Transcript
Company Public – NXP, the NXP logo, and NXP secure connections for a smarter world are trademarks of NXP B.V. All other product or service names are the property of their respective owners. © 2019 NXP B.V.
Sr. Director, Central Systems SolutionsAutomotive Microcontrollers & Processors
Dev Pradhan
Next Generation Safety Architecture
October 2019 | Session #AMF-AUT-T3624
COMPANY PUBLIC 1COMPANY PUBLIC 1
• Recap on Functional Safety• Recap on ISO 26262• Next Generation Safety Concept−Hardware
−Software & Tools
• Getting Safety Support
Agenda
COMPANY PUBLIC 2
Recap on Functional Safety
COMPANY PUBLIC 3
Implementing Functional Safety is About Managing RiskThe Risk of Failure
How products are developed: Leads to Systematic Failures• Result from a failure in design or manufacturing • Addressed by a rigorous and mature development process• Relevant to Hardware and Software• Occurrence of failures can be reduced through continual and
rigorous process improvement
Unpredictable Events:Leads to Random Failures• Addressed by including mechanisms to detect and report
faults• Inherent to Process or usage condition• Relevant to Hardware only• FMEDA*, Dependency and Fault Tree Analysis help
determine sufficiency of detection mechanisms
Failures
Systematic Random
FMEDA – Failure Mode Effects and Diagnostic Analysis
COMPANY PUBLIC 4
Risk Assessment Correlated to StandardsHazard
Internal External
Malfunction Misuse Environment
Conscious Unconscious
ISO 21434
PAS 21448
ISO 26262
Source
Cause
Behavior
Standard
Functional Safety Security SOTIF
Problem
COMPANY PUBLIC 5
Recap on ISO 26262
COMPANY PUBLIC 6
ISO 26262 – Functional Safety of Road Vehicles• Vertical standard, performance based.
• First edition published in 2011, second edition released in 2018 adding guidelines for motorcycles and semiconductor− Generic guidelines (partitioning IC, IP, DFA, fault injection, etc..)− Technology specific guidelines (digital, analog, PLD, MCU, sensors)
• Follows similar structure to IEC 61508, but totally replaces instead of augmenting.
• Separates system design from hardware component design. As a result, most components used require compliance.
COMPANY PUBLIC 7
Determining ISO 26262 ASIL Level• To determine the ASIL level of a system a Risk Assessment must be
performed for all Hazards identified• Risk is comprised of three components: Severity, Exposure & Controllability
S = Severity E = Exposure C = Controllability
C1 – Simple C2 – Normal C3 – Difficult
Light
E1 (very low) QM QM QM
E2 (low) QM QM QM
E3 (medium) QM QM A
E4 (high) QM A B
Severe
E1 (very low) QM QM QM
E2 (low) QM QM A
E3 (medium) QM A B
E4 (high) A B C
Fatal
E1 (very low) QM QM A
E2 (low) QM A B
E3 (medium) A B C
E4 (high) B C D
(QM: “quality managed” no requirements from standard applied explicitly)
S1
S2
S3
COMPANY PUBLIC 8
Automotive Applications and ASIL Level (e.g.)Note: that in the context of Autonomous there is the concept of SOTIF (ISO PAS 21448) that is not covered by ISO 26262 and any ASIL
ADAS – RADAR SRR, MRR, LRR – ASILB
ADAS – Vision Data Fusion – ASILB, up to ASIL D (Autonomous Drive)
Drive Train – ElectrificationBattery Management (12V, 48V, HV) – ASILC
Drive Train – ElectrificationElectric Motor (Alterno Starter, eAxel drive…) – ASILC
Drive Train – PowerTrainTransmission, Transfer Case – ASILD Drive Train – Electrification
Inverter, DCDC Converter - ASILC
Drive Train – S&CElectric Power Steering – ASILD
Domain Gateway Body, Safety, Chassis – up to ASILD
Drive Train – S&CSuspension / Dumping – ASILC
ADAS – ACC Adaptive Cruise Control – ASILC
