Block diagram
Physical implementation
What you’re licensing
The SoC’s fault-tree convergence point — every other IP’s err_valid/err_code line terminates here… It is delivered as a licensable soft-IP block engineered as an ASIL-B Safety Element out of Context — not just RTL, but the complete functional-safety work package needed to carry it into an ISO 26262 program:
1. Overview
fccu latches fault_i[NSRC-1:0] stickily, applies enable_q and reaction_q masks, drives fault_out_o (critical reaction) and alarm_o (non-critical), and provides a priority-encoded FAULTID register for the lowest-index active critical fault.
Key Features
- Up to NSRC hardware fault_i lines, each independently masked by ENABLE and classified critical-vs-alarm by REACTION
- Group-severity reaction classes (Hercules-ESM style): per-source GROUPSEL routes to independent err_low_o/err_high_o/err_crit_o outputs alongside the flat fault_out_o/alarm_o split
- Priority-encoded FAULTID register: lowest-index active critical fault, for fast software triage
- Triple-redundant (2-of-3 voted) sticky fault latch — a single-rail upset is masked, not just detected, so the FCCU keeps reporting correctly (err_code 9 flags the masked fault)
- Independent-rail cross-check of the critical-output OR-reduction, so a fault in the aggregation logic itself cannot silently swallow a real fault (err_code 9)
- Software INJECT register: exercises the full fault-to-reaction path (any source, any group) for ISO 26262 DC proof without a real hardware fault
- Even-parity ENABLE/REACTION/GROUPSEL config registers (err_code 1) and the catalog-standard err_clear/err_valid/err_code[3:0] self-diagnosis interface
Standards & Compliance
ISO 26262 Part 5 — fault collection / safety monitoring unit (FCCU / Hercules-ESM pattern); ASIL-B SEooC (SPFM 99.33%, LFM 100.00%, PMHF 1.91×10⁻¹⁰/h pre-sign-off)
Functional Safety
ASIL-B (SEooC) · SPFM 99.33% · LFM 100.00% · PASS
ISO 26262:2018 · FMEDA available · Safety Manual included
Register Map
| Offset | Register | Description |
|---|---|---|
0x00 | ENABLE | [NSRC-1:0] R/W per-source enable mask |
0x04 | STATUS | [NSRC-1:0] RO sticky fault bits |
0x08 | CLEAR | [NSRC-1:0] W1C write 1 clears that sticky bit |
0x0C | REACTION | [NSRC-1:0] R/W 1=critical (drives fault_out), 0=alarm only |
0x10 | INJECT | [NSRC-1:0] W1S write 1 sets sticky (fault injection / SMU) |
…3 more registers — see datasheet for the full table.
Getting Started
// Minimal instantiation
fccu #(
.ADDR_W(6)
) u_fccu (
.clk (clk),
.rst_n (rst_n),
// APB4
.p_paddr (paddr),
.p_psel (psel),
.p_penable (penable),
.p_pwrite (pwrite),
.p_pwdata (pwdata),
.p_prdata (prdata),
.p_pready (pready),
// Safety
.err_clear (1'b0),
.err_valid (err_valid),
.err_code (err_code)
);Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.
Where it fits
Typically deployed in the safety backbone of an ASIL SoC — error detection, redundancy, and the fault-reaction path that takes the system to a safe state.
Why license it, not build it
Interested in FCCU — Fault Collection & Control Unit?
Pricing, the per-IP FMEDA, safety manual, and RTL data room are shared under a mutual NDA.
Figures are pre-silicon engineering-grade estimates for a Safety Element out of Context (SEooC); final ASIL sign-off is the integrator’s, supported under NDA. FMEDA and Safety Manual available under NDA.
circuit-design.space · +1-971-357-1400 · anovickis@circuit-design.space