ON Semiconductor

Is Now

Automotive Power Delivery Solutions for Xilinx Zynq UltraScale+ MPSoC

SUMMARY

The goal of this Application Note is to present automotive power delivery solutions for Xilinx’s Zynq UltraScale+, a family of programmable MPSoCs that can enable development of safety-critical Advanced Driver Assistance Systems (ADAS) and Autonomous Driving (AD) systems. The Xilinx Automotive XA Zynq UltraScale+ MPSoC family is qualified according to AEC−Q100 test specifications with full ISO 26262 ASIL C level certification. A basic description of devices in the family can be found at UltraScale Architecture and Product Data Sheet: Overview (DS890). Even for designs centered on a single family of devices, power management requirements are diverse and often unique to a customer design. As a result, no single power management proposal can provide an optimal solution. This Application Note covers a couple of different applications and proposes alternative power delivery architectures to accommodate variations in the requirements from different designs. This approach allows more optimized solutions that balance out design goals such as PCB area, BOM cost, power efficiency, and scalability. All individual devices fully adhere to the AEC−Q100 automotive quality management process for grade 1 or 2. The proposed architectures are also compatible up to ASIL C and ASIL D levels of Functional Safety, which can be achieved with the addition of appropriate monitoring and controlling functions.

APPLICATION NOTE

APPLICATIONS INFORMATION

Power Domains and Sequencing

A Zynq UltraScale+ MPSoC consists of the two major underlying blocks Processor System (PS) and Programmable Logic (PL) in isolated power domains. PS acts as one standalone SoC and is able to boot and support all its own features without powering on the PL. PS has two internal power domains, the low-power domain (LPD) must operate before the full-power domain (FPD) can function. However, LPD and FPD can be powered simultaneously. PL has a single power domain referred to as PLPD. As a highly integrated MPSoC, the Zynq UltraScale+ can require 10 or more independent rails split between PS and PL, the exact number and currents depending on the device complexity and application. To achieve minimum current draw and ensure proper power-up, there are constraints in the order the power rails should be powered on and off within the power domains LPD, FPD, and PLPD. An explanation of the recommended power supply sequencing can be found at Zynq UltraScale+ MPSoC Data Sheet: DC and AC Switching Characteristics (DS925).

The desired sequencing can be generated by an external control circuitry or MCU that monitors the power rails and generates appropriate enable signals to the regulators. Each power rail should be controlled by an individual enable signal. For example, the PMIC NCV6922 has enable signals dedicated to each one of its DC/DC converters and LDO regulators.

Functional Safety Considerations

In safety-critical applications the correct MPSoC operation can be judged key to the system safety. In those cases power management failures potentially impacting operation must be detected and controlled by appropriate circuitry to comply with the ISO 26262 norms and required ASIL level. The key point is to formally specify in which ways the power delivery circuit can impact the correct operation of the MPSoC, as well as the other supplied peripherals, by writing clear Technical Safety Requirements (TSR) at a system level. Those TSRs should in principle be derived from the system-level Safety Goal(s) and rippled down through the different components within the system. Therefore, they depend on the specific application and Zynq UltraScale+ device. As an example, these are some possible TSRs that may be needed:

• TSR1−X: Correct voltage levels (i.e. ±3% on the main rails and 5% on others) shall be supplied to the MPSoC
• TSR2: Correct start-up sequence shall be performed
• TSR3: Required shutdown sequence shall be performed

Power Requirements − Applications #1 and #2

Two example applications are provided along with typically required power rails and currents. Application #1 is representative of ZU2EG and ZU3EG devices and can, for instance, be used in smart sensors. Application #2 covers ZU5EG, ZU6EG, and ZU7EG devices, appropriate for more complex applications, such as sensor fusion. Consult DS925 for additional information on the DC and AC switching characteristics.

Pre-regulation Schemes

Solutions proposed in this Application Note assume a 12 V automotive battery (VBAT) as the primary power source. There is need for a first pre-regulation stage generating an intermediate voltage (e.g., 5 V or 3.3 V), followed by regulators/controllers for the individual rails. The designer should check the minimum operating VBAT before selecting the intermediate voltage and pre-regulation. Choice for the pre-regulation is dictated in part by the total required power. In low-power applications, such as Application #1, a single step-down ("buck") regulator may suffice.

Some of the choices for pre-regulation include:

• NCV97200, a two-output Automotive PMU developed primarily for ASIL B systems
• NCV891330, a dual-mode buck regulator which can output 3.0 A at 5 V

System Solution for Functional Safety

The Xilinx Automotive XA Zynq UltraScale+ MPSoC family is currently qualified to ISO 26262 ASIL C.

As such, only general guidelines to achieve ASIL C will be provided along with the underlying assumptions.

First, the safety requirements have to be clearly defined to be satisfied through a continuous monitoring safety mechanism. It is possible to use automotive-qualified devices without ASIL level (QM devices), by adding external monitoring devices to the system. That is done according to the "ASIL Decomposition", where redundant and independent safety requirements are assigned to the regulation devices and to the monitoring devices.

Functional Safety Considerations (Continuation)

The monitoring device will do the sequential power-up of the rails, as well as the monitoring. It is important that both sequencing and monitoring are sufficiently independent to avoid common failure modes. This can be done through two separate devices, or through a single device with two independent islands for sequencing and monitoring. Similar reasoning can also be applied to the shut-down sequence.