Boot Rom — Introduction

What it is

boot_rom is an integrity-checked, single-cycle instruction ROM that sits at the reset-fetch address of an OpenHW CV32E40S core (rv32/rv32_lockstep), which has no internal boot ROM of its own — it is the first code the core ever executes, and so the root of the SoC’s safe-boot chain.

Key Features

• Single-cycle OBI-lite instruction ROM preloaded with a real RV32 bootloader that validates the next-stage entry vector before jumping — the fixed reset-fetch target for CV32E40S / CV32E40S-lockstep cores with no internal boot ROM
• Per-word SECDED: golden check bits stored in a SEPARATE array from the data, so a fault injected into either is genuinely detected, never re-encoded away; single-bit upsets corrected in-line, double-bit upsets → err_code 2
• Complementary-DMR fetch-address shadow: a stuck-at that would select a wrong-but-SECDED-clean word is caught by comparing the live read-mux index against its KEEP_ATTR-protected lockstep complement → folded into err_code 2
• Complementary-DMR OBI control/decode shadow (rvalid/out-of-range): a stuck-at that would mis-grant or silently suppress the OBI error response raises err_code 9
• OBI integrity companion — instr_rvalidpar_o plus per-byte instr_rchk_o parity — for an independent, end-to-end response check at the fetch consumer
• DFT fault-injection ports (inj_data_xor/inj_chk_xor/inj_raddr_xor/inj_ctrl_xor, tied 0 in mission mode) exercise every diagnostic path; verified by a 7-test directed testbench (SBE correction, DBE, out-of-range, read-mux fault, OBI control fault)
• Pre-sign-off engineering FMEDA passes ASIL-B: SPFM 99.40%, LFM 100.00%, PMHF 5.65×10⁻¹⁰/h, with 2 of 3 fault regions at measured (fault-injection) diagnostic coverage

Standards & Compliance

ISO 26262 ASIL-B SEooC (pre-sign-off engineering FMEDA: SPFM 99.40%, LFM 100.00%, PMHF 5.65×10⁻¹⁰/h); OBI-lite instruction-slave interface (CV32E40S-compatible subset)

Functional Safety

ASIL-B target (SEooC) · SPFM 99.40% · LFM 100.00% · Informational — not gated

Informational FMEDA — this IP is reported but NOT gated. The SPFM/LFM figures above are engineering estimates from a model that is not held to the ASIL metric gates (QM, safety-by-composition, a vendor-core overlay, or a pre-sign-off Technology Preview, depending on the IP). They are not a certification claim and must not be relied on as one. See the safety manual for this IP’s exact status, assumptions of use, and any open items.

ISO 26262:2018 · FMEDA available · Safety Manual included

Register Map

See datasheet for full register reference.

Getting Started

// Minimal instantiation
boot_rom #(
 .ADDR_W(6)
) u_boot_rom (
 .clk (clk),
 .rst_n (rst_n),
 // APB4
 .p_paddr (paddr),
 .p_psel (psel),
 .p_penable (penable),
 .p_pwrite (pwrite),
 .p_pwdata (pwdata),
 .p_prdata (prdata),
 .p_pready (pready),
 // Safety
 .err_clear (1'b0),
 .err_valid (err_valid),
 .err_code (err_code)
);

Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.