S32G3在软件定义汽车中的角色-S32G3 AND THE ROLE OF THE SOFTWAREDEFINED VEHICLE COMPUTER 2023

S32G3ANDTHEROLE

OFTHESOFTWARE-

DEFINEDVEHICLE

COMPUTER

ThomasBrown-SeniorPrincipalSolutionArchitect

CharlotteLi-SeniorSystemandApplicationEngineer

NOVEMBER2023

SECURECONNECTIONS

FORASMARTERWORLD

PUBLIC

NXP,THENXPLOGOANDNXPSECURECONNECTIONSFORASMARTERWORLDARETRADEMARKSOFNXPB.V.

ALLOTHERPRODUCTORSERVICENAMESARETHEPROPERTYOFTHEIRRESPECTIVEOWNERS.©2023NXPB.V.

‹#›

AGENDA

•TheSoftware-DefinedJourney

•VehicleUpdatability

•VehicleHealth

•VehicleCommunicationsandSecurity

•TheVehicleComputerandS32G3

1

PUBLIC

WEEKEND

MONDAY&TUESDAY

WEDNESDAY&THURSDAY

FRIDAY

GOTANIDEA

VALIDATE

IMPLEMENT

DEPLOYANDENJOY

WEEKLYFEATUREDELIVERY,THEMOSTIMPORTANTWIN-WINBUSINESS

.Youcandeployvalidateinyourexistingcarfleet

−ForOEM,easyaccesstocustomers:timetomarketreducedfrom7yearsto1weekandeasybugfixingwithoutrecalls

−Forusers,easyaccesstotechnology:havingnewfeatureswithoutpurchasingawholecar

−Fornature,deliveringnewfeaturesthroughnewsoftwareinsteadofnewcars,moresoftwarefactoriesandlesscarfactories

PUBLIC2

LEARNCONNECTANALYZEMONITOR

COLLECTDATASENDTOCLOUDEXTRACTVALUEPREDICT&OPTIMIZE

CONTINUOUSCUSTOMERMONITORING,THENEXTWIN-WINBUSINESS

.Bettercustomerorientation

−ForOEM:betterfeaturesacceptanceandrevenues

−For3rdparty:betterservicematchingandmorecost-effective

−Forusers:bettermatchtotheirneeds

PUBLIC3

COLLECTPREDICTINFORMMONITOR

DIAGNOSTICDATAIRREGULARITYINCIDENCECARHEALTH

KEEPINGANEYEONYOURCARHEALTHTHEBAREMINIMUMWIN-WIN

.Longervehiclelifeandrange

−ForOEM:moreattractivecarwiththesamebattery

−For3rdparty:morepredictivity

−Forusers:betterrangeandlessspending

−Fornature:lesspowergenerationforsameperformance

PUBLIC4

Ride

B

A

B

ITISALLABOUTMOBILITYDEFINITION

A

Live

PUBLIC

5

VEHICLEUPDATABILITY

PUBLIC6

‹#›

HARDWARE

DEVELOPMENT

THESHIFTINFEATUREDEPLOYMENTTOTHEVEHICLE

LEGACY

SINGLEHARDWAREANDSOFTWARE

DEVELOPMENT

FUNCTION

DEVELOPMENT

HARDWAREPRODUCTION

VEHICLEPRODUCTION

STATIC

Limitsfrequencyofupdates

NEWDECOUPLEDHARDWARE

ANDSOFTWAREDEVELOPMENT

FUTURE-PROOFHARDWARE

CAPABILITIES

NEXTGENVEHICLEPRODUCTION

HARDWARE

DEVELOPMENT

FUNCTIONSASASERVICE

SOFTWAREPLATFORM

VEHICLEPRODUCTION

HWREVSION

Allowsformultiplesoftwareupdates

andcodere-useacrosshardware

PUBLIC

7

Environment

Comfort

Convenience

Timeliness

Style

Safety

WHATDOWEVALUEINOURJOURNEYS?

