ARM on full-auto, pulls trigger with safety-critical architecture

ARM’s IoT expansion plans are continuing apace, with the announcement of the Cortex-A76AE CPU design. The new chip brings the Split-Lock processor redundancy feature to the 64-bit Cortex-A7 architecture, more commonly found in ARM’s smaller 32-bit MCUs that are used in mission-critical systems. The goal is to make ARM’s designs an option for those looking at CPU choices for self-driving systems in vehicles.

While a sound decision, it’s too early to estimate the impact on the market. ARM has a solid reputation for such safety-critical silicon, and given its stature in the mobile world, there’s a lot of cross-pollination and channel opportunities for the company to build on. In terms of roadmap, ARM expects the new CPU to appear in vehicles in 2020.

As it stands, ARM claims that the top 15 automotive chip makers are ARM licensees, and that it has a 22-year history in this space. It says that 65% of ADAS and 85% of IVI applications are powered by ARM chips. Now, while this sounds like ARM is in a dominant position, it is worth stressing that the automakers and OEMs haven’t really had other options besides ARM until this point. Now that x86 silicon and GPUs are proving to be potential candidates, ARM is on the offensive.

The AE in the product name denotes ‘Automotive Enhanced,’ but besides the Split-Lock feature, the processor seems very similar to the Cortex-A76 that is used in flagship smartphones. To this end, the company is planning to add two new variations to the AE family – the Helios-AE and the Hercules-AE. Of course, key to winning over support from automotive developers are the ISO 26262 ASIL B and ASIL D and the IEC 61508 specifications.

According to the launch, a 16-core Cortex-A76AE system will use less than 15W of electricity – largely thanks to the 7nm production process, as well as ARM’s expertise in low-power mobile processors. Up to 64-core configurations are possible, with the system using the ARMv8.2 architecture.

It isn’t clear what sort of applications the automotive community will use the chip design for. With 64-cores, you could create a very powerful central processor, which could control or manage many subsystems within a vehicle. Conversely, the 16-core configurations could provide you with multiple layers of redundancy for specific functions, such as road monitoring, IVI systems, or driving function control.

Split-Lock is a system that allows a processor to function in two modes. The Split function means that two processor cores can work independently of each other. In Lock mode, the two cores are paired to run in lock-step, so that they perform the same tasks. This allows a system to spot a hardware-induced error, as the result of the computation will differ, which then lets the overarching system know that something has gone terribly wrong.

Of course, such an architecture does not protect against the two processors simultaneously suffering the same hardware fault, but the odds of such a thing happening are absolutely miniscule – to the extent that if someone were to die from such an occurrence, it would be a sure sign that their given deity had had enough of them.

Should the monitoring system spot an error, identified through Split-Lock, then it can intervene – reverting to a last-known good configuration. The intervention system can be run on the SoC that houses the Split-Lock cores too, which should save on resources. There are arguments in favor of having that system running on physically separated hardware, but at that point, you’ve moved into a world where we have redundancy on redundancy – which quickly gets convoluted.

However, more conventional split-lock systems tend to use at least three cores in lock-step, so that there would be a clear ‘winner’ if one of the cores failed. That configuration would then let you know which core not to trust, so in the Cortex-A76AE, it would seem that you would want to be using at least four of the 16 cores to have that capability. After all, you won’t want to use a core which you now know to have some sort of hardware fault. ARM does say that two pairs of locked CPUs are available, but also believes that just the one will do.

ARM is billing this as the ‘world’s first autonomous-class processor,’ which is sure to irk rivals from Intel (Mobileye) and Nvidia. ARM’s Lakshmi Mandyam takes a pretty good jab at the two, saying that “unfortunately, the path to Level 5 autonomy has been paved with prototypes, often based on power-hungry, expensive data center CPUs lacking even the most basic functional safety features.”

We’ll keep our ears peeled for a comeback, which will probably note that power consumption isn’t really a problem when the car has an alternator (certainly a valid complaint when we’re in a pure-EV world, however).

Other design IP has been unveiled, including CoreLink GIC-600AE (Generic Interrupt Controller), CoreLink MMU-600AE (Memory Management Unit), and CoreLink CMN-600AE (Coherent Mesh Network). As the CoreLink name suggests, these elements are responsible for linking the different parts of the SoC together, in a coordinated manner.