1、Confidential 2023 Nuclei.All Rights Reserved.Confidential 2023 Nuclei.All Rights Reserved.2023-8-212Functional Safety-ISO 26262ASIL comes from Functional Safety,ISO 26262Absence of unacceptable risk due to hazards casue by malfunctioning behaviour of E/E(electrical/electronic)systems.Root causes for

2、 malfunctioning behaviour:Systematic errors(during specification,development,manufacturing,)Random hardware faults(during operation in the field)Foreseeable operational errors and misuse(during operation)Original from Mentor&NXPConfidential 2023 Nuclei.All Rights Reserved.2023-8-213ASIL DASIL CASIL

3、B(ASIL A)SPFM 99%97%90%60%not normativeLFM 90%80%60%n/aASIL LevelRandom hardware failure target values*)D 10-8 h-1 (10 FIT)C 10-7 h-1 (100 FIT)(B)10-7 h-1 (100 FIT)(A)10-6 h-1 (1000 FIT)not normative*Target values from ISO 26262-5Quantitative ASIL effect on IP designDetect/Control failureEffective s

4、afety mechanism to handle transient&permanent faultsVerification of safety mechansim to achieve target values from ISO 26262-5Confidential 2023 Nuclei.All Rights Reserved.2023-8-214Safety Mechanisms on CPU IP designMasterCoreShadowCoreCMPThe Dual-core lockstep cores executing the same code,then thei

5、r outputs and key internal states are compared every cycle;Any mismatch will generate a fault by the comparison unitDual-Core LockstepImplementing error correction code(ECC)on ILM,DLM,I/D-Cache with enhanced address and multi-bit error coverageSTLProviding STL(software test library)SRAM ECCRead/Writ

6、e CtrlECC GeneratorSRAMECC Check CorrectImplementing error detection code(EDC)on critical DFF.Selective coverage of architectural,pipeline or all DFF.DFF Parity/EDCComb logicParity/EDC GeneratorDFFs Parity/EDC CheckImplementing error detection code(EDC)on core boundary IOIO Parity/EDCOutput logicPar

7、ity/EDC GeneratorParity/EDC CheckInput logicParity/EDC CheckParity/EDC GeneratorCore BoundarySoftware Test Library Automotive Safety Integrity LevelsQM A B C DConfidential 2023 Nuclei.All Rights Reserved.2023-8-215ISO 26262 ComplianceSystematic FaultRandom Hardware Fault(Permanent&Transient)Rigor IS

8、O 26262 compliant semiconductor development processDependent Failure AnalysisDesign FMEA on UT level and verification points implementationFMEDAFault Injection Verification(transient&permanent fault)ECC verification on SRAM with Formal100%requirements coveragemore than 2000 items100%failure mode tes

9、t point covered100%function&code coverage99%diagnositc coverage claimed on DCLS97%99%diagnostic coverage claimed on SRAM ECCConfidential 2023 Nuclei.All Rights Reserved.2023-8-216V-Model for CPU IP Design5-5 General Topics for the Hardware Development4-6 Technical Safety ConceptProduct DefinitionTLS

10、RTechnical Safety Concept5-6 Specification Hardware RequirementsHardware Architecutre DesignHW ReqHardware Module DesignEvaluation of Architectrual MetricsHardware Design ImplementationReqs Verification ReportHSI SpecArchitecture Design SpecificationMicro-Architecture Design SpecificationVerificatio

11、n ReportVerification ReportRTL implementationD-FMEA5-10 Hardware Integration verificationFMEDADFASafety Analysis ReportVerification ReportPre-siliconintegration verificationFaultInjectionVerificationPre-siliconModule verificationVerification Methodology PlanVerification SpecVerification ReportVerifi

12、cation SpecVerification Report4-7 System Integration and TestingConfidential 2023 Nuclei.All Rights Reserved.2023-8-217Functional Safety ManagementDocumentation Management(in wiki)Requirements Management(in JAMA)Technical Safety Concept(in JAMA)Safety Analysis(FMEA&DFA)(in JAMA)Confidential 2023 Nuc

13、lei.All Rights Reserved.2023-8-218NA900 ISO26262 Product Certification2022 Apr 231st1st AssessmentAssessmentKick-offKick-off2021 Sep 302022 Sep 222nd2nd AssessmentAssessment2023 Mar 233rd3rd AssessmentAssessment2023 Apr 23FinalFinal AssessmentAssessmentObtainObtain CertificateCertificatehttps:/ 2023

14、 Nuclei.All Rights Reserved.NA900 1st ASIL D RISC-V CPU IP Product Certification with exidaConfidential 2023 Nuclei.All Rights Reserved.NA900 Micro-Architecture Diagram2023-8-2110 ILM w/ECCJTAGcJTAGPer1SRAMExtMEMDLM w/ECCDLM IF(SRAM)Slave Port(AXI)NA900 Core WrapperCoreMachine/Supervisor/User ModeIR

15、Q I-IFD-IFICache w/ECCDCache w/ECCDSP/FPUNMI ILM IF(SRAM)TIMERDebugECLICLM CtrlBIUPeripheral BusSystem BusSystem Bus IF(AXI)Per1Per1PMPRISC-V RV32IMACFDPB ISA supportedDual Issue,in-order 9 stage Harvard Pipeline Single precision floating point,double prevision configurableILM&DLM0/DLM1 with ECC,512

16、KBI-Cache&D-Cache with ECC,32/64KB64/128-bit AXI system bus,configurable 64-bit AXI slave portBesides Machine mode&User mode,Supervisor mode is supported for TEE(Trust Execution Environment)Configurable Trace moduleFull Standard Debug Function with JTAG/cJTAG Port Configurable in lockstep or split m

17、odePrivate Peripheral IF(AHB-Lite)TraceSafety MechanismDescriptionHWSM-DCLSDual Core LockstepHWSM-SRAM-PROTECC Protection on SRAMHWSM-I/O ProtectionInput.Output signal protection HWSM-NSI-ISONon-safety isolationHWSM-DCLS-TSCTotal-self-check comparatorHWSM-EXT-WDGExternal watchdog timerConfidential 2

18、023 Nuclei.All Rights Reserved.2023-8-2111Safety critical SoC with Nuclei2023Q32023Q4NA900(ASIL D)Q3/4Q3/4NA900(ASIL B)NA300(ASIL B)NA300(ASIL D)20242025Safety BusNA1000Confidential 2023 Nuclei.All Rights Reserved.Safety Package2023-8-2112FMEDASafety ManualConfidential 2023 Nuclei.All Rights Reserve

19、d.2023-8-2113Summary for Nuclei Automotive FuSa SolutionsNuclei ASIL-B&ASIL-D SolutionsNuclei ASIL-B&ASIL-D SolutionsSaving Certification EffortsHigh QualityFlexible Configurationsl ASIL-B&ASIL-D solutions are both availablel Rich configurations to fit variable automotive SoC requirementsl Competitive PPA with ASIL B&Dl Comprehensive safety packageAdaptable Safety ManualAdaptable Safety Analysis ReportFMEDAFMEASupporting EvidenceConfidential 2023 Nuclei.All Rights Reserved.