--- Quote Start ---
I assumed Quartus implements a "safe FSM" even when no explicitly asked to do so (as long as it identify's it as an FSM - which it does in this case).
--- Quote End ---
Safe state machine is only implemented if explicitly specified.
--- Quote Start ---
If no timing violations exist, what can cause such a thing to happen?
--- Quote End ---
There must be some kind of timing violation, e.g. a FSM input condition depending on an external asynchronous signal or an unstable design clock with glitches.
My general rule is that a state machine which can get stuck in an illegal state because it's not unconditionally reset periodically should be implemented using safe enconding scheme. Even if your design is completely safe, there might be still electrical interferences affecting the clock source.
Honored Contributor
