Patent ID: 12253562

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

In the following description, numerous specific details are given to provide a thorough understanding of embodiments. The embodiments can be practiced without one or several specific details, or with other methods, components, materials, etc. In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the embodiments.

Reference throughout this specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, the appearances of the phrases “in one embodiment” or “in an embodiment” in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

The headings provided herein are for convenience only and do not interpret the scope or meaning of the embodiments.

In the followingFIGS.3to7parts, elements or components which have already been described with reference toFIGS.1to2are denoted by the same references previously used in such Figure; the description of such previously described elements will not be repeated in the following in order not to overburden the present detailed description.

As mentioned before, various embodiments of the present disclosure provide solutions for verifying the correct operation of a reset circuit of a processing system. For a general description of a processing system comprising such a reset circuit may thus be made reference to the previous description ofFIGS.1to2.

Accordingly, various embodiments of the present disclosure provide solutions for validating the operation of a reset circuit, in particularly with respect to the functionality of the reset generation logic and also the connection of the reset-request signals RT, with the target to avoid that a reset-request might be lost because of a possible malfunction.

Moreover, in various embodiments, the solution may not only verify each reset-request signal RT generated within the processing system, but also the connection of the reset signals RST to the individual circuits.

Various embodiments of the present disclosure may thus be used to provide a coverage according the ASIL-D level of the ISO26262 specification.

FIG.3shows an embodiment of a reset circuit116a, also called reset generator circuit. Specifically, in the embodiment considered, and as described in the foregoing, the reset circuit116ais configured to receive at least one reset-request signal RT, such as signals RT1, . . . , RTm, and generates at least one reset signal RST, such as signals RST1, . . . , RSTp. For example, the reset-request signals RT and/or reset signals RST may be trigger signals, i.e., a signal wherein an event is signaled via a pulse of a given number of clock cycles.

For example, in various embodiments, the reset circuit116amay be configured to generate a single system reset signal, which is provided to all circuits receiving a reset signal.

Alternatively, one or more of the circuits, such as the circuits100,102,106and/or110, may receive individual reset signals as shown inFIG.2. For example, in this case, the reset circuit116amay be implemented with a sequential logic circuit/finite state machine (FSM) configured to generate a system reset by selectively asserting and de-asserting the individual reset signals in sequence. In fact, the reset process of a system reset may comprise a sequence of states, wherein each state is dedicated to a different task, such as an initialization phase for initializing the NVM memory104, the configuration phase for reading configuration data from the NVM memory104and storing these configuration data to registers of the processing system, etc. For example, in this context may be cited Italian Patent Application n. 102021000007871, which is incorporated herein by reference for this purpose.

Accordingly, the use of individual reset signal RST has the advantage that the reset signals RST may be used to activate or de-activate the reset of several IPs at precise moments during the evolution of the reset sequence.

Moreover, by using individual reset signals RST one or more of the circuits may also be reset during the run-time of the processing system, e.g., a resource106may be reset while the processing core(s)102are not reset. Accordingly, in order to resolve local malfunctions of a given circuit without the need of a global system reset, the respective circuit may be reset while the micro-processor(s)1020are still executing software instruction.

Generally, the following solutions for testing the reset circuit116acould be used in both cases, i.e., when the reset signal or the reset signals RST generated by the reset circuit116acomprise a common system reset signal and/or a plurality of individual reset signals.

FIG.4shows an embodiment of the implementation of the reset circuit116a.

In the embodiment considered, the reset circuit116areceives again a plurality of reset-request signals RT, which are generated by various circuits, such as a processing core102or a fault collection and error management circuit120.

In the embodiment considered, the reset circuit116ais configured to generate one or more combined reset-request signals CRT as a function of the reset-request signals RT. For example, in various embodiments, a combined reset-request signal CRT is generated via a combinational logic circuit1166configured to:assert the combined reset-request signal CRT when at least one of the reset-request signal RT is asserted; andde-assert the combined reset-request signal CRT when all reset-request signals RT are de-asserted.

