DG32’s fault path is designed to act without waiting for application software. For a buyer, the key question is whether the complete machine reaches its intended safe state under the failures that matter.
A trailing checker core compares every committed store. A mismatch trips the FAULT pin and disables the PWM bridge in a reported simulated 39 cycles, on a path with no software in it.
Firmware can still prove the path works: a locked injection register fires it on purpose, alongside other hardware fault-injection and validation methods.
A transient or permanent error changes a value the MAIN core is about to commit.
CHECKER runs the same instructions two cycles later on mirrored inputs and bus responses, so it commits the correct value.
Every committed store is compared. The first mismatch is caught on that store, not at the next software self-test.
A sticky fault latch holds the first cause, because later faults are usually its consequences. Firmware can read it after the fact.
FAULT_N goes low within 39 cycles of an injected fault in simulation. Wired to the gate-driver enable, it stops the bridge without waiting for firmware.
MAIN and CHECKER commit the same values; a mismatch at the comparator latches the fault, drops FAULT_N and the gate driver turns the bridge off.
Both cores commit the same values; CHECKER runs behind MAIN. When one value differs, the comparator catches it on that store, the latch holds the first cause, FAULT_N falls and the gate driver turns the bridge off.
Pre-silicon. Figures are design values verified in simulation and static timing, not measurements on fabricated parts, unless marked otherwise.
Lockstep catches a wrong value. It does not catch a CPU that stops, or one that reads an address that is not there. Each of those has its own detector, because on a die with no debugger halt a silent failure is the one nobody can diagnose.
The lockstep comparator. CHECKER repeats every instruction two cycles later on mirrored inputs and bus responses; the first store that differs latches its cause and drives FAULT_N.
WHYA silent datapath fault produces a wrong PWM edge, and a wrong edge can destroy a bridge.
The windowed watchdog. A kick that arrives too late faults, and so does one that arrives too early.
WHYToo early catches code that is running, but running the wrong way. It arms only when firmware enables it, so it cannot deadlock a cold boot.
The error slave. An unmapped or disabled address completes with a bus error instead of hanging the bus.
WHYWith no debugger on the die, a hung bus would be a brick.
Supply supervision: two supply-good inputs, deglitched, with reset sequencing.
WHYA brown-out would otherwise corrupt state that both cores then agree on.
A path that only ever runs when something breaks has to be exercised deliberately. The injection register is locked, so ordinary code cannot trip it by accident.
Firmware writes the magic value to the Fault CSR, which fires the comparator path without a real fault.
The same hardware path as a real mismatch: comparator, latch, FAULT_N, gate-driver enable.
The latch holds cause 001, DATA_MISMATCH, until reset, so firmware can confirm what fired.
39 cycles from injection to latch in simulation. First-silicon bring-up measures it on the September 2026 shuttle parts.
Condition monitoring on DG32, including anything the DG32-2DOM engine runs, is advisory: it reports health and recommends service. Hard trip limits stay with the hardware path above, which no model output can hold open or close.
Lockstep is a mechanism for a safety case, not a certificate. ISO 26262 ASIL-D is the path the design is aimed at; no functional-safety certification is claimed.