Serial, Networking & Storage

QSPI/OSPI Execute-In-Place (XIP) Flash Controller

Hardware code-fetch engine for external SPI-NOR flash — no software driver in the read path, ASIL-B.

Request this IP →Browse the catalog

ASIL-B

target

94.50%

SPFM

89.52%

LFM

PASS

FMEDA

1.9K

gates

1.0.0

version

Interfaces at a glance

Block diagram

Place-and-route snapshot

Physical implementation

QSPI/OSPI Execute-In-Place (XIP) Flash Controller routed place-and-route layout on the Nangate45 PDK — A real synthesis and place-and-route pass on this RTL, routed on the open Nangate45 / FreePDK45 PDK — evidence the block closes physically, not just in simulation. Target-PDK timing, area, and power sign-off figures are shared under NDA.

The deliverable

What you’re licensing

Hardware code-fetch engine for external SPI-NOR flash — no software driver in the read path, ASIL-B. It is delivered as a licensable soft-IP block engineered as an ASIL-B Safety Element out of Context — not just RTL, but the complete functional-safety work package needed to carry it into an ISO 26262 program:

Synthesizable RTL

Portable, vendor-neutral SystemVerilog that drops onto your existing SoC fabric — no foundry or EDA-tool lock-in.

Per-IP FMEDA report

SPFM / LFM / PMHF computed against the ASIL target per ISO 26262-5 — the quantitative analysis your assessor asks for.

Safety manual

Assumptions of use, the safety mechanisms and their diagnostic coverage — written to drop straight into your safety case.

IP-XACT + integration docs

A machine-readable descriptor plus register and integration documentation for fast, low-risk bring-up.

Self-checking testbench

A self-checking testbench and a one-command build, so you can reproduce every claim on day one.

What it is

qspi_xip (#C-12) is an execute-in-place (XIP) QSPI/OSPI NOR-flash read controller delivered as synthesizable SystemVerilog soft-IP.

Key Features

Autonomous CMD->ADDR->DUMMY->DATA command sequencer — a core OBI-lite fetch becomes a full QSPI read transaction with no software flash driver in the read path
Selectable x1/x2/x4 I/O width and programmable read opcode/dummy-cycle count (CMDR) and 3-/4-byte addressing (CR.ADDR4B) cover single, dual, and quad NOR-flash families
Single-line prefetch buffer returns sequential same-line fetches with a same-cycle obi_rvalid, avoiding a redundant flash transaction
Config-register even parity across CR/CMDR/DIVR/BASER/LIMITR/TOR detects an SEU in the operating configuration -> err_code 1
Fetched-line integrity parity (per-line even-parity beat, when INTEG_EN) and address-range plausibility against BASER/LIMITR (when RANGE_EN) catch a corrupted line or a runaway fetch address -> err_code 2 / err_code 3, both flagged on obi_err
Flash-access timeout watchdog (TOR, default 4096 clk) and complementary-DMR shadows on the sequencer FSM plus bit/byte counters catch a stalled flash device or a sequencer-logic upset -> err_code 4 / err_code 9
err_clear/err_valid/err_code[3:0] into the catalog-standard safety_monitor; fi_* DFT inputs exercise every mechanism for silicon test (tied 0 in mission mode)

Standards & Compliance

QSPI/OSPI NOR-flash read protocol (x1/x2/x4 I/O, 3-/4-byte addressing); APB4-lite config + OBI-lite core read port; ISO 26262 ASIL-B SEooC (SPFM 94.50%, LFM 89.52%, PMHF 2.01×10⁻⁹/h)

Functional Safety

ASIL-B (SEooC) · SPFM 94.50% · LFM 89.52% · PASS

ISO 26262:2018 · FMEDA available · Safety Manual included

Register Map

Offset	Register	Description
`0x00`	CR	[0]=EN [1]=INTEG_EN [3:2]=IOW(0=x1/1=x2/2=x4) [4]=ADDR4B(0=3B/1=4B) [5]=RANGE_EN
`0x04`	CMDR	[7:0]=READ_OPCODE (e.g. 0x03 single, 0xEB quad) [12:8]=DUMMY (dummy SCK cycles)
`0x08`	DIVR	[7:0]=SCK half-period in clk cycles; SCK = clk/(2*(DIVR+1))
`0x0C`	BASER	[31:0]=range base address (plausibility low bound, RANGE_EN)
`0x10`	LIMITR	[31:0]=range limit address (plausibility high bound, RANGE_EN)

…2 more registers — see datasheet for the full table.

Getting Started

// Minimal instantiation
qspi_xip #(
 .ADDR_W(6)
) u_qspi_xip (
 .clk (clk),
 .rst_n (rst_n),
 // APB4
 .p_paddr (paddr),
 .p_psel (psel),
 .p_penable (penable),
 .p_pwrite (pwrite),
 .p_pwdata (pwdata),
 .p_prdata (prdata),
 .p_pready (pready),
 // Safety
 .err_clear (1'b0),
 .err_valid (err_valid),
 .err_code (err_code)
);

Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.

Applications

Where it fits

Typically deployed in in-vehicle networks, industrial gateways, and sensor/actuator links where a bus controller has to carry its own safety argument.

The case

Why license it, not build it

Skip 12–18 months

The FMEDA and the safety case are already generated. You integrate a finished safety element — you don’t stand up a safety-IP program to originate one.

One vendor, one safety story

Every block in the catalog shares the same safety architecture, fault-reaction model, and FMEDA methodology — so subsystems roll up cleanly.

Verified, not vapor

The RTL builds and passes today; the safety metrics come from analysis and fault injection against real RTL, not a datasheet promise.

Interested in QSPI/OSPI Execute-In-Place (XIP) Flash Controller?

Pricing, the per-IP FMEDA, safety manual, and RTL data room are shared under a mutual NDA.

Talk to us →See related IP

Figures are pre-silicon engineering-grade estimates for a Safety Element out of Context (SEooC); final ASIL sign-off is the integrator’s, supported under NDA. FMEDA and Safety Manual available under NDA.

circuit-design.space · +1-971-357-1400 · anovickis@circuit-design.space