According to Xinzhijia: As the automotive industry advances towards intelligence, the number of electronic/electrical systems installed in vehicles continues to increase. Public data shows that a high-end luxury car can have more than 70 electronic control units (Electronic Control Unit, ECU), among which the engine management system, chassis control system, and braking system are all safety-related systems. To achieve safe design for automotive electronic/electrical systems, the road vehicle functional safety standard ISO 26262 was officially released in 2011, which includes the system risk level assessment standard – ASIL (Automotive Safety Integrity Level).
With the advent of intelligent driving and autonomous driving, higher stability and safety levels of automotive system-on-chip (SoC) have become a necessity, triggering a new round of strategic positioning among chip manufacturers. So, how are chip giants like NVIDIA, Intel, Qualcomm, and ARM faring in this competition? Xinzhijia has compiled this in-depth article from EE Times for readers.
Whether it is the ADAS system modules that are already widely equipped in vehicles, certain L4 autonomous driving systems in testing, or concept cars that still exist only in renderings, while competing for the automotive intelligence market, they are also facing rigorous tests of their robustness in practical application scenarios. ASIL (Automotive Safety Integrity Level) is one of the important indicators for assessing the safety level of semiconductor systems in functional modules.
ASIL is an important evaluation system in the ISO 26262 standard, used to identify system hazards and assess hazard risk levels. ASIL is divided into four levels: A, B, C, and D, with A being the lowest level and D the highest level. The ASIL level determines the safety requirements for the system; the higher the ASIL level, the higher the safety requirements for the system, leading to increased costs for achieving safety, which means higher diagnostic coverage for hardware, stricter development processes, and consequently increased development costs, extended development cycles, and stringent technical requirements. The following table shows the ASIL level assessment comparison. It can be seen that if the safety level reaches D, it means that the single-point failure rate across the entire system must not exceed 1%.
*ASIL level assessment comparison table (Source: Synopsys, USA)
Except for a few MCUs (Microcontroller Units) that meet ASIL D standards, chip suppliers currently ship a large number of system chips used in ADAS, with safety levels mostly at B or C. Luca De Ambroggi, an analyst from the independent data research agency IHS Markit in the automotive field, pointed out that “To achieve ASIL D level on an ADAS system scale, most manufacturers’ current solution is to use multiple B-C level SoCs to establish a redundant system, achieving D level standards through ASIL decomposition principles.”
However, such a solution also means increased costs. Luca De Ambroggi noted that this solution is not a one-time fix; ASIL D certification is a necessary path for automotive chip manufacturers and a significant challenge that suppliers need to tackle, especially for increasingly complex system-on-chips.
In this regard, many disruptive changes come from new entrants in the market—chip manufacturers with no prior experience in automotive electronics. To catch up with automotive market competitors in the wave of autonomous driving, they are seizing the opportunity for a “curve overtaking.” For example, IP core suppliers like ARM and Synopsys are launching dual-core lockstep processors aimed at ASIL D level.
In recent years, ARM has invested heavily in developing safety processor system solutions. In 2013, ARM released the “ARMv8-R” architecture, supporting real-time embedded processors. The architecture has immediate computing capabilities and can expand various safety-related solutions applicable to ADAS, V2V communication, and more. Last September, ARM, which was recently acquired by SoftBank for $32 billion, presented the Cortex-R52 processor, an upgraded version of the previous Cortex-R5, which has passed multiple safety standard certifications, including ISO 26262.
Synopsys’s path is similar. Just a few days ago, Synopsys announced that its ARC EM series “Safety Island” modules and dual-core lockstep processors are now available and meet ASIL D level standards, equipped with self-check safety monitoring and hardware safety monitoring features, such as error correction codes for detecting system failures.
*Synopsys ASIL D level dual-core lockstep processor reusable module
Angela Raucher, head of the product line for Synopsys ARC EM processors, stated, “As more and more manufacturers begin to show interest in the automotive market, we hope to lower the industry’s entry barriers through this IP core licensing model.”
However, even so, for new players entering the automotive market, the underlying implementation still requires attention. Ian Riches, head of global automotive business at Strategy Analytics, believes that unless IP suppliers provide all design support and documentation sets, any manufacturer should cautiously plan for ASIL D level applications of intellectual property cores.
MCUs for Critical Safety Applications
Some applications for critical safety requirements have led to a classification of industry chain enterprises. This has also become an important reason for companies to compete for positioning.