For example, assuming that the reset-request signals RT and the combined reset-request signal CRT are asserted when the respective signal is set to high, the combinational logic circuit1166may be implemented with a logic OR gate.

In various embodiments, the reset circuit116ais configured to selectively enable or disable one or more (and possibly all) reset-request signals RT. For example, for this purpose, a reset-request signal RT may be provided to a logic gate1162configured to mask or unmask the respective reset-request signal RT when a respective masking signal TE has a given logic level. For example, assuming that a reset-request signal RT is asserted when the signal is set to high and the signal should be masked when the masking signal TE is set to low, the combinational logic circuit1162may be implemented with a logic AND gate receiving at input a given reset-request signal RT and the respective masking signal TE.

In various embodiments, one or more (and possibly all) reset-request signals RT may be synchronized via a respective synchronization circuit1164, e.g., implemented via a flip-flop or a plurality of flip-flops connected in cascade. Such a synchronization circuit1164is often preferable, because a trigger in a reset-request signal RT may be generated by a circuit, which might be running with a different clock with respect to the clock used by the reset circuit116a, which preferably is a safe internal oscillator clock.

Accordingly, in various embodiments, one or more of the reset-request signals RT1, . . . RTm, may be provided to a respective sub-circuit1160, such as11601, . . .1160m, wherein each sub-circuit1160may comprise a masking circuit1162receiving a respective masking signal, such as masking signal TE1, . . . TEm, and/or a synchronization circuit1164. Generally, the position of the masking circuit1162and the synchronization circuit1164may also be inverted, i.e., the synchronization circuit may synchronize a reset-request signal RT and the masking circuit1162may selectively mask the synchronized reset-request signal.

In various embodiments, the reset circuit116amay be configured to generated a plurality of combined reset-request signal CRT by repeating the sub-circuits1160and the combinational logic circuit1166. Specifically, in this case, each reset-request signal RT may have associated a plurality of sub-circuits1160wherein each sub-circuits receives a respective masking signal TE.

In the embodiment considered, the one or more combined reset-request signals CRT are provided to a reset management circuit1168configured to generate one or more reset signal RST as a function of the one or more combined reset-request signals CRT. For example, in this way, the reset management circuit1168may be activated when anyone of the (unmasked) reset-request signals RT is asserted, e.g., is set to high.

For example, when only a single system reset signal RST is used, the system reset signal RST may correspond to a combined reset-request signal CRT, or the reset management circuit1168may be implemented with a combinational logic circuit configured to generate the system reset signal RST as a function of one or more of the combined reset-request signals CRT.

However, as mentioned before, usually, the reset circuit116a, and in particularly the reset management circuit1168, is configured to generate a plurality of reset signals RST1, . . . , RSTp, wherein the reset circuit selectively asserts and de-asserts one or more of the reset signals RST1, . . . , RSTpaccording to a given and usually predetermined sequence. Accordingly, in this case, the reset management circuit1168may be implemented with a sequential logic circuit implementing a finite state machine configured to control a sequence of operations.

Accordingly, in various embodiments, in order to verify the operation of the reset circuit116a, the processing system is configured to verify one or more of (and preferably all):the connectivity/connection between the circuit generating a reset-request signal RT and the reset circuit116a;the operation of the optional sub-circuits1160, i.e.:a) the masking of the respective reset-request signal RT via the masking circuit1162, and/orb) the synchronization of the respective reset-request signal RT or the respective signal at the output of the masking circuit1162via the synchronization circuit1164, and the respective storage of the synchronized signal to a flip-flop; andthe operation of the combinational logic circuit1166used to generate the combined reset signal CRT.

In various embodiments, the processing system is also configured to verify at least one of:the operation of the reset management circuit1168; andthe connectivity of the reset signals RST to the respective circuits receiving the reset signals RST.

