Teleop Link Guard — Command-Link Freshness Watchdog

What it is

teleop_link_guard is the operator/decoder-side freshness watchdog for a teleoperated video link, delivered as synthesizable SystemVerilog soft-IP with an APB4-lite control interface and built-in ISO 26262 (ASIL-B) safety instrumentation.

Key Features

• Four independent link-health mechanisms drive the sticky safety actuation safe\_state\_o: L1 staleness/glass-to-glass latency, L2 a diverse time-sync-free no-frame timeout, L3 sequence-gap/drop/reorder detection, L4 decoded-side freeze detection (N identical frame hashes)
• DMR-protected detection datapath (L7): the entire watchdog state (last sequence, timestamp, hash, freeze/no-frame counters) is duplicated, so a single upset diverges the shadow and forces a fail-safe assert plus err\_code 9 instead of silently blinding the guard
• Two-tier safety model separates the fail-safe actuation from guard self-diagnosis: safe\_state\_o is the safety function (→ minimal-risk maneuver); err\_valid/err\_code is a distinct guard-integrity alarm (config parity → err\_code 1, safe-state/detection DMR → err\_code 9)
• Codec-agnostic by design — checks operate on sequence/timestamp/hash metadata, not pixel signatures, so link-health detection holds across a lossy encode where frame-signature schemes cannot
• APB4-lite config + sticky STATUS telemetry (STALE/NOFRAME/SEQGAP/FREEZE/SAFE_STATE/ERR_VALID/ERR_CODE) plus LAST_SEQ/LAST_LAT/MISS_CNT readback for live link-quality visibility
• Proven Safety Island integration: a working demo (13/13 checks) routes safe\_state\_o and err\_valid into an fccu fault hub via spare ext\_fault\_i lines (sources 11/12) alongside safe\_video‘s frame-integrity alarm (source 10), with per-source fault\_id\_o reporting and zero safety\_island RTL changes
• Pre-sign-off FMEDA, D4 gate-level fault-injection measured: ASIL-B PASS, SPFM 99.65%, LFM 91.31%, PMHF 0/h across all six fault regions

Standards & Compliance

ISO 26262 ASIL-B SEooC (pre-sign-off, D4 gate-level measured: SPFM 99.65%, LFM 91.31%, PMHF 0/h); AMBA APB4-lite control/status; IEEE 802.1AS time-sync (AoU for the latency check); Technology Preview — digital-only, silicon validation pending, FMEDA informational

Functional Safety

ASIL-B target (SEooC) · SPFM 99.65% · LFM 91.31% · Informational — not gated

Informational FMEDA — this IP is reported but NOT gated. The SPFM/LFM figures above are engineering estimates from a model that is not held to the ASIL metric gates (QM, safety-by-composition, a vendor-core overlay, or a pre-sign-off Technology Preview, depending on the IP). They are not a certification claim and must not be relied on as one. See the safety manual for this IP’s exact status, assumptions of use, and any open items.

ISO 26262:2018 · FMEDA available · Safety Manual included

Register Map

…3 more registers — see datasheet for the full table.

Getting Started

// Minimal instantiation
teleop_link_guard #(
 .ADDR_W(6)
) u_teleop_link_guard (
 .clk (clk),
 .rst_n (rst_n),
 // APB4
 .p_paddr (paddr),
 .p_psel (psel),
 .p_penable (penable),
 .p_pwrite (pwrite),
 .p_pwdata (pwdata),
 .p_prdata (prdata),
 .p_pready (pready),
 // Safety
 .err_clear (1'b0),
 .err_valid (err_valid),
 .err_code (err_code)
);

Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.