Alp SDK · v0.17.0 · released 2026-10-13

One declarative file. Heterogeneous build.

Same C/C++ API across Alif, Renesas, DeepX. Set the module SKU; the SDK produces a dual-image build for every heterogeneous SoM — Yocto on the A-cluster, Zephyr on the M-class companion, IPC stitched in. It runs on every E1M edge AI module and implements the open E1M standard.

§ The Alp SDK stack

Write once, run on any E1M module.

Alp SDK is the unification software layer for Alp Lab edge AI modules. A single C/C++ API works across every E1M SoM — present and future — wrapping each vendor's SDK on top of the chosen OS (Zephyr / Yocto / bare-metal). Single-OS or heterogeneous, the application surface stays identical.

◆ E1M platform

AI Framework

On-device inference

On-device runtimes

TFLM → Ethos-U Alif AEN (U55 all E3..E8; U85 on E4/E6/E8 — Transformer)TFLM → DRP-AI3 (Renesas V2N)TFLM → DEEPX DX-M1 (V2M family)TFLM → CPU reference kernels

Model families

classificationdetection (YOLOv5/v8 on DEEPX + DRP-AI3)segmentationkeyword-spottingpose

Offline training only

TensorFlowPyTorch

↓trained model → deployable inference

Dev Tooling

Build, orchestrate, flash

v0.17.0

board.yaml v2tan CLI (build · run · flash · generate)tan doctor (host preflight)tan monitor (serial console)tan new-som (porting kit)west alp-quality (gate profiles → JSON/SARIF/JUnit)alp_orchestrate.py (fan-out + system-manifest)alp_project.py (per-core emit)portable-API conformance suiteVS Code extensionprogram_eeprom.pyper-OS dependency bootstrap

↓board.yaml → per-core build + flash

Alp SDK

One unified <alp/*.h> API

Peripherals

GPIO / I²C / SPIUART / PWM / ADCCAN / RTC / WDT / USB

Audio

PDM in (mics)I²S out + ampTAS2563

Camera

OV5640CAM_MUX

Inference

dispatcherEthos-U / DRP-AIDEEPX / CPU

IoT / BLE

Wi-Fi 6MQTTBLE 5.4

Security

MbedTLSPSA CryptoOPTIGA TM

Display / GUI

SSD1306 / 1331LVGLGPU2D / Dave2D

HW Info

EEPROM manifest (authoritative)hw_rev + serial<alp/hw_info>

DSP / Power

alp_dsp_* chain (FFT, FAC, IIR)<alp/power.h>

Heterogeneous IPC (v0.6 NEW)

<alp/rpc.h> framed RPMsg over OpenAMP<alp/system_ipc.h> auto-generated endpoint IDs<alp/mproc.h> mailbox · shared mem · hwsem

80 Tier-1 chip drivers + Tier-2 community

lsm6dsobmi323bmp581icm42670ina236tmp112tcal9538rv3028c724c128cc3501essd13xx…

User libraries (board.yaml libraries:)

ETLfmtnlohmann_jsondoctestLVGLMbedTLSCMSIS-DSPLittleFS

↓<alp/*.h> calls · RPMsg IPC bridges M-class ↔ A-class

Operating System

Per-core slice (cores: in board.yaml) · heterogeneous = peers on same SoM

Zephyr · M-class cores

Yocto · A-class cores

Bare-metal · no-RTOS

Bare-metal

↓per-core OS slice

Vendor SDK

We wrap each one

Alif Ensemble (AEN)Renesas RZ/V2NDEEPX DX-M1

↓wrapped vendor HAL

Hardware + HAL

E1M open-standard form factor

E1M (35×35 mm) SoMsE1M-X (45×65 mm) SoMsE1M-EVK carrierE1M-X-EVK carriervendor HALs

Standalone firmware against <alp/...> headers, or alp-studio codegen — same API surface either way.

