Safe FSM Default Recovery
Aerospace and high-reliability digital systems must survive single-event upsets (SEUs). When radiation or power glitches flip a flip-flop bit, a finite state machine can enter an unmapped state and deadlock. A robust FSM includes explicit recovery logic to detect invalid states and force a return to a safe idle condition.
The module controls a sequence with three valid states: IDLE (2'b00), ACTIVE (2'b01), and COOLDOWN (2'b10). In IDLE, asserting go transitions the machine to ACTIVE. In ACTIVE, asserting done transitions the machine to COOLDOWN. From COOLDOWN, the machine unconditionally returns to IDLE on the next cycle. State 2'b11 is an invalid state. To simulate a single-event upset, an inject_fault input forces the state register to 2'b11 on the next clock edge. If the machine finds itself in state 2'b11, it must assert error_flag and unconditionally transition to IDLE on the next clock cycle. The status output always reflects the current state register value.
- Clock edge:
posedge clk - Reset type: Asynchronous active-low reset
rst_n - Reset behaviour: State becomes
IDLE(2'b00);statusbecomes 2'b00;error_flagbecomes 0 - Priority:
rst_noverrides all other inputs;inject_faultoverrides all normal state transitions and recovery transitions - Outputs:
statusanderror_flagare purely combinational outputs derived directly from the current state register
Cycle 1: rst_n=0 → state=2'b00, status=2'b00, error_flag=0 Cycle 2: rst_n=1, go=1, inject_fault=0 → state=2'b00, status=2'b00, error_flag=0 Cycle 3: rst_n=1, go=0, inject_fault=1 → state=2'b01, status=2'b01, error_flag=0 Cycle 4: rst_n=1, go=0, inject_fault=0 → state=2'b11, status=2'b11, error_flag=1 Cycle 5: rst_n=1, go=0, inject_fault=0 → state=2'b00, status=2'b00, error_flag=0 Cycle 6: rst_n=1, go=0, inject_fault=0 → state=2'b00, status=2'b00, error_flag=0
flowchart LR
RESET(( )) -->|reset| IDLE
IDLE((IDLE 00)) -->|go=1| ACTIVE
IDLE -->|go=0| IDLE
ACTIVE((ACTIVE 01)) -->|done=1| COOLDOWN
ACTIVE -->|done=0| ACTIVE
COOLDOWN((COOLDOWN 10)) -->|unconditional| IDLE
INVALID(["INVALID 11 ★"]):::out -->|unconditional| IDLE
IDLE -.->|inject_fault=1| INVALID
ACTIVE -.->|inject_fault=1| INVALID
COOLDOWN -.->|inject_fault=1| INVALID
classDef out fill:#6C5CE7,stroke:#5B4FE8,color:#fff{ "signal": [
{ "name": "clk", "wave": "p....." },
{ "name": "rst_n", "wave": "01...." },
{ "name": "go", "wave": "010..." },
{ "name": "inject_fault", "wave": "0010.." },
{},
{ "name": "status", "wave": "======", "data": ["00", "00", "01", "11", "00", "00"] },
{ "name": "error_flag", "wave": "0..10." }
], "head": { "text": "Fault injection during ACTIVE state and subsequent recovery." } }| Signal | Direction | Width | Description | |--------|-----------|-------|-------------| | clk | input | 1 | Positive-edge triggered clock | | rst_n | input | 1 | Asynchronous active-low reset; state returns to IDLE | | go | input | 1 | Triggers transition from IDLE to ACTIVE | | done | input | 1 | Triggers transition from ACTIVE to COOLDOWN | | inject_fault | input | 1 | Forces state to 2'b11 on the next clock edge | | status | output | 2 | Current state register value | | error_flag | output | 1 | Asserted high when the current state is 2'b11 |
Constraints
- Clock edge and reset polarity must exactly match the specification
- Output values must correctly reflect the reset state immediately upon
rst_ngoing low inject_faulthas priority over normal state transitions- State 2'b11 must unconditionally transition to
IDLE(2'b00) on the next clock edge unlessinject_faultis asserted - Outputs
statusanderror_flagmust be purely combinational based on the current state
Topics
Solve this problem
Write the module in Verilog, SystemVerilog or VHDL. Your submission is compiled and simulated against a real testbench — you get the waveform back, not a stored answer.
This problem is part of Codiode Pro. The statement above is free to read.
The circuit builder and code editor need a desktop screen. On a phone, read the problem here and open it on a laptop to solve.