False Starts, Noise and Malformed Frames

candidate at t=0                     edge detector fires
line still at space at M/2           qualification PASSES
-> start accepted, timing origin set to a disturbance
-> eight data samples taken at 1.5, 2.5, ... UI from nothing in particular
-> a stop sample taken at 9.5 UI
-> a byte is delivered

Require the line to have been continuously at MARK for one full frame time
before any start candidate may be qualified.

// ---------------------------------------------------------------------------
//  9.5 — idle qualification. The technique Chapter 6.2 §7 deferred: refuse to
//  accept a start until the line has been at mark for a full frame time, so a
//  receiver joining a live line cannot mis-frame on the remainder.
// ---------------------------------------------------------------------------
module uart_idle_qualify #(
    parameter int unsigned OVERSAMPLE = 16,
    parameter int unsigned FRAME_BITS = 10
) (
    input  logic clk,
    input  logic rst_n,
    input  logic os_tick_i,
    input  logic rx_sync_i,
    output logic line_idle_o        // LEVEL: mark held for a full frame time
);
    localparam int unsigned IDLE_TICKS = FRAME_BITS * OVERSAMPLE;
    localparam int unsigned CNT_W = (IDLE_TICKS <= 1) ? 1 : $clog2(IDLE_TICKS + 1);

    logic [CNT_W-1:0] mark_cnt_q;

    always_ff @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            mark_cnt_q  <= '0;
            line_idle_o <= 1'b0;      // NOT idle out of reset — must be earned
        end else if (rx_sync_i == 1'b0) begin
            mark_cnt_q  <= '0;
            line_idle_o <= 1'b0;
        end else if (os_tick_i) begin
            if (mark_cnt_q == CNT_W'(IDLE_TICKS)) begin
                mark_cnt_q <= mark_cnt_q;              // saturate
            end else begin
                mark_cnt_q <= mark_cnt_q + 1'b1;
                if (mark_cnt_q == CNT_W'(IDLE_TICKS - 1)) line_idle_o <= 1'b1;
            end
        end
    end
endmodule

// Conceptual SystemVerilog — gating start acceptance on proven idle.
// The qualifier itself is Chapter 5.2's, unmodified; this adds a
// precondition rather than changing the mechanism.
if (start_cand_i && line_idle_o) begin
    // ... Chapter 5.2's qualification proceeds from here
end

//===========================================================================
//  uart_idle_qualify_v — Synthesizable Verilog-2001
//
//  Idle qualification: refuse to call the line idle until it has been at
//  MARK for a full frame time. A receiver that powers up mid-character would
//  otherwise treat the next low interval as a start bit and mis-frame on the
//  remainder of somebody else's character.
//
//  line_idle_o is NOT set out of reset. Idle is earned by observation, never
//  assumed — that is the contract, and Chapter 9.5 §5 shows what assuming it
//  costs.
//===========================================================================
module uart_idle_qualify_v #(
    parameter OVERSAMPLE = 16,
    parameter FRAME_BITS = 10
) (
    input  wire clk,
    input  wire rst_n,
    input  wire os_tick_i,
    input  wire rx_sync_i,
    output reg  line_idle_o
);
    localparam IDLE_TICKS = FRAME_BITS * OVERSAMPLE;

    function integer clog2;
        input integer value;
        integer i;
        begin
            clog2 = 1;
            for (i = value - 1; i > 1; i = i >> 1) clog2 = clog2 + 1;
        end
    endfunction

    localparam CNT_W = (IDLE_TICKS <= 1) ? 1 : clog2(IDLE_TICKS + 1);

    reg [CNT_W-1:0] mark_cnt_q;

    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            mark_cnt_q  <= {CNT_W{1'b0}};
            line_idle_o <= 1'b0;              // must be earned
        end else if (rx_sync_i == 1'b0) begin
            mark_cnt_q  <= {CNT_W{1'b0}};
            line_idle_o <= 1'b0;
        end else if (os_tick_i) begin
            if (mark_cnt_q == IDLE_TICKS[CNT_W-1:0]) begin
                mark_cnt_q <= mark_cnt_q;                    // saturate
            end else begin
                mark_cnt_q <= mark_cnt_q + 1'b1;
                if (mark_cnt_q == (IDLE_TICKS[CNT_W-1:0] - 1'b1))
                    line_idle_o <= 1'b1;
            end
        end
    end
endmodule

