How to prevent MCU reset loop and go to Deep-Failsafe

[tam11]

Hi
I am using FS26 and FS84 for 2 different AUTOSAR projects. Both have same problem.

In theory when FLT_ERR_CNT reaches maximum value, then SBC must enter into Deep fail safe mode. But this seems unreachable when some fault occurs during runtime (e.g. watchdog fault).

Its because SW is initialized with FLT_ERR_CNT cleared and FS0B released.

Lets assume below scenario:
1. A program flow issue occurs during run time 2 min after start (e.g. an unexpected infinite loop) which causes watchdog error.
2. So in SBC watchdog timeout happens which resets MCU and SBC goes for INIT_FS mode.
3. SW initializes SBC (FLT_ERR_CNT cleared and FS0B released)
4. Step 1 repeats.

What is correct strategy to avoid such uncontrolled MCU reset loop and go to Deep failsafe when such scenario occurs?

I am looking for solution for both FS26 and FS84.

Thanks

[Miguel_Mannes_Hilleshiem]

Hello tam11,

There are flags on the FS_DIAG_SAFETY1 register that allow you to identify when there is an watchdog issue.
After the reset, check these bit fields:

To avoid being stuck on that loop, you have to change the choices when running your software.

Here some hints on how to detect your MCU might be on that loop.

1 - Write on FS26 memory a key that represents your start-up attempt number

 -> at first start-up with Battery fail, read the memory (NULL?) and write a know different value.

 -> at next reset, read the memory, if the value is your know value, it means the device was reset. Change the value to the first software debug mode and change your flow (disable a resource?) to try avoid the blocking loop.

If you go to DFS:

1 - Check wake-up source on FS26 M_WIO_FLG > WUEVENT[3:0].

 -> If Battery fail, do your normal configuration and software execution.

 -> If DFS recovery, you might be in that case.

2 - Read M_SYS_CFG -> RETRY_CNT[7:0] to check the total number of retries attempts (value).

 -> If your device is at the first retry attempt (first restart) then do something, if is the second, do something else.

Do not clear the retry counter RETRY_CNT[7:0] using RETRY_CLR.

Hope this helps you.

Miguel.

[tam11]

This topic is incorrectly marked as SOLVED by NXP which will mislead to other readers.

Still there is no solution provided to the question raised.

[guoweisun]

About your question:

During the run mode of SBC, if it has watchdog fault and the  FLT_ERR_CNT reaches maximum value then SBC enter into LPOFF or assert RSTB, you don't need this function, right?

[tam11]

Thanks for reply.

During the run mode of SBC, if it has watchdog fault and the  FLT_ERR_CNT reaches maximum value then SBC enter into LPOFF or assert RSTB, you don't need this function, right?

When FLT_ERR_CNT reaches maximum value SBC enters into Deep Fail safe mode (not LPOFF).

When watchdog fault occurs, I want to do the reset. This part is OK.

But after the reset SW re-initializes SBC and clears the FLT_ERR_CNT (as recommended in datasheet).

So FLT_ERR_CNT will never reach in maximum value. This part is problem. Because we will end up in reset loop if same watchdog fault happens again and again.

[guoweisun]

That should be protection for MCU and system, you need enter into debug mode the update the software during this condition.

[tam11]

@guoweisun, Didn't understood what that means. Do you mean enter into debug mode and re-flash software ?

[guoweisun]

If your assumption case happened, the system stuck in the reset endless which remind you to update software.

[tam11]

Well this scenario is not for test on my desk where I re-flash the software quickly. It can be actual scenario in a car driving on the road.

We are using this SBC for safety reasons (safety critical system in car) . So it should not let system stuck in the endless reset. It must go to safe state (which is Deep-failsafe I guess).

[guoweisun · Accepted solution]

This above can be configured as 00 or 01 which do not affect the RSTB.

If WD error counter always =max, the fault error counter will increase into max then enter into deep FS mode.

[tam11]

This above can be configured as 00 or 01 which do not affect the RSTB.

Generating a RESET on watchdog error few times is required and expected. It gives MCU or software some chance to recover. So I can't configure those setting.

Problem here is the FLT_ERR_CNT. By SBC design, it is required to clear this counter at SW initialization to enter SBC into Normal mode.

So if watchdog error is not gone --> FLT_ERR_CNT will never reach maximum value --> SBC will never go to Deep-failsafe --> system stuck in endless reset loop.

I hope I have explained this clearly in original question.

[guoweisun]

During the INIT phase also need clear the fault error counter, but if the WD always errors at this time the fault error counter also increase to MAX value then lead it into Deep-FS mode.

[tam11]

Ok. We are just going round-and-round in the discussion.

I think I tried my best to explain the problem. Sorry if it wasn't clear enough.

[guoweisun]

Excluding the INIT phase WD error, assumption WD no error in the INIT phase and enter into normal mode successfully, at the normal mode the WD error happens again then RSTB assert LOW then enter into INIT phase again and again,that' your condition right?