This column will introduce the disassembly analysis of intelligent vehicle controllers, presenting the latest reference designs and selection schemes for mass-produced controllers. Today, we share the intelligent networking domain controller module – TBOX of SAIC Feifan R7.
The electronic architecture of SAIC Feifan R7 is developed by Zero束, with four domain controllers: intelligent networking, intelligent computing, intelligent driving, and cockpit. The intelligent networking domain control is similar to the traditional T-box module.
TBOX stands for: Telematics Box, which is an integrated automotive electronic module that combines intelligent information processing and communication technology. It enables wireless communication between the vehicle and the outside world, providing various conveniences and safety guarantees for drivers and vehicles. The intelligent networking TBOX is usually installed below the vehicle dashboard. Through TBOX and a mobile app, many functions can be realized, such as controlling door locks, honking, flashing lights, turning on the air conditioning, starting the engine, etc.; it can also query the vehicle’s status remotely, including remaining fuel in the tank, battery level, vehicle location, and whether the vehicle is locked. In short, TBOX provides car owners with a very convenient travel experience. Below, we will analyze the magic of SAIC Feifan R7 intelligent networking – TBOX from aspects such as the TBOX shell, internal circuits, and system composition.
As shown in the figure, the shell of TBOX consists of two metal parts, with the front metal shell featuring a heat dissipation groove design.
2.2, Wiring Harness Terminal Description:
Figure 3 TBOX Wiring Harness Terminal
TBOX has power, UART/CAN bus, Ethernet ports, 4G/5G antennas, and GPS antennas.
TBOX mainly consists of SOC chip, MCU chip, communication module, encryption chip, switch chip, storage chip, power management chip, and GNSS module. As shown in the figure:
Figure 4 Composition Mind Map of Feifan R7 TBOX
Functions of each module and commonly used schemes:
3.1, The Role of SOC Chip and Common Models
The SOC chip is an important component in the automotive TBOX, responsible for processing vehicle information and implementing various functions. The SOC chip usually consists of multiple cores, with each core responsible for different tasks, allowing the TBOX to handle multiple tasks simultaneously. Common SOC chip models include NXP’s IMX6 and IMX8. These chips have powerful computing and image processing capabilities, supporting the playback of high-definition videos and real-time image analysis, providing TBOX with robust computing and processing power.
3.2, The Role of MCU Chip and Common Models
The MCU chip is a critical component for controlling various sensors and actuators in the vehicle. It monitors the vehicle’s status in real-time and controls the operation of various systems as needed. Common MCU chip models include Infineon’s TC2x and TC3x series, NXP’s S32K14X, and Renesas’ R7F7X series. These chips are characterized by high performance and low power consumption, meeting the demands of TBOX in vehicle control and monitoring.
3.3, The Function of Communication Module and Common Module Models
The communication module is a key component in TBOX that enables communication between the vehicle and the outside world. It can connect to the internet via wireless networks, transmitting vehicle information and enabling remote control. Common communication module models include Huawei’s ME909s, MH5000 series, and Quectel’s AG35, AG550, AG520, etc. These modules support 5G, 4G, and 3G networks, with Quectel’s AG520, AG550, and Huawei’s MH5000 supporting V2X, providing stable and reliable connection performance, enabling high-speed data transmission and remote control functions.
3.4, The Function of GPS Module and Common Module Models
The GPS module is a key component in TBOX used for positioning and navigation. It can receive satellite signals and calculate the accurate position of the vehicle through positioning algorithms. Common GPS module models include: Hichip’s UM960, UM982, and ublox’s ZED-F9K, ZED-F9P, ZED-F9H, etc. These modules are characterized by fast positioning, high precision, and stability, meeting TBOX’s requirements in navigation and positioning.
3.5, The Function of Switch Chip and Common Chip Models
The switch chip is an important component in TBOX that enables data exchange and communication, allowing data transmission and interaction between various subsystems within the vehicle. Common switch chip models include Broadcom’s BCM89x series and MARVELL 88Q5050 series. These chips are characterized by high bandwidth and low latency, enabling fast data transmission and real-time system interaction.