However, these additional verifications are purely optional, because the processing system may be configured to remain after a power-on in a wait state until a reset is received. Accordingly, in this case, the processing system, in particular the processing cores102, would not be started when the reset management circuit1168of the connectivity to the circuits to be reset is not working correctly.

Accordingly, the test of the reset management circuit1168and of the connectivity to the circuits to be reset may be considered covered implicitly by testing the connection to the reset circuit116a, the operation of the combinational logic circuit1166and optionally the sub-circuits1160. For example, in case of safety critical applications, the operation of the processing system may be monitored via an external watchdog timer, e.g., forming part of a further processing system configured to monitor the operation of an electronic system comprising a plurality of processing systems (see alsoFIG.1). Accordingly, in case the initial reset phase after a power-on would not be started or would not be completed, the processing system would not signal the completion of the initialization of the processing system to the watchdog timer (e.g., by asserting a given signal provided to the watchdog timer via software instructions executed by a processing core102). Accordingly, the external watchdog timer will detect the malfunction of the processing system. For example, in this case, the further processing system may deactivate one or more functionalities at system level and/or may report a malfunction of the processing system.

FIG.5shows an embodiment of a processing system10aaccording to the present disclosure.

In the embodiment considered, the processing system10acomprises again a reset circuit116aconfigured to receive a plurality of reset-request signals RT. For example, in the embodiment considered, a first reset-request signal RT115is generated by a power supply monitoring circuit115configured to monitor a supply voltage of the processing system10a. For example, the power supply monitoring circuit115may comprise for this purpose a comparator, e.g., a comparator with hysteresis, i.e., a Schmitt trigger, configured to compare the supply voltage with one or more threshold values. Accordingly, in this way, the signal RT115may request a reset of the processing system10awhen the processing system10ais switched on.

As described in the foregoing, further reset-request signals RT may be provided by other circuits, such as IP cores, of the processing system10a. For example, in various embodiments, one or more second reset-request signals RT102may be provided by each processing core102of the processing system10a. For example, in this way, a reset-request signal RT102may be asserted via software instructions executed by the respective microprocessor1020. Additionally or alternatively, one or more reset-request signals RT120may be provided by fault collection and error management circuit120. For example, in this case, a reset-request signal RT120may be asserted in case of a malfunction signaled via one or more error signals ERR (see the description ofFIG.2). Additionally or alternatively, one or more reset-request signals RTRPmay be provided by one or more respective terminals RP of the processing system10a, such as pins or pads of a respective integrated circuit comprising the processing system, in particular the circuits102,115,116a,120.

In the embodiment considered, the reset circuit116areceives thus the signals RT, e.g., the signals RT102, RT115, RT120and RTRP. In the embodiment considered, each reset signal RT is then provided to a respective sub-circuit1160of the reset circuit116a. As mentioned before, the sub-circuits, and the respective masking circuit1162and/or synchronization circuit1164, are purely optional. For example, each of the reset-request signals RT102, RT120and RTRPmay be provided to a respective sub-circuit1160comprising at least the synchronization circuit1160, and preferably also the masking circuit1162. Conversely, the sub-circuit1160for the reset-request signal RT115generated by the power supply monitoring circuit115may be omitted or may only comprise the synchronization circuit1164, i.e., the reset-request signal RT115may not be masked, because usually such a reset in response to a power-on of the processing system10ais necessary.

For example, in the embodiment considered, the masking signals TE, such as signals TE102, TE120and TERP, may be provided by a circuit117. For example, the circuit may be a register interface connected to the communication system114, which thus permits that the logic levels of the masking signals TE (or at least a subset thereof) may be programmable, e.g., via software instructions executed by a processing core102.

As described in the foregoing, in various embodiments, the processing system10ais configured to test the whole chain from the generation of the reset-request signals RT till the output of the combinational logic circuit1166configured to generate a combined reset-request signal CRT.

