Packing a safety island into an SoC: the partitioning is the hard part

Let me say something. These past two days I've been going through the materials on the Huashan A2000 family — Lite, standard, Pro three tiers, 7nm, with CPU, GPU, NPU, MCU, ISP, CV all crammed onto one piece of silicon. Officially they talk about a 3L safety architecture: high-performance compute domain, deterministic safety domain, independent safety domain, three layers, achieving ASIL-D.

The first thing I looked at wasn't compute.

I just got my hands on ASIL-B, barely more than a day, haven't even scratched the surface — correct me where I'm wrong. But there's an intuition sitting there: previously you hung an external MCU as safety redundancy; now it's integrated into the SoC — cost, integration, supply chain all look better on paper, but the correlated-failure issue is right on the table. Same piece of silicon: the high-compute domain is running models at full load over there — heat, power, clock jitter — what guarantees it doesn't infect the safety domain.

The official line is hardware-level isolation plus dynamic configuration, able to switch between extreme safety and efficient collaboration.

Sounds fine. What I care about is how fine-grained the switching is. Are the independent safety domain's power, clock, and reset truly independent, or do they share a rail and rely on software to backstop? Without asking that clearly, ASIL-D on the spec sheet is just a word.

Also, a quick gripe about naming: one moment it's Lite, standard, Pro, the next it's N, L, U, X — two naming schemes from the same company, easy to mix up when selecting parts.

One suggestion only: don't look at TOPS first. First ask for the isolation boundary diagram of the independent domain. If you can't get it, add a cold start after prolonged sun exposure to your corner-case list yourself. We've run this intersection three hundred times, and what's always gotten us was never compute.