safe_video — Video Pipeline Integrity Monitor

What it is

safe_video is a safety-video pipeline monitor — synthesizable SystemVerilog soft-IP with an APB4-lite control interface and built-in ISO 26262 (ASIL-B/D) safety instrumentation that proves a video stream is live, unfrozen, and content-intact anywhere it sits in the chain, from camera ingest all the way to the final frames driven onto an instrument-cluster display.

Key Features

• Nine per-frame supervision mechanisms mapped to err_code: signature/freeze/blank/drop/geometry → err_code 3, frame-timeout watchdog → err_code 4, metadata SECDED double-bit → err_code 2, config parity → err_code 1, supervisor-FSM duplicate-DMR → err_code 9
• Observe-only tap on a generic frame interface (sof/eof/pix_valid/pix_data/src_seq) — never in the pixel datapath, so it cannot stall or corrupt the stream it watches
• Deployment-agnostic: tap the csi2_rx pixel output for ADAS/AV camera ingest, or the display-controller output for instrument-cluster telltale supervision — the same block, two safety cases
• Per-frame rolling signature (rotate-xor) with programmable EXP_SIG for end-to-end integrity or known-content self-test (e.g. a cluster power-on bulb check)
• Threshold-driven and opt-in per mechanism (SIG_CHK/SEQ_CHK/TO_EN via CTRL), with sticky STATUS telemetry, a frame counter, and last-frame signature readback
• “Who watches the watcher”: the supervisor FSM is duplicated and cross-checked (M9), so the supervision logic itself carries a diagnostic, not just the video it observes
• FMEDA-verified: SPFM 94.00%, LFM 89.49%, PMHF 3.63×10⁻⁹/h — ASIL-B PASS; 28 directed tests, one targeted fault per mechanism, lint-clean under Verilator -Wall

Standards & Compliance

AMBA APB4 (ARM IHI 0024); ISO 26262 ASIL-B SEooC (SPFM 94.00%, LFM 89.49%, PMHF 3.63×10⁻⁹/h); ecc_pkg SECDED storage protection

Functional Safety

ASIL-B target (SEooC) · SPFM 94.00% · LFM 89.49% · Informational — not gated

Informational FMEDA — this IP is reported but NOT gated. The SPFM/LFM figures above are engineering estimates from a model that is not held to the ASIL metric gates (QM, safety-by-composition, a vendor-core overlay, or a pre-sign-off Technology Preview, depending on the IP). They are not a certification claim and must not be relied on as one. See the safety manual for this IP’s exact status, assumptions of use, and any open items.

ISO 26262:2018 · FMEDA available · Safety Manual included

Register Map

…3 more registers — see datasheet for the full table.

Getting Started

// Minimal instantiation
safe_video #(
 .ADDR_W(6)
) u_safe_video (
 .clk (clk),
 .rst_n (rst_n),
 // APB4
 .p_paddr (paddr),
 .p_psel (psel),
 .p_penable (penable),
 .p_pwrite (pwrite),
 .p_pwdata (pwdata),
 .p_prdata (prdata),
 .p_pready (pready),
 // Safety
 .err_clear (1'b0),
 .err_valid (err_valid),
 .err_code (err_code)
);

Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.