is VHDL unsafe with state machine?

Question

Typical VHDL state machine is to define a type that consist of states, then use that type in a signal. But if someone (not me, no way! ;-)) forget to put a reset state, the state machine continues to work starting from the first state declared in type. This is wrong! It should go to undefined state. But since the state definition does not include undefined state, it never goes there. Below is an example code.

type state_type is (S0, S1, S2, S3, STARTUPSTATE);

signal currState, nextState : state_type;

begin

process(currState) begin

case currState is

when S0 => blah0; nextState <= findNextState(blah0);

when S1 => blah1; nextState <= findNextState(blah1);

when S2 => blah2; nextState <= findNextState(blah2);

when S3 => blah3; nextState <= findNextState(blah3);

when STARTUPSTATE => nextState <= findNextState(someCondition);

when others => -- never goes here

end case;

end process;

process(reset, clk) begin

if reset='1' then

-- currState <= STARTUPSTATE; somebody forgot this reset!!!

elsif rising_edge(clk) then

currState <= nextState;

end if;

end process;

Note that the state machine starts at S0, not STARTUPSTATE as intended. One could argue that STARTUPSTATE should be the first item in state type, but that's not the point; the problem arose out of error, and VHDL did not flag it as "X". Also, that still doesn't fix the problem: after P&R, flop is not reset property, and one doesn't know what state the flop will take. But functional simulation will work just fine. It seems coding state machine like this is going to mask problems that may come up in hardware after P&R.

One way to circumvent this is to use std_logic_vector to explicitly encode that states. But doing that means one has to binary code the states and more decoding is needed as opposed to more efficient methods such as one-hot. And doing one-hot in VHDL means if-else rather than case, which could incur unnecessary logic.

If FPGA always take on some value, that might be fine. But flops without reset must take on undefined values upon power up until valid inputs (D + CK) are present. This becomes especially problematic for ASIC emulation where ASIC behaves differently than FPGA due to coding error that was masked by VHDL.

So what are the options other than going to Verilog for safe coding of state machine in VHDL that will catch errors like this without explicitly specifying the state values? Thank you.

altera_forum · Answer

no they shouldnt. By default ALL registers in an FPGA powerup to '0' unless specified. Whether you code in Verilog or VHDL it wont be any different. There is no such thing as undefined in real hardware. Even more interesting, a state machine like this with more than 3 states has the states encoded as 1 hot by default, so there are actually many illegal states.

As for the VHDL, all types, if left uninitialised, will initialise to the left most state, which in this case is S0. It cannot go to 'X' in simulation because you have not defined an 'X' state. This is not a std_logic (which would default to 'U', not 'X'). If you really want the specifics, then yes, you have to define the states yourself using std_logic_vector or similar. Even if you did this, without the reset, its likely to power up to all zeros, regardless of what youir first state should be.

The solution: have your powerup/reset state as the left most state.

altera_forum · Answer

I think your question confuses several unrelated points. In functional simulation, the initial state of a signal will follow general VHDL rules, not an assumed behaviour of FFs. For enumerations, the first member is the initial state.

In synthesized code, there's no thing like unknown state. Safe coding of state machine doesn't mean to enter an 'X' state for a missing reset. It means that any illegal states will automatically cause a transition to a defined, usually the initial state. That's important to prevent locking of a FSM in case of unexpected events, e.g. clock glitches or timing violation of input signals.

A functional simulation however does neither show nor handles illegal states, you have to refer to a gate level simulation to check for these effects.

In my opinion, there's no principle difference between VHDL and Verilog implementation of state machines, except for some syntax details. But although you'll define e.g. a state encoding in Verilog, it will be usually translated in a one state hot design by the synthesis tool.

altera_forum · Answer

As FvM points out, the VHDL language is essentially changing your code to:

signal currState, nextState : state_type := S0;

Which is a synthesizeable construct; whatever Quartus decides is the state width, and the encoding for S0, the registers will be initialized to at power-on.

If STARTUPSTATE should be first, then either the enumeration can be changed, or the code changed to

signal currState, nextState : state_type := STARTUPSTATE;

or, explicitly use a reset signal and initialize the state in the process as you have shown. However, even in that case, if you never assert reset in the simulation, the state variables will be assigned to either S0 or whatever you explicitly assign to.

Personally I prefer the explicit use of a reset signal.

Cheers,

Dave

altera_forum · Answer

I don't want to drag discussion back to some posts in 2008. But, an issue was raised that "when others" is ignored by most tools by default unless you override it, because it takes too much logic. Thus a reset is essential for power up case. For critical applications it must be safe in real time as well and so when others must be there fitted.

Does that mean "when others" of state machines only or any case statement, I don't know and I don't think so.

altera_forum · Answer

Hi, I think both replies miss the point that there is discrepancy of hardware behavior and RTL functional simulation. If one assume this only relate to flops that always reset to some value as I discussed in original post, this is not a problem. But the real flop in ASIC or may not behave this way. Correct behavior is undefined output from flops (sometimes 0, sometime 1, never known a priori). Therefore, coding this way with left most entry as default state does not address the issue of undefined output from real flop causing the post place and route and hardware behavior to not match RTL functional.

Granted, one can say this is reset bug, so that should be fixed. But functional simulation will not catch this kind of bug when all states are defined. I supposed one can go a step further and define and undefined state as left most in type declaration just to catch not properly resetted state machine, but that's so kludgy...

As for HW, I was testing an FPGA hardware in lab long ago, and it would only work after dozen or so power cycles. Now I think of it, I suspect the guy who did RTL did not reset his state machine written in VHDL.

Forum Discussion

is VHDL unsafe with state machine?

10 Replies

Recent Discussions

DE1-SoC project compiles, but board programming fails 42% through

Compatibility and Configuration of Arria10 Devices with and without HPS

USB Blaster conflicts with other FTDI devices result in PC crash

MAX10 Single end I/O low/high speed bank frequency

Device migration about DD and DA