Reliability

Maintainability

Affordability

8

PUBLIC

Source:

/watch?v=vOif7PXPufc

Comfort

USECASE-ENHANCEDSTABILITYCONTROL

Whyshouldwecollectdatafromvehicles?

Howcanitbeusedtoenhancethedrivingexperience?

Allharshbreakingeventsarelogged,alongwithotherdata:timeofday,vehiclespeed,weatherconditions,absinfo,gpslocation

Dataenhancedmodelsareusedtoenhancedstabilitycontrolandprovideearlywarningatspecifichazardlocations

Safety

PUBLIC9

RoadMaintenanceService

RoadHazardService

Cloud

RoadDefect

Warning

OnBoardService

EdgeCommunications

GPS

Sensor

and

Actuator

s

IVI

Display

Power

Steerin

g

Wheel

Speed

SteeringAngle

Brake

Suspension

Rain

Sensor

Tyre

Pressure

TorqueVectoring

Temperature

ENHANCEDSTABILITYCONTROLWITHSERVICE-ORIENTEDEXTENSIONS

VehicleHealth

VehicletoCloudAPI

RoadDefect

Detection

SignaltoService

ElectronicStabilityControl

Trajectory

Calculation

DomainController

Edge

LateralAccelerat

ion

Cameras

10

OTAClient

Gateway

Characteristics:

•Binarybasedupdateartifacts

•Performedinfrequently

•Drivenbybugfixing,performanceimprovementofvulnerability

patching

OTA

Agent

ECU2

OTA

Agent

ECU1

OTA

Agent

ECUn

…

TODAY’SOVER-THE-AIRUPDATEARCHITECTURE*UptaneOTAreferenceonS32G

OTAServers

•Packagemanagement

•Vehiclefleetmanagement

•Securityservices

OTAClient

•MasterpointforallECUsinthevehicle

•Campaignmanagement

•Localpackagemanagement

OTAAgent

•Localsecurityauthentication

•A/Bupdatemechanics

PUBLIC

11

Workl

oad

Workl

oad

Workl

oad

iECU1

iECU2

iECUn

OTAClient

…

…

ContainerFramework

OTAAgent

StaticPartition/s

DynamicPartition

VehicleComputer

•OTAmechanismsenhancedtoinclude

ECUn

ECU2

OTA

Agent

OTA

Agent

ECU1

OTAAgent

…

DiscreteECUs

TOMORROW’SOVER-THE-AIRUPDATEARCHITECTURE

IntegratedECUs

SecurePartition

cloud-nativeartifacts

•OTAClient/Agentsmustbecomevirtualisation/integrationcapable

•UpdatedtoincludeSOVDNotification

mechanisms

PUBLIC12

VEHICLEAPIINTRODUCTION

Whatis

VehicleAPI?

Whatis

VehicleHAL?

Whatis

VehicleSignalSpecification?

TheVehicleAPIenablestheAutomotive

SoftwareDevelopertoacceleratedevelopofcross-domainfunctionsandonandoffboarddigitalservicesandexperiencesthatscale

acrossvehiclefleets.

TheVehicleHardwareAbstractionLayer

translatesthevehiclespecificsignaldescriptionsintoastandardizedrepresentationusedbythe

VehicleAPI(VSS)

TheVehicleSignalSpecification,asdefinedby

COVESAintroducesavehicledomaintaxonomy..Ahierarchalstructuretodescribethesignalsofthevehiclepertheirrespectivedomain

TheSoftware-DefinedVehicle

–

ADigitalApproachtoCreatingNext-GenerationExperiences

https://www.digital

-/_files/ugd/87c677_bc0cec5efbec4337a11b72c8ac234bee.pdf

lify.app/

13

PUBLIC

VEHICLEAPI-SEATCONTROLDEMOARCHITECTURE

AWSSeatControl

Application

•Enableremoteuser

controlviaanydevice

IVISeatSimulation

(PC/RUST):

•Visualisecurrentposition

•Provideinterfacecontrols

IVISeatControlApplication

(PC/Python):

•Controlsseatposition

•Controlsseatheating

•Enablessavingpre-sets

VSSorVISS

Kuksa.ValDatabrokerandServer(PC/RUST/C++):

