A self-contained all-digital, ASIL-rated NPU — staging RAM → tensor DMA → tiled INT8 GEMM → self-checked activation → decode, watched over by a SOTIF output-plausibility monitor — that drops into an SoC with the FMEDA work products already generated, the whole datapath run end-to-end in simulation, and a self-check on every stage including the output itself. You’re not acquiring RTL — you’re acquiring a safe AI accelerator whose safety case is already assembled.
The industry ships NPUs by the dozen; almost none are functional-safety rated for the automotive, robotics, or medical edge. “Safe AI accelerator” is a category with real, growing demand (ADAS, autonomous robotics, safety-critical vision) and almost no certified supply. The defensible piece is not the MACs — those are a commodity — it’s the safety wrapping around them.
| Stage | Function |
|---|---|
| Staging RAM | ECC-protected on-chip working set |
| Tensor DMA | Descriptor-driven feed with pointer/parity protection |
| Tiled GEMM | INT8 matrix engine, tileable compute |
| Activation | Self-checked non-linear stage |
| Decode / output | Result decode |
| SOTIF monitor | Output-plausibility check — a self-check on the result itself |
Run end-to-end in simulation. The full pipeline is exercised as one subsystem, and every stage carries a diagnostic — culminating in the output monitor that catches an implausible result before it leaves the accelerator.
A commodity MAC array is easy to copy; a safety-rated inference subsystem with an output-plausibility argument is not. That safety wrapping — ECC datapaths, self-checked stages, and the SOTIF monitor — is the moat, and it’s what makes this licensable into safety-critical designs where a bare NPU cannot go.
Full FMEDA, safety mechanisms, and RTL data room under mutual NDA.Request the data room →
circuit-design.space · +1-971-357-1400 · sales@circuit-design.space
Full FMEDA, DFA/formal proofs, and the RTL data room follow under a mutual NDA.
Figures are pre-silicon engineering-grade estimates for a Safety Element out of Context (SEooC); final ASIL sign-off is the integrator’s, supported under NDA. “ISO 26262-ready” means the work products are generated — not that the IP is third-party certified.
circuit-design.space · +1-971-357-1400 · sales@circuit-design.space