Some veteran players in the automotive industry have long invested their main resources in the R&D of ASIL D level MCUs, attempting to take the lead in the race.
Riches said, “Mainstream automotive suppliers began developing ASIL D level devices before 2015. For example, Freescale, before merging with NXP, launched the MPC5643L 32-bit MCU for automotive chassis and safety applications in 2012, taking the lead in the industry.”
“If manufacturers wanted an ASIL D level processor back then, ARM was not the best choice. Now, major traditional automotive suppliers are investing heavily in developing their own D level architectures; the time has come.”
According to IHS data, ASIL D level requires ECUs to have extremely high safety performance in operations such as braking and steering.
The Path to ASIL D Level
At this year’s CES, when NVIDIA CEO Jensen Huang stood on stage, he showcased the company’s Xavier chip product, touted as the “artificial intelligence supercomputer” for autonomous vehicles. Huang introduced that this system-on-chip, expected to be released by the end of the year, has achieved ASIL C level certification, but its modules can be designed to achieve ASIL D safety functions.
In addition, the market is filled with various players positioning themselves as the “super brains” of autonomous vehicles.
Riches from Strategy Analytics emphasized, “Even though companies like NVIDIA, Intel, and Qualcomm have declared great interest and ambition in the automotive market, opportunities still exist for traditional automotive suppliers.”
And this opportunity lies in MCUs for critical safety applications.
Take Infineon as an example; its TriCore Aurix microcontroller developed for automotive applications is part of NVIDIA’s module. “Infineon’s TriCore core is an important component that enables NVIDIA’s solution to meet D level standards.”
However, the automotive “super brains” laid out by many major players are often not intended for use in ADAS; instead, they are turning to the larger blue ocean of autonomous driving. For instance, NXP’s open-source autonomous driving computing platform Bluebox and Renesas’s 64-bit in-vehicle processor RCar are both attempting to compete with existing in-vehicle devices.
Let’s take a look at what NXP has to say.
Currently, NXP has two architectures of chip products, one based on Power Architecture technology (lockstep architecture, capable of reaching ASIL D level standards) and the other based on ARM architecture. For future product line planning, NXP hopes to achieve ASIL D level based on existing ASIL B level ARM cores using lockstep architecture.
*NXP’s S32V234 architecture for ADAS
Now, five years have passed since NXP released its first automotive safety development kit for the general market, the MPC5643L, but even so, an NXP spokesperson stated that achieving ASIL D level for products is still not an easy task. NXP chose to collaborate with an independent organization (Exida) during the certification phase of the MPC5643L; this chip is based on Power architecture and supports lockstep mode. According to NXP, this collaboration with Exida lasted more than a year, consuming a massive amount of communication and coordination resources.
Meanwhile, NXP announced that its “Safe Assure” process has been completed, which aims to help NXP customers achieve the required safety certification levels. NXP claims that “Safe Assure” is developed with the ISO26262 ASIL standard as the goal, covering development processes, chip products, software products, and supporting documentation, significantly reducing the difficulty of obtaining safety certification from a system level.
After that, NXP upgraded the standard automotive development protocol of its products to meet ISO 26262 requirements, which includes built-in independent safety assessment modules.
In summary, ASIL certification is not a simple one-time test, but is deeply embedded in the entire chip development cycle. It involves not only additional safety functions added during the development process but also a corporate culture that prioritizes safety. In the product development and production stages, safety management, safety planning, safety timing, safety assessment, safety thinking, safety analysis, and safety documentation are all indispensable. An NXP spokesperson stated.
Simplifying Processes
The IP core industry model represented by ARM and Synopsys focuses on significantly reducing development time. Chip manufacturers can quickly design, verify, and then release safety SoCs for ADAS or autonomous driving under mature IP core licensing.
Synopsys’s Raucher explained: Safety SoC chips for autonomous driving may require up to six months of additional verification time.
For general SoCs, the chip verification process will first test for systemic failures, which are failures caused by chip/software bugs and specification errors. However, for SoCs with higher safety requirements, it is necessary to test for failures caused by random factors, which geometrically increases the testing workload. Errors may arise from transistor failures, poor circuit contacts, or even soft faults caused by interactions between high-energy particles and silicon elements. Testing must also confirm whether these failures are permanent, temporary, or potential.
