Contracts for Innovation: DSbD Advancing CHERI Tools and software

To lead a project you can:

• be an organisation of any size
• work alone or with the subcontracted skills and expertise of others from business, research organisations, research and technology organisations, or the third sector (charities, social enterprises and voluntary groups)

Applicant organisations must:

• have the knowledge and experience working with CHERI to undertake the proposed project
• have available platforms or environments to support the proposed project

A CHERI-enabled device is a system on chip silicon implementation that utilises the RISC-V architecture that implements the CHERI extensions as defined in the RISC-V Specification for CHERI Extensions.

Contracts will be awarded to a single legal entity only. The majority of the project work and key deliverables must be completed by the applicant and be carried out in the UK. Subcontractors can be used, but only for specialist skills.

An individual may be named in only one application submitted to this competition.

A single organisation may submit multiple applications in this competition.

We welcome and encourage applications from people of all backgrounds and are committed to making our application process accessible to everyone. This includes making reasonable adjustments, for people who have a disability or a long term condition and face barriers applying to us.

You can contact us at any time to ask for guidance.

We recommend you contact us at least 15 working days before this competition’s closing date to allow us to put the most suitable support in place. The support we can provide may be limited if you contact us close to the competition deadline.

You can contact Innovate UK by email or call 0300 321 4357. Our phone lines are open from 9am to 12pm and 2pm to 5pm UK time, Monday to Friday (excluding bank holidays).

Projects must:

• start by 1 September 2025
• end by 31 March 2028
• last between 6 and 31 months
• have total costs between £200,000 and £1 million, inclusive of VAT, for stage 1
• have total costs up to £2 million, inclusive of VAT, for stage 2

Stage 1 must complete by 31 March 2026. No time extensions for stage 1 milestones will be possible. All stage 2 milestones must be completed prior to 31 March 2028.

You must provide defined and measurable milestones including associated deliverables which must be clearly broken down with associated claims against stage 1 and stage 2 respectively.

A total of up to £12 million, inclusive of VAT, is allocated to this competition across two stages. The funding budget is up to £4 million for stage 1 and up £8 million for stage 2.

Contracts will be awarded to projects with total eligible costs between £200,000 and £1 million, inclusive of VAT, for stage 1 and up to £2 million inclusive of VAT, for stage 2. Each project will last between 6 and 31 months.

Break Clause: The funding for the continuation of the Advancing CHERI Tools and Software projects is subject to a review by March 2026.

In the event that the decision is made to terminate the funding as a result of this review, there will be a three month notice period before the funding will stop. Innovate UK will not be able to fund any further project activity after the end of the notice period, and projects will stop at the end of stage 1 on 31 March 2026.

Projects who have not met their stage 1 milestones will be given a 30 day notice period before the funding for their project will stop. Innovate UK will not be able to fund further project activity after the end of the notice period, and projects who have not met their stage 1 milestones will stop on 31 March 2026.

Subject to meeting all stage 1 milestones, and funding being confirmed beyond March 2026, projects will continue into stage 2 delivery.

Although the risk of termination is expected to be low, it is crucial that applicants demonstrate they have considered this in their project plan. Projects should be designed in a way that ensures tangible and viable deliverables could be delivered by March 2026 should the funding be terminated.

The aim of the competition is to fund activities in maturing and enabling the availability of CHERI (Capability Hardware Enhanced RISC Instructions) tools and software components for RISC-V embedded devices that implement the CHERI architecture extensions.

The competition is supporting economic growth and societal resilience through accelerating the adoption and diffusion of the secure by design CHERI technology. The focus is on maturing and increasing the availability of the required tooling and software components for CHERI-enabled devices.

We require projects to mature and make available tools and software components for use with CHERI-enabled devices. This could include porting and optimisation activities on:

• the Linux kernel and associated frameworks such as memory management, file system, network and inter-process communication
• application services frameworks and software components libraries used in embedded systems, such as various protocols and communications, storage and databases, identity and cryptography
• Real-Time Operating Systems (RTOS) and runtimes used within embedded systems such as FreeRTOS, Zephyr OS, Java, Docker, WebAssembly
• tools used by developers of software such as compilers, debuggers, profilers and core libraries

The Centre for CHERI Tools and Software

For the successful commercial adoption of CHERI enabled products and services it is necessary to have matured tools, software components and associated dependencies available in a consistent and accessible form.

A Centre for CHERI Tools and Software (referred to as ‘the Centre’ from here on) is separately being created to be a collaborative engineering organisation that will consolidate and make available CHERI-based software and tools for RISC-V embedded devices.

Your project must involve the development, maturation and subsequent availability of CHERI Tools and Software components specifically for CHERI-enabled, RISC-V embedded devices. Your project should contribute towards building the Centre’s accessible, open-source ecosystem in order to build consistent and supportable CHERI-enabled software stacks, with a focus on embedded markets. Projects should justify applicability to usage in Critical National Infrastructure (CNI).

Projects must identify either a single or associated grouping of tools or software components that will be developed and matured through defined activities that will result in defined milestones and associated deliverables to a state suitable for distribution through the Centre’s infrastructures.

Projects working on open-source software component or tool outcomes should deliver using Open Source Security Foundation (OSSF) best practices to align with the Centre’s dissemination activities

For projects delivering commercial outcomes, submissions must describe a credible and practical route to market to commercialise those outcomes.

An online briefing will be held on Tuesday 20 May at 2pm: click here to register for a place.

If you want help to find an organisation to work with, contact Innovate UK Business Connect’s Electronics and Computing team.