AN 704: FPGA-based Safety Separation Design Flow for Rapid Functional Safety Certification

Download PDF
ID 683720
Date 9/01/2018
Public
Document Table of Contents
Document Table of Contents x
FPGA-based Safety Separation Design Flow for Rapid Functional Safety Certification
FPGA-based Safety Separation Design Flow for Rapid Functional Safety Certification x
About the Functional Safety Separation Flow Work Flows Functional Safety Separation of a Motor Control Design Example Appendix A: Terminology Appendix B: Design Checklist Document Revision History for AN 704: FPGA-based Safety Separation Design Flow for Rapid Functional Safety Certification
Work Flows x
Design Creation Flow Design Modification Flow
Functional Safety Separation of a Motor Control Design Example x
Design Considerations Design Creation Flow Using the Design Modification Flow
Design Considerations x
About Safety IP Partitions and LogicLock Regions Assigning I/O Pins Clocks, PLLs and Resets Routing Across Safety IP Partitions
Design Creation Flow x
Design Hierarchy and safety IP partitions Preparing the Design Example in the Intel® Quartus® Prime Software DC Link Monitor safety IP partition Creating a Safety IP partition for the DC Link Monitor and PLL Subsystem Component Creating a Safety IP partition for the PWM Interface Component Creating a Safety IP LogicLock Region for the DC Link Monitor Creating a LogicLock Region for the PWM Interface Creating a Fixed Size and Origin for a LogicLock Region Removing Precomiled Netlists Using the Intel® Quartus® Prime Incremental Compilation Compiling the Design The Fitter Report Exporting Safety IP Partition Generating Safety IP Bitstream Files
Using the Intel® Quartus® Prime Incremental Compilation x
Creating a Partition for the FOC Fixed-Point Component Creating a LogicLock Region for the FOC Fixed-Point Component
Generating Safety IP Bitstream Files x
Generating Complete FPGA Bitstream File
Using the Design Modification Flow x
Changing Nonsafety IP - Changing FOC Algorithm Parameter Adding New Features to Nonsafety IP Importing Safety IP Partition
FPGA-based Safety Separation Design Flow for Rapid Functional Safety Certification

Appendix B: Design Checklist

Design Phase Flow Actions

Design

Creation

Flow

Design

Modification

Flow
General Yes Yes

Have you installed ? All tool log messages should include "Info: Version 17.0.2 Build 602 07/19/2017 SJ Standard Edition".

General Yes Yes If you use a JTAG Master in the safety partition, have you added sci_use_legacy_sld_flow=on to quartus.ini as described in Knowledge Base solution ID rd07012015_904.
Place and Route Yes Yes

Have you assigned a strict preserved partition and reserved LogicLock region with fixed size and position to the safety IP?

Place and Route Yes Yes

Do not use the LL_MEMBER_EXCEPTIONS assignment on a safety IP partition, otherwise all the logic is not inside the LogicLock region. The Intel® Quartus® Prime software should give an error in this condition. In the , you must ensure the project does not use this assignment. Searching the project .qsf file for the following assignment or look at the Members column in the LogicLock Regions window.

set_instance_assignment -name LL_MEMBER_EXCEPTIONS <exception-list> -to <safe-partition-name>

Place and Route Yes Yes

Have you manually reviewed all ENABLE_STRICT_PRESERVATION assignments in the Intel® Quartus® Prime project .qsf file to ensure they are all set correctly?

  • An ENABLE_STRICT_PRESERVATION ON assignment is made for every safe IO pin connected to the safety IP
  • An ENABLE_STRICT_PRESERVATION OFF assignment is made for every non-safe IO pin connected to the safety IP
  • An ENABLE_STRICT_PRESERVATION assignment is not made to an IO pin connected to a non-safety IP.

The Intel® Quartus® Prime software checks that all IO pins connected to a safety IP have explicit ENABLE_STRICT_PRESERVATION assignments. If the assignment is missing the software gives an error message. The Intel® Quartus® Primesoftware ignores any ENABLE_STRICT_PRESERVATION assignments that you make to IO pins that are not connected to a safety IP.

Place and Route Yes Yes

Did the Intel® Quartus® Prime software apply the expected strict preservation settings to the safety IP partition and execute the expected strict preservation flow?

Have you checked the Intel® Quartus® Prime Fitter report strict preservation sub-section to confirm that LogicLock regions, partitions, and I/O assignments are correct?

Place and Route Yes No

Have you exported the post-fit netlist and routing information for the safety IP to .qxp file using the Intel® Quartus® Prime export parition feature?

For example, check the datestamp on the <safety IP partition name>.qxp file is correct.

Place and Route No Yes

Have you imported the post-fit netlist and routing information for the safety IP using the Intel® Quartus® Prime import parition feature from the .qxp file genertated during the design control flow phase ?

Place and route Yes No

Before running the design creation flow, have you removed all previous compilation netlists and .sof files? Otherwise the design modification flow runs.

Bitstream Generation Yes Yes

After successful compilation, has the Intel® Quartus® Prime software generated a .psm file for the safety IP?

Check the datestamp on the <safety IP partition name>.psm file is correct.

Bitstream Generation Yes Yes

Have you generated the .rbf, .ppb, and .md5.sign files for each safety IP using the quartus_cpf utlity?

Bitstream Generation No Yes

Have you run the functional safety POF verification tool to compare the safety IP bitstreams between design creation and design modification flows?

  • Check the .rbf.ppb.rpt file for correct tool versions, file datestamps, and error or warnings messages.
  • Any warnings detected by the functional safety POF verification tool should be reviewed to check they are expected and do not impact the design. Refer to the Functional Safety POF Comparison Tool User Guide for information about functional safety POF verification tool usage and messages.
  • Check that there is no inadvertent file corruption of the .psm and .rbf.ppb files. You should run an MD5 checksum on those files and compare the checksums against those stored in the .md5.sign file. You may use the 'md5sum' (or equivalent) utility shipped with ACDS Cygwin to recreate the checksum.
Bitstream Generation No Yes

Does the Intel® Quartus® Prime assembler give an internal error message, which may indicate a mismatch in the safety IP bitstream?

Verification Yes Yes

For each safety IP partition, have you prepared the following evidence for both design creation and design modification flows?

  • <design-name>.sof
  • <partition-name>.psm
  • <partition-name>.rbf.ppb
  • <partition-name>.rbf.ppb.rpt
  • <partition-name>.md5.sign
Verification Yes No

Have you archived the .qxp, .rbf.ppb, .psm, .sof and .md5.sign files to prevent the Intel® Quartus® Prime software overwriting them when you subsequently run a design modification flow compilation?

Verification Yes Yes

Have you archived the project on sucessful completion and verification of design creation flow and design modification flow compilations?

Related Information
Level Two Title