1. v1.0after first pilotPlanned

   Silicon-verified release · ABI freeze

   • ›HiL bring-up sweep across AEN + V2N101 + V2M101
   • ›ABI snapshot frozen — backwards-compat guarantee
   • ›Concurrent multi-NPU (DRP-AI3 + DEEPX) proven on V2M101
   • ›Mender OTA E2E on V2N101 fleet of N ≥ 3 boards
   • ›4 vertical reference apps end-to-end verified
2. v0.17.02026-10-13 · releasedShipped

   Silicon evidence on a third SoM family (E1M-V2M) · E1M-NX9101 / i.MX 93 removed · Riverdi 12.1" LVDS display · tan-cli 0.7.0

   • ›Pre-1.0 minor with public ABI changes: 323 symbols added, 53 changed, 27 recorded removals (docs/abi/removed-symbols.json), snapshot docs/abi/v0.17-snapshot.json. Breaking for callers: alp_shmem_config_t.cacheable and alp_rpc_config_t.cacheable are removed (#2556) — drop any .cacheable initializer; the som-preset schema is now v2 with write_authority required and npu_population removed, and there is no v1 compatibility path, so an out-of-tree preset still declaring schema_version: 1 fails validation (#2024); coreMQTT-SN is dropped because its upstream repository no longer exists (#1784); and the rest of the alp_cli command surface is deleted — tan is the CLI (#1367, #1368)
   • ›E1M-NX9101 / NXP i.MX 93 support is removed because the module has not gone into production and is on hold (#2781): the SoM preset, imx93 family metadata, SoC spec, the rpmsg-imx93 example, the Yocto machine and the pca9451a chip driver all go. ABI value change: ALP_CAP_ID_HW_LCDIF is removed from the middle of alp_cap_id_t, so every later enumerator (ALP_CAP_ID_XSPI_DMA through ALP_CAP_ID_HW_I3C and ALP_CAP_ID_COUNT) is now one lower — rebuild anything that stores or compares those numeric IDs
   • ›The verification ledger now flips the A55 inference backends to ✅ on silicon, all measured on an E1M-V2M103: DEEPX DX-M1 (#1262) opens and invokes yolo11n through <alp/inference.h>, 50/50 invokes at a mean 46.93 ms, with output parity against ONNX Runtime CPU — and beyond inference, the DX-M1 flash-boots firmware 2.4.0, enumerates as PCIe 1ff4:0000 Gen3 x2, and all seven core sets rebind and invoke cleanly at ~45-48 ms per invoke; DRP-AI3 (#1268) runs YOLOX-S/VOC at ~40 ms per 640x640 frame over 20/20 invokes (a baked alp-image-edge run is still owed); and the ONNX Runtime CPU floor runs 10/10 invokes at ~1670 ms per frame — verified against the DEEPX layer’s ONNX Runtime 1.20.1, not the 1.28.0 recipe, which has still not run on silicon
   • ›docs/verification-status.md now parses 105 silicon/HIL-gated rows across 13 sections (was 84 rows across 7 at v0.16.0); its glyph counts are 20 ✅ verified, 51 🟡 partial, 35 ⏳ untested, 1 ❌ failing, and they can exceed the row count because a row may carry two glyphs. Most of the growth is newly ledgered sections such as the AEN801 peripheral matrix, not status flips. The AEN I²C, SPI, UART and GPIO backends moved from untested to partial: the underlying mechanism is bench-proven, portable-backend dispatch is not
   • ›Display: Riverdi RVT121HVDFWCA0-B 12.1" LVDS panel support on the E1M-EVK through a new clean-room TI SN65DSI83 DSI-to-LVDS bridge driver, plus a display-agnostic layer — the SDK sets default backlight at boot and a display declares its mount rotation (alp_display_caps_t.rotation is [ABI-EXPERIMENTAL]). The aen-trace-runner exhibition game ships as an example (#2446) and runs on the Riverdi panel by changing only the shield; the panel runs on the bench on an E1M-AEN803 + E1M-EVK at rotation 90. Known issue: body control is not yet bench-tested on the Riverdi build
