SoC chip selection for intelligent driving domain controller

The following figure shows a typical intelligent driving system computing power deployment.

When designing an intelligent driving system, you must consider chip selection. How to select from a wide range of SoC chips is a complex system engineering, which requires not only deep learning computing power, but also CPU computing power, security, memory bandwidth, power consumption, cost, etc. DJI has accumulated some experience in the selection of intelligent driving core chips, which we would like to share here. The main components of a typical SoC are:

1. The internal architecture of CPU can be simplified into the following model

The CPU contains control units responsible for instruction fetching, branch prediction, data forwarding, etc., ALU for logical operations, cache, DRAM and other storage units. Compared with parallel computing cores such as GPUs, the CPU's control unit and storage unit are more powerful and suitable for logical control.

In automotive SoCs, CPUs are divided into Safety MCU and ACPU according to different functions. The former has weaker performance but stronger real-time and safety features, while the latter has multiple cores, high main frequency, and powerful performance but reduced real-time and safety features.

1.1 Safety MCU Safety MCU has a variety of common CPU architectures, such as Infineon's TriCore, Renesas' G3KH, ARM Cortex M7, and ARM Cortex R5F. There are both external safety MCU solutions and built-in safety MCU solutions, such as Texas Instruments TDA4 with built-in Cortex R5F. SoCs generally have built-in Safety MCUs to improve system integration.

For example, the internal architecture complexity of the Cortex R5F MCU core is shown in the figure below. The main features are as follows:

• 
  

• 8-stage assembly line;

• 
  

• The CPU frequency can support up to 1.0 GHz, far exceeding traditional MCUs;

• 
  

• The Data Processing Unit is responsible for various operations and logic control;

• 
  

• The FPU is responsible for floating-point operations;

• 
  

• L1 Instruction/Data Cache is the first-level cache, with a reference capacity of 16KB+16KB;

• 
  

• The Memory Protection Unit is used for memory protection. Its protection capability is limited and it can generally only support the protection of a dozen or so areas.

Cited from "DDI0460D_cortex_r5_r1p2_trm.pdf"

A key feature in the design of Safety MCUs is the so-called lock-step core architecture, which achieves high-reliability operation through paired cores, usually referred to as "Primary Core" and "Shadow Core". This design ensures the stability and safety of the MCU in complex environments in a unique way. The core of lock-step core technology is that the two cores achieve fully synchronized operation at the instruction level, that is, they execute the same instructions at the same time and produce the same results. To ensure the consistency of the two, the system is equipped with a "Compare" mechanism that periodically compares the output results of the two cores. If the comparison results show that the two results are the same, the MCU continues to operate normally; if the results are different, it indicates that an error or fault may have occurred in the system, and appropriate safety measures need to be taken at this time, such as shutting down the system or performing fault isolation. Although the lock-step core architecture uses two cores, it is actually equivalent to the performance of only one core from the perspective of computing power. This is because the two cores must remain synchronized and execute the same instructions at all times. However, this design limitation is exchanged for higher reliability and safety. Lock-step core technology is a traditional and effective way to achieve high diagnostic coverage of MCU cores. By comparing the primary core and the shadow core, the system can detect potential errors or failures at the first time, thus avoiding them from threatening the stability and security of the system. After years of practical verification, this method has demonstrated its excellent performance and reliability in the field of microcontrollers and less complex microprocessors.

In addition to requiring the CPU core to reach ASIL D, Safety MCUs often require the internal bus, peripheral interface, power supply, etc. to be isolated from the Main Domain. Otherwise, the MCU Domain may be abnormal due to an abnormality in the Main Domain with a low safety level, such as incorrect operation of the peripheral register.

The computing power of the Safety MCU is generally expressed in KDMIPS (Kilo Dhrystone Million Instructions executed Per Second). For example, the computing power of the Cortex R5F is about 2 KDMIPS.

Because MCU computing and memory resources are relatively limited, and it does not support MMU (Memory Management Unit, a memory management unit that is more powerful than MPU), it can generally only run small RTOS such as FreeRTOS. The automotive industry generally requires RTOS to reach ASIL D level, and commonly used MCU RTOS mainly include AUTOSAR OS and SafeRTOS. Generally, there is no supporting libc and STL library, and the support for C++ is not friendly enough, making it difficult to develop and maintain complex software. Because the safety and real-time performance of the software and hardware of Safety MCU are relatively high, it is generally used to run software such as data interaction, diagnosis, and control algorithms for the entire vehicle.

