Avionics, Space & Mil-Std Networking

AFDX End-System (ARINC 664 Part 7)

arinc664 is an ARINC 664 Part 7 / AFDX (Avionics Full-Duplex Switched Ethernet) end-system soft-IP: the dual-redundant,

Request this IP →Browse the catalog

ASIL-B

target

92.38%

SPFM

88.73%

LFM

PASS

FMEDA

4.2K

gates

0.1.0

version

The deliverable

What you’re licensing

arinc664 is an ARINC 664 Part 7 / AFDX (Avionics Full-Duplex Switched Ethernet) end-system soft-IP: the dual-redundant, It is delivered as a licensable soft-IP block engineered as an ASIL-B Safety Element out of Context — not just RTL, but the complete functional-safety work package needed to carry it into an ISO 26262 program:

Synthesizable RTL

Portable, vendor-neutral SystemVerilog that drops onto your existing SoC fabric — no foundry or EDA-tool lock-in.

Per-IP FMEDA report

SPFM / LFM / PMHF computed against the ASIL target per ISO 26262-5 — the quantitative analysis your assessor asks for.

Safety manual

Assumptions of use, the safety mechanisms and their diagnostic coverage — written to drop straight into your safety case.

IP-XACT + integration docs

A machine-readable descriptor plus register and integration documentation for fast, low-risk bring-up.

Self-checking testbench

A self-checking (crypto: bit-exact) testbench and a one-command build, so you can reproduce every claim on day one.

What it is

arinc664 is an ARINC 664 Part 7 / AFDX (Avionics Full-Duplex Switched Ethernet) end-system soft-IP: the dual-redundant, traffic-policed protocol layer — per-VL Bandwidth-Allocation-Gap (BAG) shaping, bit-identical A/B network replication, and Sequence-Number redundancy management — that sits above a standard Ethernet MAC (the catalog gmac).

Key Features

Configurable Virtual Links (N_VL), each with an independent BAG shaper + Lmax and per-row even parity (err_code 1) — a TX request issued before BAG credit elapses is policed, not transmitted early (BAGVIOL++, err_code 3)
Bit-identical dual-network A/B transmission: txa_word/txb_word are driven from the same combinational payload word, so replication itself structurally cannot diverge between networks
RX first-valid-wins de-duplication against a per-VL Sequence-Number sliding window (SNWIN); redundant duplicates silently dropped (CNT_DUP), genuinely out-of-window or FIFO-backpressured frames flagged as a protocol fault (CNT_DROP, err_code 3)
SECDED-protected RX delivered-frame FIFO (fifo_ecc): single-bit errors corrected transparently, double-bit uncorrectable flagged err_code 2
Complementary-DMR lockstep on both the TX shaper/scheduler and RX dedup FSMs → err_code 9, formally proved against legal-edge-graph, no-duplicate-delivered, and BAG-never-violated invariants
MAC-agnostic 16-bit frame-word handshake (valid/last, SN riding the last byte) to two external gmac MAC instances — Ethernet PHY, framing, FCS, and MII are entirely out of this IP’s scope
Frame-plane / config-plane separation: VL_CFG, VL_BAG, SNWIN, counters, and status live on the APB4 slave and never touch the AFDX frame datapath

Standards & Compliance

ARINC 664 Part 7 (AFDX); ISO 26262 ASIL-B SEooC (SPFM 92.38%, LFM 88.73%, PMHF 6.03×10⁻⁹/h); DO-254 / ED-80 hardware design-assurance evidence (formal proofs + FMEDA)

Functional Safety

ASIL-B (SEooC) · SPFM 92.38% · LFM 88.73% · PASS

ISO 26262-5 FMEDA method (transferable evidence for the RTCA DO-254 assurance case) · FMEDA available · Safety Manual included

Register Map

Offset	Register	Description
`0x00`	CTRL	[0]EN [1]TX_EN [2]RX_EN [3]RXFIFO_FLUSH
`0x04`	STATUS	[0]TX_BUSY [1]RX_BUSY [2]RXF_EMPTY [3]RXF_FULL [6:4]sh_state [9:7]dd_state
`0x08`	VL_SEL	[VL_W-1:0] selects the VL row addressed by VL_CFG / VL_BAG / VL_SN
`0x0C`	VL_CFG	[0]VL_EN [15:1]reserved [27:16]LMAX (frame words)
`0x10`	VL_BAG	[BAGW-1:0] BAG reload (min inter-frame spacing, in shaper ticks) for VL_SEL

…12 more registers — see datasheet for the full table.

Getting Started

// Minimal instantiation
arinc664 #(
  .ADDR_W(6)
) u_arinc664 (
  .clk       (clk),
  .rst_n     (rst_n),
  // APB4
  .p_paddr   (paddr),
  .p_psel    (psel),
  .p_penable (penable),
  .p_pwrite  (pwrite),
  .p_pwdata  (pwdata),
  .p_prdata  (prdata),
  .p_pready  (pready),
  // Safety
  .err_clear (1'b0),
  .err_valid (err_valid),
  .err_code  (err_code)
);

Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.

Applications

Where it fits

Typically deployed in avionics, defense, and space systems built to the ARINC, MIL-STD, and CCSDS standards.

The case

Why license it, not build it

Skip 12–18 months

The FMEDA and the safety case are already generated. You integrate a finished safety element — you don’t stand up a safety-IP program to originate one.

One vendor, one safety story

Every block in the catalog shares the same safety architecture, fault-reaction model, and FMEDA methodology — so subsystems roll up cleanly.

Verified, not vapor

The RTL builds and passes today; the safety metrics come from analysis and fault injection against real RTL, not a datasheet promise.

Interested in AFDX End-System (ARINC 664 Part 7)?

Pricing, the per-IP FMEDA, safety manual, and RTL data room are shared under a mutual NDA.

Talk to us →See related IP

Figures are pre-silicon engineering-grade estimates for a Safety Element out of Context (SEooC); final ASIL sign-off is the integrator’s, supported under NDA. FMEDA and Safety Manual available under NDA.

circuit-design.space · +1-971-357-1400 · sales@circuit-design.space