   • ›Cameras: OV5647 (#2213) and Sony IMX296 (#2287) Zephyr sensor drivers and IMX335 support — OV9281, IMX296, IMX335 and OV5647 are all verified on an E1M-AEN803 — plus the aen-camera-firstlight, aen-isp-capture, aen-isp-ov5647-viewfinder and connectivity/camera-mjpeg-stream examples. A Linux V4L2 / media-controller backend for <alp/camera.h> lands on V2N/V2M with metadata-generated camera devicetree and board.yaml cameras: selection (#2616, #2633); on Linux, IMX296LQ is bench-proven on an E1M-V2M103 (and OV9281 through a hand-written devicetree), while the other Linux sensor fragments are marked bench-unverified
   • ›V2N / V2M platform: a portable <alp/gpu2d.h> backend on the Mali-G31 through the vendor EGL/GLES stack with CPU fallback (bench-unverified), and the Alif D/AVE 2D backend running on AEN silicon (#2515) — fill, blit and blend all match on an E1M-AEN803 M55-HE over 9 of 9 runs, with ADDITIVE and MULTIPLY still served by the software fallback; ROS 2 Humble as an opt-in, layer-gated feature plus a micro-ROS example (examples/multicore/microros-ros2-v2n: the M33 slice builds and boots on an E1M-V2M103; no ROS 2 round-trip with an agent yet); Linux remoteproc attach to the TF-A-started CM33 (opt-in, #2671) — the attach-only production path is bench-run on an E1M-V2M103: attach, a refused stop and a clean re-probe after reboot, with the CM33 heartbeat advancing throughout; the dev-image stop / start / reload half is not exercised; and a persistent, allowlisted U-Boot environment on eMMC boot partition 2 (#2675)
   • ›NPUs: examples/v2n/v2n-drpai-inference arrives with the ALP_ENABLE_DRPAI opt-in that wires DRP-AI3 into alp-image-edge, and examples/v2n/v2n-two-models opens one model on DRP-AI3 and one on DEEPX DX-M1 to run them at the same time on an E1M-V2M (#2398) — that example is not bench-verified; the two backends have never run together
   • ›Alif power: an SE STOP / STANDBY backend (#2784), bench-proven on an E1M-AEN803. STOP wakes on the LPTIMER and both RV-3028 paths on the M55-HE and the M55-HP (HP: SUMMARY cycles=3 pass=5 fail=0, also with the HE running), and STANDBY plus 256 KiB DTCM retention across STOP passed 3/3 on the M55-HE; HP STANDBY is unsupported by design. Not verified: the E1M-AEN801 HP and the ALP_POWER_WAKE_GPIO LPGPIO wake pads, which no pad on the AEN801/803 R2 is free to exercise
   • ›Companion chips: GD32 bridge host-side protocol v0.15 and v0.17 mirrors (#2692, #2748) and persistent BOOT_CONFIG (#2697); E1M IO15/IO26 need bridge firmware reporting protocol minor 16 or newer (#2725); alp-sdk no longer redistributes the GigaDevice GD32G5x3 firmware library (#2702). The CC3501E host speaks wire 4.0 (3.x accepted); use bridge firmware v0.9.2
   • ›Examples: 158 → 183 directories — 33 added, 8 removed (aen-camera-regcheck, aen-sdcard-readout, connectivity/mqtt-sn-publish, multicore/rpmsg-imx93, v2n-emmc-block-stat, v2n-ethernet-dual, v2n-rtc-multi-alarm, v2n-xspi-flash-readwrite)
   • ›Alongside it, tan-cli cut v0.7.0 (2026-10-13), a minor with breaking changes that requires alp-sdk v0.17.0 or newer and pins its planner to v0.17.0. Breaking: som-preset schema v2 only; a Flow D (alif_mram_jlink) MRAM write refuses until --atoc-unqueryable acknowledges it replaces the whole ATOC; tan bootstrap installs the arm-zephyr-eabi toolchain by default (--no-toolchain opts out) and tan doctor gains a toolchain check that can fail (exit 4); tan build --plan / --manifest / --manifest-from / --no-auto-bootstrap refuse with build.flag-retired (exit 2); the swd_probe flash backend and E1M-NX9101 are removed. New since 0.6.0: tan flash --ram (AEN ITCM RAM-run), tan flash --raw, --probe-serial / --probe-usb-path, tan reset, tan probe identify, tan model zoo / tan model add, and tan monitor --capture / --break-uboot
3. v0.16.02026-08-23 · releasedShipped