In summary, when selecting Safety MCU, in addition to paying attention to the computing power of Safety MCU, we also need to focus on the isolation of buses and peripherals, and also the size of on-chip RAM. Global automotive MCU manufacturers include NXP, Texas Instruments, STMicroelectronics, Microchip, Infineon, Renesas, Corepower, Intel/Mobileye, Qualcomm, NVIDIA, Ambarella, ARM, Tesla, BYD Semiconductor, Jiefa, CoreChi, CoreWang, CoreQing, CoreTitanium, Black Sesame Intelligence, Kunlun Core, Houmo Intelligence, Xijing Technology, Yixing Intelligence, Cambrian Xingge, HiSilicon, Horizon Robotics, Aixin Yuanzhi, Yuanshixin, GigaDevice, Zhongying, AMEC, Xinhai, Guoxin Technology, Jiefa, etc. Fa Technology, Zhaoguan Electronics, Meiren, Huimang Micro, BYD Semiconductor, Zhixin Technology, Qixin Micro, Hangshun, Saiteng Micro, Qipu Micro, Xiaohua Semiconductor, Yuntu Semiconductor, Xihua Technology, Fudan Microelectronics, National Technology, Jihai, Pioneer Semiconductor, Ziguang Guowei, Fengchi Gaoxin, Lingdong Micro, Neusoft Carrier, Sigma Microelectronics, Huichun Technology, Huaxin Microelectronics, Aisco Microelectronics, Lingou Chuangxin, Fengqi Technology, Taisi Micro, Xuanzhi Technology, Xinxian Semiconductor, Shengqi Micro, Ingenic, Silan Micro, Shengsi Microelectronics, Naineng, Xinke Integration, Pengpai Micro, Hengshuo, Juquan, Eswi, Lingsi Micro, Allwinner, Huada Beidou, Rockchip, etc.

1.2. ACPU Commonly used ACPU architectures include MIPS and ARM, but ARM's Cortex A series is the main one. Compared with MCU, ACPU has a more complex architecture, higher main frequency, better cache and RAM performance, and stronger overall performance.

For example, the internal architecture complexity of the Cortex A72 ACPU core is much more complex than the Safety MCU, and the computing power is about 3 times that of the Cortex R5F at the same main frequency. The main upgrades are as follows:

• 
  

• 15-stage pipeline: - Branch prediction can improve the success rate of branch prediction; - Decode can support parallel decoding of multiple instructions; - Dispatch can support issuing multiple instructions at the same time; - Multiple execution units such as Interger execute / Adv SIMD and FP / Load store can work in parallel;

• 
  

• Can support higher CPU frequency, such as 2.0 GHz;

• 
  

• Instruction/Data Cache is the first-level cache, with a reference capacity of 48KB+32KB;

• 
  

• The L2 cache is generally large, with a reference capacity of 1MB, which can greatly reduce the probability of instruction and data cache misses and reduce access to DDR;

• 
  

• Supports MMU, which can achieve address isolation between kernel state and user state, and between different processes, and improve the security of memory access;

Cited from "cortex_a72_mpcore_trm_100095_0003_06_en.pdf"

For L2+ systems, in addition to requiring the ACPU core to reach ASIL B, commonly used peripherals are generally also required to reach ASIL B, such as IPC/DMA/CSI. The specific hardware safety level requirements depend on the functional safety decomposition.

The computing power of ACPU is generally expressed in KDMIPS, such as the computing power of Cortex A72 is about 11 KDMIPS. The computing power of ACPU depends on the architecture of the CPU core used and the CPU's main frequency. Generally, the newer the architecture, the higher the main frequency supported. The commonly used CPU core computing power information is as follows.

ACPU Cores ending with AE can support lockstep and achieve ASIL D functional safety level, such as Cortex-A65AE. In the future, L3~L4 systems will have more and more demands for ASIL D ACPU computing power.

ACPU not only has a high main frequency and sufficient resources, but also has the ability to run large operating systems such as Linux, providing a powerful computing platform for intelligent driving systems. In L2+ level intelligent driving systems, functional safety requirements often impose strict ASIL B level standards on operating systems. In this case, operating systems such as QNX or VxWorks have become the first choice. These operating systems not only support multi-process concurrent execution, but also each process has an independent address space, achieving effective isolation between processes. This design ensures the stability and security of the system. Even if a process crashes, it will not affect the normal operation of other processes. At the same time, these operating systems also support the complex scheduling of hundreds or thousands of threads in intelligent driving systems. Through an efficient thread management mechanism, the system can make full use of the multi-core performance of ACPU to achieve fast response and efficient processing. This is crucial for realizing various complex functions of intelligent driving systems, such as preprocessing of sensor data, scheduling of accelerators, perception fusion, navigation planning, etc.