Boot & Reset Safety

Boot and reset safety is the engineering of the transitions every ECU makes between off and safely operating: power-on reset, the boot chain through boot ROM and bootloader to application start, resets of every kind, degraded startup, and safe shutdown. These are the most dangerous seconds of the lifecycle because diagnostics are not yet armed, outputs are in transition, and faults can exist that no runtime mechanism will ever see. Under ISO 26262 this work spans system-level safe states and arming under Part 4, hardware self-tests and monitoring under Part 5, and the software startup, watchdog and shutdown design under Part 6.

A typical set includes logic BIST (LBIST) exercising the CPU and safety logic, memory tests such as march tests over RAM, flash checksum verification, configuration register checks, and tests of the monitoring hardware itself, such as watchdog and voltage-monitor checks. The design problem is budget: every test costs boot time, and functions have startup deadlines. The course shows how to place tests across startup, runtime and shutdown so the coverage claim holds without missing the arming deadline.

A reset storm is a loop where a fault triggers a reset, the restart re-encounters the fault, and the ECU cycles indefinitely - resetting fast enough that it never stays up long enough to report, degrade or protect anything. The defenses are architectural: reset-cause recording that survives the reset, escalation counters that distinguish one recovery from a loop, storm breakers that stop retrying after a threshold, and a parking state that holds the ECU in a safe, diagnosable condition instead of endlessly rebooting.

Because the ECU ends up half-dead: supply voltage sags low enough that guarantees are lost - RAM may be corrupted, peripherals misconfigured - but not low enough for a clean power-on reset. Logic may keep running on invalid state. Handling it needs explicit brownout detection thresholds, a decision policy between resuming and forcing a full reset, and RAM validity marking so the next boot knows what it can trust. Chapter 11 is dedicated to exactly this recovery problem.

It contains 14 chapters: why startup and shutdown are uniquely risky, the anatomy of an automotive boot chain, a taxonomy of resets, power and voltage edges, startup self-tests, the arming sequence, watchdog behaviour across the lifecycle, reset storms, degraded startup and limp home, safe shutdown, brownout recovery, multi-core and secure boot platforms, and the ISO 26262 mapping. The final chapter delivers eight reusable patterns, a worked boot budget for a steering-assist-class ECU, ten pitfalls and a reviewer checklist.