   Renode retired — hardware or native_sim, nothing in between · CC3501E firmware v0.3.0 · non-Debian Linux hosts get a runnable install command

   • ›Renode is retired outright (#1502, ADR 0022 Amendment 2): the tan renode verb, the four pr-renode-* CI workflows, the Alif E8 and RZ/V2N platform models and fixtures, and the aen-sim-vision example are all deleted, along with every live doc claim. What to do instead: build and flash to real hardware (tan build + tan flash), or run a single image headless under native_sim with tan run when it has no cross-core dependency. There is no simulated substitute for the cross-core RPMsg handshake — that must be verified on silicon. The cost is stated plainly in the SDK’s own changelog: alp-sdk loses its pre-silicon simulator coverage with no replacement planned, and no CI job now boots any alp-sdk image on any core. board.yaml’s diagnostics.sim_console is retained everywhere — it serves alp-studio’s hardware simulator, which never was a Renode concern
   • ›CC3501E companion firmware v0.3.0 on wire protocol 4 is the first published prebuilt blob to carry OTA_PROMOTE (#1609), shipped signed (detached ECDSA-P256/SHA-256) with its .sha256, and all six AEN SoM presets now point at it. It lands with the bench-found fixes it needed: GET_DIAG_INFO reports the real Wi-Fi role and heap instead of two fields that lied, the soft-AP no longer runs with the NWP left in ELP (#1562), WIFI_AP_STOP moved its blocking radio teardown off the SPI ISR context (#1563), wifi connect / wifi ap refuse wpa3 with an empty passphrase rather than silently downgrading to WPA2-PSK (#1480, #1552), and cc3501e_wifi_connect() stopped debiting a phantom 100 ms on every healthy poll, which had been collapsing timeout_ms to roughly a third of what was asked (#1481)
   • ›A Fedora, Rocky or Arch host was handed sudo apt-get install -y … verbatim in the machine-readable field the VS Code extension consumes — a command it cannot run (#1464). metadata/bootstrap.json’s prerequisites.install.linux is now keyed by package manager: apt stays required-and-complete, dnf is new and proven, and pacman ships no entry at all rather than an unattended pacman -S against a stale sync database. Every shipped entry was proven by running it in a real container (fedora:42, rockylinux:9, debian:12 control) and confirming the binary landed on PATH; a new workflow re-runs that proof on every relevant PR. dnf deliberately carries no ninja: the RHEL-derivative default repos carry it under no name, so nothing was guessed
   • ›A CPU inference floor for the Cortex-A55 lands via ONNX Runtime (src/yocto/inference_ort.cpp), default-off behind ALP_SDK_USE_ORT_CPU and ordered strictly last in backend auto-resolution. The Yocto recipe builds — bitbake onnxruntime completes against E1M-V2N101, 997 tasks, producing libonnxruntime.so.1.28.0 for cortexa55 — but a green build is not a working inference and no SKU has run ORT on silicon yet. It is 🟡 code-complete / bench-unverified in docs/verification-status.md, which now parses 84 ledger rows (11 ✅ verified, 35 🟡 partial, 39 ⏳ untested, 1 ❌ failing)
   • ›New public accessor alp_inference_last_invoke_latency_us() (#1541): alp_inference_invoke() now brackets the backend’s synchronous executor in both dispatchers and stores the last successful invoke’s duration in microseconds, replacing the hand-rolled k_cycle_get_32() timing the two in-tree camera-vision harnesses each carried. A failed invoke never updates the value; on Zephyr the reading saturates at UINT32_MAX - 1 µs rather than wrapping, so ALP_ERR_NOT_READY means only “no successful invoke yet”, never “too slow to report”
   • ›AEN flash-path corrections. E1M-AEN401 / AEN601 m55_hp board trees still carried the pre-#1445 symmetric slot0, so the planner published a slot0_load_address of 0x802b0000 for an image linked at 0x80010000 (#1482). Three AEN bench flash scripts wrote MRAM, never read their own verifybin result, and exited 0 on a failed flash (#1488, #1478). A storage[].flash_device: naming an AEN MRAM sub-region resolved and decorated a Devicetree label the board tree never defines (#1484), and orchestrate now refuses status: ok on an unverified dt_label (#1556). On real E8 silicon the on-SoM DP83825 answers at MDIO address 0, not the 1 the devicetree declared (#1244)
   • ›Supply-chain and CI hardening across the workflow tree: three workflows spliced externally-chosen GitHub Actions context into unguarded run: blocks — a template injection reachable from a fork PR (#1475) — and the gate that now blocks it was widened to cover actions/github-script’s with: script: sink too (#1529). Every Action uses: is pinned to a commit SHA with a gate and a bump path (#1479), every actions/checkout stopped persisting the run’s GITHUB_TOKEN into local git config, every workflow job carries a runtime cap (#1477), apt-get’s total time is bounded after a trickling mirror hung CI for roughly 11 hours (#1575), and shellcheck widened from scripts/bench/** to every shipped .sh file (#1550)
   • ›The model & edge-AI lifecycle design record lands ahead of the code it plans (#933): two specs and eight implementation plans for check / envelope / zoo / prep / measure / tflite-convert plus their tan and VS Code counterparts, published under docs/superpowers/. Design only — no code, no metadata, no schema, no public header changes — landed on its own so ~3,800 lines of design reasoning stop being reachable only through a 77-file conflicting integration PR
   • ›Alongside it, tan-cli cut v0.6.0 (2026-08-24) — the release a default install actually produces, since v0.6.0-rc1 shipped as a GitHub pre-release that install.sh / install.ps1 never resolved. It requires alp-sdk v0.16.0 or newer, and its planner mirror and vendored fixtures are pinned to that release tag rather than to a dev commit for the first time
4. v0.15.02026-08-07 · releasedShipped