In various embodiments, the processing system10acomprises for this purpose a test circuit, configured to execute a Reset Built-In Self-Test, also identified as R-BIST in the following. Specifically, as will be described in greater detail in the following the test circuit comprises a control circuit40, e.g., a hardware sequential logic circuit implementing an FSM, which sequentially asserts one reset-request signals RT at a time and validates the correctness of the combined reset-request signal(s) CRT after the combinational logic circuit(s)1166.

Specifically, in various embodiments, with one or more reset-request signals RT is associated a respective combinational logic circuit420configured to selectively assert the respective reset-request signal RT as a function of a respective (connectivity) test signal CT. For example, inFIG.5are shown combinational logic circuits420102,420115,420120and420RPand respective test signals CT102, CT115, CT120and CTRPfor the reset quests signal RT102, RT115, RT120and RTRP. For example, assuming that a reset-request signal RT is asserted when the signal is set to high, each combinational logic circuit420may be implemented with a logic OR gate, whereby the reset-request signal is asserted when the respective test signal CT is set to high. Generally, the combinational logic circuit420may not be provided for all reset-request signals RT. For example, the combinational logic circuit420115for the reset-request signal RT115may be omitted, because the processing system10awould never be started when this reset-request signal RT115would not work correctly.

Specifically, in various embodiments, the modified reset-request signal RT′ is generated prior to the transmission via the lines within the integrated circuit, i.e., the distance between the circuit420and the respective circuit generating the reset-request signal RT is smaller than the distance between the circuit4200and the reset circuit116a. Accordingly, in the embodiment considered, the reset circuit116ais configured to receive the reset-request signals RT′ (instead of the original reset-request signals RT). Accordingly, in various embodiments, each combinational logic circuit420is provided at the output of the respective circuit generating respective the reset-request signal RT and may also be integrated within the respective circuit, e.g.:the combinational logic circuit420102is provided at the output of (or is integrated in) the respective processing core102;the combinational logic circuit420115is provided at the output of (or is integrated in) the power supply monitoring circuit115;the combinational logic circuit420120is provided at the output of (or is integrated in) the fault collection and error management circuit120; andthe combinational logic circuit420RPis provided at the output of (or is integrated in) the input circuit of the pin or pad RP.

Accordingly, the circuits420may be used to generate a modified reset-request signal RT′, e.g., modified reset-request signals RT′102, RT′115, RT′120and RT′RP, by selectively asserting the original reset-request signals RT102, RT115, RT120and RTRPvia the test signals CT102, CT115, CT120and CTRP. As mentioned before, the combinational logic circuit420may also not be provided for all reset-request signals RT.

In the embodiment, the reset circuit116acomprises also an additional masking circuit422configured to selectively mask or unmask the combined reset-request signal(s) CRT when a test mode signal TM is asserted. For example, assuming that the combined reset-request signa(s) CRT are asserted by setting the signal to high and the combined reset-request signa(s) CRT should be masked when the signal TM is set to low, the additional masking circuit422may be implemented with a logic AND gate.

Accordingly, in the embodiment considered, the test signals CT, such as CT102, CT115, CT120and CTRP, and the test mode signal TM are generated/provided by the control circuit40. Moreover, the control circuit40monitors the combine reset-request signal(s) CRT.

FIG.6shows an embodiment of the operation of the test circuit, in particular the control circuit40.

Specifically, after a start step1000, the control circuit40waits at a step1002until a test of the reset circuit116ais requested.

Generally, the test may be requested via software and/or via hardware. For example, for this purpose, the control circuit40may be connected to the communication system114. For example, in this case, a microprocessor1020of a processing core102may generate the respective test request via software instructions, wherein the test request is then transmitted to the control circuit40via the communication system114. For example, in this way may be requested one or more tests with different values for the masking signals TE, which thus permits to verify also the operation of the masking circuits1162.