Drive Train – PowerTrainEngine Management Unit – ASILB
Drive Train – S&CABS, ESP – ASILD
1
2
2
34
5
1
7
18
3
ASILD
C
B
A
QM
LEGEND
6
COMPANY PUBLIC 9
Functional Safety Process Assessed to Meet ISO 26262 ASIL-D
NPI LIFECYCLE
TO CES RQ ECQS
CONCEPT DEFINITION PLANNING EXECUTION CLOSURE
PROJECT LIFECYCLE
PDA PPA R PCPCAPI
(4-6) Safety Context
(4-7) Safety Concept
(5-6) Requirements Specifications (RS)
(5-7) Detailed Design Specifications (DDTS)
(5-8,9) Initial Safety Analysis
(5-10) Validation Testing
(5-7) Block Level Verification Testing
(8-13) Qualification Testing
(5-7) Chip Level Verification Testing
ImplementSafety Documentation Silicon TestingSimulation TestingFunctional Documentation
Diagram Color Schema Development Flow Requirement Traceability
Fault Injection Testing
Fault Injection Testing
Fault Injection Testing
Input RequirementsStandard
CustomerMarketing (MRD)
Internal
Product Requirements (PRD)
Architectural Specification
Data Sheet
Reference Manual
Safety Manual
FMEDA, FTA, DFA
(7-5) Production Testing
Customer Documents
Input Document
PI GateDefine product typeQM or ISO 26262
R GateProduct Functional Safety Assessment Report & Safety Case
ISO 26262 Process
NXP Process
COMPANY PUBLIC 10
S32 Automotive PlatformSafety Concept Architecture
COMPANY PUBLIC 11
S32 Automotive Processing Platform
Highest performing ASIL-D processorsof today’s best performing safe automotive platforms1
Maximizes software Re-use within and across application domains
Delivers new levels of automotive safety, security and over-the-air (OTA) capabilities
1 Based on publicly available competitor roadmap performance statements.
COMPANY PUBLIC 12
Powertrain & Vehicle Dynamics
Vehicle Dynamics & Safety
Chassis, Safety, Torque and Energy
Management
• Long term innovator in chassis and powertrain control
• Significant growth in safety as autonomous control drives robust fault tolerant systems
Body & Comfort
General Purpose & Integrated Solutions
Body ElectronicsEdge Nodes
• Broadest portfolio of integrated MCU+HV mixed-signal solutions
• Application specific software solutions
Gateway
Connectivity & Security
Vehicle Network Processing
• #1 in vehicle networking and security
• End-to-end portfolio of networking devices
Driver Replacement
Advanced Driver Assistance Systems
Radar, LIDAR, VisionSensor Fusion
• #1 in radar processing
• Comprehensive radar, vision and central processing portfolio
MPC577S32S
S32KS12Z
S32RS32V
MPC574S32
S32 Automotive Computing Portfolio
COMPANY PUBLIC 13
Safety Targets for Next-Generation Platform
Developed as a Safety Element Out of Context (SEooC)
Following an ISO 26262 ASIL-D Safety Development Process
Supported with Complementary Safety Collateral
Sensor processingASIL B to D
Number crunching
ASIL B to D
DecisionASIL D
ProtectedMemory
ProtectedI/O
Real-time CPUsPerformance CPUs
Application specific
accelerators
COMPANY PUBLIC 14
S32 HW Safety Measures
Memory Bus
Main Bus
Coherent Bus
xRDC
xRDCxRDC
SRAM
xRDC
xRDC
DRAM
Security
HS Comms
xRDC
DMA
DMA
DMA
DMADebugTrace
xRDC
Interconnect:• Replicated Master
& Slave NIUs• Parity on all
messages• Fault Reporting• BIST
Fault Collector UnitError Injection ManagerError Recovery ManagerReset Generation ManagerSafety by Software ECC on SRAM
Logic & Memory Built-in Self Test
Clock MonitoringPower Supply Monitoring
Redundant Peripherals
Peripheral Bus
Timers
Comms
PLLs
FCCUEIM
RCCURGM
SbSW
CMUCRC
ADC
WDog
POST
STCUTimers
Comms
PLLs
ADC
xRDC xRDC xRDC xRDC
ECC on DRAM
Lockstep DMA with ECC on memories & integrated CRC
To SoC Island
Delayed Lockstep or Decoupled Performance Clusters, INT CTL
ECC on memories.
