Interactive System Architecture Atlas交互式系统架构图谱
Move across a highlighted module to preview its engineering card beside the source region. Click to lock the region, dim unrelated architecture and focus the viewport. Pan, scroll or pinch for deep zoom; use the module rail for a guided reading sequence.
移动到高亮模块即可在原始区域旁预览工程说明卡。点击后锁定区域、暗化无关架构并聚焦视口。拖动、滚轮或双指进行深度缩放，也可通过模块序列条按顺序阅读。
Hardware/Software Contract Boundaries软硬件契约边界
EI.Tensor.v1Perception and model traffic感知与模型流量Shape, dtype, quantization, semantic frame, acquisition time, calibration revision and validity mask travel with every tensor.每个张量携带形状、数据类型、量化、语义坐标、采集时间、标定版本和有效掩码。
EI.ControlSlot.v1Bounded control slot有界控制时隙A command declares release time, deadline, actuator set, mode, limits, source authority and fail-safe action.指令声明释放时间、截止时间、执行器集合、模式、限值、来源权限和故障安全动作。
EI.KnowledgePage.v1Domain context page领域上下文页Compact ontology IDs, relations, rules and capability predicates are cached near compute without treating generated text as truth.紧凑的本体 ID、关系、规则和能力谓词缓存在计算附近，生成文本不被视为事实。
EI.SafetyClaim.v1Independent safety evidence独立安全证据Monitor configuration, coverage, diagnostic latency, fault response, test vectors and approver remain separate from AI firmware.监视器配置、覆盖率、诊断延迟、故障响应、测试向量和批准人与 AI 固件分离。
EI.ModelPackage.v1Qualified model image合格模型镜像Weights, compiler, operator profile, precision, golden tensors, latency envelope, license and rollback digest are signed together.权重、编译器、算子配置、精度、黄金张量、延迟包络、许可证和回滚摘要共同签名。
EI.Trace.v1Cross-island causal trace跨岛因果轨迹Hardware timestamps connect sensor ingress, inference, planning, command admission, actuation and safety intervention.硬件时间戳连接传感输入、推理、规划、指令准入、驱动和安全干预。
Interactive Domain Runtime Atlas交互式领域运行时图谱
The runtime path from sensing to action has three execution partitions: variable-latency cognition, bounded control, and independently enforced safety. Each partition has its own timing and assurance requirements.
从感知到动作的运行路径分为三个执行分区：可变延迟认知、有界控制和独立强制安全。三个分区分别采用不同的时序与保障要求。
Latency Classes and Admission Rules延迟等级与准入规则
| Class等级 | Typical work典型工作 | Execution partition执行分区 | Admission rule准入规则 |
|---|---|---|---|
| L0 · Hard safety硬安全 | Emergency stop, torque/velocity envelope, watchdog, safe state.急停、力矩/速度包络、看门狗和安全状态。 | Lockstep safety MCU or isolated safety island.锁步安全 MCU 或隔离安全岛。 | No dependency on NPU, Linux, network or generated policy.不依赖 NPU、Linux、网络或生成策略。 |
| L1 · Servo伺服 | Current, torque, velocity, position and impedance loops.电流、力矩、速度、位置和阻抗闭环。 | Real-time cores, deterministic SRAM, TSN/EtherCAT endpoint.实时核、确定性 SRAM 和 TSN/EtherCAT 端点。 | Static schedule, bounded WCET and deadline monitor.静态调度、有界 WCET 和截止时间监视。 |
| L2 · Reactive autonomy反应式自主 | State estimation, local planning, sensor fusion, collision avoidance.状态估计、局部规划、传感融合和避碰。 | CPU/DSP/vector cluster with reserved memory and NoC budget.具有预留内存和 NoC 预算的 CPU/DSP/向量集群。 | Tail-latency gate; stale output is rejected, never applied late.执行尾延迟门；陈旧输出被拒绝，不能迟到后执行。 |
| L3 · Cognition认知 | VLA inference, semantic retrieval, task decomposition and explanation.VLA 推理、语义检索、任务分解和解释。 | NPU/tensor engines, HBM/LPDDR and general-purpose OS.NPU/张量引擎、HBM/LPDDR 和通用操作系统。 | Produces bounded proposals; cannot write actuator queues directly.只生成有边界提案，不能直接写入执行器队列。 |
Reference SoC Partition参考 SoC 分区