3.6, The Function of Encryption Chip and Common Chip Models
The encryption chip is a key component in TBOX that ensures data security and prevents malicious attacks. It can encrypt and decrypt data, implementing access control and identity authentication functions. Common encryption chip models include Infineon’s SLE 95250SLS32 series, Maxim’s DS28E25 series, and Shanghai Xintai’s TTM2000, TTM3000 series. These chips have advanced encryption algorithms and security features, protecting data in TBOX from unauthorized access and tampering.
Analysis of Feifan R7 TBOX
Composition diagram of Feifan R7 TBOX:
Figure 5 Composition Diagram of Feifan R7 TBOX
4.1, SOC – NXP MIMX8QX6AVLFZAC
Figure 9 MIMX8QX6AVLFZAC Physical Image
Introduction to NXP MIMX8QX6AVLFZAC
The i.MX 8X series processors are highly integrated and support graphics, video, image processing, and voice functions, meeting the needs for security certification and high energy efficiency. Suitable applications include industrial automation and control, HMI, robotics, building control, automotive dashboards, video/audio, in-vehicle infotainment systems, and in-vehicle information services, etc.
Figure 10 i.MX 8X Block Diagram
Features:
|
Processor Composite Device
|
·2-4 Cortex-A35 cores
·1 Cortex-M4F core for real-time processing
·1 Tensilica® HiFi 4 DSP
|
|
Multimedia
|
·2-4 Vec4-Shader GPUs, OpenGL® ES 3.1, OpenCL™ 1.2 EP, OpenVG™ 1.1, Vulkan®
·Video: 4K H.265 dec | 1080p H.264 enc / dec
|
|
Memory
|
·16/32-bit DDR3L-1866 and LPDDR4-2400
·1 Octal SPI or 2 Quad SPI
·ECC Function
①.Cortex-A35 L1 cache parity
②.Cortex-A35 L2 cache ECC
③.ECC protection on sDDR interface
|
|
Display & Camera
|
·2 Combined MIPI DSI (4 channels) / LVDS (1080p)
·24-bit Parallel Display I/F (WXGA)
·SafeAssure® Fault Recovery Display
·1 4-channel MIPI CSI2
·1 Parallel 8-bit CSI (BT.656)
|
|
Connectivity
|
·2 SDIO3.0 [or 1 SDIO3.0 + 1 eMMC5.1]
·USB 2.0 and 3.0 OTG support, with PHY
·2 Ethernet AVB MACs
·3 CAN / CAN FD
·MOST 25/50
·PCIe 3.0 (single channel), providing L1 sub-state
·1 12-bit ADC (6 channels)
·4 SPI, 1 ESAI, 4 SAI, 1 Keyboard
·4 I2C (high speed), 4 I2C (low speed)
·1 SPDIF
|
|
Security
|
·High reliability boot, SHE
·TRNG, AES-128, AES-256, 3DES, ARC4, RSA4096, SHA-1, SHA-2, SHA-256, MD-5
·RSA-1024, 2048, 3072, 4096 and secure key storage
·10 Tamper pins (active and passive)
·Online encryption engine (AES-128)
|
4.2, MCU – Renesas R7F7015833
Figure 10 R7F7015833 Physical Image
R7F7015833 is Renesas’ automotive-grade chip RH850.RH850 Product Combination Diagram:
RH850/C1M-Ax microcontroller is equipped with RH850 series G3MH (C1M-A2 is dual-core) CPU cores (C1M-A1 operating frequency is 240MHz, C1M-A2 operating frequency is 320MHz), providing excellent processing capability. In addition to ROM, RAM, and DMA, this microcontroller also integrates various timers (such as motor control timers), various serial interfaces (such as CAN, which is CAN FD compatible), 12-bit A/D converter (ADC), R/D converter (RDC3A) that converts rotary transformer output signals into digital angle information, CPU and parallel motor control unit (EMU3), etc., and is equipped with various peripheral functions suitable for HEV/EV motor control. In addition, C1M-A2 can control two motors simultaneously.