MasterCore
Comp
L1 Cache
TCMMPU
MasterCore
MPU
RTCore
Comp
L1 Cache
TCMMPU
RTCore
MPU
Delayed Lockstep Real-time Cores & INT CTL.ECC on memories
Safety Feature
L2 Cache
Perf Core
MMU
Perf Core
MMU
L2 Cache
Perf Core
MMU
Perf Core
MMU
Comp
eXtended Resource Domain Controller manages access control, system memory protection and peripheral isolation
COMPANY PUBLIC 15
Fault Management and AvailabilityPrevious Generation – State of the Art Functional Safety
S32x – Introducing availability 2019+
Lockstep mismatch MCU resetLockstep mismatch begin availability flow
No localization of fault beyond lockstep core pair
Localization of fault possible to individual core
No continued operation possible with safety coverage
Continued operation possible with loss of core, or loss of cluster
Remaining core/cluster functional
Not possible to distinguish between permanent and transient faults in core complex
All transient faults recoverableCache faults recoverable without BIST – reset only
Fail Safe Strategy Fault Tolerant Strategy
Reset/Power-up
In Lockstep
Recovery Mode
Restart
Degraded 0 Degraded 1 Shutdown
Safe State & complete
transactions
Fault
Transient Fault
Permanent Fault
COMPANY PUBLIC 16
Top Level Safety Requirements• The SoC itself is developed as a SEooC to provide functionaly with appropriate
assumed safety integrity – ASIL D− SPFM (Single Point Failure Metric): 99% for transient & permanent faults− LFM (Latent Failure Metric): 90% for permanent faults− PMHF (Probabilistic Metric Hardware Failure): 10-9 h-1 (10% of system target for ASIL-D (<10-8 h-1))
• Fault Tolerant Time Interval (time a Fault occurrence and the system transitions to a Safe state)− FTTIMCU= 10ms to 100ms
• Multiple Point Fault Detection Interval (multi-point faults are latent faults)− MPFDIMCU= defined by application (e.g. 12hrs typical auto)
• To detect multiple-point faults in the most critical safety mechanisms, software initiated fault injection tests can be periodically triggered within the FTTI.
COMPANY PUBLIC 17
Top Level Availability Requirements• The contribution of the SoC to the Fault Recovery Time of the
application is targeted to beFRT <= 50 ms.
• This time is split between fault recovery (FRTMCU) and reset/boot (BootTimeMCU) Note: This includes the time to perform SoC fault diagnostics, reset and boot the SoC to the
point to handover to load full application code. It does not include the application re-initialization time.
• Fault Tolerance (Availability) of the SoC is targeted to be:< 100 FIT (10-7 h-1) of failures should lead to application Shutdown
COMPANY PUBLIC 18
Fault Reactions – FCCU • When a fault is routed to the FCCU there are 3 reactions possible to
bring the SoC to a safe state:−R1: Alarm interrupt with FCCU timer, if timer expires interrupt and error out asserted
(local recovery)−R2: Interrupt and error out asserted (global recovery)−R3: No interrupt, error out asserted and reset (no recovery configured)
• If a fault is Not Safety Related, the FCCU could be configured to the following reactions:−Fault is disabled, no FCCU reaction− Interrupt
COMPANY PUBLIC 19
S32 Automotive PlatformSafety SW and Tools
COMPANY PUBLIC 20
Safety Software Support (Safety SDK)
• Successful boot of safety-related components is required to start a safety application.• Runtime fault detection is mediated by Safety SDK – faults are detected by both HW and
SW mechanisms • Runtime error recovery is managed via Safety SDK• Safety SDK manages a global, destructive SoC recovery.
S32 SoC
Safety SDK
Safety BootSupport
Safety SDKRuntime Detection and Reaction Support
Safety SDK
RecoverySupport
Customer Application
BIST EIM FCCU RGM ERM
COMPANY PUBLIC 21
Safety SDK Components
• SquareCheck – detects latent faults in HW safety mechanism
• BIST Manager – configures, initiates, and provides access to MBIST and LBIST
• sBoot – detects violations of HW safety configuration
• sCRCU – detects faults in CRC; also, it computes CRC
• eMCEM – Error Manager configures FCCU and provides handlers to faults signaled to FCCU
• SW Recovery – initiates the global recovery process
• Mode Selector – depending on the SoC fault status selects the appropriate operating mode
Detection Components Reaction Components
COMPANY PUBLIC 22
Safety Software Portfolio
