*Author: Empowering Manufacturing with Technology
Preface
In the whole smart driving solution, the role of MCU is mainly to cooperate with perception chips, outputting some information to the chassis system according to the current motion status of the vehicle and the perceived target. Therefore, it is essential to ensure the safety of MCU in the application of smart driving sensors and domain controllers.
To this end, we invited Infineon China’s intelligent driving product manager, Yuchenjie, to share with us the application of MCU in smart driving sensors and domain controllers.
Sharing Transcript
Yuchenjie: I mainly share the application of MCU in smart driving sensors and domain controllers.
Apart from control of the actuator, ADAS/AD system can be simply divided into two parts: sensors and computing platform. Regardless of the computing power of SOC on the sensor or computing platform, MCU is still indispensable in the current architecture.
I mainly share it in a few parts:
- Brief introduction of Infineon;
- A systemic introduction to the current Infineon TC3 series microcontrollers, with some upgrades mentioned on the TC4 series;
- Application of AURIX in ADAS;
- How Infineon MCU cooperates with SOC vendors in domain controllers’ applications;
- Is a high computing power ASIL-D MCU still needed when more AI SOC vendors integrate real-time processors?
1. Infineon is a leading automotive semiconductor company, and most car manufacturers’ controllers on the market use Infineon’s solutions to a greater or lesser extent.
2. Infineon’s TC3 series microcontrollers.
Infineon’s microcontrollers are not only used in ADAS but also cover almost all fields. For example, in systems that emphasize functional safety, including powertrain, new energy, and engine control. It is also widely used in applications such as autonomous driving, body control, audiovisual entertainment, instrumentation, and so on.
Explanation:
Microcontroller, abbreviated as MCU, is a typical embedded microcontroller.
The microcontroller is an integrated circuit chip that uses very large-scale integrated circuit technology to integrate a central processing unit CPU with data processing capabilities, random-access memory RAM, read-only memory ROM, multiple I/O ports, interrupt systems, timers/counters, and other functions (possibly including display driver circuits, pulse-width modulation circuits, analog multiplexers, A/D converters, and other circuits) on a silicon chip to form a small and complete microcomputer system.
In simple terms, the microcontroller is a small computer system.When planning the first generation of microcontrollers, semiconductor manufacturers need to consider the various applications that the microcontroller will cover and plan the entire project accordingly. Infineon, with years of engineering experience, has developed a 40 nm TC3 series platform where almost all derivative cores and peripheral IPs are the same, allowing for the reuse of most of the underlying software and allowing processors in the same series to be used across different applications, significantly reducing development costs for OEMs and Tier 1.
Infineon’s AURIX high-end MCU is well-known for its functional safety capabilities, but it also has carefully designed information security features. AURIX 2G integrates an ARM core and some dedicated hardware resources to meet the Evita Full standard for security. In the field of MCU for automotive electronics, most suppliers are moving towards using an ARM-based architecture, mainly based on M cores or R cores for system development. It is undeniable that ARM has a good ecosystem, but in an increasingly complex international environment, the origin of the IP has become an important consideration standard. Infineon’s AURIX product line is one of the few that still insists on having its own core IP among fabless suppliers.
Traditional automotive electronic controllers are developed around MCUs, but with the increasing installation rate of ADAS, high-performance AI SoCs are beginning to take the stage in automotive electronics. In ADAS/AD systems, System-on-Chip (SoC) is mainly used for perception and classification through machine learning and neural networks, but the parts that interact with the chassis require high real-time performance and still need MCUs to complete the task.
Take a look at Infineon’s TC3 series MCU. In TC3XX, TC3 is the product category, and the first “X” represents the series, similar to BMW 3 and 5 series, where the higher the number, the higher the overall configuration.
The highest specification in this series is currently TC39, followed by descending numbers. The advantages of this series lie in the scalability of resources and performance, software and hardware compatibility, and more hardware-based functional and information security. Currently, many globally known OEMs are using the AURIX TC39X for functional safety on quasi-Level 3 domain controller platforms, and most pin resources can be seamlessly compatible from TC39X to 38X, 37X, and 32X, making it easier for Tier1 to plan early cross-platform and cross-application MCU selection.