COMPUTE COMPLEXApplication and real-time CPUs应用与实时 CPU- RV64 or Arm application cluster for Linux-class services.RV64 或 Arm 应用集群运行 Linux 类服务。
- Isolated real-time cores with local SRAM and interrupt budget.带本地 SRAM 和中断预算的隔离实时核。
- Lockstep safety MCU remains independently clocked and verified.锁步安全 MCU 独立时钟并独立验证。
AI / VECTORNPU, DSP and vector enginesNPU、DSP 与向量引擎- INT8/FP16/BF16 tensor paths with structured sparsity as an optional profile.INT8/FP16/BF16 张量路径，可选结构化稀疏配置。
- Vector DSP handles filters, point clouds, transforms and classical control math.向量 DSP 处理滤波、点云、变换和经典控制数学。
- Operator watchdog prevents unbounded kernels from blocking control traffic.算子看门狗防止无界内核阻塞控制流量。
MEMORYSemantic-aware memory hierarchy语义感知内存层级- ECC SRAM for control, scratchpad for tensor/vector engines, LPDDR/HBM for models.控制使用 ECC SRAM，张量/向量引擎使用暂存器，模型使用 LPDDR/HBM。
- DMA descriptors carry frame, calibration, owner and lifetime metadata.DMA 描述符携带坐标、标定、所有者和生命周期元数据。
- Safety and control partitions have reserved bandwidth and denial counters.安全与控制分区具有预留带宽和拒绝计数器。
NOC / IOTime-aware interconnect时间感知互连- Virtual channels separate control, safety, sensor, model and debug traffic.虚拟通道隔离控制、安全、传感、模型和调试流量。
- TSN, EtherCAT, CAN FD, MIPI CSI, GigE Vision and PCIe terminate through IOMMU domains.TSN、EtherCAT、CAN FD、MIPI CSI、GigE Vision 和 PCIe 通过 IOMMU 域接入。
- Hardware timestamps share a monotonic epoch across ingress and actuation.硬件时间戳在输入与驱动之间共享单调纪元。
ONTOLOGY ENGINEDomain knowledge acceleration领域知识加速- ID translation, relation filtering, rule predicates and vector/graph cache.ID 转换、关系过滤、规则谓词和向量/图缓存。
- Provides compact context to planners without placing RDF traversal in servo loops.向规划器提供紧凑上下文，不把 RDF 遍历放入伺服闭环。
- Knowledge pages are signed, versioned and bounded by capability policy.知识页经过签名与版本化，并受能力策略约束。
SECURITY / SAFETYIndependent trust and diagnostic island独立信任与诊断岛- Root of trust, measured boot, encrypted model storage and attestation.信任根、度量启动、加密模型存储和证明。
- Memory/firewall isolation, lockstep diagnostics and fail-operational state machine.内存/防火墙隔离、锁步诊断和故障运行状态机。
- Safety monitor consumes raw sensors independently of AI summaries.安全监视器独立消费原始传感器，不依赖 AI 摘要。
POWER / THERMALWorkload-aware power control负载感知功耗控制- Separate voltage/frequency islands for NPU, CPU, sensor and control partitions.NPU、CPU、传感和控制分区采用独立电压/频率岛。
- Thermal governor preserves safety and servo budgets before AI throughput.热治理优先保证安全与伺服预算，再考虑 AI 吞吐。
- Power telemetry is part of every benchmark manifest.功耗遥测属于每份基准清单的一部分。
PACKAGEMonolithic or chiplet realization单片或 Chiplet 实现- Early prototype: FPGA plus discrete accelerator and safety controller.早期原型：FPGA 加离散加速器和安全控制器。
- Volume option: compute, IO and safety chiplets with a qualified die-to-die link.量产选项：计算、IO 与安全 Chiplet 通过合格 Die-to-Die 链路连接。
- Package, cooling and connector life are robot-level requirements.封装、散热和连接器寿命属于机器人级需求。
DEBUG / EVIDENCENon-invasive observability非侵入式可观测- Trace funnels capture causal events without perturbing hard real-time paths.追踪汇聚器在不扰动硬实时路径的情况下采集因果事件。
- Performance counters are partitioned by tenant, model and control mode.性能计数器按租户、模型和控制模式分区。
- Production debug is authenticated, rate-limited and physically revocable.生产调试经过认证、限速并可物理撤销。
Open Implementation and Verification Stack开放实现与验证栈
