The deliverable
What you’re licensing
A RISC-V Platform-Level Interrupt Controller (PLIC) delivered as synthesizable SystemVerilog soft-IP. It is delivered as a licensable soft-IP block engineered as an ASIL-B Safety Element out of Context — not just RTL, but the complete functional-safety work package needed to carry it into an ISO 26262 program:
Synthesizable RTL
Portable, vendor-neutral SystemVerilog that drops onto your existing SoC fabric — no foundry or EDA-tool lock-in.
Per-IP FMEDA report
SPFM / LFM / PMHF computed against the ASIL target per ISO 26262-5 — the quantitative analysis your assessor asks for.
Safety manual
Assumptions of use, the safety mechanisms and their diagnostic coverage — written to drop straight into your safety case.
IP-XACT + integration docs
A machine-readable descriptor plus register and integration documentation for fast, low-risk bring-up.
Self-checking testbench
A self-checking (crypto: bit-exact) testbench and a one-command build, so you can reproduce every claim on day one.
What it is
A RISC-V Platform-Level Interrupt Controller (PLIC) delivered as synthesizable SystemVerilog soft-IP.
Key Features
- Level-sensitive interrupt routing: NSRC sources (v0.1 hard-capped at 8 — PRIORITY is one fixed 32-bit, 4-bit/source register) to a single hart context’s ext_irq_o → mip.MEIP; priority 0 unconditionally disables a source
- ENABLE bitmap + THRESHOLD gating (only priority > threshold sources are eligible); CLAIM read atomically returns and clears the highest-priority eligible source id (lowest id breaks ties), COMPLETE ack re-pends a still-asserted level source
- TMR-voted pending latch: three keep’d rails (pend_r0/r1/r2) load every cycle and are voted 2-of-3 by voter_2oo3, masking a single-rail upset while pend_disagree flags the latent fault
- Independent eligibility-OR recompute (any_elig_redund) cross-checks ext_irq_o every cycle; either mismatch reports err_code 9 (lockstep) so a missed interrupt can never go silent
- Per-source even parity over the interrupt-routing vector table — one bit per 4-bit priority nibble, one over ENABLE, one over THRESHOLD — recomputed and compared every cycle → err_code 1; prio_fi_i is a dedicated DFT injection hook (tie 0 in mission mode)
- APB4 slave configuration/claim plane, fully separate from the irq_src_i interrupt-source data plane; 8-bit address decode over PRIORITY/PENDING/ENABLE/THRESHOLD/CLAIM
- Pre-sign-off FMEDA: SPFM 96.20%, LFM 95.56%, PMHF 1.00×10⁻⁹/h — PASS ASIL-B with margin on every metric; the claim-ID arbitration compare is the one disclosed, fail-loud residual single point
Standards & Compliance
RISC-V Platform-Level Interrupt Controller (PLIC) specification; ISO 26262 ASIL-B SEooC (SPFM 96.20%, LFM 95.56%, PMHF 1.00×10⁻⁹/h)
Functional Safety
ASIL-B (SEooC) · SPFM 96.20% · LFM 95.56% · PASS
ISO 26262:2018 · FMEDA available · Safety Manual included
Register Map
| Offset | Register | Description |
|---|
0x00 | PRIORITY | 4 bits/source packed (0 = source disabled) |
0x04 | PENDING | [NSRC-1:0] RO |
0x08 | ENABLE | [NSRC-1:0] |
0x0C | THRESHOLD | [3:0] (only priority > threshold can interrupt) |
0x10 | CLAIM | read = claim id (clears pending); write = complete |
Getting Started
// Minimal instantiation
plic #(
.ADDR_W(6)
) u_plic (
.clk (clk),
.rst_n (rst_n),
// APB4
.p_paddr (paddr),
.p_psel (psel),
.p_penable (penable),
.p_pwrite (pwrite),
.p_pwdata (pwdata),
.p_prdata (prdata),
.p_pready (pready),
// Safety
.err_clear (1'b0),
.err_valid (err_valid),
.err_code (err_code)
);
Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.
Applications
Where it fits
Typically deployed in the safety backbone of an ASIL SoC — error detection, redundancy, and the fault-reaction path that takes the system to a safe state.
Figures are pre-silicon engineering-grade estimates for a Safety Element out of Context (SEooC); final ASIL sign-off is the integrator’s, supported under NDA. FMEDA and Safety Manual available under NDA.