--==========================================================================
--  uart_idle_qualify -- Synthesizable VHDL-2008
--
--  Idle is EARNED by observation, never assumed: line_idle_o is '0' out of
--  reset and only rises after a full frame time of continuous mark. A
--  receiver that joins a live line mid-character therefore cannot treat the
--  remainder of somebody else's character as a frame.
--==========================================================================
library ieee;
use ieee.std_logic_1164.all;
use ieee.numeric_std.all;
use ieee.math_real.all;

entity uart_idle_qualify is
    generic (
        OVERSAMPLE : positive := 16;
        FRAME_BITS : positive := 10
    );
    port (
        clk         : in  std_logic;
        rst_n       : in  std_logic;
        os_tick_i   : in  std_logic;
        rx_sync_i   : in  std_logic;
        line_idle_o : out std_logic
    );
end entity uart_idle_qualify;

architecture rtl of uart_idle_qualify is

    constant IDLE_TICKS : positive := FRAME_BITS * OVERSAMPLE;

    function cnt_width (n : positive) return positive is
    begin
        if n <= 2 then
            return 1;
        else
            return positive(ceil(log2(real(n))));
        end if;
    end function;

    constant CNT_W : positive := cnt_width(IDLE_TICKS + 1);

    signal mark_cnt_q : unsigned(CNT_W-1 downto 0);

begin

    process (clk, rst_n)
    begin
        if rst_n = '0' then
            mark_cnt_q  <= (others => '0');
            line_idle_o <= '0';                    -- must be earned
        elsif rising_edge(clk) then
            if rx_sync_i = '0' then
                mark_cnt_q  <= (others => '0');
                line_idle_o <= '0';
            elsif os_tick_i = '1' then
                if mark_cnt_q = to_unsigned(IDLE_TICKS, CNT_W) then
                    mark_cnt_q <= mark_cnt_q;                   -- saturate
                else
                    mark_cnt_q <= mark_cnt_q + 1;
                    if mark_cnt_q = to_unsigned(IDLE_TICKS - 1, CNT_W) then
                        line_idle_o <= '1';
                    end if;
                end if;
            end if;
        end if;
    end process;

end architecture rtl;

  PASS reset: NOT idle -- idle must be earned
  PASS a busy line never qualifies as idle

//===========================================================================
//  tb_uart_idle_qualify_v — self-checking Verilog-2001 testbench
//
//  INDEPENDENCE: the checker counts the mark ticks IT DROVE and asserts idle
//  exactly at FRAME_BITS x OVERSAMPLE. It never reads mark_cnt_q.
//
//  The property that matters most is the NEGATIVE one: idle is not asserted
//  out of reset. A receiver that assumes idle can mis-frame on the remainder
//  of somebody else's character, and no positive test catches that.
//===========================================================================
`timescale 1ns/1ps

module tb_uart_idle_qualify_v;

    reg clk = 1'b0, rst_n = 1'b0;
    always #5 clk = ~clk;

    reg os_tick = 1'b0, rx_sync = 1'b1;
    wire a_idle, b_idle;

    uart_idle_qualify_v #(.OVERSAMPLE(16), .FRAME_BITS(10)) dut_a (
        .clk(clk), .rst_n(rst_n), .os_tick_i(os_tick), .rx_sync_i(rx_sync),
        .line_idle_o(a_idle));
    uart_idle_qualify_v #(.OVERSAMPLE(8), .FRAME_BITS(7)) dut_b (
        .clk(clk), .rst_n(rst_n), .os_tick_i(os_tick), .rx_sync_i(rx_sync),
        .line_idle_o(b_idle));

    localparam A_TICKS = 160;
    localparam B_TICKS = 56;

    integer checks = 0, failures = 0;

    task check;
        input cond;
        input [8*58-1:0] name;
        begin
            checks = checks + 1;
            if (cond) $display("  PASS %0s", name);
            else begin failures = failures + 1; $display("  FAIL %0s", name); end
        end
    endtask

    task drive_ticks;
        input integer n;
        integer k;
        begin
            for (k = 0; k < n; k = k + 1) begin
                @(negedge clk) os_tick = 1'b1;
                @(negedge clk) os_tick = 1'b0;
                @(negedge clk);
            end
        end
    endtask
    task settle; begin repeat (2) @(negedge clk); end endtask

    initial begin
        #4_000_000;
        $display("  FAIL watchdog: simulation did not finish");
        $display("== %0d checks, %0d failures ==", checks+1, failures+1);
        $display("   RESULT: VERILOG IDLE-QUALIFY TESTS FAILED (timeout)");
        $finish;
    end

    initial begin
        $display("== uart_idle_qualify_v : self-checking Verilog testbench ==");

        rst_n = 1'b0; rx_sync = 1'b1;
        repeat (4) @(negedge clk);
        check(a_idle === 1'b0, "reset: NOT idle -- idle must be earned");
        @(negedge clk) rst_n = 1'b1;
        @(negedge clk);

