Hardfuzz v1 original

HardFuzz

A ~$40 FPGA fault-injection module for safety-critical embedded testing. Inject precisely-targeted hardware faults — SPI bit-flips, I2C clock stretching, CAN frame corruption — into a live bus under host control, run scriptable coverage-guided campaigns, and get a pass/fail evidence report. An open, low-cost alternative to the $30K–$80K bench tools (Lauterbach, Kraken, XCITE) that ISO 26262 / IEC 61508 fault- injection evidence usually demands.

Runs on a Digilent Cmod A7 (Xilinx Artix-7) wired inline with a NUCLEO-F446RE as the device under test. Injector BOM ≈ $40.

What works today

Every RTL core self-checks in simulation (make sim); the C++ host layer has its own test suite (make -C host). See HardFuzz_Refined_Plan.md for the design and month-by-month build log, docs/HardFuzz_v1_Spec.md for where it's headed as a product (board I/O, attach modes, out-of-box experience), and docs/HardFuzz_v2_Standalone.md for the computer-free v2 — an on-board ESP32 runs the campaign engine and streams results to a phone app over BLE.

Layout

rtl/            Verilog sources
  uart/         UART RX/TX (the host link over the Cmod's FT2232 bridge)
  ctrl/         ctrl_regs.v — UART->register-file command FSM (host control)
  spi/          spi_slave.v — mode-0 SPI slave, the DUT-facing bus (echo response)
  i2c/          i2c_slave.v — I2C slave (write xactions) with clock-stretch hook
  can/          frame_corrupt.v — CAN bus monitor + force-dominant injector
  inject/       bitflip_inj.v (SPI bit flip), timing_distort.v (I2C clock stretch)
  timing/       pulse_meter.v — scope-free timing measurement
  hardfuzz_top.v    bring-up top: LED heartbeat + UART echo
  spi_inject_top.v  Month 1 integration: host-armed SPI bit-flip injection
  i2c_inject_top.v  Month 2 integration: host-armed I2C clock-stretch injection
  can_inject_top.v  Month 2 integration: host-armed CAN frame corruption (sim-only)
  multi_inject_top.v Month 4: combined SPI+I2C in one bitstream (reg4 selects protocol)
sim/            testbenches + Icarus runner (primary verifier for now)
constraints/    cmod_a7.xdc  (pinout; SPI on Pmod JA)
scripts/        Vivado batch build / program TCL
firmware/       STM32 C — SPI master (main.c) + I2C master (main_i2c.c)
host/           arm.py + Month 3 C++ campaign library (include/hardfuzz/) & `hardfuzz` CLI
hardware/       HardFuzz v1 custom-PCB design — schematic spec + BOM (KiCad capture next)
docs/           timing-verification.md and design notes

Prerequisites

• Icarus Verilog + Surfer for fast simulation — brew install icarus-verilog surfer. (Surfer is the maintained, native-arm64 waveform viewer; the old gtkwave cask is discontinued and x86-only.)
• Xilinx Vivado (free ML Standard edition) for synthesis, bitstream, and the ILA — but Vivado has no macOS build, so run it on a Linux box / cloud instance and copy the .bit back. See docs/vivado-cloud.md.
• openFPGALoader (brew install openfpgaloader) to program the Cmod A7 from macOS natively — make prog. Board string: cmoda7_35t (or cmoda7_15t).

Quick start

Simulate first — no board required:

make sim         # UART echo self-check   -> "ALL TESTS PASSED"
make sim-pulse   # timing meter self-check
make wave        # run a sim and open the waveform in Surfer
                 #   (pick another: make wave WAVE=tb_pulse_meter)
                 #   how to read it: docs/waveforms.md

Then, to get onto hardware (Vivado on Linux/cloud, program from the Mac):

make bit         # ON A LINUX/CLOUD BOX: synth + P&R + bitstream (docs/vivado-cloud.md)
                 #   copy build/vivado/spi_inject_top.bit back to the Mac
make prog        # ON THE MAC: openFPGALoader loads the .bit to the Cmod A7

On the board, led[0] blinks at ~1 Hz (clock/toolchain alive). Open the Cmod's USB serial port at 115200 8N1 and type — every character echoes back and led[1] toggles (host link alive).

Verifying timing without a scope

You'll add a logic analyzer and oscilloscope later. Until then, docs/timing-verification.md covers how to measure digital fault timing on-chip (cycle counting, loopback calibration, the ILA, and a reserved trig_out pin) and — importantly — what stays invisible until the instruments arrive.

