enter into debug mode the update the software during this condition.

Re: How to prevent MCU reset loop and go to Deep-Failsafe

tam11 — Thu, 23 Nov 2023 12:34:52 GMT

@guoweisun, Didn't understood what that means. Do you mean enter into debug mode and re-flash software ?

Re: How to prevent MCU reset loop and go to Deep-Failsafe

guoweisun — Thu, 23 Nov 2023 12:40:35 GMT

If your assumption case happened, the system stuck in the reset endless which remind you to update software.

Re: How to prevent MCU reset loop and go to Deep-Failsafe

tam11 — Thu, 23 Nov 2023 13:09:04 GMT

Well this scenario is not for test on my desk where I re-flash the software quickly. It can be actual scenario in a car driving on the road.

We are using this SBC for safety reasons (safety critical system in car) . So it should not let system stuck in the endless reset. It must go to safe state (which is Deep-failsafe I guess).

Re: How to prevent MCU reset loop and go to Deep-Failsafe

guoweisun — Fri, 24 Nov 2023 01:29:03 GMT

This above can be configured as 00 or 01 which do not affect the RSTB.

If WD error counter always =max, the fault error counter will increase into max then enter into deep FS mode.

Re: How to prevent MCU reset loop and go to Deep-Failsafe

tam11 — Thu, 23 Nov 2023 13:56:47 GMT

This above can be configured as 00 or 01 which do not affect the RSTB.

Generating a RESET on watchdog error few times is required and expected. It gives MCU or software some chance to recover. So I can't configure those setting.

Problem here is the FLT_ERR_CNT. By SBC design, it is required to clear this counter at SW initialization to enter SBC into Normal mode.

So if watchdog error is not gone --> FLT_ERR_CNT will never reach maximum value --> SBC will never go to Deep-failsafe --> system stuck in endless reset loop.

I hope I have explained this clearly in original question.

Re: How to prevent MCU reset loop and go to Deep-Failsafe

guoweisun — Thu, 23 Nov 2023 14:05:12 GMT

During the INIT phase also need clear the fault error counter, but if the WD always errors at this time the fault error counter also increase to MAX value then lead it into Deep-FS mode.

Re: How to prevent MCU reset loop and go to Deep-Failsafe

tam11 — Thu, 23 Nov 2023 14:24:39 GMT

Ok. We are just going round-and-round in the discussion.

I think I tried my best to explain the problem. Sorry if it wasn't clear enough.

Re: How to prevent MCU reset loop and go to Deep-Failsafe

guoweisun — Thu, 23 Nov 2023 14:27:59 GMT

Excluding the INIT phase WD error, assumption WD no error in the INIT phase and enter into normal mode successfully, at the normal mode the WD error happens again then RSTB assert LOW then enter into INIT phase again and again,that' your condition right?

Re: How to prevent MCU reset loop and go to Deep-Failsafe

tam11 — Thu, 25 Jul 2024 22:21:23 GMT

This topic is incorrectly marked as SOLVED by NXP which will mislead to other readers.

Still there is no solution provided to the question raised.

Re: How to prevent MCU reset loop and go to Deep-Failsafe

Miguel_Mannes_Hilleshiem — Thu, 23 Oct 2025 12:51:50 GMT

Hello tam11,

There are flags on the FS_DIAG_SAFETY1 register that allow you to identify when there is an watchdog issue.
After the reset, check these bit fields:

To avoid being stuck on that loop, you have to change the choices when running your software.

Here some hints on how to detect your MCU might be on that loop.

1 - Write on FS26 memory a key that represents your start-up attempt number

-> at first start-up with Battery fail, read the memory (NULL?) and write a know different value.

-> at next reset, read the memory, if the value is your know value, it means the device was reset. Change the value to the first software debug mode and change your flow (disable a resource?) to try avoid the blocking loop.

If you go to DFS:

1 - Check wake-up source on FS26 M_WIO_FLG > WUEVENT[3:0].

-> If Battery fail, do your normal configuration and software execution.

-> If DFS recovery, you might be in that case.

2 - Read M_SYS_CFG -> RETRY_CNT[7:0] to check the total number of retries attempts (value).

-> If your device is at the first retry attempt (first restart) then do something, if is the second, do something else.

Do not clear the retry counter RETRY_CNT[7:0] using RETRY_CLR.

Hope this helps you.

Miguel.