        // ---- a high line is not yet a qualified idle line ----------------
        drive_ticks(A_TICKS - 1); settle;
        check(a_idle === 1'b0, "one tick short of a frame time: not idle");
        drive_ticks(1); settle;
        check(a_idle === 1'b1, "full frame time of mark: idle asserted");

        // ---- any low clears it immediately, with no tick required --------
        @(negedge clk) rx_sync = 1'b0;
        settle;
        check(a_idle === 1'b0, "a single low clears idle at once");

        // ---- and it must be re-earned in full ----------------------------
        @(negedge clk) rx_sync = 1'b1;
        drive_ticks(A_TICKS - 1); settle;
        check(a_idle === 1'b0, "re-qualification is not shortened");
        drive_ticks(1); settle;
        check(a_idle === 1'b1, "idle re-earned after a full frame time");

        // ---- saturation: staying high does not wrap it back to not-idle --
        drive_ticks(A_TICKS * 3); settle;
        check(a_idle === 1'b1, "long idle: counter saturates, stays idle");

        // ---- the threshold scales with the parameters --------------------
        @(negedge clk) rx_sync = 1'b0; settle;
        check(a_idle === 1'b0 && b_idle === 1'b0, "both instances cleared");
        @(negedge clk) rx_sync = 1'b1;
        drive_ticks(B_TICKS); settle;
        check(b_idle === 1'b1, "8x/7-bit qualifies at 56 ticks");
        check(a_idle === 1'b0, "16x/10-bit has NOT qualified yet");
        drive_ticks(A_TICKS - B_TICKS); settle;
        check(a_idle === 1'b1, "16x/10-bit qualifies at 160 ticks");

        // ---- a busy line never qualifies ---------------------------------
        // Alternating mark and space, as a live link looks, must never reach
        // a full frame time of continuous mark.
        @(negedge clk) rx_sync = 1'b0; settle;
        begin : busy_line
            integer j;
            for (j = 0; j < 20; j = j + 1) begin
                @(negedge clk) rx_sync = 1'b1;
                drive_ticks(20);
                @(negedge clk) rx_sync = 1'b0;
                drive_ticks(4);
            end
        end
        settle;
        check(a_idle === 1'b0, "a busy line never qualifies as idle");

        // ---- reset while qualified ---------------------------------------
        @(negedge clk) rx_sync = 1'b1;
        drive_ticks(A_TICKS); settle;
        check(a_idle === 1'b1, "idle before reset");
        @(negedge clk) rst_n = 1'b0;
        repeat (2) @(negedge clk);
        check(a_idle === 1'b0, "reset drops idle -- it must be re-earned");
        @(negedge clk) rst_n = 1'b1;
        @(negedge clk);

        $display("== %0d checks, %0d failures ==", checks, failures);
        if (failures == 0) $display("   RESULT: ALL VERILOG IDLE-QUALIFY TESTS PASSED");
        else               $display("   RESULT: VERILOG IDLE-QUALIFY TESTS FAILED");
        $finish;
    end
endmodule

//===========================================================================
//  tb_uart_idle_qualify_sv — self-checking Verilog-2001 testbench
//
//  INDEPENDENCE: the checker counts the mark ticks IT DROVE and asserts idle
//  exactly at FRAME_BITS x OVERSAMPLE. It never reads mark_cnt_q.
//
//  The property that matters most is the NEGATIVE one: idle is not asserted
//  out of reset. A receiver that assumes idle can mis-frame on the remainder
//  of somebody else's character, and no positive test catches that.
//===========================================================================
`timescale 1ns/1ps

module tb_uart_idle_qualify_sv;

    logic clk = 1'b0, rst_n = 1'b0;
    always #5ns clk = ~clk;

    logic os_tick = 1'b0, rx_sync = 1'b1;
    logic a_idle, b_idle;

    uart_idle_qualify #(.OVERSAMPLE(16), .FRAME_BITS(10)) dut_a (
        .clk(clk), .rst_n(rst_n), .os_tick_i(os_tick), .rx_sync_i(rx_sync),
        .line_idle_o(a_idle));
    uart_idle_qualify #(.OVERSAMPLE(8), .FRAME_BITS(7)) dut_b (
        .clk(clk), .rst_n(rst_n), .os_tick_i(os_tick), .rx_sync_i(rx_sync),
        .line_idle_o(b_idle));

    localparam A_TICKS = 160;
    localparam B_TICKS = 56;

    int unsigned checks = 0, failures = 0;