However, the inventors have observed that such a software-controlled test is usually not advisable. In fact, as mentioned before, the combined reset-request signal(s) CRT are masked during the test. Accordingly, this masking would also mask a real reset-request occurring during the test. For this reason, in various embodiments, the test is requested directly in hardware as part of a Build-In Self-Test (BIST) of the processing system10a, which is executed while the microprocessor(s)1020are not started yet. For example, as shown inFIG.5, in this case, the processing system10amay comprise a diagnostic circuit118implementing a BIST control circuit. For example, as described in the previously cited document 102021000007871, in response to switching on the processing system10a, i.e., in response to one or more of the reset-request signals RT, the processing system10amay be configured to execute the following phases in sequence during a (complex) reset procedure:a first reset step, where the reset circuit116aexecutes a first (system) reset of the processing system10a;a diagnostic phase, where the diagnostic circuit118executes the one or more tests of the processing system10a;an optional second reset phase, where the reset circuit116aexecutes a second (system) reset of the processing system10a; anda software runtime phase, where the one or more microprocessors1020are started and execute software instruction.

For example, a microprocessor1020may be reset by asserting the respective reset signal RST102and the microprocessor1020may be started by de-asserting the respective reset signal RST102. Accordingly, in this case, the reset signal RST102may be asserted during the first reset phase, the diagnostic phase, and the optional second reset phase. Accordingly, in general, one or more circuits of the processing system10amay be kept under reset (by asserting the respective reset signal RST) during the diagnostic phase, such as the processing core(s)102and most (or all) of the resources/peripherals106, while one or more other circuits may be active (e.g., with the respective reset signal RST being de-asserted) during the diagnostic phase, such as the memory controller110, the diagnostic circuit118and the fault collection and error management circuit120.

In various embodiments, a state control circuit, e.g., implemented within the FSM1168, may thus automatically request the execution of one or more build-in self-test operations during the reset procedure. Accordingly, in this case, the test may be requested as part of these BIST operation.

For example, this is also shown inFIG.5, where the reset management circuit1168is configured to provide a signal SDP to the diagnostic circuit118, wherein the reset management circuit1168asserts the signal SDP in order to start the diagnostic phase, i.e., request the execution of the BIST. In response to the signal SDP, the diagnostic circuit118starts then one or more tests. For example, in various embodiments, the diagnostic circuit118provides a signal SRD to the control circuit40, wherein the diagnostic circuit118asserts the signal SRD in order to request the start of the test of the reset circuit116a, i.e., the control circuit40determines at the step1002whether the signal SRD is asserted. Once the control circuit40has executed the test, the control circuit40may assert a signal ERD in order to indicate the completion of the test, and provide a signal STATE indicating the result of the tests. Accordingly, once all tests have been executed, e.g., in response to the signal ERD, the diagnostic circuit118may assert a signal EDP in order to indicate the end of the diagnostic phase. In response to the signal EDP, the reset management circuit1168may thus execute the second reset phase and/or start the microprocessor(s)1020. Usually, the diagnostic circuit118does not provide the result of the test to the reset management circuit1168, but the result (such as the signal STATE) is used to generate an error signal provided to the fault collection and error management circuit120and/or the diagnostic circuit118is connected to the communication system114, whereby a microprocessor1020may read the result(s) of the diagnostic phase by sending read requests to the communication system114. Generally, the operation of the diagnostic circuit118could also be implemented directly within the reset circuit116a, e.g., within the reset management circuit1168.

Accordingly, in case no test has been requested (output “N” of the verification step1002), the control circuit40returns to the step1002. Conversely, in case a test has been requested (output “Y” of the verification step1002), the control circuit40proceeds to a step1004where the control circuit40sets the signal TM (e.g., to low) in order to mask the combined reset-request signal(s) CRT and asserts one of the test signals CT, thereby asserting the respective reset-request signals RT′.

At a following step1006, the control circuit40evaluates then the logic level of the combined reset-request signal(s) CRT.