•AuthorisationAPI

•Subscribefunctionality(changes)

•Get/Setoperations

VSSorVISS

CANVSSBridge

•Kuksa.valprovider

•ConvertproprietaryCANmessagetoVSSsignal

Linuxvcan

Seatsimulator(PC/RUST)

•Visualisethepositionoftheseatandheatingstatus

•Simulatethephysicalbutton

controlsgenerateCANmessages

Vehicle.Cabin.Seat.Row1.DriverSide.Switch.IsUpEngaged

Vehicle.Cabin.Seat.Row1.DriverSide.Switch.IsDownEngaged

Vehicle.Cabin.Seat.Row1.DriverSide.Position

Vehicle.Cabin.Seat.Row1.DriverSide.Height

Vehicle.Cabin.Seat.Row1.DriverSide.Headrest.Height

Vehicle.Cabin.Seat.Row1.DriverSide.Switch.Headrest.IsUpEngaged

Vehicle.Cabin.Seat.Row1.DriverSide.Switch.Headrest.IsDownEngaged

14

PUBLIC

‹#›

VEHICLEHEALTH

15

PUBLIC

USECASE1:Indistributedsystems,ECU’sarerequiredtodegradetheirownperformancetosatisfythermal

management.Inacentralisedsystem,wemaywishtoaggregatethetemperaturesensordatafromacrossthefullVEAtofacilitateintelligentthermalmanagement

USECASE2:Thecentralresourcemonitoris

responsibletomaintainthefullvehiclehealthstatus.IntheeventofaCPUfailure,theVehicleComputermay

dynamicallyreconfiguretheredundantcomputeCPUtore-enablethefailedtaskduringthefault-toleranttime

interval.

USECASE3:Inordertosupportamoreefficientmethod

ofdeployingsoftwaretovehiclefleets,thevehicle

electronicsandsoftwaremustbefullyinstrumentedtosupportthefleetsoftwaretestinganddebuggingbeforefullfleetsoftwareroll-out.

VEHICLERESOURCEMONITOR

•Inautonomoussystemstheory,Self-awarenessreferstoasystem'sabilitytorecognizeitsown

state.

•Incloud-nativedevelopment,Observability

visualizesandcorrelatesmetrics,events,logs,andtracedatasoyoucanidentifyproblemsandanalyseperformanceissues

•Forthesoftware-definedvehicle,buildingself-awarenessandobservabilityintheVehicle

Computercanfacilitatebetterfailureresilience;statefulvehiclecontrolandenablenewmore

efficientsoftwarevalidationmethodologies.

•Thevehicleresourcemonitorintegratestheseconceptstosupportvehiclehealthand

updatability

“youcannotmanagewhatyoudonotmeasure”PUBLIC16

•SOCpowerandhealthstatus

•VirtualECUperformanceandmemoryusage

VEHICLERESOURCEMONITOR

•PCIestatistics

•Networkbandwidth

•Endtoendlatency

•Packetlossstatistics

•Securitystatus

•Tomeetthecomplexrequirementsofautonomousvehicles,self-awarenessmustnotbetakenseparatelyoneachlayerbutcombinedintoacoherent

vehicleself-awareness

•TheVehicleComputercanusethese

inputstoimplementstatefulexecution

managementandotherintelligentcontrolactions

•TheVehicleComputercanlogfull

systemeventsonit’sSSDand/ormakemetricsavailabletothecloudforforensicanalysis

NXPVEHICLERESOURCEMONITORARCHITECTURE

•Powerstatus

•CPUload

•Sensor/Actuatorhealth

PUBLIC

17

VEHICLERESOURCEMONITOR

.SOVD(Service-OrientedVehicleDiagnostics)

−DiagnosticcommunicationbetweenHPCsandECUs(remote,proximity,in-vehicle)

−ProvideoneAPIforalldiagnosticpurposesaswellasforsoftwareupdates(crossvehicle)

−Coversbothtraditionalusecases(dataaccess,faultinformation,controlofinternalsoftware

functions)aswellasHPCrelateddiagnosticusecases(vehiclesoftwareupdates,logging,tracing,accesstosysteminformation,dynamicdiscoveryofcontent)

−NotreplacewidelyusedtechnologiesliketheUDSprotocolbuttocoexistswithUDSwhileenhancingthefunctionalityfordiagnostic

communication

−BaseonHTTP/REST,JSONandOAuth,starttheimplementationwithAUTOSAR.