Compared to the previous generation TC2 series, the TC3 series has significant improvements in computing power, memory, communication interfaces, functional safety mechanisms, and hardware encryption.There are three major product lines of ARM processors: first, the Cortex-A series high-performance application processors; second, the Cortex-M series microcontrollers; and third, the Cortex-R series real-time processors.
From the kernel perspective, more and more manufacturers are adopting the ARM architecture. While low-end real-time controllers are based on the Cortex-M series, the R series kernel is used more for high-real-time and high-functionality demand scenarios. Infineon did not consider using an ARM-based core as the main computing unit until the next generation of the TC4 series. We believe that the AURIX series based on Tricore has been verified by hundreds of Tier1 and OEMs in the field of functional safety and still has strong vitality.
Compared with independent MCUs, more and more SoCs will incorporate some real-time processors on the die. As an MCU supplier, Infineon will also add a lightweight neural network acceleration kernel in the next generation of the TC4 series, which we call PPU, Parallel Processing Unit, and is deeply optimized based on Synopsys’ ARC EV kernel.
Just as adding a real-time core in a SoC cannot replace an independent MCU in the true sense, the purpose of introducing PPU is also mainly to consider functional safety. For safety-critical tasks, PPU can share some AI computing power in the SoC chip as a backup. For example, PPU can perform post-data processing such as clutter tracking on imaging radar to ensure that safety-related ADAS/AD functions can also achieve fail-safe or even fail-operational with the help of ASIL D MCU in the event of SoC failure.
In terms of communication interfaces, TC3 has mainstream CAN, LIN, CANFD, 100M, and 1G Ethernet, as well as the LVDS interface for radar applications, which we call RIF, Radar Interface. Please note that the LVDS on AURIX mentioned here is used to communicate with the baseband signal of the 77G radar MMIC, not for video signals from cameras. The calculation power of a single MCU is not enough to process video signals. However, the mainstream radar systems currently rely on a single MCU system to complete signal and data processing.In the next generation TC4, we will introduce 5G Ethernet and PCIE interface specially designed to improve communication speed between SoC and MCU for ADAS domain controllers. Currently, communication between SoC and MCU relies on high-speed SPI with a maximum speed of only a few tens of megabits per second, considering signal integrity. The introduction of PCIE will significantly improve the efficiency of data exchange between SoC and MCU. By then, high-speed communication between SoC and MCU will be based on the Ethernet of the service-oriented SOMIP or the lower-level PCIE protocol stack, and they will have their respective applications.
In low-speed interfaces, we will also introduce a new 10G Ethernet, which we believe will have its place in the entire vehicle network between CANFD and 100M Ethernet.
Thirdly, the application of AURIX in ADAS. What I said today is based on the current architecture, because no one knows what the sensor architecture of L2 and L3 will look like in five years. But it is generally believed that L2 is equipped with radar and cameras but no LiDAR, and the L3 level is characterized by the addition of LiDAR. In fact, Infineon also has a LiDAR MEMS mirror, but we think that the commercial conditions for large-scale use of LiDAR are not yet ripe, and L3 will not arrive so fast.
In terms of pure image resolution or recognition, LiDAR is certainly not as good as a camera due to the lack of RGB information. But LiDAR has depth information that cameras do not have.
Regardless of how Musk views LiDAR, and even many semiconductor giants are not optimistic about it, I personally think that LiDAR has its necessity. Compared with the popular concept of 4D millimeter-wave radar, the angle resolution achieved is in the order of 0.X, while LiDAR is striving to reach the level of 0.01, which is incomparable.
The previous generation of radar was based on a multi-chip architecture. To make a millimeter-wave radar system, external phase-locked loops, separate transceiver chips, independent ADCs, and DSP chips for FFT processing were required. However, the current generation of radar is integrated. The receive and transmit channels, phase-locked loops, and ADCs are all integrated onto one MMIC chip, and the down-converted and sampled baseband signals are transmitted to the MCU with FFT hardware accelerator via LVDS/MIPI. A power chip that can supply power to both the MCU and MMIC at the same time completes the system.
