The screen behind the wheel is the one with legal obligations. How it is architected when everything else is consolidating, and what Android is and is not allowed to own.
Advanced6 minCluster · Safety · Architecture
The instrument cluster is the screen the driver looks at most and trusts most. It
is also the one with legal requirements attached, which makes it the hardest part
of a consolidated cockpit.
Availability. A telltale must appear within a bounded time of its condition
occurring, every time. Android can be garbage collecting, updating, or restarting.
Boot time. Telltales are typically required within about two seconds of
ignition. Android takes fifteen or more.
Certification. The rated content needs a safety argument. A general-purpose
OS with dynamic memory allocation, preemptive scheduling and millions of lines of
third-party code cannot practicably provide one.
Cluster and infotainment converging — One cockpit controller, several displays, and a hypervisor proving that the infotainment guest cannot disturb the safety guest.
The cluster has its own processor running its own safety-rated software.
Infotainment sends content over a link — Ethernet, or shared memory if they are
on the same board.
Advantages: clean safety argument, independent failure, straightforward
certification.
Costs: two systems to build, two bills of material, a link to design and
version.
One processor, several guests. A safety guest owns the cluster display; an
infotainment guest owns the centre screen. A provides
.
Advantages: one chip, lower cost, shared GPU, a single thermal budget.
Costs: the isolation argument is now a software argument and must be proven
rather than assumed.
message ClusterCard { uint32 version = 1; // versioned from the first message Zone zone = 2; // which region of the cluster Type type = 3; // NAVIGATION | MEDIA | PHONE | ASSISTANT string primary = 4; // "Turn right" string secondary = 5; // "300 m" Icon icon = 6; // an enumerated icon, not a bitmap uint32 progress = 7;}
