StartUpGraphic

Overview

Start Up Sequence 1.4.0
Additonal Rationale

Sheet 1: Start Up Sequence 1.4.0

MICRO
RESET

Out of Reset

In Reset

TOD
STATE

Pwr On

Unknown

Pwr Off

WATCHDOG
STATE

Active

Inactive

ERROR-OUT
STATE

Normal

Faulted

INTRPT VECTOR TBL

Ebase

Rbase

ECM
STATE

Intlzd

Not Intlzd

DIAG MGR
STATE

Avail

Not Avail

Motor Control ISR

Active

Not Active

FDD Ref.

CM110A_FblStrtUpCfg

CM112A_CoreVltgMonr

CM106A _McuCoreConfigAndDiagc

CM104A_EcmOutpAndDiagc

CM107A_GuardCfgAndDiagc

CM108A_DataAndAdrPar

CM101A_ExcpnHdlg

CM107A_GuardCfgAndDiagc

CM800A_SyncCrc

CM102A_FlsMem

Hardware Power Up

BIST Execution

Lock Step Init*

Init Local RAM

Init DTS RAM

BSS/Data Sections

Power On Reset?

* BRAMDAT0 = FlsProgmReq or

* Includes

Yes è

Backup RAM Test

No app or cals?

FPU Init

Init Server Runnable Names

GP Init

Pass è

McuDiag = PwrOnRst

Configure BIST Reset (only on POR)

Configure Code Flash ECC

Configure Data Flash ECC Off

Configure Local RAM ECC / I Cache

Init SPI ECC Peripheral Mem

Confg SEGCONT

Init SPI

Init Ports

Stay in FBL*?

MCAL

McuCoreCfgAndDiagcInit1

McuCoreCfgAndDiagcInit2

EcmOutpAndDiagcInit3

MCAL

EcmOutpAndDiagcInit4

EcmOutpAndDiagcInit1

GuardCfgAndDiagcInit3

DataAndAdrParInit1

ExcpnHdlgInit1

GuardCfgAndDiagcInit1

SyncCrcInit0

FlsMemInit2

System Reg Init

MPU Init

Fail è

McuDiag = BackupRamTstFailr

Yes è

Temporal Monitor to Flash Mode

Init FEE for FBL

Init Serial Comm

PROGRAMMING….

McuDiag = FlsProgmCmpl

SW RESET

Cache init

No è

Reset Temporal Monitor

Jump to Application

Establish C Environment

Init DET

(ExecStrtUpTest == TRUE)?

(PowerOnReset == TRUE) AND (DebugMode = OFF)?

(ExecStrtUpTest == TRUE) AND (DebugMode = OFF)?

No è

CVM Low Reset?

Yes è

CVM Start Up Test

Yes è

BIST Checks

Yes è

Lock Step Tests

(ExecStrtUpTest == TRUE) AND (ECM Status Bits = 0)?

Init ECM*

(ExecStrtUpTest == TRUE) AND (ECM Status Bits = 0)?

Init AutoSAR SPI Drivers

Init Ports

Enable Watchdog ISR

Start Watchdog

(ExecStrtUpTest == TRUE)?

Init Digital IO

Init Flash Driver

Enable FPU Exceptions

StartOS*

Configure Guards

Sync CRC Init

Flash Mem Init*

CRC Check Start

Init FEE and Load

Init DEM

Config Prog Flow / Alive Monitors

Start Alarms / Run RTE Inits

PERIODICS RUN

Condition to Check If a test has to be performed for Power On Reset/ Soft Reset/ Hard Reset:

Yes è

McuDiag = CoreVltgMonLo

Clear CVM Error

ChkForStrtUpTest ( Address of ExecStrtUpTest)

Pass è

* Do Nothing *

Pass è

* Do Nothing *

Pass è

* Do Nothing *

Pass è

EI Interrupt Test

*MCU_Init()

Yes è

Pseudo Error Injection

ECM Compare Tests

Yes è

PBG Start Up Test

Yes è

P Bus Data Parity Start Up Test

* Init MPUs, User mode

* This function starts the Cofe Flash CRC

* Includes DMA initialization

If (ExecStrtUpTest == TRUE)

No è

CVM High Reset?

