Safe reset techniques for microcontroller systems in safety related applications

A method for safe reset in a system including a microcontroller and a plurality of registers, the method comprising:

• detecting a reset signal, and resetting at least some of the plurality of registers based on the reset signal, wherein the resetting sets at least one of the plurality of registers to respective actual reset values that differ from expected initialization values;
• calculating a signature value based on the actual reset values;
• determining whether the at least some of the plurality of registers have initialized correctly by comparing the calculated signature value to a predetermined signature value, the predetermined signature value based on the expected initialization values;
• and
• operating the system in a trusted state only if the calculated signature value is bitwise identical to the predetermined signature value, and entering a degraded safety state or un-safe state if the calculated signature value differs from the predetermined signature value.

A microcontroller system, comprising:

• a processing unit;
• a plurality of peripherals coupled to the processing unit through a bus interface;
• a reset module coupled to the processing unit and the plurality of peripherals, the reset module configured to provide a plurality of reset signals which reset different combinations of the plurality of peripherals, wherein a first reset signal resets a first combination of the plurality of peripherals and a second reset signal resets a second combination of the plurality of peripherals;
• and
• an assurance module configured to calculate a first signature value in response to the first reset signal and calculate a second signature value in response to the second reset signal, wherein the first signature value is based on actual reset values for registers of the first combination of the plurality of peripherals and the second signature value is based on actual reset values for registers of the second combination of the plurality of peripherals;
• wherein the processing unit is configured to perform a first comparison between the calculated first signature value and a pre-determined first signature value to determine whether the microcontroller system is in a trusted safety state, wherein the first comparison is performed in response to the first reset signal, and wherein the pre-determined first signature value is based on expected reset values for the registers of the first combination of the plurality of peripherals.