Q200FreeSystemVerilog
Detect and recover an upset one-hot FSM
Interview prompt
Question
Protect a 16-state one-hot control FSM against sampled bit upsets. For known 0/1 state bits, detect zero-hot and multi-hot encodings, force a safe recovery state, and add a verification assertion. Treat X/Z simulation values and physical metastability as separate concerns.
Candidate starting point
Implementation scaffold
module safe_onehot_fsm16 (
input logic clk,
input logic rst_n,
input logic advance,
output logic [15:0] state,
output logic state_error
);
localparam logic [15:0] SAFE = 16'h0001;
logic [15:0] state_d;
always_comb begin : detect_and_choose_state
// TODO: Implement detect_and_choose_state using the supplied state and interface.
end
always_ff @(posedge clk or negedge rst_n) begin : state_register
// TODO: Implement state_register using the supplied state and interface.
end
property p_legal_onehot;
// TODO: Implement legal_onehot with the stated clock, reset and timing contract.
endproperty
a_legal_onehot: assert property (p_legal_onehot);
endmodule
// TODO: Explain silent valid-code corruption in a binary encoding and the distinct recovery/assertion roles.
Reviewed example
Trace one case
Input
state=16'b0000_0000_0000_0010 with advance=1 at the normal transition; later an upset creates state=16'b0000_0000_0000_0110 before a sampling edge.Expected output
normal next state is 16'b0000_0000_0000_0100; the upset asserts error and the next edge forces SAFE 16'b0000_0000_0000_0001Two asserted state bits are illegal even though a binary encoding might interpret a flipped bit as another valid state.
What to cover
Requirements
- Treat exactly one asserted bit as legal; all-zero and two-or-more-hot values are illegal.
- On detection, override normal next-state logic and recover to SAFE on the next edge.
- Expose an error indication so the event can be logged or escalated.
- Explain why a binary-state bit flip can silently land on another valid code.