ARM Updates Automotive Product LineReleased four CPUs, an ISP, and infrastructure, all featuring functional safety characteristicsArm’s latest automotive intellectual property (IP) products include not only four new CPUs but also an image signal processor (ISP) and modules that enable the configuration of functional safety computing clusters. The IP configuration options allow developers to target systems with a range of safety-critical requirements.The new CPUs include two automotive versions of the Cortex-A series: Cortex-A520AE and Cortex-A720AE, as well as Cortex-R82AE and Neoverse V3AE. The Mali-C720AE is a new ISP capable of handling parallel workloads for computer vision and human perspective displays. These processors are equipped with consistent and non-consistent interconnects, namely Neoverse CMN-S3AE and CoreLink NI-710AE. The CoreLink GIC-720AE is a general-purpose interrupt controller that supports mixed-criticality, enhancing the overall product line.The automotive version CPUs execute the same programs as their non-automotive counterparts. The difference lies in their ability to detect and respond to any faults that occur during operation.Functional safety in automotive applications is governed by ISO 26262 (see MPR report August 2022, “Functional Safety Steering to Chips”); systems must demonstrate recovery capabilities against deterministic faults (essentially design errors) and random (or latent) faults (errors unrelated to the original design quality). This is primarily achieved through the use of trusted tools to eliminate systematic faults; random faults are managed through additional circuitry. The standard defines four Automotive Safety Integrity Levels (ASIL); the most common are ASIL B (for less critical functions) and ASIL D (for the most critical functions).All of ARM’s new modules meet the ASIL D requirements for systematic faults. Depending on the module and configuration, random faults can achieve ASIL B or D. They are now ready for licensing.Three Modes of Cortex-A CPUsLike previous automotive CPUs, Arm supports three basic modes for functional safety purposes on its new Cortex-A CPUs: split, lock, and hybrid, as shown in Figure 1. The split mode has no redundancy, so all CPUs operate independently. The lock mode, on the other hand, pairs all CPUs to run in lockstep, effectively halving the number of usable CPUs since half are used for redundancy rather than independent programmability. In lock mode, the DynamIQ Shared Unit (DSU; see MPR report July 2023, “Arm DSU-120 Reduces Dynamic and Static Power”) in the interconnect cluster is also replicated to create lockstep DSU pairs.
Figure 1 Arm Automotive CPU Configuration(DSU=DynamIQ Shared Unit. In the lock configuration, all CPUs and DSUs are replicated and synchronized. The split configuration does not use redundancy. The hybrid configuration only replicates the DSU while keeping the CPUs independent.)The hybrid mode only replicates the DSU while the CPUs remain independent. It provides sufficient redundancy to help developers achieve ASIL B systems while saving chip area. A complete ASIL D system requires the lock mode.In these configurations, either all CPUs are independent (up to 14 cores per cluster, compared to 4 previously), or all CPUs are in lockstep (up to 7 lockstep pairs per cluster). Cadence also allows a configuration called “hybrid” at design time; it includes the redundancy logic required for lock mode but allows for startup in either split or lock mode. When in split mode, the replicated DSU is not used, but the area loss is minimal since most of the area is L3 cache, which is not replicated but protected by error-correcting code (ECC).Protection Features of Cortex-A CPUsThe new 520AE and 720AE core CPUs (see MPR report June 2023, “Cortex-X4 is a 10-Instruction Wide Machine”) and R82AE (see MPR report September 2020, “Cortex-R82 Brings Linux to SSDs”) include four functional safety features that are also present in older automotive-grade CPUs. The first feature protects stored content through ECC, which can correct single-bit errors and detect double-bit errors (SECDED).The second feature is interface protection, which safeguards the integrity of data transmitted between the CPU and other modules through the interconnect system. The sending module adds parity bits to each data packet, and the parity checker in the receiving module confirms the integrity of the received data. An implicit assumption is that two errors leading to correct parity are unlikely to require further redundancy. If multiple bit errors are anticipated, the NI-720AE allows for an older ECC protection model, which is also used in Cortex-R52.Transient fault protection is an optional feature that can flag errors in critical flip-flop states. During design, developers identify the flip-flops that need protection, and the compiler instantiates parity logic for these flip-flops so that single-bit errors can be detected.Finally, a strategy to promote system safety is to use regular testing to ensure all components maintain full functionality. This is straightforward for structured elements like memory, which benefit from built-in self-test (BIST; for memory versions, MBIST). However, digital logic in CPUs lacks this structure, necessitating more targeted software testing. Arm is providing libraries for such testing.The new Neoverse V3AE (see MPR report March 2024, “Arm Adds Compute Subsystem to V3”) targets maximum single-thread performance but lacks two protection features present in Cortex models: interface protection and software testing libraries. Additionally, split-lock is not available, meaning all pairs must operate in lockstep. When asked why this core has fewer safety features than others, Arm stated that it optimized functionality for the intended use of this core but did not disclose specific details.Automotive ISPArm also introduced the Mali ISP for automotive use. Given the importance of perception sensors for supporting autonomous decision-making and providing images to occupants, this ISP features two parallel pipelines, one for computer vision and one for human vision, as shown in Figure 2. These pipelines can transmit data to multiple different outputs; multiple output pipelines can be used to tailor each output stream to its destination.