In the upcoming AURIX TC4, Infineon has integrated a neural network accelerator called PPU for tracking and clustering radar signals.## 4. How Infineon cooperates with SOC manufacturers in the application of domain controllers.
Generally, only independent domain controllers are available in L2+ intelligent cars. Because lower level L1/L2 does not have path planning function, and the number of sensors is limited, the MCU on the radar or camera sensor side is enough to complete the target level fusion and decision-making tasks.
In the current ADAS/AD electronic architecture, some OEMs are divided into high-speed and low-speed domains. The high-speed domain is responsible for high-speed ADAS functions such as AEB and ACC. The low-speed domain is responsible for APA, AVP and other functions.
Another part of the external OEMs integrates all functions into one domain controller. I believe that as SoC computing power increases and OEM cost reduction needs, the trend of merging high and low speed domains is inevitable.
Regardless of whether it is a high-speed, low-speed, or large-domain controller, the current mainstream L2+ and L3 domain controllers are completed by one or two SoCs plus a Safety MCU, where the SoC is responsible for perception, global path planning, etc., and the MCU is responsible for target-level sensor fusion and real-time decision-making tasks. I will expand on this below.
5. As more and more SOC manufacturers integrate real-time processors, is a high computing ASIL-D MCU still needed in the AD domain controller?
The answer is yes. The current AI SOC has rich computing power, such as Cortex-A core, NPU, GPU, etc. There are also some SOC that integrate a real-time lockstep core at the MCU level, called the safety island. It seems to instill a concept that adding a pair of lockstep cores to the SoC is functionally safe ASIL-D. In fact, a pair of lockstep real-time cores, the ECU system, and even the chip itself reaching ASIL-D level are not the same concept.
Furthermore, due to die size, cost and other reasons, some safety islands are currently only integrated with very limited RAM. Taking a Lockstep R5F with an additional 1M SRAM as an example, if the program is expected to run entirely in RAM, the program size is significantly constrained.Actually, it’s not just ADAS/AD, more and more safety-critical real-time systems tend to choose the AUTOSAR BSW with a large architecture at the underlying software level. The application layer implementation is built on the model, and the application layer of the decision-maker part in the AD domain controller includes trajectory verification, vehicle dynamics model, and decomposition of driving commands such as torque/angle from the trajectory.
Although these essentially logical tasks do not consume too much memory, as soon as they are on the bottom layer of AUTOSAR, the size of the entire software suddenly goes up. Secondly, if relying on external flash, the efficiency of program reading is limited by access latency and the size of internal cache.
From the perspective of safety computing, these are just the tip of the iceberg. Below, let’s take a look at the value of an independent safety MCU from the perspective of safety supervisor or safety path.
Taking a future L3 domain controller as an example, the sensor input and output include FFT peaks of the 4D cascaded radar coming in over a hundred megabytes, the Lidar point cloud coming in over a gigabyte of Ethernet, the original signal of the camera with LVDS/Serdes, as well as the Ethernet backbone and HDMI output of the entire vehicle.
There may be as many as three SoCs to process camera, Lidar, sensor fusion and path planning data after processing. As you can imagine, from the perspective of board-level functional safety, how many power domains need monitoring, especially SoC’s supply rail and power-up timing are very complicated.
Currently, the number and accuracy of ADCs in the safety island of SoCs are lower than those of MCUs in lower process technologies.
In addition, Infineon has also combined functional safety PMIC with AURIX to supply power to the MCU and peripheral sensors and transceiver chips, and monitor the safe operation of the MCU through an external watchdog. It also monitors overcurrent and overvoltage of the system power supply. When the MCU runs or the system power supply has an exception, it serves as the last barrier to reset the MCU and cut off the output of the domain controller to the outside, putting the system in a safe state. We call this the second-level shutdown path.
In summary, the functions of the safety MCU in the ADAS/AD domain controller mainly include safety computing and independent safety path. Currently, the AI SoC with integrated safety island still needs a safety MCU to implement the functional safety of the system.
This article is a translation by ChatGPT of a Chinese report from 42HOW. If you have any questions about it, please email bd@42how.com.