Safety in State Machines

Overview

State machines control sequencing, decisions, and transitions across nearly every functional block in a digital system. They orchestrate protocols, manage handshakes, regulate pipelines, and enforce timing relationships. Because they determine what happens next, faults in a state machine can lead to unpredictable or hazardous behavior. Safety analysis focuses on ensuring that state transitions are valid, that illegal states are detectable, and that the system can recover or enter a safe state when corruption occurs.

Main Safety Risks

• Illegal state entry
  SEU, SET, or logic corruption causing the FSM to enter a state not defined in the design.
• Stuck states
  The FSM becomes trapped in a state due to a missing transition or corrupted condition.
• Unexpected transitions
  Transitions triggered by corrupted inputs, metastability, or timing faults.
• State bit corruption
  Single‑bit or multi‑bit flips altering the encoded state.
• Output corruption
  Incorrect control signals generated due to invalid or misaligned states.
• Divergence between redundant FSMs
  Mismatch between lockstep or dual‑path state machines.
• Clock or reset faults
  Asynchronous reset glitches or clock instability causing partial state updates.
• I/O‑related upstream faults
  Invalid or unstable inputs driving the FSM into unsafe transitions.
• Deadlock or livelock
  The FSM stops progressing or loops indefinitely due to logic faults.

Mitigation Techniques

• Safe state encoding
  One‑hot, Gray, or Hamming‑distance‑optimized encodings to detect invalid states.
• Illegal‑state detection
  Monitoring for undefined state patterns and forcing a safe recovery.
• Redundant FSMs
  Dual or lockstep state machines with comparison for high‑integrity systems.
• Transition plausibility checks
  Verifying that transitions follow allowed paths.
• Input filtering
  Debouncing, synchronization, and glitch suppression on FSM inputs.
• Timeout supervision
  Detecting stalled states or missing transitions.
• Reset hardening
  Ensuring clean, synchronized reset signals across all FSM registers.
• Built‑In Self‑Test
  Validating FSM logic, transitions, and outputs at startup.
• ATPG/DFT support
  Scan‑based observability of state registers and transition logic, plus fault‑coverage measurement.

Safety Architecture Considerations

• State encoding strategy
  Encoding must support illegal‑state detection, error containment, and safe fallback behavior.
• Recovery behavior
  Define how the system reacts to illegal states, unexpected transitions, or divergence between redundant FSMs.
• Interaction with protocols
  FSM safety must align with protocol timing, handshake rules, and retry/error‑handling mechanisms.
• FMEDA assumptions
  State‑machine robustness contributes to diagnostic coverage, latent‑fault detection, and safe‑state guarantees.
• Verification evidence
  Safety‑critical FSMs require formal verification of transitions, fault‑injection campaigns, coverage reports, and reset‑sequence validation.

⭐ Related Technical Pages

• FSM — Architecture & Fundamentals
  Foundational concepts for designing finite‑state machines, including encoding, transitions, and implementation patterns.
• Protocol Layers — State Machines and Error Handling
  How protocol‑level FSMs manage framing, retries, error handling, and state‑transition robustness.
• Control & Data Path — Overview
  Interaction between control logic, sequencing, and datapath operations.
• Timing and Synchronization — Principles and Constraints
  Clocking, timing closure, and synchronization fundamentals that affect FSM stability.
• Safety in Clocking
  Failure modes related to clock instability, gating, and distribution.
• Safety in CDC
  Metastability risks and synchronization strategies for multi‑clock FSM inputs.
• Safety — Overview
  Core principles of functional safety and system‑level fault handling.
• Safety in Protocol Layers
  State‑machine‑driven protocol behavior, retries, and error‑recovery mechanisms.
• Safety in Data Path & Buffers
  Interaction between FSM control signals and datapath validity, timing, and flow control.
• ATPG and DFT — Architecture and Principles
  Structural testability, scan‑based observability, and fault‑model coverage.
• LBIST Architecture
  Use of LFSR/MISR structures to validate FSM logic and transitions.
• Scan Architecture
  Scan‑chain access to FSM state registers for structural testing.
• Fault Models
  Common fault types affecting FSM logic, transitions, and state encoding.