RISC-V Safety Island

A turnkey, ISO 26262-ready RISC-V safety subsystem — integrated, verified, and delivered with its FMEDA work products. Drop-in lockstep compute plus boot, isolation, lifecycle, timer, mailbox and logic-BIST, aggregated into one fault hub with a single graded safe-state reaction.

You are not buying RTL — you are buying the 12–18 months of safety-integration and certification schedule you skip. There is no shrink-wrapped, ISO 26262-ready RISC-V safety island on the open market today. This is it.

Why an island, not a part

A handful of safe IP blocks is not a safety case. The island is sold as one element with one rolled-up FMEDA metric, one Freedom-From-Interference argument, and one safe-state reaction — exactly the artifacts a Tier-1 safety assessor and an acquirer’s due-diligence team ask for first.

Headline safety metrics (verified roll-up)

Declared ASIL-D (SEooC) · SPFM 98.18% · LFM 96.07% · PMHF 2.87×10⁻⁸ /h · highest ASIL met: C

Failure-rate-weighted composition of every member’s own verified FMEDA model (tools/fmeda_rollup.py) — not a flat average. Against its DECLARED ASIL-D targets the roll-up does not pass: SPFM 98.18% against ≥99.00% (−0.8 pts) and PMHF 2.87×10⁻⁸/h against <1×10⁻⁸/h (2.9× over); LFM passes with +6.1 pts. All three metrics do meet ASIL-C. The dominant residual is the lockstep core, and the documented rv32_lockstep → ASIL-D lift is the route to closing the SPFM/PMHF gap.

safety_island_rollup.md is the authority for these figures — this page is hand-authored, so unlike every generated IP page its numbers are not re-derived on regeneration. Until it is brought under tools/gen_web_docs.py they must be updated by hand whenever a member’s FMEDA moves.

What’s inside

Optional: axi_tcm SECDED scratchpad/TCM. Roadmap: crg/pmu, jtag_dtm.

Key Features

• DCLS lockstep compute — the redundant compare covers the whole core, including the ALU/datapath a single core leaves uncovered (lockstep alert → safe state).
• One fault hub, graded reaction — every member detection lands on fccu, which drives Low / High / Critical reactions (Hercules-ESM-style) and a single fault_out safe-state pin.
• Freedom From Interference — iopmp enforces master-side isolation between partitions; the FFI argument licenses the subsystem PMHF sum.
• Secure, measured boot — rot measures the SECDED boot ROM and releases the core only after an authenticated boot; lifecycle-locked debug/test/DFT gates.
• Built-in self-test — logic BIST (latent-fault coverage) + memory BIST hooks.
• Configurable — add/subtract members by parameter (hart count, ROM size, with or without rot/lbist/TCM) to fit the target SoC and cost point.
• One APB4 config bus, slot-decoded to every member’s registers.

Functional Safety

Declared ASIL-D (SEooC); all three metrics meet ASIL-C · SPFM 98.18% · LFM 96.07% · PMHF 2.87×10⁻⁸ /h — see the roll-up above for which ASIL-D targets are not met

ISO 26262:2018 · Subsystem FMEDA roll-up + per-member FMEDA · Freedom-From-Interference / dependent-failure analysis · Safety Manual · all included.

The roll-up tool ranks the residual contributors, so the path to ASIL-D is explicit and evidence-backed — no hand-waving, every diagnostic-coverage number is tied to verified RTL and a repeatable test.

Deliverables

• Synthesizable SystemVerilog RTL (integrator + every member), parameterized.
• Subsystem FMEDA roll-up report + per-member FMEDA reports.
• Freedom-From-Interference / dependent-failure analysis.
• Integration testbench (boot → fault injection → graded safe-state).
• Safety Manual + Safety Application Note (assumptions of use / SEooC claims).
• IP-XACT packaging.

Target applications

ADAS & autonomous compute · automotive body/zonal controllers · industrial functional safety (IEC 61508) · robotics · medical devices · aerospace · any SoC that needs a certifiable RISC-V safety domain without an 18-month in-house safety program.

Getting Started

Contact circuit-design.space for the evaluation package: the integrator RTL, the FMEDA roll-up, and the safety manual. Configurations from a single-hart cost-optimized island to a dual-hart ASIL-D-targeted compute domain.

Engineering-grade pre-sign-off FMEDA: λ_gate anchored on SN 29500-2 + JESD89A public SER; diagnostic coverage refined to measured at gate-level fault injection for sign-off. Final FIT/PMHF scale with the foundry’s process-qualified SER.