Safe finite state machine design

[SomeDude]

Hi,

I am programming a Xilinx FPGA using Xilinx Project Navigator tool and
FPGA Express for synthesis.

I want to design a "safe" FSM, where the machine would fall back to
reset state when it goes in an illegal state (I am using one-hot
encoding).

At the end of the case statement listing all states, I included a
"when others" clause that should make the machine go back to reset
state if it is stuck in a state that is not listed (an illegal state).

In FPGA Express, I selected the option "FSM Synthesis: Interpretation
of VHDL 'when others': safest (all possible, including illegal,
states)".

However, ModelSim simulations show that the machine does not properly
recover from an illegal state. In Post-Place & Route sim, I forced the
state to an illegal one (more than one '1' in state vector). I used
the -deposit option when forcing the signal so the state is not frozen
(will change value when driven). What the simulation shows is that the
machine stays in the illegal state. This is particularly strange since
I explicitely chose the safest option in FPGA Express. Maybe the
problem is in the simulation?

I cannot get any support since Xilinx don't support FPGA Express and
Synopsis do not make it anymore. Any help would be really appreciated.
It is important for our application to have safe recovery for illegal
states.

Here is the following snippet of code I used:

main_fsm: process(clk, rst_n)
begin
if rst_n = '0' then
z <= "00";
state <= RESET;

elsif (clk'event and clk = '1') then

case state is

when RESET =>
state <= STATE1;
z <= "00";

when STATE1 =>
state <= STATE2;
z <= "01";

when STATE2 =>
state <= STATE1;
z <= "10";

when others =>
state <= RESET;

end case;
end if;
end process;

Thank you!

 

[Mike Treseler]

However, ModelSim simulations show that the machine does not properly
recover from an illegal state. In Post-Place & Route sim, I forced the
state to an illegal one (more than one '1' in state vector). I used
the -deposit option when forcing the signal so the state is not frozen
(will change value when driven). What the simulation shows is that the
machine stays in the illegal state. This is particularly strange since
I explicitely chose the safest option in FPGA Express. Maybe the
problem is in the simulation?

Maybe.
Try binary encoding then explicit encoding
and see if that makes any difference.

-- Mike Treseler

 

[Wallclimber]

I don't have a direct answer to your problem, but since the
statemachine is so simple, you may want to check out the generated
logic to check whether or not it's a simulation problem. It should be
only a few gates...

Tom Verbeure

 

[arant]

if rst_n = '0' then
z <= "00";
state <= RESET;

elsif (clk'event and clk = '1') then

case state is

when RESET =>
state <= STATE1;
z <= "00";

I think there is a problem of reset recovery with your design in case you are not using a synchronous reset for your design
___________________
rst_n _____________|
__ __ __
clk ____| |__| |__| |__

state ----RESET----><STATE1---

On the next posedge of clk after the reset is deasserted there could be a possibilty of the value of state going unknown/metastable

You can also try the following

p_fsm_seq: process(clk, rst_n)
begin
if rst_n = '0' then
z <= "00";
ps<= RESET;
elsif (clk'event and clk = '1') then
ps<= ns;
end if;
end process p_fsm_seq;

-- ps present_state
-- ns next_state
p_fsm_comborocess(ps)
begin

ns <= RESET;
case ps is

when RESET =>
ns <= STATE1;
z <= "00";

when STATE1 =>
ns <= STATE2;
z <= "01";

when STATE2 =>
ns <= STATE1;
z <= "10";

when others =>
ns <= RESET;

end case;
end if;
end process p_fsm_combo;