Enable Motor Control ISR

{

Fail è

McuDiag = CVM Start Up Test Failure

Fail è

McuDiag = Bist Failures

Fail è

McuDiag = Lock Step failures

Pass è

* Do Nothing *

Pass è

* Do Nothing *

Pass è

* Do Nothing *

Pass è

* Do Nothing *

Pass è

* Do Nothing *

Start OS Timer

Execute Start Up Test

Yes è

McuDiag = CoreVltgMonHi

Clear CVM Error

AutoSAR mode to RUN

}

No è

* Do Nothing *

No è

* Do Nothing *

No è

* Do Nothing *

Fail è

McuDiag = EI Interrupt Test Failure

Fail è

McuDiag = Pseudo Error Injection Failure

Fail è

McuDiag = Mst/Chkr Compare

Fail è

McuDiag = PBG Start Up Test Fault

Fail è

McuDiag = P Bus Data Parity Start Up Test

INITs Execute

No è

Pin Reset ?

Reset Cause

Safety reason to use manual software reset on SYSERR:
Nexteer is performing a SW Reset on a SYSERR so that we can capture information that caused the error.
Also, we drive the ErrorOut pin as a redundant safety mechanism.

Fail è

McuDiag = ECM Start Up Fault/FACI Reset Transfer Error

No è

* Do Nothing *

No è

Do Nothiing

No è

Do Nothiing

Yes è

McuDiag = PinRst

Clear POF Flag

ECM EI, FENMI and Internal Reset Generation Disabled only for Lock Step Error in ECM

ECM EI Interrupt is Enabled for FACI Error in ECM

No è

ECM Reset ?

ECM EI, FENMI and Internal Reset Generation Disabled for all ECM Errors

Rationale: PBG Lock bits once set, don't allow the control registers to chagne its values. Hence it is required that this Start Up test is run before the Guard is configured

Rationale for using SYSERR instead of ECM interrupts:
SYSERR has multiple errors mapped to a single bit where as ECM has one bit for each error. Hence, it is easier to turn of ECM Error and have th SYSERR perform all the Interrupt as they both (FENMI and SYSERR) have high priority.

Yes è

McuDiag = EcmRst

Clear POF Flag

Check for ECM Bits that are set from reset.
FACI Reset is a special case because it is being checked in the If-Else If Conditions.
If(FACI Reset Bit Clear and No ECM Bits Set, Perform Test)
Else If (FACI Bit Set, Set BRAMDAT with FACI Error)
Else If (Any other ECM Bits set, Set BRAMDAT0 with ECM Start Up Fault)
Else (ExecStrtUpTest = False, Do Nothing)

*MCU_Init() does not clear the ECM Bits due to RESF Bits being cleared in FBL on an ECM Reset.
On a Power On Reset and SW Reset, irrespective of the RESF Bits, the MCU_Init does not clear the ECM Error Status Registers and there is no reason to clear the ECM Status Register. ECM Status Register gets cleared on a Power On Reset.

No è

Software Reset?

VCIE & VPGE disabled to run PGB startup test

VCIE disabled to run Address Parity Self Test

Yes è

Clear POF Flag

No è

Debug Mode?

Yes è

* Do Nothing *

Rationale: When out an ECM Reset, the BRAMDAT0 is loaded with ECMRESET value and cannot be over written. This value is then checked in the Reset Cause and the ECM Bits are checked if it's a Lockstep Error and the NTC is logged. Hence we do not clear the ECM Status Bits.
In the Else case Statement, we are supposed to check for the ECM bits and log it as a ECM Start Up Fault. This means that the bit was set during the window where the Init3 ends and the MCU_Init() configuraiton is complete.

No è

McuDiag = RstUkwn

Sheet 2: Additonal Rationale

Questions	Rationale
why is Nexteer using SYSERR instead of ECM errors?	Because SYSERR has multiple errors mapped to a single bit where as ECM has one bit for each error. Hence, it is easier to turn of ECM Error and have the SYSERR perform all the Interrupt as they both (FENMI and SYSERR) have high priority.
safety reason to use ECM reset as opposed to manual software reset in our design. Any reason not using the ECU reset violates a safety need?	Nexteer is performing a SW Reset on a SYSERR so that we can capture information that caused the error. Also, we drive the ErrorOut pin as a redundant safety mechanism.

Last modified October 12, 2025: Initial commit (312cf32)