   AEN801 dual-core flash release-blocker fixed · DRP-AI3 reachable from <alp/inference.h> · four real Yocto backends

   • ›Release-blocker: on E1M-AEN801 the M55-HP and M55-HE images both linked to slot0 0x80010000, so flashing both cores silently overwrote one image (#1069). Alongside it, alp_mproc_boot_core()’s image-residency precondition and a direction-specific M55-HP TCM-invalidation erratum are documented from E8 bench evidence (#1070), and a new aen-dualcore-he-master example (HE-master → HP-peer) is silicon-proven as of 2026-08-01
   • ›CONFIG_DCACHE=n is fixed across eight AEN dual-core / SRAM0-beacon examples that were silently exposed to cross-core cache incoherence, and five AEN examples stopped mis-reporting ALP_ERR_NOSUPPORT as an unreachable-in-practice SKIP (#1071)
   • ›The RZ/V2N on-die DRP-AI3 NPU is reachable from <alp/inference.h> as an opt-in backend (#1145), and libalp_sdk’s own link now refuses undefined symbols instead of deferring the failure to the consuming app
   • ›Real Yocto/Linux backends land for <alp/display.h> and <alp/i3c.h> (#1143, #1147) and for <alp/storage.h> and <alp/usb.h> (#1140, #1141) — the Linux leg of four portable classes that previously had a Zephyr backend only
   • ›Security and concurrency hardening: two path-traversal bugs in tan model build and in untrusted template catalogs (#1125, #1126); flash-backend path traversal plus script command injection (#1112, #1113); the CC3501E Wi-Fi/BLE/GPIO/OTA backends had shared one unlocked transport (#1116); five memory-safety defects in the AEN Zephyr drivers (#1119–#1122, #1124); signed-left-shift UB in SHA-256 word assembly (#1117); and an alp_handle_begin_close() busy-spin that could deadlock under priority scheduling (#1114)
   • ›ALP_CAP_HW_ETHERNET read false on V2N/V2M despite two 1 GbE ports (#1240). Two ADRs pin the surrounding stance: ADR 0023 keeps Ethernet out of <alp/*> (the portable contract is ALP_SOC_ETHERNET_COUNT plus the port identity and the rtl8211fdi PHY driver, not a new <alp/net.h>), and ADR 0024 keeps ADC, PWM, DAC, counter and qenc on V2N/V2M served exclusively by the GD32 IO-MCU bridge
   • ›Gate and tooling integrity: an hw_rev that exists but is status: reserved / tbd / status-less is now refused (#1025, the status half); scripts/gen_rzv2n_cm33_svd.py projects a cross-validated CMSIS-SVD register view for the RZ/V2N CM33 that Renesas ships no SVD for (#1029); test-all.sh had been running 1 of 34 required gate scripts on Windows (#1109); and the macOS and Windows CI legs can now actually fail the PR

§ Examples

Real applications. Clone, build, run. Our exhibition showcase, Trace Runner, is an SDK example too — a body-controlled game on one E1M-AEN803.