Figure 2 Mali-C720AE Architecture(The parallel computer vision and human vision pipelines support streams driven by traditional and AI algorithms for autonomous decision-making, as well as decisions that humans will see in the cockpit or other seats. Multiple output pipelines also run in parallel. In medium and small configurations, modules with dashed borders can be omitted; some other functional modules can also be omitted.)In addition to the main output pipeline, the ISP has several other dedicated outputs. These outputs provide:* Unprocessed raw images* Infrared images from RGBIr sensors, at quarter or full resolution* Foveated Vision (downsampled full field of view and full resolution for regions of interest)* Gaussian Pyramid output (one for each output pipeline)The ISP has three configurations: large, medium, and small. The large configuration includes all modules shown in Figure 2. The medium configuration omits some functional modules (e.g., chroma) and has only two output pipelines. The small configuration assumes the ISP only drives computer vision algorithms without a display, thus omitting the human vision pipeline and some other modules, such as spatial noise reduction.All three configurations have the same safety features. These features include RAM with ECC or parity, configuration registers, and CRC checks on critical paths, as well as BIST for complex functional modules.Arm also offers a differentiable model of the ISP, which can be purchased separately from the ISP. The differentiable nature of the model means users can compute gradients and perform backpropagation to establish calibration parameter tables, similar to how neural models are trained. ARM states this can save months of work and allow for collaborative development of ISP settings and perception algorithms.Cluster Infrastructure Gains SafetyArm also provides automotive versions of its system IP: mesh networks that coherently connect CPU clusters, non-coherent interconnects, and general-purpose interrupt controllers. ARM states that its consistent mesh network Neoverse CMN S3AE incorporates “a range of safety features, including ECC, parity mechanisms, and other technologies.” ARM has not disclosed details publicly, sharing them only with partners under confidentiality agreements. It is branded as Neoverse because it primarily targets infrastructure applications, similar to Neoverse CPU cores, but ARM also supports Cortex-A CPUs through DSU.The CoreLink NI-710AE non-coherent interconnect includes various safety mechanisms.* It allows dual lockstep configurations and provides redundancy through shadow versions.* It protects AMBA signals through parity or traditional ECC.* It protects asynchronous signals with copies that have opposite polarity to the main signals.* It can protect copies of other miscellaneous non-AMBA signals, some with the same polarity and some with opposite polarity. Two of these signals use odd parity. Profiling and debug signals are not protected.* Access protection units safeguard address regions.* Packet source identifiers allow for firewalling at routing destinations.* Internal networks are protected using CRC.* Entry endpoints are replicated and have hang detection.* Fault management units monitor and report errors.Finally, the CoreLink GIC-720AE is a general-purpose interface controller designed to allow mixed-criticality, supporting all CPUs through a single controller. It includes critical logic redundancy, ECC memory protection, and fault detection for stream interfaces; the fault management unit performs error detection and reporting. It keeps its management software stack unaffected, ensuring that interrupt handlers do not interfere with code executing on different cores.Only Compute Subsystem ProviderDespite being at the forefront during the hype cycle, the automotive industry is gradually increasing the number of electronic devices in vehicles and using these devices for systems that affect vehicle safety. While existing automotive system-on-chip (SoC) solutions rely on older CPUs, higher levels of vehicle autonomy will require more powerful CPUs and more multicore clusters. The centralization of electronic control units also involves multiple functions with different safety criticalities on the same chip. Thus, CPUs can collaboratively handle a task or take on different tasks that cannot interfere with each other.Arm’s new automotive products not only include four new CPUs (Cortex-A520AE, Cortex-A720AE, Cortex-R82AE, and Neoverse V3AE) but also introduce system IP that guarantees functional safety. Consistent coherent and non-coherent interconnect solutions, along with the new general-purpose interrupt controller, save developers time by providing safety-ready IP and documentation, helping customers demonstrate their functional safety.One of the CPUs, Neoverse V3AE, has fewer safety features. If customers wish to use it in ways not anticipated by Arm, they may encounter difficulties. The company may have reasons for making such a choice, but it has not publicly articulated a clear rationale.Although Arm cores dominate in application-level CPUs, several companies already offer automotive-grade CPUs, including Andes, Cadence, Nuclei, SiFive, and Synopsys. The uniqueness of Arm’s products lies in the compute cluster infrastructure. Other IP vendors primarily focus on functional modules (besides CPUs, memory interfaces, communication interfaces, and security managers), but customers must assemble lower-level pipelines in a way that meets safety standards. Arm’s approach saves development time.From a development perspective, Arm’s automotive CPUs operate the same way as their non-automotive counterparts. Therefore, software can run on either version, simplifying code startup. Using the new IP is not as simple as plugging it in, as there are many configurations available, and modules must be adjusted for the desired functionality and safety criticality.With this release, Arm further strengthens its already robust domain. The new cores and infrastructure will help it maintain this dominance.Pricing and Availability:Arm’s new automotive CPU cores and core cluster infrastructure are now available for licensing. ARM has not disclosed licensing terms and fees. For more information, please visit the company’s website at https://www.arm.com/products/silicon-ip-cpu/automotive-enhanced.
