AN 704: FPGA-based Safety Separation Design Flow for Rapid Functional Safety Certification

ID 683720
Date 9/01/2018
Document Table of Contents

Design Hierarchy and safety IP partitions

The first stage of the design creation flow is to define the design hierarchy and safety IP partitions. You should implement every safety related IP in your design in a partition(s) so the safety IP is protected from recompilation.

To demonstrate the design flow for the motor control system example, Intel considers the following IP is safety related:

  • DC Link Monitor, PLL, associated clocking structure and IO pins
  • The six-channel PWM in the drive channel 0 subsystem
  • FOC subsystem (nonsafety IP)
Figure 10. The Main Entities in the Design Hierarchy and the Logical Design Partitions

The design hierarchy allows design flexibility and is suitable for logical separation of the safety components in this example. Intel groups together the drive channel peripherals , independent of the FOC algorithm and the Nios II processor. This design can support many drive axes, with only a single instance of the FOC algorithm or Nios II processor.

This design specifies two safety related IP as design partitions, and one nonsafety IP partition. Using nonsafety IP partitions in the functional safety separation flow is optional.

Intel achieves strict preservation for safety IP partitions using the global .qsf assignment PARTITION_ENABLE_STRICT_PRESERVATION.

set_global_assignment -name PARTITION_ENABLE_STRICT_PRESERVATION <ON/OFF> - section_id < partition_name >

The assignment exhibits the following properties

  • When any partition has the assignment value ON, the Intel® Quartus® Prime software enables the safety and nonsafety separation flow
  • A partition default assignment value is OFF (nonsafety IP). In other words, when a partition has the assignment value OFF, it is equivalent to not having the PARTITION_ENABLE_STRICT_PRESERVATION assignment and specifies that the partition is defined as nonsafety IP
  • You may only assign partitions and I/O pins to safety IP.
  • A partition assigned to safety IP may contain safe logic only. If you assign a parent partition to a safety IP, consider all its child partitions as part of the same safety IP.
  • A design may contain several safety IP paritions. All the partitions containing logic that implements a single safety IP functionality should belong with the same top-level parent partition.