RV32 Safety Core — CV32E40S TCM Processor

What it is

rv32_safe is an ASIL-B safety wrapper around the vendored OpenHW CV32E40S RV32IMC processor core (Solderpad Hardware Licence v2.1), delivered as synthesizable SystemVerilog with no instruction or data cache — a deterministic, TCM-fed core built for safety islands and a direct upgrade path to lockstep, not for raw single-thread speed.

Key Features

• RV32IMC_Zicsr_Zifencei ISA — full M-extension multiply/divide (not the mul-only Zmmul option), always-on Zc compressed decode; B_EXT bit-manipulation and PMP/PMA regions are left at their off/zero defaults in this instantiation
• Cache-free, TCM-only memory interface: two independent secure OBI buses (instr/data) wired straight to a 0-wait-state TCM/SRAM — the core has no cache to hide latency and deadlocks if rvalid coincides with gnt
• CV32E40S security hardening aggregated into safety_monitor: register-file SECDED ECC, OBI handshake parity + rchk response checksum, hardened-CSR shadow copies, hardened-PC recompute — alert_major → err_code 1, alert_minor → err_code 3
• 32-line vectored CLINT-style irq_i; no external debug module wired (debug_req_i tied 0) — debug_halted_o/core_sleep_o remain for observability without an unanalyzed run-control entry point
• Pre-sign-off FMEDA (standalone): SPFM 51.30%, LFM 89.36%, PMHF 2.75×10⁻⁷/h — documented FAIL ASIL-B, driven by the uncovered ALU/mult/div/pipeline datapath (0% SPF DC); close the gap with rv32_lockstep, a same-port-list MAIN-core drop-in
• Measured, not estimated: 5,091 LUT / 3,012 FF / 3 DSP48E2 @ ≈116 MHz on Alveo U200; validated 2.29 CoreMark/MHz and 0.92 DMIPS/MHz bare-metal runs with err_valid held at 0
• Vendored CV32E40S RTL is never modified — all ASIL-B hardening lives in rv32_safe.sv, preserving upstream verification status and Solderpad licence compliance

Standards & Compliance

RISC-V RV32IMC_Zicsr_Zifencei ISA; OpenHW CV32E40S (Solderpad HL v2.1); ISO 26262 ASIL-B SEooC — pre-sign-off FMEDA SPFM 51.30% / LFM 89.36% / PMHF 2.75×10⁻⁷/h (FAIL standalone; PASS via rv32_lockstep)

Functional Safety

ASIL-A target (SEooC) · SPFM 51.30% · LFM 89.36% · Informational — not gated

Informational FMEDA — this IP is reported but NOT gated. The SPFM/LFM figures above are engineering estimates from a model that is not held to the ASIL metric gates (QM, safety-by-composition, a vendor-core overlay, or a pre-sign-off Technology Preview, depending on the IP). They are not a certification claim and must not be relied on as one. See the safety manual for this IP’s exact status, assumptions of use, and any open items.

ISO 26262:2018 · FMEDA available · Safety Manual included

Register Map

See datasheet for full register reference.

Getting Started

// Minimal instantiation
rv32 #(
 .ADDR_W(6)
) u_rv32 (
 .clk (clk),
 .rst_n (rst_n),
 // APB4
 .p_paddr (paddr),
 .p_psel (psel),
 .p_penable (penable),
 .p_pwrite (pwrite),
 .p_pwdata (pwdata),
 .p_prdata (prdata),
 .p_pready (pready),
 // Safety
 .err_clear (1'b0),
 .err_valid (err_valid),
 .err_code (err_code)
);

Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.