HW Safety Measures Computational Shell
Vision, RadarPeripherals
Communication& IO Peripherals
ERM
SRAM
Flash Controller
HW Safety Layer
Service Safety Layer
Functional Safety Layer
NXPSoC
SCST
eMCEM
MBIST & LBISTManager
Application SDK
sBoot
Autosar sMCAL
Vison Accelerator
GPU
Radar AcceleratorFCCU
WDG
STCU
LBIST MBIST
CMU
Recovery SW
Perf CPU
SquareCheck
PTLib
Mode SelectorSafety Device Config
sCRCUSbSW
Safety by SW – HW IP
Perf CPU
RT CPURT CPU
Safety SDK
COMPANY PUBLIC 23
SW Safety DeliverablesCONCEPT DEFINITION PLANNINGPDA PPA R PCPCA EARPI PRC RFPNPI Lifecycle
Automotive SPICE + Safety Extensions = ISO 26262
SW FMEA
Safety Manual
Safety CaseSW Safety Case
SW FMEA
Safety Assessment Plan
SW FMEA
Safety Manual
Safety Case
SW FMEA
Safety Manual
Safety Case
2-6.5.4/6/5/5
SW Safety Plan6-5.5.1/7.5.2
6-6.5.3
FSA1, FSA2, FSA3
Confirmation Review
Audit/Assessment
ISO26262 Confirmation Measures
SW Tools Evaluation & Qualification Reports8-11.5.1/11.5.2
System RS/AS/System Safety ConceptNPI Safety Manual
6-7.5.4/7.5.5/8-8.5.1
FSA3 (Final Product)
Software Safety Concept3-8.5.1
FSA1 (Safety Concept) FSA2 (Detailed Design)
COMPANY PUBLIC 24
Tool Compliance
• Classification Report• Qualification Plan• Qualification Report• Safety Manual• ISO26262 compliance report
Validas AG
Real-time CPUsPerformance CPUs
Application specific
accelerators
Certified Compilers (3P)Qualification
Kit
Certified Compilers (3P)
COMPANY PUBLIC 25
S32 Safety Alternatives for Performance Cores
L2
Core 0
SCST
Core 1
SCST
L2
Core 2
SCST
Core 3
SCST
L2
Core 2 Core 3
L2
Core 0 Core 1
L2
Core 0 Core 1
L2
Core 2 Core 3
TMWDP
TMC
TA1 TA2 TA3
• Targets ASIL D• Delayed Lock-step Clusters• Configured at Boot• Fully transparent to SW • Fallback to degraded mode in case of a
permanent fault
HW Lockstep Safety by SW Core Self Test
• Targets ASIL B (with minimal SW overhead)
• Core self-test (SCST) • Executed @ runtime on each CPU• High diagnostic coverage with low
performance impact
• Enable ASIL B/D by application monitoring
• Detects loss of integrity and data error caused by SW & HW faults
• Time Monitored Comparator (TMC) – Detects data and timing errors
• Timed Multi-Watchdog Processor (TMWDP)– Operational logical flow errors
COMPANY PUBLIC 26
Getting Safety Support
COMPANY PUBLIC 27
SafeAssure Community Public Space for knowledge
distribution and industry-wide newshere
SafeAssure NDAPrivate NDA space for customer to
access safety documentationhere
SupportSafety Expert Group composed of
Safety Managers and Architects, Field and Application Engineers
Self SufficientCommunity users find answers to their questions an safety documentation requests
SafeAssure CommunityCustomer Support for Functional Safety
COMPANY PUBLIC 28
NXP ISO 26262 Confirmation MeasuresNXP performs ISO 26262 Confirmation Reviews (CR), Audit and Assessment as required by ISO 26262 for SEooC development
Confirmation Measures (CM) performed depending on ASIL• All checks executed with independence level I3 by NXP Quality organization• NXP Assessors certified by SGS-TÜV Saar as Automotive Functional Safety Professional (AFSP) • NXP CM process certified by SGS-TÜV Saar as ISO 26262 ASIL D
Confirmation Measures ASIL A ASIL B ASIL C ASIL D
CR Safety Analysis Yes Yes Yes YesCR Safety Plan Yes Yes YesCR Safety Case Yes Yes YesCR Software Tools Yes YesAudit Yes YesAssessment Yes YesNote: The following confirmation reviews are not applicable: hazard analysis and risk assessment, item integration and testing, validation plan & proven in use argument
COMPANY PUBLIC 29
NXP SafeAssure™ ProductsTo support the customer to build their safety system, the following deliverables are provided as standard for all ISO 26262 developed products
• Public Information available via NXP Website− Quality Certificates− Reference Manual− Data Sheet
• Confidential Information available under NDA− Safety Plan − Safety Manual− Permanent Failure Rate data (Die & Package) - IEC/TR 62380 or
SN29500− Transient Failure Rate data (Die) - JEDEC Standard JESD89− Safety Analysis (FMEDA, FTA, DFA) & Report− PPAP− Confirmation Measures Report (summary of all applicable confirmation
measures)
NXP and the NXP logo are trademarks of NXP B.V. All other product or service names are the property of their respective owners. © 2019 NXP B.V.
top related