On-chip serial and network controllers — CAN 2.0/FD/XL, FlexRay, automotive Ethernet, UART, SPI, I²C/I³C and storage links, each with ASIL safety instrumentation.
Root-of-trust and crypto — AES, SHA-2/3, HMAC, PKA, TRNG/DRBG, CRC, and secure on-board communication (SecOC).
The ASIL safety mechanisms and system glue — ECC memory, 2-of-3 TMR voters, lockstep safety wrappers, BIST, the fault-collection unit, and compute helpers.
AMBA↔TileLink protocol bridges, width/clock-domain converters, and crossbars that stitch a heterogeneous SoC together.
AMBA-5 CHI coherent fabric — home nodes (HN-F), request nodes, AXI↔CHI bridges, and the coherency crossbar, with ordering proven by formal.
The RISC-V platform layer — lockstep cores, boot ROM, caches, CLINT/CLIC/ACLINT, IOPMP, JTAG debug, mailbox, and the LPDDR5 controller.
Aerospace and defense buses — MIL-STD-1553, the ARINC 429/629/664/717/818/825 family, ECSS-CAN, and CCSDS space links.
Edge-inference building blocks — INT8 MAC clusters, tensor DMA, NPU stages, KV-cache compression engines, LM head, and an AI plausibility guard.
Motor and power control — FOC/BLDC commutation, high-resolution motor PWM, DC-DC control, quadrature encoders, and sigma-delta sensor front-ends.
Display and imaging pipelines — MIPI CSI-2/DSI, DisplayPort link, AVTP transport, and safety-monitored video encode.
UAV and robotics safety — DroneCAN, DShot ESC, RC receiver, Remote ID, teleop link guard, and a safety-chute trigger.
The housekeeping layer — timers/counters, watchdogs (incl. windowed), real-time clock, clock/reset generation, and GPIO.
Additional building blocks that don't fit a single family.
Integrated, pre-assembled safety subsystems delivered with a rolled-up FMEDA.
Every entry in this catalog is delivered as a complete work product rather than a bare RTL drop. The intent is that an integrator can take a block into their own ISO 26262 safety case without first having to reverse-engineer the supplier’s assumptions about how it fails.
The analysis travels with the design. Each FMEDA report states the element count it is based on, the failure-mode distribution assumed across those elements, and the resulting single-point and latent-fault metrics — so a quoted figure can be traced back to a synthesized netlist rather than taken on trust. The safety manual states the assumptions of use: what the integrator must provide at their level for those figures to hold. That document is where most SEooC integrations quietly go wrong, which is why it ships as a first-class deliverable and not an appendix.
Every block here is engineered as a Safety Element out of Context, and it is worth being precise about what that does and does not mean. A SEooC is developed against an assumed safety requirement and an assumed operating context, because the supplier does not know the vehicle, the item, or the hazard the block will eventually serve. The figures in this catalog are therefore pre-silicon, engineering-grade estimates made against that assumed context. They are not a sign-off. Final ASIL attribution belongs to the integrator, who owns the item-level hazard analysis and is the only party who can confirm that the assumptions of use actually hold in their design.
SPFM, the single-point fault metric, is the share of a block’s dangerous failures caught by its own safety mechanisms — in practice the figure that best reflects how hard a block works to detect its own faults. LFM, the latent-fault metric, covers faults that are not themselves dangerous but that disable a safety mechanism, so a later fault goes undetected. ISO 26262 sets targets for both, and they rise with ASIL.
A verdict of PASS means a block’s computed metrics meet the target for its stated ASIL. A verdict of in progress means the block is functionally complete and verified, but its diagnostic coverage is still being raised to that target — it is an honest state, not a failed one, and the catalog shows it rather than hiding it. Gate counts, where shown, are drawn from the same synthesized netlist the FMEDA element count is based on, so area and safety figures refer to the same design.
A safety block is only as good as its fit to the item it serves. Engagements here tend to follow the same four steps, and the second one is the one that decides the outcome.
The complete catalog with per-IP datasheets and pricing is shared under a mutual NDA.
Figures are pre-silicon engineering-grade estimates for a Safety Element out of Context (SEooC); final ASIL sign-off is the integrator’s, supported under NDA. Verdicts marked “in progress” are IP whose diagnostic coverage is still being raised to its ASIL target.
circuit-design.space · +1-971-357-1400 · anovickis@circuit-design.space