Cross-Layer Verification Matrix跨层验证矩阵
| Evidence level证据层级 | Target目标 | Method方法 | Release condition发布条件 |
|---|---|---|---|
| V0 · Contract契约 | Registers, tensor/control ABIs, memory map, clock and reset rules.寄存器、张量/控制 ABI、内存图、时钟和复位规则。 | Schema lint, executable specification and adapter conformance.模式检查、可执行规范和适配器一致性。 | No ambiguous units, ownership, ordering or fail-safe state.单位、所有权、顺序和故障安全状态无歧义。 |
| V1 · RTL | Datapaths, NoC, DMA, isolation, timers, safety state machines.数据通路、NoC、DMA、隔离、定时器和安全状态机。 | Simulation, assertions, formal properties, mutation and fault injection.仿真、断言、形式化属性、变异和故障注入。 | Coverage closure and all mandatory safety properties proven or bounded.覆盖率闭合，强制安全属性已证明或有界。 |
| V2 · Virtual platform虚拟平台 | Boot, drivers, RTOS, model compiler, ROS bridge and recovery.启动、驱动、RTOS、模型编译器、ROS 桥和恢复。 | Instruction/transaction simulation, recorded sensor replay and CI.指令/事务仿真、录制传感回放和 CI。 | Golden workloads reproduce from signed manifests.黄金负载可从签名清单复现。 |
| V3 · FPGA | Real sensor ingress, control timing, network, thermal and power behavior.真实传感输入、控制时序、网络、热和功耗行为。 | Prototype board, HIL, bus analyzers and controlled fault insertion.原型板、HIL、总线分析仪和受控故障注入。 | p99 deadlines and fault response pass under worst admitted load.最坏准入负载下 p99 截止时间和故障响应通过。 |
| V4 · Pre-silicon signoff流片前签核 | PPA, clocks, CDC/RDC, DFT, power intent, package and thermal model.PPA、时钟、CDC/RDC、DFT、电源意图、封装和热模型。 | Qualified EDA flow, static checks, emulation and independent review.合格 EDA 流程、静态检查、仿真加速和独立评审。 | No open severity-one issue; signed waivers have owner and expiry.无未关闭一级问题；签名豁免具有责任人和到期时间。 |
| V5 · Silicon and robot硅片与机器人 | Characterization, production test, calibration, robot tasks and field update.特性测试、量产测试、标定、机器人任务和现场升级。 | ATE, shmoo, thermal chamber, metrology, HIL and supervised pilots.ATE、Shmoo、温箱、计量、HIL 和监督试点。 | Silicon limits update capability profiles; no silent widening.硅片限值更新能力配置，禁止静默放宽。 |
Initial Architecture Gates初始架构门槛
The listed values apply to the pilot profile. Each product requires limits derived from its workload characterization and hazard analysis.
表中数值适用于试点配置。具体产品应根据负载特征和危险分析重新确定限值。
0 deadline misses caused by NPU loadStress all admitted AI, sensor and debug traffic.压力覆盖全部准入 AI、传感和调试流量。p99 < 10 us @ 1 kHz profileMeasured at command admission and actuator egress.在指令准入和执行器输出处测量。100% mandatory faults reach safe stateIndependent suite includes stale AI and bus failures.独立测试覆盖陈旧 AI 输出和总线故障。task KPI within approved toleranceCompare training, reference runtime and silicon outputs.比较训练、参考运行时与硅片输出。reserved control bandwidth never deniedIncludes refresh, ECC, thermal and contention cases.覆盖刷新、ECC、热和竞争场景。100% critical events causally orderedSensor-to-actuation chain uses one monotonic epoch.传感到驱动链使用同一单调纪元。rollback < 5 min; no unsigned bootPower-loss and network-loss updates are exercised.测试断电和断网升级场景。control stays in budget at AI throttleThermal governor sacrifices cognition throughput first.热治理优先牺牲认知吞吐。Realization Roadmap实现路线
PHASE 0Workload and hazard envelope负载与危险包络Freeze representative perception, planning, control and safety workloads. Measure bandwidth, tail latency, memory, power and fault response on existing robots.冻结代表性感知、规划、控制和安全负载，测量现有机器人的带宽、尾延迟、内存、功耗和故障响应。
