The deliverable
What you’re licensing
Retains the line from ReadUnique as Unique-Clean (UC) or from ReadShared as Shared-Clean (SC); It is delivered as a licensable soft-IP block engineered as an ASIL-B Safety Element out of Context — not just RTL, but the complete functional-safety work package needed to carry it into an ISO 26262 program:
Synthesizable RTL
Portable, vendor-neutral SystemVerilog that drops onto your existing SoC fabric — no foundry or EDA-tool lock-in.
Per-IP FMEDA report
SPFM / LFM / PMHF computed against the ASIL target per ISO 26262-5 — the quantitative analysis your assessor asks for.
Safety manual
Assumptions of use, the safety mechanisms and their diagnostic coverage — written to drop straight into your safety case.
IP-XACT + integration docs
A machine-readable descriptor plus register and integration documentation for fast, low-risk bring-up.
Self-checking testbench
A self-checking (crypto: bit-exact) testbench and a one-command build, so you can reproduce every claim on day one.
Key Features
- Retains the line from ReadUnique as Unique-Clean (UC) or from ReadShared as Shared-Clean (SC); a local wr_req against a held UC line moves it to Unique-Dirty (UD) with zero CHI bus traffic
- Direct Cache Transfer (DCT): a snoop hitting a UD line forwards the SECDED-corrected data as SnpRespData on TXDAT — cache-to-cache, the Home Node never reads memory for that line
- Clean-hit or miss answers the ordinary no-data SnpResp on TXRSP; SnpUnique invalidates the held line, SnpShared retains a shared-clean copy (even after a dirty forward: UD→SC, not UD→I)
- Inline SECDED (ecc_pkg 4×64b) on the held line — single-bit upsets corrected transparently before the line ever leaves the RN, double-bit upsets flagged err_code 2
- Complementary diverse-DMR shadows on both the ReadUnique/ReadShared engine FSM and the independent snoop-response FSM, proven non-divergent in formal BMC (a_est_dmr/a_sst_dmr) — err_code 9
- Config-register even parity (err_code 1), CHI RespErr on a returning CompData propagated as err_code 3, and a ReadUnique/ReadShared-hang watchdog (err_code 4) — all through the shared safety_monitor
- Single synchronous clock domain, no CDC in this block (CHI flit/credit ports synchronous-by-spec); FMEDA ASIL-B PASS — SPFM 92.28%, LFM 90.63%, PMHF 9.66×10⁻⁹/h
Standards & Compliance
AMBA 5 CHI (Issue E-class RN-F); ISO 26262 ASIL-B SEooC (SPFM 92.28%, LFM 90.63%, PMHF 9.66×10⁻⁹/h)
Functional Safety
ASIL-B (SEooC) · SPFM 92.28% · LFM 90.63% · PASS
ISO 26262:2018 · FMEDA available · Safety Manual included
Register Map
| Offset | Register | Description |
|---|
0x00 | CTRL | RW [0]=EN |
0x0C | STATUS | RO [1:0]=line_state (I/UC/UD) [10:8]=err_code [11]=err_valid |
Getting Started
// Minimal instantiation
chi_rnf_dct #(
.ADDR_W(6)
) u_chi_rnf_dct (
.clk (clk),
.rst_n (rst_n),
// APB4
.p_paddr (paddr),
.p_psel (psel),
.p_penable (penable),
.p_pwrite (pwrite),
.p_pwdata (pwdata),
.p_prdata (prdata),
.p_pready (pready),
// Safety
.err_clear (1'b0),
.err_valid (err_valid),
.err_code (err_code)
);
Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.
Figures are pre-silicon engineering-grade estimates for a Safety Element out of Context (SEooC); final ASIL sign-off is the integrator’s, supported under NDA. FMEDA and Safety Manual available under NDA.