|
|
C1M-A1: 240MHz core (includes lock-step dual-core x1)
C1M-A2: 320MHz core x2 (includes lock-step dual-core x1)
FPU
|
|
Timer:
|
Main oscillator: 20MHz
PLL with optional SSCG mode: 240MHz or 320MHz
PLL without SSCG mode: 80MHz
On-chip low-speed oscillator: 240kHz
Data transfer: DMAC / DTS
|
|
Timer:
|
Timer array unit D (TAUD) 2 or 4 units
Timer array unit J (TAUJ) 1 or 2 units
Motor control timer (TSG3) 2 or 3 units
Encoder timer (ENCA) 2 units
|
|
Analog:
|
SAR A/D converter 30 or 48 channels, 3 units
|
|
Communication Interface:
|
Clock Serial Interface H (CSIH) 3 channels
CAN Interface (RS-CANFD) 4 channels
LIN Interface (RLIN3) 3 channels
Serial Communication Interface (SCI3) 3 channels
RSENT 4 channels
|
|
Motor Control:
|
Motor Control Timer (TSG3) 2 or 3 units
R/D Converter (RDC3A) 1 or 2 units
Enhanced Motor Control Unit (EMU3) 1 unit
|
|
Security:
|
Multi-input signature generator (MIST)
Clock monitor
Watchdog timer
Security watchdog timer
Memory protection function
|
|
Power Voltage:
|
1.15V – 1.35V (CPU core)
4.5V – 5.5V (I/O, system, AD converter, RD converter)
|
|
Temperature:
|
Tj= -40° – +150°
|
4.3, 5G+V2X Module – Quectel AG550
AG55xQ is a series of automotive-grade 5G NR Sub-6 GHz modules developed by Quectel, supporting both 5G NR standalone (SA) and non-standalone (NSA) modes. Using 3GPP Rel-15 technology, the module can support up to 2.4 Gbps downlink speed and 550 Mbps uplink speed in 5G NSA mode, and up to 1.6 Gbps downlink speed and 200 Mbps uplink speed in LTE-A networks. With its C-V2X PC5 direct communication function (optional), AG55xQ can be widely used in the Internet of Vehicles field, providing reliable solutions for the establishment of smart vehicles, autonomous driving, and intelligent transportation systems. Additionally, the module supports dual SIM dual standby (optional) and a rich set of functional interfaces, providing great convenience for customers developing applications. Its excellent ESD and EMI protection performance ensures its robustness in harsh environments.
AG55xQ includes AG550Q (5G + DSSS + C-V2X), AG551Q (5G + DSSS), AG552Q (5G + DSDA), and AG553Q (5G + DSDA + C-V2X). To meet different market demands, each series includes several models: AG55xQ-CN, AG55xQ-EU, AG55xQ-NA, and AG55xQ-JP. At the same time, each series of modules is backward compatible with existing GSM, UMTS, and LTE networks, enabling connectivity in areas without 5G NR network deployment and remote areas without 3G/4G network coverage.
· Complies with IATF 16949 and APQP, PPAP automotive industry quality management process requirements, developed based on Qualcomm SA515M chip (compliant with AEC-Q100 standard).
· 5G NR Sub-6 GHz module, supporting standalone and non-standalone modes.
· Backward compatible with 4G (Cat 19)/3G/2G networks.
· MIMO technology meets the requirements for data rate and connection reliability in wireless communication systems.
· Optional C-V2X PC5 Mode 4 direct communication.
· Optional dual SIM dual standby technology (DSDA), meeting different application needs of customers.
· Optional single-frequency GNSS, dual-frequency GNSS, PPE (RTK), and GNSS/QDR combined navigation solutions, meeting different levels of positioning accuracy and speed requirements in different environments.
· Enhanced functional features: DFOTA, VoLTE, QuecOpen®, high security, etc.
· Ultra-wide working temperature range (-40 °C ~ +85 °C), eCall applications below +95 °C, superior anti-electromagnetic interference capability meet the application needs of automotive and other harsh environments.
