Block diagram
Physical implementation
What you’re licensing
OTP-anchored, OpenTitan-style lifecycle state machine that gates debug/test/DFT access from RAW through PROD to RMA — one-way, monotonic… It is delivered as a licensable soft-IP block engineered as an ASIL-B Safety Element out of Context — not just RTL, but the complete functional-safety work package needed to carry it into an ISO 26262 program:
Lc Ctrl — Introduction
What it is
An OpenTitan-style device-lifecycle controller: an OTP-backed state machine that carries a chip through six one-way states — RAW → TEST → DEV → PROD → RMA → SCRAP — and gates debug/test/DFT access strictly by the current state, so PROD (and RAW, SCRAP) never expose an unlock.
Key Features
- Six-state one-way lifecycle FSM (RAW → TEST → DEV → PROD → RMA → SCRAP) with a formally-proven allowed-edge table — monotonic encoding, no skip or regression, SCRAP terminal
- Per-state debug/test/DFT gating (debug_en/test_en/dft_en) is a pure combinational function of lc_state_q — PROD, RAW, and SCRAP formally proven to expose zero unlock
- Every transition requires both edge legality and an authorising token_valid; illegal or unauthorised requests are rejected and latch a sticky lockout_q (err_code 3) instead of failing silently
- Lifecycle-state complementary-DMR shadow (lc_state_cmpl_q = ~lc_state_q) catches a stuck state bit that could silently unlock debug in PROD — err_code 9
- Transition edge-check DMR (legal_edge vs. an independently-coded legal_edge_chk) plus an access-gate/APB read-mux decode-DMR both feed err_code 3, closing the decode paths beyond the state register itself
- Zero-wait-state APB4 slave (LC_STATE/LC_GATES/LC_TRANS/LC_STATUS) is a read-mostly management/status plane — no security decision crosses the bus, only state readback and the gated transition request
- Catalog FMEDA: 188 synthesized cells, SPFM 99.82%, LFM 100.00%, PMHF 5.82×10⁻¹²/h — full-margin PASS against the ASIL-B target
Standards & Compliance
AMBA APB4 (ARM IHI 0024); OpenTitan-style lifecycle-controller pattern; ISO 26262 ASIL-B SEooC (SPFM 99.82%, LFM 100.00%, PMHF 5.82×10⁻¹²/h)
Functional Safety
ASIL-B (SEooC) · SPFM 99.82% · LFM 100.00% · PASS
ISO 26262:2018 · FMEDA available · Safety Manual included
Register Map
| Offset | Register | Description |
|---|---|---|
0x00 | LC_STATE | RO [2:0] current lifecycle state |
0x04 | LC_GATES | RO [0]=debug_en [1]=test_en [2]=dft_en |
0x08 | LC_TRANS | WO [2:0] requested target state (gated by token_valid) |
0x0C | LC_STATUS | RO [0]=last transition ok [1]=lockout (sticky illegal request) |
Getting Started
// Minimal instantiation
lc_ctrl #(
.ADDR_W(6)
) u_lc_ctrl (
.clk (clk),
.rst_n (rst_n),
// APB4
.p_paddr (paddr),
.p_psel (psel),
.p_penable (penable),
.p_pwrite (pwrite),
.p_pwdata (pwdata),
.p_prdata (prdata),
.p_pready (pready),
// Safety
.err_clear (1'b0),
.err_valid (err_valid),
.err_code (err_code)
);Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.
Where it fits
Typically deployed in the safety backbone of an ASIL SoC — error detection, redundancy, and the fault-reaction path that takes the system to a safe state.
Why license it, not build it
Interested in Device Lifecycle Controller?
Pricing, the per-IP FMEDA, safety manual, and RTL data room are shared under a mutual NDA.
Figures are pre-silicon engineering-grade estimates for a Safety Element out of Context (SEooC); final ASIL sign-off is the integrator’s, supported under NDA. FMEDA and Safety Manual available under NDA.
circuit-design.space · +1-971-357-1400 · anovickis@circuit-design.space