For example, in case the test has been requested via hardware as part of a BIST, after the (first) reset phase, the masking signals TE are usually set to not mask the reset-request signals RT, e.g., the signals TE are set to high. Accordingly, in this case, the control circuit40may be configured to compare at the step1006each combined reset-request signal CRT with a respective expected value. For example, assuming that a combined reset-request signal CRT is generated by combining all reset-request signals RT (or more specifically the received reset-requests signals RT′), the combined reset-request signal CRT should be asserted at the step1006. Accordingly, in case the combined reset-request signal CRT does not have the expected value, e.g., is set to low, the control circuit40may set the signal STATE to indicate a (general) failure of the reset circuit116aand/or a (specific) failure of the currently asserted test signal CT, and thus the respect reset-request signal RT.

At a step1008, the control circuit40may then verify whether all test signals CT have been tested. In case not all test signals CT have been tested (output “N” of the verification step1008), the control circuit40selects at a step1010a next test signal CT and returns to the step1004, where the control circuit40asserts then the selected test signal CT, and de-asserts all other test signals CT, thereby asserting only the respective reset-request signal RT′.

Conversely, in case all test signals CT have been tested (output “Y” of the verification step1008), the control circuit40sets the signal TM (e.g., to high) in order to unmask the combined reset-request signal(s) CRT, and the operation stops at a stop step1014. Optionally, the control circuit40may also signal the completion of the test at the step1012, e.g., by asserting the completion signal ERD for the diagnostic circuit118.

Accordingly, in the embodiment considered, the test circuit40,420,422sequentially asserts one of the reset-request signal RT′. Preferably, prior to verifying the logic value of the combined reset signal(s) CRT, the control circuit40waits for one or more clock cycles, in order to ensure that the logic level of the reset-request signal RT′ may be propagated to the combined reset-request signal(s) CRT. Accordingly, in this way, the control circuit40may acquire and/or verify the logic level of the combined reset-request signal(s) CRT, e.g., in order to verify whether the reset event has been propagated correctly to the output of the combinational logic circuit1166. During the test mode, the reset event does not generate an actual reset, because the combined reset-request signal(s) CRT are masked via the masking circuit422and the test-mode signal TM.

In various embodiments, no additional circuits may be provided in order to test the correct functionality of the masking circuit422. In fact, the correct functionality of this masking gate422is implicitly granted by two facts:in case the output of the masking gate422would be stuck at a level that prevents any reset to be propagated correctly to the reset management circuit1168, then the processing system10a, in particular the processing core(s)102, would never be started after a power-on reset-request RT115and an external watchdog may be used to detect this malfunction; andin case the output of the masking gate422would be stuck at a level that generates a reset-request, the processing system10awould stay under reset, and an external watchdog may again be used to detect this malfunction.

As mentioned before, in various embodiments, the control circuit40(or a further test circuit) may be used to also verify the reset signals RST used to reset individual circuits/IPs.

FIG.7shows an embodiment of the connection of the reset circuit116a, in particular the reset management circuit1168, to a plurality of circuits. For example, inFIG.7, the reset management circuit1168generates a plurality of p reset signals, wherein:the first reset signal RST1is provided to a memory controller100;the second reset signal RST2is provided to a processing core102;the last reset signal RSTpis provided to a resource106.

As mentioned before, other individual reset signals RST may be provided to other circuits of the processing system10a, such as a DMA controller110and the fault collection and error management circuit120.

In the embodiment considered, each reset signal RST is provided to the respective circuit via an optional synchronization circuit1170, such as synchronization circuit11701, . . . ,1170p, e.g., implemented via one or more flip-flops connected in cascade.

Moreover, in the embodiment considered, each circuit provides one or more reset-status signal RSTAT, e.g., reset-status signal RSTAT1, . . . , RSTATp, which indicate whether the respective device has received the reset-requests and/or is executing a reset.

Accordingly, in order to determine whether a reset signaled via a given reset signal RST has been correctly propagated to the respective circuit, the processing system10amay monitor the respective reset-status signals RSTAT.