4.4, Encryption Chip – Xintai TTM2000A11
Introduction to Xintai TTM2000A11:
Mizar TTM2000 is a flexible, reliable, secure, and compliant encryption chip product for the automotive electronics field. This product is specifically designed for the security of V2X applications in the Internet of Vehicles, fully meeting the message authentication performance, security certificate management, and other requirements needed for C-V2X and DSRC application scenarios.
|
Standards and Certifications
|
– EVITA hardware security module Full-level architecture design
– AEC-Q100 Grade 1 requirements
– National Cryptography Bureau Security Chip Level 2
|
|
Product Features
|
– ARM® SecureCore® SC300™ 32-Bit RISC Core, 80Mhz
– 120.0DMIPS (Dhrystone v2.1);
– Memory Protection Unit (MPU);
– 24-bit SysTick timer;
– 3.3V and 1.8V power supply, IO pin levels are 3.3V
– Operating temperature range: -40℃ – 125℃
– Package LQFP-64, QFN-64 (TBD)
|
|
Security Features
|
– Hardware “root of trust” tamper detection function, physical shielding layer protection design, anti-side channel attack protection design
– Internally integrates hardware cryptographic algorithm units based on international standards and the standards of the National Cryptography Bureau of China
– 4 independent TRNGs
– Hardware encrypted Flash, secure storage for key encryption
– Watchdog timer (WDT)
– High/low voltage anomaly detection
– Temperature anomaly detection
|
|
Cryptographic Algorithm Unit
|
– High-speed ECDSA (NIST-P256)
– High-speed SM2
– High-speed SM3
– RSA (up to 2048 bits)
– ECC-256
– SHA-256
– AES
– DES
– SM4
|
|
System Protection
|
– Each chip has a unique 32-bit serial number
– Comprehensive lifecycle state management
– System security boot using domestically produced cryptographic algorithms
|
|
Communication Features
|
– 2 integrated SPI controllers, configurable as Master/Slave mode
– 1 UART controller
– 1 I2C
– 5-channel GPIO, configurable as Input/Output, or as external interrupt input;
– 1 external timer
– 1 Watchdog
– 8-channel DMA controller
– Various configurable IO connections achieve better performance and flexibility
|
|
Memory
|
– 512KB internal Flash, supports ECC
– 160KB SRAM
– Secure ROM
|
|
Key Cryptographic Unit Performance Design Goals
|
– Ultra-high-speed SM2/ECDSA (NIST P-256) unit: >4000 verifications/second;
– High-speed general curve ECDSA unit: >1500 verifications/second;
– High-speed SM3 unit: >500Mbps
– High-speed SHA unit: >500Mbps
|
4.5, Switch Chip – MARVELL 88Q5050
Introduction to Marvell 88Q5050:
Marvell 88Q5050 is an 8-port, high-security automotive gigabit Ethernet switch chip, fully compliant with IEEE802.3 and 802.1 automotive standards, equipped with advanced security features to prevent network threats (such as hacking and denial of service (DoS) attacks). This 8-port Ethernet switch chip has 4 fixed IEEE 100BASE-T1 ports, along with 4 configurable ports, which can include 1 IEEE 100BASE-T1, 1 IEEE 100BASE-TX, 2 MII/RMII/RGMII, 1 GMII port, and 1 SGMII port. The switch chip provides local and remote management features, allowing users to easily access and configure the device. Through AEC-Q100 Grade 2 certification, this solution employs Marvell’s highest hardware security features designed for automotive Ethernet chips to prevent malicious attacks or threats to data streams within vehicles. This advanced switch chip utilizes deep packet inspection (DPI) technology and secure boot capabilities to provide the industry’s most secure automotive Ethernet switch. All Ethernet ports support address blacklisting and whitelisting features to further enhance security.