ASAMSOVDarchitecture

/standards/detail/sovd/

PUBLIC18

VEHICLERESOURCEMONITOR

•OnchipIPandfirmware

supportinghealthstatusandself-awarenesscanbeaggregated

centrallywithnooverheads

•CPUandSoftwareobservabilityissupportedbythetelemetryuse

caseonS32G/GVIPORthroughSonatusCollector.

SoCHealthMonitoring

-Temperature,Current,andVoltage,butdifficulttoquantifytheinfluenceofeachvECU.

-On-ChipAnomalydetectionandfailureprediction)

Safety/FaultMonitoring

-fatalsafetyfaultsnotmanagedlocallybythevECUs

Networkingmonitoring

-Counters/MonitorsforEthernetTraffic,availabletoEthSwitch/NETCPSIowners

19

PUBLIC

PUBLIC20

HARNESSTHEVALUEOFDATA

PUBLIC

21

‹#›

VEHICLE

COMMUNICATIONSAND

SECURITY

22

PUBLIC

SDVCOMMUNICATIONARCHITECTURE

Externalcommunications

Securecommunicationstocloud

withTLS,MQTT,HTTP

Serviceorientedcommunication

•SOME/IP

•MultiGiEthernet

•PCIe

•SOVD

•AVB/TSN

Legacycommunications

•CAN,LIN,FlexRay,CAN-FD,CANXL

•DiagnosticsoverUDS

•CAN-over-Ethernet;

•10BTEthernet

Cloud

VehicleComputer

ZonalControllers

SmartEdges

PUBLIC23

Stellantis–IEEESA–Ethernet&IP@AutomotiveTechnologyDay

MOTIVATIONFORSDN

ZonalnetworkswithTSN.Everytalker,bridgeandlistenermustworktogethersupportinga

commonQOSpolicy

Dynamics.Frequentupdatesanddemandforstatefulconfiguration.Heterogeneousnetworkipdrivesconfigurationcomplexity

Newvehiclenetworkdesignmethodologiesandtoolsrequireseamlessexportandimportofconfigurationdatastructures