Specifically, as mentioned before, the reset circuit116, in particular the reset management circuit1168may be configured to assert the reset signals RST in response to the reset-request signals RT. For example, these signals RT may signal system reset-requests, wherein the reset management circuit1168asserts and de-asserts the reset signals RST according to a predetermined sequence. For example, in order to implement a system reset, the reset management circuit1168may assert the reset signals RST almost contemporaneously and then de-assert the reset signals RST according to a given sequence, whereby the respective circuits are started in sequence. In general, by using a plurality of combined reset-request signals CRT (and optionally respective masking signals TE), different types of resets may be supported, wherein the reset management circuit1168may assert and de-assert a respective sub-set of the reset signals RST according to a respective predetermined sequence.

For example, in this case, the control circuit40may be configured to automatically monitor the signals RSTAT during the reset procedure, e.g., in response to a power-on reset RST115of the processing system10a, because in this case, all status signals RSTAT should signal that the respective circuit has received the reset-request signaled via the respective reset signal RST.

Specifically, during a reset procedure happening in response to a power-on, usually most circuits, such as the processing core(s)102and the peripherals106, are under reset also during the diagnostic/BIST phase. Conversely, other circuits may not be under reset during the diagnostic phase. However, usually these circuits, such as the memory controller100, the BIST controller118, and the fault collection and error management circuit120, are essential for the operation of the processing system10a, i.e., the microprocessor(s)1020would not start if these circuits do not operate correctly, and/or these circuits may be tested separately.

Accordingly, once the test has been requested, e.g., via the signal SRD, the control circuit40may also verify whether the reset-status signals RSTAT of these circuits are asserted, e.g., by generating a combined reset-status signal CRSTAT, e.g., via a logic AND gate1072, indicating whether all the respective reset-status signals RSTAT are asserted. Accordingly, in various embodiments, the control circuit40may be configured to just verify the logic level of the combined reset-status signal CRSTAT associated with the circuits, which should be under reset during the diagnostic phase, i.e., the circuits for which the respective reset signal RST is asserted during the diagnostic phase.

Additionally or alternatively, reset operations of individual circuits are typically not managed via reset-request signals RT, but by selectively asserting one or more of the reset signals RST via software instructions executed by a micro-processor1020. For example, in this case, the reset management circuit1168may comprise or have associated a register interface, e.g., the register interface117, used to set the logic level of one or more (and preferably all) reset signals RST, and optionally in order to read the logic level of the reset-status signals RSTAT.

Accordingly, in this case, a micro-processor1020may verify the connectivity of a given reset signal RST by asserting the respective reset signal RST and verifying the respective reset-status signals RSTAT. Additionally or alternatively, the reset-status signals RSTAT may also in this case be provided to the control circuit40. For example, the control circuit40may monitor the reset signals RST, determine whether one or more of these reset signals RST are asserted, and then determine whether the one or more reset-status signals RSTAT provided by the circuits having the reset signal asserted is also asserted. Accordingly, in case the reset signal RST of a circuit is asserted and the respective reset-status signal RSTAT provided by the same circuit is not asserted, the control circuit40may signal a failure, e.g., via an error signal ERR provided to the fault collection and error management circuit120and/or an interrupt provided to the processing core(s)102.

Accordingly, one or more of the embodiments disclosed herein provide solutions for testing the logic and associated signals used to request and generate a reset, covering both system resets reset and individual reset signals.

The described solution may be executed in hardware, with a minimal execution time, minimal area overhead, and no software intervention.

By applying the proposed scheme, the reset generation logic can be at ASIL-D level.

Of course, without prejudice to the principle of the invention, the details of construction and the embodiments may vary widely with respect to what has been described and illustrated herein purely by way of example, without thereby departing from the scope of the present invention, as defined by the ensuing claims.

While this invention has been described with reference to illustrative embodiments, this description is not intended to be construed in a limiting sense. Various modifications and combinations of the illustrative embodiments, as well as other embodiments of the invention, will be apparent to persons skilled in the art upon reference to the description. It is therefore intended that the appended claims encompass any such modifications or embodiments.