SKU-10 · 130 nm CMOS (SKY130) DG32-Max secure MCU
DG32-Max checks signed firmware in 309 ms from reset, on a lockstep RISC-V pair.
Every figure on this page is a design target unless marked otherwise.
- Security
- Signed boot from mask ROM, 309 ms from reset; secrets in 1 kbit ReRAM
- Memory
- 128 KB error-corrected SRAM
- Interfaces
- CAN-FD, UART, SPI, 9-bit ADC, debug
DG32-Max checks signed firmware in 309 ms from reset, on a lockstep RISC-V pair.
DG32-Max targets imported secure microcontrollers and the separate security chip often used to check firmware before it runs.
- Job
- Boot only signed firmware on one chip, without a separate secure element.
- Replaces
- MAX32655-class imported secure MCUs, and the separate secure element a board adds to boot only signed firmware: one die replaces the pair.
- Status
- RTL feature-complete on 1 October 2026; FPGA proof and place-and-route for the December 2026 OpenFrame shuttle follow.
The business case for SKU-10
The opportunity is simpler secure control for industrial, drone and EV equipment, provided customer requirements can be met.
What it replaces
MAX32655-class imported secure MCUs, and the separate secure element a board adds to boot only signed firmware: one die replaces the pair.
Customer opportunity
Industrial controllers, drone flight controllers and ESCs, EV body and charger controllers, IoT gateways; captive as the host platform inside SKU-1 and SKU-11.
Policy and demand
Country-of-origin rules for defence and drone procurement bar land-border-nation components; an indigenous secure MCU on an open PDK, auditable at every layer, answers that directly. Verified boot is the first security requirement buyers ask for, and here it is in mask ROM rather than a second chip.
The delivery trade-off
SKY130 through ChipFoundry’s OpenFrame is a low-cost shuttle slot with 44 pads, and its 100 MHz design target is enough for the control and crypto load. SKY130 has no OTP or eFuse, so the root key lives in mask ROM and device secrets and the rollback counter in a 1 kbit ReRAM macro.
What SKU-10 claims, what it is worth, and what gates it.
The following mechanisms explain the proposed customer benefit. Each still needs to be validated in the complete product.
DG32-Max checks signed firmware in 309 ms from reset, on a lockstep RISC-V pair.
DG32-Max targets imported secure microcontrollers and the separate security chip often used to check firmware before it runs.
One chip replaces an imported secure MCU and its separate boot-check chip.
The opportunity is simpler secure control for industrial, drone and EV equipment, provided customer requirements can be met.
RTL is feature-complete as of 1 October 2026; no silicon result yet.
Customer design wins and validation remain essential; the documented design status is not qualified production.
Architecture targets, not datasheet values.
Every figure is a design target stated in the SKU Blueprint, page 37. None is a measurement of manufactured silicon.
- 309 msSigned firmware checked from reset
- 128 KBError-corrected memory
- 100 MHzDesign target, lockstep DGridRiscV pair
Detailed architecture and specifications
- Process
- 130 nm CMOS (SKY130) at 100 MHz, ChipFoundry OpenFrame shuttle
- Processor
- Dual DGridRiscV in lockstep, crypto instructions, 4 KB I-cache
- Memory
- 128 KB error-corrected SRAM
- Security
- Signed boot from mask ROM, 309 ms from reset; secrets in 1 kbit ReRAM
- Interfaces
- CAN-FD, UART, SPI, 9-bit ADC, debug
- Package
- 44 signal pins in a 64-pin package
- Process
- 130 nm CMOS (SKY130)
- Maturity
- Pre-silicon engineering evidence
- Designed toward
- Verified boot · Country-of-origin procurement rules
- Source
- SKU Blueprint, October 2026, page 37
Standards the architecture is designed toward. No DeepGrid part holds a certification or qualification today.
7 questions SKU-10 has to answer before it can be relied on.
The Blueprint’s design and status notes raise these. Each is a question silicon, test or layout has to answer before SKU-10 can be relied on.
Boot only firmware that carries a valid signature.Physics
Signature verification lives in mask ROM, checked from reset, rather than in a second chip.
Keep a root key and device secrets on a process with no OTP or eFuse.Physics
The root key sits in mask ROM; device secrets and the rollback counter sit in a 1 kbit ReRAM macro.
Control and crypto work, not peak clock speed.Physics
A lockstep pair designed for 100 MHz on SKY130, reached through a low-cost shuttle slot with 44 signal pads. 100 MHz is the design target, not a measurement: the DG32-LITE lockstep core closes at about 55–62 MHz post-route today.
Keys without OTPOpen
How are the root key and rollback counter protected on a process that has no OTP or eFuse?
Boot timeOpen
What sets the 309 ms from reset to verified firmware, and what would shorten it?
Memory areaOpen
How much of the die do the 32 compiled SRAM macros for 128 KB take, and what does that leave?
From FPGA to siliconOpen
Which results from the Arty A7-100T proof carry over to the December 2026 shuttle?
Simulated and implemented, not yet measured.
- Strongest evidence
- RTL feature-complete; every bench and firmware test passes, including secure boot on all three test images. No silicon result yet.
- Development status
- RTL feature-complete on 1 October 2026; FPGA proof and place-and-route for the December 2026 OpenFrame shuttle follow.
RTL feature-complete with passing bench and firmware tests; no silicon, FPGA proof or certification result is claimed yet.
How every figure on this site was obtainedThe systems it goes into, and the parts beside it.
Secure-boot chain, key storage on a node without OTP, crypto throughput and the 44-pin budget.
Parts beside it
Read the source behind every figure.
Each document opens inside the site at the cited section; the PDF is the edition of record.
Design files
Bring the socket. We will tell you what SKU-10 has to prove for it.
Send the platform, voltage and power environment, interfaces and qualification needs. The reply names what is architecture, what is evidence and what would have to be tested.