The deliverable
What you’re licensing
Full 5-channel TL-C handshake: AcquirePerm/AcquireBlock (A) → Probe (B) → ProbeAck/ProbeAckData (C) → Grant/GrantData (D) → GrantAck (E), It is delivered as a licensable soft-IP block engineered as an ASIL-B Safety Element out of Context — not just RTL, but the complete functional-safety work package needed to carry it into an ISO 26262 program:
Synthesizable RTL
Portable, vendor-neutral SystemVerilog that drops onto your existing SoC fabric — no foundry or EDA-tool lock-in.
Per-IP FMEDA report
SPFM / LFM / PMHF computed against the ASIL target per ISO 26262-5 — the quantitative analysis your assessor asks for.
Safety manual
Assumptions of use, the safety mechanisms and their diagnostic coverage — written to drop straight into your safety case.
IP-XACT + integration docs
A machine-readable descriptor plus register and integration documentation for fast, low-risk bring-up.
Self-checking testbench
A self-checking (crypto: bit-exact) testbench and a one-command build, so you can reproduce every claim on day one.
1. Overview
The coherency point of a TileLink-C crossbar.
Key Features
- Full 5-channel TL-C handshake: AcquirePerm/AcquireBlock (A) → Probe (B) → ProbeAck/ProbeAckData (C) → Grant/GrantData (D) → GrantAck (E), plus voluntary Release/ReleaseData (C) → ReleaseAck (D), over an address-indexed MSI directory (dir_state[NUM_LINES][NM])
- Correct MSI downgrade semantics: an exclusive grow (NtoT/BtoT) probes every other holder toward N, a shared grow (NtoB) downgrades any exclusive holder to B; scan_j walks conflicting holders one at a time, each fully ProbeAck’d before the scan advances
- Optional BURST_BEATS-deep line buffer streams whole cache lines through GrantData/ProbeAckData/ReleaseData (BURST_BEATS=1 reproduces the single-beat v0.2 path); per-line Release via the c_address port targets any of the NUM_LINES lines independently
- Optional backing-SRAM port (mem_*, USE_BACKING_SRAM) read-allocates Grant data and writes dirty lines back one beat per cycle; a mem_wpar/mem_rpar parity pair closes the round-trip into err_code 2
- Optional second coherency engine (PIPELINE) processes an Acquire to a different directory line fully in parallel with the first; per-line ownership locks (line_lock0/1) guarantee at most one engine ever owns a line, preserving the single-Trunk invariant under concurrency
- ASIL-B safety: MSI directory parity (err_code 1), datapath parity across the GrantData output mux and the backing-SRAM round-trip (err_code 2), and diverse-DMR lockstep over both engines, the line buffer, beat counters, per-line locks and SRAM-port state (err_code 9), all latched by the shared safety_monitor
- Gated standalone ASIL-B SEooC: SPFM 93.60%, LFM 90.00%, PMHF 3.23×10⁻¹⁰/h — PASS with margin on every metric, no external wrapper credited
Standards & Compliance
TileLink-C coherence protocol (A/B/C/D/E channels, MSI cap encoding: T/B/N); ISO 26262 ASIL-B SEooC (SPFM 93.60%, LFM 90.00%, PMHF 3.23×10⁻¹⁰/h)
Functional Safety
ASIL-B (SEooC) · SPFM 93.60% · LFM 90.00% · PASS
ISO 26262:2018 · FMEDA available · Safety Manual included
Register Map
See datasheet for full register reference.
Getting Started
// Minimal instantiation
tl_c_xbar #(
.ADDR_W(6)
) u_tl_c_xbar (
.clk (clk),
.rst_n (rst_n),
// APB4
.p_paddr (paddr),
.p_psel (psel),
.p_penable (penable),
.p_pwrite (pwrite),
.p_pwdata (pwdata),
.p_prdata (prdata),
.p_pready (pready),
// Safety
.err_clear (1'b0),
.err_valid (err_valid),
.err_code (err_code)
);
Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.
Figures are pre-silicon engineering-grade estimates for a Safety Element out of Context (SEooC); final ASIL sign-off is the integrator’s, supported under NDA. FMEDA and Safety Manual available under NDA.