    task automatic check(input bit cond, input string name);
        checks++;
        if (cond) $display("  PASS %0s", name);
        else begin failures++; $display("  FAIL %0s", name); end
    endtask

    task automatic drive_ticks(input int n);
        for (int k = 0; k < n; k++) begin
            @(negedge clk) os_tick = 1'b1;
            @(negedge clk) os_tick = 1'b0;
            @(negedge clk);
        end
    endtask
    task automatic settle(); repeat (2) @(negedge clk); endtask

    initial begin
        #4ms;
        $display("  FAIL watchdog: simulation did not finish");
        $display("== %0d checks, %0d failures ==", checks+1, failures+1);
        $display("   RESULT: SYSTEMVERILOG IDLE-QUALIFY TESTS FAILED (timeout)");
        $finish;
    end

    initial begin
        $display("== uart_idle_qualify : self-checking Verilog testbench ==");

        rst_n = 1'b0; rx_sync = 1'b1;
        repeat (4) @(negedge clk);
        check(a_idle === 1'b0, "reset: NOT idle -- idle must be earned");
        @(negedge clk) rst_n = 1'b1;
        @(negedge clk);

        // ---- a high line is not yet a qualified idle line ----------------
        drive_ticks(A_TICKS - 1); settle;
        check(a_idle === 1'b0, "one tick short of a frame time: not idle");
        drive_ticks(1); settle;
        check(a_idle === 1'b1, "full frame time of mark: idle asserted");

        // ---- any low clears it immediately, with no tick required --------
        @(negedge clk) rx_sync = 1'b0;
        settle();
        check(a_idle === 1'b0, "a single low clears idle at once");

        // ---- and it must be re-earned in full ----------------------------
        @(negedge clk) rx_sync = 1'b1;
        drive_ticks(A_TICKS - 1); settle;
        check(a_idle === 1'b0, "re-qualification is not shortened");
        drive_ticks(1); settle;
        check(a_idle === 1'b1, "idle re-earned after a full frame time");

        // ---- saturation: staying high does not wrap it back to not-idle --
        drive_ticks(A_TICKS * 3); settle;
        check(a_idle === 1'b1, "long idle: counter saturates, stays idle");

        // ---- the threshold scales with the parameters --------------------
        @(negedge clk) rx_sync = 1'b0; settle;
        check(a_idle === 1'b0 && b_idle === 1'b0, "both instances cleared");
        @(negedge clk) rx_sync = 1'b1;
        drive_ticks(B_TICKS); settle;
        check(b_idle === 1'b1, "8x/7-bit qualifies at 56 ticks");
        check(a_idle === 1'b0, "16x/10-bit has NOT qualified yet");
        drive_ticks(A_TICKS - B_TICKS); settle;
        check(a_idle === 1'b1, "16x/10-bit qualifies at 160 ticks");

        // ---- a busy line never qualifies ---------------------------------
        // Alternating mark and space, as a live link looks, must never reach
        // a full frame time of continuous mark.
        @(negedge clk) rx_sync = 1'b0; settle;
        begin : busy_line
            int j;
            for (j = 0; j < 20; j = j + 1) begin
                @(negedge clk) rx_sync = 1'b1;
                drive_ticks(20);
                @(negedge clk) rx_sync = 1'b0;
                drive_ticks(4);
            end
        end
        settle();
        check(a_idle === 1'b0, "a busy line never qualifies as idle");

        // ---- reset while qualified ---------------------------------------
        @(negedge clk) rx_sync = 1'b1;
        drive_ticks(A_TICKS); settle;
        check(a_idle === 1'b1, "idle before reset");
        @(negedge clk) rst_n = 1'b0;
        repeat (2) @(negedge clk);
        check(a_idle === 1'b0, "reset drops idle -- it must be re-earned");
        @(negedge clk) rst_n = 1'b1;
        @(negedge clk);

        $display("== %0d checks, %0d failures ==", checks, failures);
        if (failures == 0) $display("   RESULT: ALL SYSTEMVERILOG IDLE-QUALIFY TESTS PASSED");
        else               $display("   RESULT: SYSTEMVERILOG IDLE-QUALIFY TESTS FAILED");
        $finish;
    end
endmodule