|
Processor
|
Integrated ARM Cortex-M7 CPU, 250 MHz
|
|
IO Interface
|
•4 IEEE 100BASE-T1
•The remaining four ports can be configured as follows:
– IEEE 100BASE-T1
– IEEE 100BASE-TX
– MII/RMII/RGMII – GMII – SGMII
•2 SMI
– Master interface can connect to external PHY or other switches
– Slave interface for managing the switch
•Configurable GPIO
•QSPI interface with configurable clock frequency (19.2 MHz-83.3 MHz)
•TWSI master interface
•JTAG
|
|
Package Features
|
128-pin LQFP package, 0.5 mm pitch, 14 mm x 20 mm
|
|
EEPROM
|
Slave interface with loader for configuring the switch (32 Kb-512 Kb)
|
|
Switch Matrix
|
Gigabit switch matrix
|
eMMC Samsung 8G KLM8G1GEUF
DDR4 Samsung 2G K4F6E3S4HM
Samsung eMMC is designed in BGA package form as an embedded MMC solution. eMMC operates similarly to MMC devices, thus making it simple to read and write to the memory using the MMC protocol v5.1 (industry standard).
eMMC consists of NAND flash memory and an MMC controller. The NAND area (VDDF or VCC) requires a 3V power supply voltage, while the 1.8V or 3V dual power supply MMC controller supports voltage (VDD or VCCQ). Samsung eMMC supports HS400 to improve sequential bandwidth, especially sequential read performance.
There are several advantages to using eMMC. It is easy to use because the MMC interface allows for easy integration with any microprocessor that has an MMC host.
Since the embedded MMC controller isolates NAND technology from the host, any revisions or corrections to NAND are invisible to the host. This leads to faster product development and quicker time to market.
②、DDR4 Samsung 2G K4F6E3S4HM
K4F6E3S4HM-THCL is a versatile LPDRAM, an ideal choice for mobile solutions. Samsung’s LPDDR4 is a breakthrough product that not only offers faster data transfer speeds but also lower power consumption, providing more design options for ultra-thin devices, artificial intelligence (AI), virtual reality (VR), and wearable devices.
· Double data rate architecture; two data transfers per clock cycle
• Bidirectional data strobe (DQS_t, DQS_c) sends/receives data together with the data used when capturing data by the receiver
• Differential clock inputs (CK_t and CK_c)
• Differential data strobes (DQS_t and DQS_c)
• Commands and addresses on the positive CK edge; two edges of DQS reference the data and data mask
• Each module consists of 2 channels
• Each channel has 8 internal banks
• DMI pins: DBI (Data Bus Inversion) during normal write and read operations, DM (Data Mask) used for masking write data when DBI is off
-DBI on masks written DQ 1 count#
• Burst length: 16, 32 (OTF)
• Read/write latency: Refer to Table 64 LPDDR4 AC timing table
• Auto-precharge option for each burst access
• Configurable drive strength
• Refresh and self-refresh modes
• Partial array self-refresh and temperature-compensated self-refresh
• Internal VREF and VREF training
• FIFO-based write/read training
• MPC (Multi-Purpose Command)
• LVSTL (Low Voltage Swing Termination Logic) IO
• VDD1/VDD2/VDDQ:1.8V/1.1V/1.1V
• No DLL: CK unsynchronized to DQS
• Edge-aligned data output, data input center-aligned write training
4.7, GNSS Module – UBLOX ZED-F9K-00B
The ZED-F9K module uses the u-blox F9 GNSS platform to provide continuous decimeter-level positioning accuracy for the most challenging automotive use cases. LAP 1.30 supports L1/L2/E5B and L1/L5 frequency bands for maximum flexibility, satellite availability, and security. Complex built-in algorithms cleverly fuse IMU data, GNSS measurements, wheel tick data, and vehicle dynamics models to identify individual GNSS lane failures. The module natively supports u-blox PointPerfect GNSS enhancement services. It provides parallel outputs of various global navigation satellite systems and IMU outputs to support all possible architectures, including a 50 Hz sensor fuse with very low latency solutions. It also enables advanced real-time applications like augmented reality, while optimized multi-band and multi-constellation capabilities maximize the number of visible satellites, even under urban conditions. This device is a standalone solution that provides the best possible system performance.
Next issue preview: “Disassembly Analysis of a Certain New Force High-Performance Autonomous Driving”
This column will continue to disassemble the latest controller solutions at home and abroad, including but not limited to intelligent driving, cockpit, central computing, body domain control, chassis domain control, and power domain control. If you are interested in this column, please contact the editor:btighteast.