PHASE 1Executable architecture model可执行架构模型Build transaction-level NoC, memory and accelerator models; connect recorded sensors and reference software before committing RTL.建立事务级 NoC、内存与加速器模型，在提交 RTL 前接入录制传感和参考软件。
PHASE 2FPGA heterogeneous prototypeFPGA 异构原型Validate control isolation, interfaces, ontology cache, model compiler and trace path with real sensors, drives and HIL.用真实传感、驱动和 HIL 验证控制隔离、接口、本体缓存、模型编译器和追踪路径。
PHASE 3IP qualification and subsystem RTLIP 资格与子系统 RTLQualify cores, NoC, memory, safety, security and accelerator blocks against contracts, formal properties and PPA budgets.依据契约、形式化属性和 PPA 预算确认核心、NoC、内存、安全、保密和加速模块。
PHASE 4Emulation and software freeze仿真加速与软件冻结Boot production firmware, replay full robot scenarios, close drivers and compilers, and freeze signed golden workloads.启动生产固件、回放完整机器人场景、闭合驱动和编译器，并冻结签名黄金负载。
PHASE 5Tapeout and bring-up流片与点亮Proceed only after independent signoff. Characterize silicon limits, update capability profiles and run robot pilots under supervised release.仅在独立签核后流片。表征硅片限值、更新能力配置，并在监督发布下运行机器人试点。
RoboChip EDU: an extensible teaching boardRoboChip EDU：可扩展教学开发板
RoboChip EDU is a proposed teaching platform for the AI-native embodied-intelligence robot SoC. Students can measure the separate paths for Linux-class cognition, deterministic control, and independent safety. A removable compute module carries the robot chip and memory. The carrier supplies protected power, laboratory IO, network interfaces, trace access, and replaceable sensor or actuator mezzanines.
RoboChip EDU 是面向 AI 原生具身智能机器人 SoC 的教学平台设想。学生可以分别测量 Linux 类认知、确定性控制和独立安全三条路径。可更换计算模块承载机器人芯片和内存，教学载板提供受保护电源、实验室 IO、网络接口、追踪接口以及可替换的传感器或执行器扩展板。
Board partition and electrical boundaries板级分区与电气边界
| Partition分区 | Proposed implementation建议实现 | What students can observe学生可观测内容 | Protection boundary保护边界 |
|---|---|---|---|
| Compute module计算模块 | Robot SoC, LPDDR, nonvolatile storage, clock tree, PMIC, and module identity EEPROM.机器人 SoC、LPDDR、非易失存储、时钟树、PMIC 和模块身份 EEPROM。 | Boot stages, memory QoS, NPU load, thermal throttling, and signed image state.启动阶段、内存 QoS、NPU 负载、热降频和签名镜像状态。 | The keyed connector prevents an incompatible voltage profile from starting.带防呆的连接器阻止不兼容电压配置启动。 |
| Control and safety island控制与安全岛 | Independent MCU, local ECC SRAM, watchdog, hardware inhibit, encoder capture, and timestamp unit.独立 MCU、本地 ECC SRAM、看门狗、硬件禁止、编码器采集和时间戳单元。 | Deadline jitter, stale command rejection, watchdog response, and safe-state transition.截止时间抖动、陈旧指令拒绝、看门狗响应和安全状态转换。 | AI software cannot directly override the inhibit line or safety firmware.AI 软件不能直接覆盖硬件禁止线或安全固件。 |
| Sensor and network IO传感与网络 IO | MIPI CSI, USB, Ethernet with TSN profile, CAN FD, encoder inputs, GPIO, I2C, SPI, and UART.MIPI CSI、USB、带 TSN 配置的以太网、CAN FD、编码器输入、GPIO、I2C、SPI 和 UART。 | Ingress timestamps, DMA ownership, packet priority, calibration revision, and dropped-frame counters.输入时间戳、DMA 所有权、报文优先级、标定版本和丢帧计数。 | Level shifting, ESD protection, current limiting, and IOMMU domains isolate student wiring errors.电平转换、ESD 保护、限流和 IOMMU 域隔离学生接线错误。 |
| Mezzanine interface扩展板接口 | Two keyed connectors with power budget pins, board ID, SPI, I2C, UART, CAN FD, PWM, ADC, and synchronized trigger lines.两组防呆连接器，提供功耗预算引脚、板卡 ID、SPI、I2C、UART、CAN FD、PWM、ADC 和同步触发线。 | Driver binding, capability discovery, hot-plug policy, and timing across board boundaries.驱动绑定、能力发现、热插拔策略和跨板时序。 | The carrier enables power only after board identity and requested current pass policy checks.载板仅在扩展板身份和请求电流通过策略检查后供电。 |