Demandsaninstrumented,observablenetwork

Renault,RTAW–AutomotiveEthernetCongress2023–FACEArchitectureStudy

PUBLIC24

CORECONF

CORECONFServer

CoAPClient

CORECONFClient

Server

ConfigDatastore

SJA1xxx

Drivers

CoAPClient

CoAPServer

GMAC

DTLS

Net

drivers

IP

PFE

S32Processor

DTLS

IP

Integrated

SwitchIP

S32Processor

DTLS

IP

TTE/NETC

TSNSwitch

NXPSwitch

NXPPROJECTONSOFTWARE-DEFINEDNETWORKING

•NXPisprototypingsoftware-definednetworkingselectingthemostefficientprotocols

•AtNXPseesvalueinharmonizingethernetconfiguration

•ResultswillbesharedatAutomotiveEthernetCongress2024

CentralNetworkConfiguration

SDNmanagementcommunication

CORECONFServer

CoAPServer

MCAL

DTLS

IP

NETC

TSNSwitch

S32Microcontroller

PUBLIC

25

VEHICLESECURITYRISKS

CLOUDSERVER

ATTACK

ATTACKFROM

WIRELESSDEVICE

MALICIOUS

FIRMWAREUPDATE

V2XMESSAGE

SPOOFING

MAN-IN-THE-MIDDLEATTACK

GPSSPOOFING

SNIFFINGOFUSERDATA

ATTACKFROM

DOWNLOADED

APPLICATION

MALWAREFROM

INFECTEDSTORAGE

EVCHARGER

ATTACK

REMOTEZERO-DAYEXPLOIT

ATTACKON

KEYS/

CERTIFICATES

MALWAREDELIVERY

THROUGHMEDIACONTENT

ENCODING

KEYLESSENTRYSPOOFING

SENSORDATA

MANIPULATION

COMPROMISED

ACTUATOR

COMPROMISEDECU

OBD-IIPORTATTACK

RANSOMWAREATTACK

VEHICLENETWORK

REMOTEATTACKONVEHICLEBUS

SNOOPINGANDATTACKS

EXPLOITINGSOFTWARE

VULERABILITIES

PUBLIC26

2024

2020

ISO/SAE21434-AUTOMOTIVECYBERSECURITYENGINEERING

TheUNECER155regulationforcybersecurityrequiresAutomotiveOEMstohaveacertifiedCyberSecurityManagementSystem(CSMS)thatidentifies&managessupplier-relatedrisks

UNregulationR155inforce

Jan.2021

RegulationinforceinEU&Japanforallvehicletypes2

July2024

UNECE

WorldForumfor

HarmonizationofVehicleRegulations(WP.29)

RegulationinforceinEU&Japan,

fornewvehicletypes1

July2022

2021

2022

2023

Aug.31,2021

1.InEuropeforallnewvehicletypes;inJapaninitiallyonlyifequippedwithSWOTAupdatesandfromJan.2024onwardalsonewvehicletypeswithoutOTA.

2.Forallnewvehicleregistrations,soalsoforregistrationofexistingvehicletypes.InJapaninitiallyonlyforvehicletypeswithSWOTAupdatesandfromMay2026alsoforvehicletypeswithoutOTA.

ISO/SAE21434published

Sept.6,2021

NXPcertifiedascompliant

TheISO/SAE21434standardiswidelyrecognizedasmeansforthesupplychaintohelpvehiclemanufacturersachievecompliancewithUNECER155

PUBLIC

27

2

IN-VEHICLENETWORKSECURITY(SDV)

VehicleComputer

Sensor/ActuatorSensor/Actuator

HOWTOENSURETRAFFIC

SEPARATIONONTHESAME

PHYSICALMEDIUM?

Logicseparationonthesharednetworkrequiredtopreventpivoting

Freedomofinterferencemustbemaintained

Requires

Securein-vehiclenetworkcommunications

PUBLIC

28

HOWDOWESECURETHEVEHICLENETWORK

TheVehicleComputerandNetworkmustenforceConfidentiality,IntegrityandAvailabilityatalllayers

Firewalling:

•Enforcesisolationbetweennetworksub-segments.i.etrustedzone,

safetyzone,edgenetwork

•Discard’sunauthorizedmessages

•VLANseparation

•StrictrulesbasedonmultipleIPlayers

Communicationprotocols:

•SecOC:

−PDUintegrity

•TLS

−TCP/UDPlayer

•IPsec

−IPlayer

•MACsec

−Hopbyhop

−Ethernetlayer

IntrusionDetectionSystem:

•Advancedanomalydetectionatmultiplelayers(IDS)

•Usesdeeppacketinspectiontoidentifycommonattacks(ARPspoofingforeg)

•The(P)inIDPSiswhere

identifiedattacksarepreventedbyupdatingfirewallingrules

PUBLIC

29

breakclassical

signatureschemes

Post-QuantumsecurebootusingfullPQCsignatureschemes

Securebootusing

classicalsignature

schemes

standardized(1stwinners)

Today~2024Crypto-Agilityinsecureenclavesandatsystemlevel

POST-QUANTUMSECUREBOOT:DON’TWAITUNTILIT’STOOLATE!

Post-Quantum

Quantum

Cryptography

Computerscan

Post-Quantumsecurebootusinghybrid

signatureschemes

Sufficientmaturity

Thesooner,thebetter

Doit

NXP!

nowwith

TransitorysolutionusingPost-QuantumsecureprotocolsFindoutmorebyengagingwithNXPsecurityexperts!

