Software self-test runs periodically and cannot see a fault between runs. DG32-LITE compares every value the CPU commits, as it commits it, and the path from mismatch to a switched-off bridge never passes through firmware.
A trailing checker core compares every committed store. A mismatch trips the FAULT pin and disables the PWM bridge in 39 cycles, on a path with no software in it.
Firmware can still prove the path works: a locked injection register fires it on purpose, which is the only way to test it on real silicon.
A transient or permanent error changes a value the MAIN core is about to commit.
CHECKER runs the same instructions two cycles later on mirrored inputs and bus responses, so it commits the correct value.
Every committed store is compared. The first mismatch is caught on that store, not at the next software self-test.
A sticky fault latch holds the first cause, because later faults are usually its consequences. Firmware can read it after the fact.
FAULT_N goes low within 39 cycles of an injected fault in simulation. Wired to the gate-driver enable, it stops the bridge without waiting for firmware.
Pre-silicon. Figures are design values verified in simulation and static timing, not measurements on fabricated parts, unless marked otherwise.
THE FAULT PATH, ANIMATED
EVERY WAY THE CPU CAN FAIL
Lockstep catches a wrong value. It does not catch a CPU that stops, or one that reads an address that is not there. Each of those has its own detector, because on a die with no debugger halt a silent failure is the one nobody can diagnose.
The lockstep comparator. CHECKER repeats every instruction two cycles later on mirrored inputs and bus responses; the first store that differs latches its cause and drives FAULT_N.
WHYA silent datapath fault produces a wrong PWM edge, and a wrong edge can destroy a bridge.
The windowed watchdog. A kick that arrives too late faults, and so does one that arrives too early.
WHYToo early catches code that is running, but running the wrong way. It arms only when firmware enables it, so it cannot deadlock a cold boot.
The error slave. An unmapped or disabled address completes with a bus error instead of hanging the bus.
WHYWith no debugger on the die, a hung bus would be a brick.
Supply supervision: two supply-good inputs, deglitched, with reset sequencing.
WHYA brown-out would otherwise corrupt state that both cores then agree on.
HOW THE PATH IS PROVEN
A path that only ever runs when something breaks has to be exercised deliberately. The injection register is locked, so ordinary code cannot trip it by accident.
Firmware writes the magic value to the Fault CSR, which fires the comparator path without a real fault.
The same hardware path as a real mismatch: comparator, latch, FAULT_N, gate-driver enable.
The latch holds cause 001, DATA_MISMATCH, until reset, so firmware can confirm what fired.
39 cycles from injection to latch in simulation. First-silicon bring-up measures it on the September 2026 shuttle parts.
WHERE DIAGNOSTICS STOP
Condition monitoring on DG32, including anything the DG32-2DOM engine runs, is advisory: it reports health and recommends service. Hard trip limits stay with the hardware path above, which no model output can hold open or close.
Lockstep is a mechanism for a safety case, not a certificate. ISO 26262 ASIL-D is the path the design is aimed at; no functional-safety certification is claimed.