| Debug and evidence调试与证据 | USB-C console, JTAG/SWD through an authenticated mux, trace buffer, current monitors, test points, and logic-analyzer header.USB-C 控制台、经认证复用器接入的 JTAG/SWD、追踪缓存、电流监测、测试点和逻辑分析仪接口。 | A timestamped chain from sensor ingress through inference and admission to actuator output.从传感输入、推理、准入到执行器输出的带时间戳链路。 | Debug unlock is logged, time limited, and unavailable to the safety island during assessed exercises.调试解锁会被记录并限时，在考核实验期间不能访问安全岛。 |
A current-limited 12 to 24 V classroom input feeds protected 12 V, 5 V, 3.3 V, and adjustable sensor rails. The board reports rail voltage, current, temperature, brownout, and trip cause. Motor power remains on an external drive mezzanine.限流的 12 至 24 V 教学输入经过保护后生成 12 V、5 V、3.3 V 和可调传感电源轨。开发板报告电压、电流、温度、欠压和跳闸原因。电机功率级保留在外部驱动扩展板上。
The SoC, safety MCU, Ethernet endpoint, sensor triggers, and trace unit share a monotonic timebase. Students can inject bounded offset and drift to test synchronization and stale-data handling.SoC、安全 MCU、以太网端点、传感触发和追踪单元共享单调时基。学生可以注入有界偏移和漂移，以测试同步与陈旧数据处理。
The carrier accepts a low-cost FPGA/SoM module before custom silicon and a robot-chip module after bring-up. Stable carrier pin assignments let the same course material follow both targets.在定制芯片完成前，载板可使用低成本 FPGA/SoM 模块；芯片点亮后再换用机器人芯片模块。稳定的载板引脚定义让同一套课程覆盖两种目标。
Camera, force/torque, motor-control, industrial-network, and mobile-base mezzanines publish an identity and capability descriptor. Software binds drivers by contract instead of connector position alone.相机、力/力矩、电机控制、工业网络和移动底盘扩展板发布身份与能力描述。软件依据契约绑定驱动，而不是只依据连接器位置。
Teaching sequence and measurable outcomes教学顺序与可测结果
LAB 01Boot, identity, and signed artifacts启动、身份与签名制品Inspect measured boot, module identity, firmware signatures, rollback counters, and the handoff from ROM to the application and safety partitions.检查度量启动、模块身份、固件签名、回滚计数，以及 ROM 向应用分区和安全分区的交接。
LAB 02Timed sensor path定时传感路径Capture a camera or encoder stream, trace DMA movement, compare clocks, and quantify latency from physical input to a typed tensor or event.采集相机或编码器数据流，追踪 DMA 搬运，比较时钟，并量化物理输入到类型化张量或事件的延迟。
LAB 03AI load versus control timingAI 负载与控制时序Stress the NPU and memory while a 1 kHz loop runs on the control island. Record jitter, QoS denials, thermal throttling, and deadline monitors.在控制岛运行 1 kHz 闭环的同时压测 NPU 和内存，记录抖动、QoS 拒绝、热降频和截止时间监测。
LAB 04Command admission and safe stop指令准入与安全停止Submit valid, late, excessive, and unauthorized commands. Verify that the admission gate rejects unsafe requests and that the safety MCU reaches the defined state.提交有效、迟到、超限和未授权指令，验证准入门拒绝不安全请求，并确认安全 MCU 到达定义状态。
LAB 05Capability-aware expansion能力感知扩展Attach a mezzanine, read its descriptor, bind the driver, enforce its power budget, and reject a deliberately incompatible capability declaration.接入扩展板，读取其描述符，绑定驱动，执行功耗预算，并拒绝一个故意设置的不兼容能力声明。
LAB 06Evidence package证据包Export firmware and model digests, calibration revision, trace records, latency percentiles, power data, fault response, and the exact board profile used for the run.导出固件与模型摘要、标定版本、追踪记录、延迟百分位、功耗数据、故障响应和本次实验使用的准确板卡配置。