Month 1 core: SPI bit-flip injection

spi_inject_top is the FPGA-as-SPI-slave design from the refined plan. The host arms a target over UART; the STM32 (SPI master) clocks frames; the injector flips the chosen bit of the MISO echo; the STM32 reads back the corrupted byte. Register map:

UART wire protocol: W(0x57) addr data to write; R(0x52) addr to read one byte. E.g. to flip frame 5, bit 3: W 01 05, W 02 00, W 03 03, W 00 01.

tb_spi_inject proves this end-to-end in simulation (arm over UART → clock 8 frames → only frame 5 / bit 3 flips, flip_count == 1). All four testbenches pass under Icarus: make sim.

Month 2 core: I2C clock-stretch injection

i2c_inject_top is the FPGA-as-I2C-slave counterpart to the SPI design. The host arms a target byte + stretch length over UART; the STM32 (I2C master) writes a transaction; on the target byte the slave holds SCL low for the programmed time — an abnormal clock stretch that stalls the master and trips its timeout. Register map:

I2C is open-drain on Pmod JA7 (SCL) / JA8 (SDA); slave address 0x42. tb_i2c_inject proves it end-to-end in sim (arm over UART → I2C write → SCL stretched only on the target byte, ~20 µs, stretch_count == 1). RTL is sim-verified; not yet run on hardware — needs STM32 I2C-master firmware (the current firmware is SPI-only) and a separate bitstream (make bit TOP=i2c_inject_top).

Month 2 core: CAN frame corruption (sim-only)

can_inject_top corrupts CAN frames without being the transmitter, exploiting the bus's wired-AND rule: a dominant bit always wins. frame_corrupt watches the bus (RXD from a transceiver), tracks the bit index from Start-Of-Frame, and on a host-armed bit forces the bus dominant for width bits. Aim decides the fault: a data/CRC bit → bad CRC; ≥6 forced bits → bit-stuffing violation; a bit in the EOF → form error.

Arm with arm.py … can --bit 20 --width 1. tb_can_inject proves it in sim (targeted bits forced dominant, untargeted bits untouched, corrupt_count correct). SIM-ONLY — hardware needs an SN65HVD230 transceiver on can_txd/can_rxd (shares Pmod JA7/JA8) plus STM32 bxCAN firmware; neither exists yet.

Status

Working on hardware ✅ — the Month 1 MVP runs end to end on a Cmod A7 + NUCLEO-F446RE. Host arms a target over UART (arm.py), the STM32 clocks SPI frames, the FPGA injects exactly one bit on the chosen frame, and the STM32 reads back and reports the fault (e.g. frame 5 bit 3: 0xA4 → 0xAC, all other frames clean). Design is in the Cmod's flash (make prog-flash), so it survives power cycles.

Bring-up gotchas (both fixed): make prog loads to volatile SRAM — use prog-flash to persist; and the Cmod UART pins are uart_rxd_out=J18, uart_txd_in=J17 (do not swap — it silently kills the register interface while SPI still works).

Both the SPI bit-flip (Month 1) and I2C clock-stretch (Month 2) cores now run end to end on hardware — host arms over UART, the STM32 master runs a transaction, the FPGA injects, and the master catches the fault (SPI: 0xA4→0xAC; I2C: byte hits the master's timeout at 2 ms while the slave holds SCL low).

Verified in sim + hardware: spi_slave, bitflip_inj, spi_inject_top + SPI firmware; i2c_slave, timing_distort, i2c_inject_top + I2C firmware; ctrl_regs, arm.py. Combined SPI+I2C — validated on hardware: multi_inject_top (one bitstream, reg4 selects protocol) + main_multi.c (one firmware, S/I/R commands) let a single mixed SPI+I2C campaign run live with zero reflashing — wire both buses once, and each fault swaps the active protocol on both sides. Proven end to end with host/campaigns/multi.json (7/7 pass).

Verified in sim (not yet on hardware): frame_corrupt, can_inject_top — needs an SN65HVD230 transceiver to run on hardware.

Month 3 C++ campaign layer (host/) — built + self-tested: header-only C++17 (FaultCampaign, CoverageTracker, coverage-guided Scheduler, RegClient, JSON/CSV reports with IEC 61508 traceability) + the hardfuzz CLI, with live mode: it arms the FPGA over the Cmod UART and drives the STM32 run-command firmware (send 'R' → RESULT line) for real pass/fail verdicts. Verified against a mock transport (make -C host, 18 checks); the run-command firmware is in main.c/main_i2c.c.

Next: validate live hardfuzz run on the boards (dry run + serial parsing are tested; the end-to-end serial path needs a hardware pass); CAN hardware bring-up when the SN65HVD230s arrive; HTML report + coverage heatmap. trig_out is ready for a scope.