Reset — Sequencing and Power‑On Initialization
Overview
Reset sequencing and power‑on initialization ensure that every subsystem starts in a valid, deterministic, and safe state. In safety‑critical designs, the order and timing of reset release must be tightly controlled to avoid partial initialization, illegal logic states, or unsafe actuator behavior. Reset sequencing is tightly coupled with power‑good validation, clock stability, and domain‑level dependencies.
This page describes the safety‑relevant aspects of reset sequencing, power‑on initialization, dependency management, and startup validation.
Power‑On Initialization Flow
A typical safe startup sequence follows this order:
- Power rails ramp up under PMIC control.
- Power‑good (PGOOD) signals assert when voltages stabilize.
- Clock sources (oscillators, PLLs) reach valid frequency and lock.
- Global reset remains asserted until power and clocks are stable.
- Reset sequencing releases domains in a controlled order.
- Software boot begins only after all dependencies are validated.
Each step must be deterministic and monitored.
Reset Sequencing
Reset sequencing defines the order in which resets are released across domains.
Why Sequencing Matters
- Prevents logic from running before its dependencies are ready.
- Ensures analog blocks stabilize before digital logic interacts with them.
- Avoids illegal states in state machines and control loops.
- Guarantees safe initialization of actuators and I/O.
Typical Reset Order
- Always‑on domain
- Clock and oscillator domain
- Core digital logic (CPU, buses)
- Peripherals and communication interfaces
- I/O and actuator domains
Reset Release Timing
Reset deassertion must be aligned with clock stability and domain readiness.
Key Timing Requirements
- Minimum reset pulse width for all registers.
- Synchronous release to avoid metastability.
- Clock‑aligned deassertion per domain.
- PGOOD‑gated release to ensure valid supply.
Safety Risks
- Registers exiting reset at different times.
- FSMs entering illegal states.
- Partial initialization due to short reset pulses.
- Reset release before clock stabilization.
Dependency Management
Subsystems often depend on:
- stable power rails
- valid clock sources
- initialized analog blocks
- calibrated references
- configured safety monitors
Reset sequencing must enforce these dependencies.
Techniques
- Reset gating based on PGOOD signals.
- Clock‑valid gating (PLL lock, oscillator ready).
- Analog‑ready flags.
- Software‑validated release for complex subsystems.
Power‑On Reset (POR) and Brown‑Out Handling
POR and brown‑out detectors ensure safe startup and prevent partial resets.
POR Requirements
- Trigger only when supply reaches valid thresholds.
- Hold reset long enough for stabilization.
- Integrate with PMIC and FCCU fault lines.
Brown‑Out Handling
- Immediate reset on undervoltage.
- Prevents corrupted memory or logic.
- Must be glitch‑filtered and supervised.
Startup Validation
After reset release, the system must validate:
- memory integrity (ECC, BIST)
- peripheral readiness
- clock stability
- sensor plausibility
- safety mechanism availability (watchdog, FCCU)
Software must not begin safety‑critical operations until all checks pass.
Safety Recommendations
- Use synchronous reset release for all clocked domains.
- Gate reset release with PGOOD and clock‑valid signals.
- Guarantee minimum reset pulse width.
- Validate startup through BIST and software checks.
- Monitor reset integrity via FCCU.
- Ensure deterministic behavior across temperature and voltage.
