Analysis of the evolution trend of intelligent driving domain controller hardware solutions

B. Support enough sensor access and provide sufficient CPU and AI computing power

The sensor interface should be rich, supporting multi-channel camera video data access, multi-channel Ethernet device access (the main interface of 4D millimeter wave radar is 100M Ethernet, and the main interface of laser radar is Gigabit Ethernet), multi-channel CAN interface device access (millimeter wave radar), etc.

For low-end models, at least 5 high-definition cameras are required (at least 4 for parking and at least 1 for driving). For mid-to-high-end models, the total number of driving and parking cameras is more than 10, and many models are even equipped with 4D millimeter-wave radar and lidar. The access to multi-source sensors means that not only the corresponding interfaces need to be configured, but also sufficient memory bandwidth and computing power are required to ensure the normal operation of the algorithm model.

3. In the short and medium term, the single SOC chip solution is the trend, but it cannot cover all scenarios

Based on the development of chip technology and the demand for domain control solutions for different levels of autonomous driving, the author believes that in the short and medium term, there will be two routes for the hardware architecture solutions of intelligent driving in the future: lightweight domain control tends to adopt a single SoC solution; high-computing power domain control supports higher-level intelligent driving functions, has higher requirements for functional safety levels, and requires system redundancy, so at least another SoC is required for backup functions. Therefore, the main SoC + backup SoC solution, or even the main domain controller + secondary domain controller solution, will be adopted.

3.1 Lightweight Domain Controller — Single SoC Chip Solution  

Due to product positioning and cost constraints, lightweight intelligent driving domain controllers have lower requirements for computing power (generally around 10 to 10 TOPS), sensor access capabilities, and functional safety than high-computing domain controllers. According to industry insiders, several of the domestic chips that are about to be mass-produced can support L2+-level driving and parking solutions through a single SoC chip. For example, Xingge SD5223 and Heizhima's A1000.

The lightweight domain controller is the first to adopt a single SoC chip solution, which is mainly related to its product definition and application scenarios. Because it is positioned to realize L1~L2+ driving assistance functions. Peng Nengling mentioned: "Does the L2 autonomous driving scenario need to have such a high functional safety level? From the perspective of compliance and product performance boundaries, it is not necessarily necessary. For L2 level, national regulations require drivers to be responsible for safety. The system is just helping people drive and does not need to enter a minimum risk state."

The current mass-produced domain controllers do not use single SoC chip solutions. However, from the long-term development trend, the integration of chips will become higher and higher, and the domain control solution using a single SoC chip will be the future development trend. Because it can make the system more integrated, it can not only reduce the system hardware cost, but also facilitate the OTA upgrade of the system.

3.2 High-computing power domain controller - main SoC + backup SoC/MCU or main domain controller + secondary domain controller solution

In order to meet the needs of higher-level autonomous driving functions, a high-computing domain controller is designed. It is necessary to have a redundancy solution for the domain controller. Currently, there are two mainstream solutions:

Main SoC chip and backup SoC/MCU chip (L2+) on one board

Use the primary domain controller + secondary domain controller solution (L3 and above)

According to an expert on the autonomous driving system of a certain OEM, "At present, there is no mature solution to achieve redundant design of system safety using a single SoC chip solution. The most reliable approach is to use the main SoC + backup SoC/MCU solution: one is the main computing unit, which performs some normalized calculations, and the other is the backup computing unit for safety monitoring and emergency processing. When the main computing unit fails, the backup computing unit is used to control the vehicle. This is a more mainstream design solution at present."

1) Main SoC + Backup SoC

A. Tesla - Autopilot HW3.0 (144TOPS): The mainboard adopts a dual FSD chip redundant design. The power supply and data channels of the two chips are independent and backed up for each other, reducing the hidden dangers of functional area failures. The two chips analyze the same data, verify and compare each other, and then draw the final conclusion, which improves the security and accuracy of data processing.

AutoPilot HW3.0 hardware motherboard (Image source - Tesla AI Day presentation materials)

B. NIO - Supercomputing Platform NIO Adam (1016TOPS): This intelligent driving domain control platform uses 4 Orin-X chips, including 2 main control chips + 1 redundant backup chip + 1 group intelligence and personality training dedicated chip. The 2 main control chips are used to implement the full stack operation of the NAD algorithm, including multi-scheme mutual verification perception, multi-source high-precision positioning, multi-modal prediction and decision-making; 1 redundant backup chip is used to ensure the safety of the vehicle when the main control chip fails.

 NIO Adam, the supercomputing platform of NIO (Image source: NIO official website)

2) Primary domain controller + secondary domain controller

If it is used to support L3 and higher-level autonomous driving functions, it is necessary to consider adopting the main domain controller + sub-domain controller design solution. Because the dual-chip solution will also have some problems. After all, they are on the same board and the positions of the two chips are not very far apart. If they encounter a strong magnetic field or high temperature, the two chips are likely to fail at the same time.

If there are two domain controllers, they will be placed farther apart. In extreme cases, they will be affected independently, and the security of the entire system will be greatly improved. If two identical domain controllers are designed, the cost will be much higher, and such a design is generally not adopted. In order to balance costs, another domain controller doing other work will generally be selected to "part-time" as the "deputy" of the intelligent driving domain controller. When the main domain controller has problems, it can replace the main domain controller to implement the responsibility of controlling the car and stop the car by the side.

Schematic diagram of the primary domain control + secondary domain control solution (Image source: "A 20,000-word article explains the evolution of autonomous driving functional architecture")

A. Great Wall Motors - GEEP4.0 architecture: The hardware platform of this architecture consists of the central computing platform (CCU), intelligent cockpit module (HUT), intelligent driving module (IDC), and three regional controllers (VIU_L, VIU_R and VIU_F). IDC is the main control unit of intelligent driving. In the high-level autonomous driving configuration, CCU can serve as a backup for the ICU domain controller to achieve the lowest risk conditions.

B. SAIC Zero-Bundle - Galaxy Full Stack 3.0 Architecture Solution: The hardware of this architecture consists of two high-performance computing units HPC1 and HPC2 and four zone controllers (ZONE). One of the two high-performance computing units is used for smart cockpit and smart driving functions, and the other one is mainly used for gateway, vehicle control, BCM and other functions, and also undertakes the backup function of smart driving.