Forum Discussion

Altera_Forum's avatar
Altera_Forum
Icon for Honored Contributor rankHonored Contributor
17 years ago

safe state machines

Hello,

In the past, Altera recommended (in an older version of the Quartus handbook) to always explicitly specify the default state of state machines, to ensure that whenever a state machine jumps into some illegal state (as a result of a timing glitch or a SEU), it will at least return to a valid state quickly.

In VHDL, it translates to (assume the machine has only two valid states):


case (my_state) is
  when state_1 =>
    -- do stuff
  when state_2 =>
    -- do other stuff 
  when others =>
    my_staet <= state_1;
end case;

The key here is the transition in "others", which isn't strictly required because the case covers all the real cases. However, this is important in "safe state machine" design.

But now I've seen other recommendations in the Quartus handbook. The latest edition says that Quartus will ignore such explicit transitions. Instead, one has to use the "safe" attribute for state machines (or set them globally in the analysis settings).

I hope I'm wrong, but have Altera really changed the policy just like that? Why can't Quartus just preserve the "others" logic whenever I specify it explicitly? Isn't it simpler for the designer to specify his state machines like this, than explicitly setting attributes?

What have been your experiences with the safe encoding, manual and automatic?

Thanks in advance

32 Replies

  • Altera_Forum's avatar
    Altera_Forum
    Icon for Honored Contributor rankHonored Contributor

    By a synthesis attribute, for details see the Quartus software manual.

    TYPE 	 STATE_TYPE IS (s_idle, s_sync1, s_sync2, s_sync3, s_data, s_check);
    ATTRIBUTE syn_encoding : STRING;
    ATTRIBUTE syn_encoding OF STATE_TYPE : TYPE IS "safe";	
    SIGNAL state  : STATE_TYPE;
  • Altera_Forum's avatar
    Altera_Forum
    Icon for Honored Contributor rankHonored Contributor

    Hello,

    I just turned on safe state machine i nthe synthesis option,

    and I can see using signalprobing that when the state is illegal, it goes in reset state (idle) after 1 clock cycle.

    This is cool.