In light of the above background, if IP vendors provide pre-configured, ASIL D level verified processors to chip manufacturers, it will be very helpful for the development of safety SoCs. High safety SoCs require error correction and detection, need synchronous redundant cores to run the same code as the main core, and require additional control units to compare the output results of the main core and redundant core, as well as a massive amount of documentation to comply with ISO 26262 standards. Raucher explained.
For ARM and Synopsys, they offer processor solutions aimed at ASIL D level with similar architectures.
ARM describes its Cortex-R52 solution as follows:
-
Supports dual-core lockstep mode operation, with additional comparators for comparing the output results of the dual cores.
-
Provides additional multiple failure detection functions.
-
Designed for ASIL-D standards.
Additionally, ARM’s senior product marketing manager Phil Burr added that ARM will provide a complete set of safety documentation aimed at ASIL-D standards during the design process for partner manufacturers, which can significantly simplify the process of obtaining ASIL-D certification.
*ARM Cortex R52 architecture schematic
ARM has established a reputation in the industry for its rich experience in safety-certified chips. Although the latest Cortex-R52 architecture chips have not yet been launched, there are already similar mature products on the market. For example, the TI TMS570LS10206 dual-core lockstep device based on ARM has already achieved SIL3 certification, which is equivalent to ASIL D level.
Synopsys also has ambitions in the consumer electronics field and is currently looking to establish commercial partnerships with consumer electronics chip manufacturers familiar with ARC cores. Synopsys plans to design system-level chip architectures that can simultaneously penetrate both the consumer electronics market and the automotive semiconductor market.
In Riches’ view from Strategic Analysis, “ARM is certainly trying to expand its market share in the automotive semiconductor field, and ARM has a significant advantage over Synopsys.”
First, ARM already has market-ready products; second, ARM has established partnerships with numerous automotive chip suppliers. Synopsys’s primary challenge is to build a giant ecosystem like ARM, which includes not only third-party support in operating systems but also corresponding development tools to compete with ARM.
Why is ASIL-D so Urgent?
If your vehicle overall meets the ISO 26262 ASIL-D level standard, it means that in the face of certain critical safety issues, the vehicle can make decisions on your behalf. In contrast, for vehicles meeting the ASIL-B level standard, the vehicle will only alert the driver to impending dangers, and specific actions need to be executed by the driver.
Currently, the actual deployed ADAS systems still require the driver to be ready to intervene at any time. So, why is there such an urgent demand for ASIL-D level chips in the industry? Do ASIL-D level SoCs really have practical significance?
NXP believes the answer lies with automotive OEM manufacturers, as OEM manufacturers need to balance product robustness with development speed, and insufficient reliability can easily lead to litigation.
On one hand, the entire industry is racing to deploy “high-performance computing systems to provide computing power for autonomous driving decisions”; on the other hand, the diverse automotive control subsystems on autonomous vehicles must “maintain a high level of safety while providing various intelligent functions.”
Based on this, as the industry embraces autonomous driving, OEM manufacturers are seeking engineering solutions that are feasible. These solutions must meet stringent safety standards while providing rapid product iteration capabilities and sufficient computing power.
“Safety standard-compliant system-level chips are the optimal solution to this tricky problem,” NXP asserts.
De Ambroggi from the independent data research agency IHS Markit draws a similar conclusion from another perspective. He believes that OEM manufacturers have not yet made explicit demands for ASIL-D because, from a demand perspective, it is not yet urgent. “However, if ASIL D level chips are priced the same as ordinary chips, all OEM manufacturers would be happy to use and promote them, as this solution clearly saves them costs. This not only saves the costs of additional redundant devices but also spares OEM manufacturers from dealing with more complex solutions, which is evidently promising.”
Meanwhile, the ASIL D level safety standard has been a focus of the automotive industry for many years, and the ASIL-D standard is not only applicable to ADAS or autonomous driving systems but also to various safety-related systems, such as braking systems and steering assist systems. Thus, Riches concludes that beyond autonomous driving systems, ASIL D level chips have a larger application space, and related demand is expected to maintain growth momentum in the coming years.
**Images from the internet
Recommended Reading:
Infineon CEO Interview: What Creates the “Zero Failure” of Autonomous Vehicles?
Long press to recognize the image QR code, subscribe to “Xinzhijia”.
For more fresh news, click “Read the original text.”