NXP-HELPS-STANDARDIZE-NEXT-GENERATION-SECURITY

PUBLIC

30

KEYTAKEAWAYS

.NXPisaleaderinindustryPQCandSDVeffortstoaddressneeds

−NXPhasauthoredCRYSTALS-Kyberalgorithmthathasbeen

selectedasthefoundationforfuturepost-quantumcryptography(PQC)standards

−NXPhasshownhowS32GautomotiveprocessorswithhardwaresecuritycansupportPQCforsecureboottoday

−NXPiscollaboratingwithpartnerstoshowend-to-endsolutionsforPQC-secureover-the-air(OTA)updatesandsigningservices

Webinar:End-to-end

securityinvehicle

electronicarchitectures

https://mobex.io/webinars/end-to-end-

security-in-vehicle-electronics-

architectures/

31

PUBLIC

‹#›

THEVEHICLECOMPUTER

ANDS32G3

32

PUBLIC

CENTRALCOMPUTE

REQUIREMENTS

Real-timeEnd-Nodes

Zone

Controller

HPC

ADAS

IVI

VehicleCompute

PropulsionDomain

Zone

Controller

Radar

Processor

Zone

Controlle

r

Real-timeEnd-Nodes

Real-timeEnd-Nodes

Zone

Controller

Real-timeEnd-Nodes

Real-timeEnd-Nodes

Thesoftware-definedvehiclecomputermust:

.

Real-time

End-Nodes

Zone

Controller

Zone

Controlle

r

infrastructure

Bootfastand

−

orchestratevehicle

Real-time

End-Nodes

Real-time

End-Nodes

−Bethecornerstoneforvehiclesecurity

−Betheplatformformultipleexecutionenvironmentsisolatedandpartitionedwitharobustsafetyconcept

−RedundancychannelforADAS

PUBLIC33

NATIVEREAL-

TIME

Deterministic

Real-TimeOS

Safe

Baseboard

MODULARHPCAPPROACHWITHASTABLEVEHICLECOMPUTEFOUNDATION

CentralHPCECUDesign

ModularComputeCards

(e.g.incld.ADAS,IVISoCs)

Singleliquid

cooledmetal

enclosure

(e.g.incld.VehicleComputerSoC(s)-Body,GW,Motionstrategy)

HighPerformanceProcessingModules

NATIVE

COMPUTE

Upgradable

Interchangeable

HLOS

VehicleApps

ComputeSoC

Software-DefinedVehicleComputer

HETEROGENEOUSCOMPUTE

FastWakeup

HLandRTOS

Isolation

FunctionalSafety

SecureFoundation

NXPS32GNXPS32Z

NXPEthernetSwitch&PHYs

34

PUBLIC

PUBLIC35

Cabin/ADASmainboard

Responsibleforintelligentcabinandintelligentdriving

CentralControlE/EAutomotiveArchitecture

LEAPMOTORPUTTING

THELAYERSOFTHE

BRAININACTION

SoC

Highperformancecomputing

S32G

Vehiclecontrol/bodymainboard

~20%

Wiringharnessreduction

33%

Boxcountreduction

Responsibleforvehiclecontrol

andbodycontrol

CompatiblewithNXPS32G

medium/highconfiguration

NXPS32G

VEHICLENETWORK

PROCESSORS

Rapidlydeploynewservicesandupgradable

features

Safe,high-performanceprocessingforAutomated

Driving

Supportdomainandzonalvehiclearchitectures

DesignedandcertifiedtoISO26262:2018forASILD

systemsandISO/SAE21434forcybersecurity

Broaduseinotherautomotiveandnon-automotive

applications

S32G

PUBLIC

36

S32G3SERIES-SWANDPIN-COMPATIBLEEXTENSIONOFTHES32GFAMILY

SAFEPROCESSING

Upto4Dual-CoreLockstepArm®Cortex®-M7Microcontrollers

Upto8ClusterLockstepArmCortex-A53Microprocessors

16ResourceIsolationDomains

NETWORKING

20xCAN/CANFDInterfaces

LINandFlexRay™