--==========================================================================
--  tb_uart_idle_qualify -- self-checking VHDL-2008 testbench
--  Same 14 checks as the Verilog and SystemVerilog testbenches.
--==========================================================================
library ieee;
use ieee.std_logic_1164.all;
use std.env.finish;

entity tb_uart_idle_qualify is
end entity tb_uart_idle_qualify;

architecture sim of tb_uart_idle_qualify is
    constant CLK_PERIOD : time    := 10 ns;
    constant A_TICKS    : natural := 160;
    constant B_TICKS    : natural := 56;
    signal clk, rst_n, done : std_logic := '0';
    signal os_tick : std_logic := '0';
    signal rx_sync : std_logic := '1';
    signal a_idle, b_idle : std_logic;
begin
    clk <= not clk after CLK_PERIOD / 2 when done = '0' else '0';

    dut_a : entity work.uart_idle_qualify
        generic map (OVERSAMPLE => 16, FRAME_BITS => 10)
        port map (clk, rst_n, os_tick, rx_sync, a_idle);
    dut_b : entity work.uart_idle_qualify
        generic map (OVERSAMPLE => 8, FRAME_BITS => 7)
        port map (clk, rst_n, os_tick, rx_sync, b_idle);

    watchdog : process
    begin
        wait for 4 ms;
        report "watchdog: simulation did not finish" severity error;
        report "   RESULT: VHDL IDLE-QUALIFY TESTS FAILED (timeout)" severity failure;
        wait;
    end process watchdog;

    stim : process
        variable checks, failures : natural := 0;
        procedure check(cond : boolean; name : string) is
        begin
            checks := checks + 1;
            if cond then report "  PASS " & name;
            else failures := failures + 1; report "  FAIL " & name severity error; end if;
        end procedure;
        procedure drive_ticks(n : natural) is
        begin
            for k in 1 to n loop
                wait until falling_edge(clk); os_tick <= '1';
                wait until falling_edge(clk); os_tick <= '0';
                wait until falling_edge(clk);
            end loop;
        end procedure;
        procedure settle is
        begin
            for i in 0 to 1 loop wait until falling_edge(clk); end loop;
        end procedure;
    begin
        report "== uart_idle_qualify (VHDL) : self-checking testbench ==";
        rst_n <= '0'; rx_sync <= '1';
        for i in 0 to 3 loop wait until falling_edge(clk); end loop;
        check(a_idle = '0', "reset: NOT idle -- idle must be earned");
        rst_n <= '1'; wait until falling_edge(clk);

        drive_ticks(A_TICKS - 1); settle;
        check(a_idle = '0', "one tick short of a frame time: not idle");
        drive_ticks(1); settle;
        check(a_idle = '1', "full frame time of mark: idle asserted");

        wait until falling_edge(clk); rx_sync <= '0'; settle;
        check(a_idle = '0', "a single low clears idle at once");

        wait until falling_edge(clk); rx_sync <= '1';
        drive_ticks(A_TICKS - 1); settle;
        check(a_idle = '0', "re-qualification is not shortened");
        drive_ticks(1); settle;
        check(a_idle = '1', "idle re-earned after a full frame time");

        drive_ticks(A_TICKS * 3); settle;
        check(a_idle = '1', "long idle: counter saturates, stays idle");

        wait until falling_edge(clk); rx_sync <= '0'; settle;
        check(a_idle = '0' and b_idle = '0', "both instances cleared");
        wait until falling_edge(clk); rx_sync <= '1';
        drive_ticks(B_TICKS); settle;
        check(b_idle = '1', "8x/7-bit qualifies at 56 ticks");
        check(a_idle = '0', "16x/10-bit has NOT qualified yet");
        drive_ticks(A_TICKS - B_TICKS); settle;
        check(a_idle = '1', "16x/10-bit qualifies at 160 ticks");

        wait until falling_edge(clk); rx_sync <= '0'; settle;
        for j in 0 to 19 loop
            wait until falling_edge(clk); rx_sync <= '1';
            drive_ticks(20);
            wait until falling_edge(clk); rx_sync <= '0';
            drive_ticks(4);
        end loop;
        settle;
        check(a_idle = '0', "a busy line never qualifies as idle");

        wait until falling_edge(clk); rx_sync <= '1';
        drive_ticks(A_TICKS); settle;
        check(a_idle = '1', "idle before reset");
        wait until falling_edge(clk); rst_n <= '0';
        for i in 0 to 1 loop wait until falling_edge(clk); end loop;
        check(a_idle = '0', "reset drops idle -- it must be re-earned");
        wait until falling_edge(clk); rst_n <= '1';
        wait until falling_edge(clk);

        report "== " & integer'image(checks) & " checks, " &
               integer'image(failures) & " failures ==";
        if failures = 0 then report "   RESULT: ALL VHDL IDLE-QUALIFY TESTS PASSED";
        else report "   RESULT: VHDL IDLE-QUALIFY TESTS FAILED" severity error; end if;
        done <= '1'; finish;
    end process stim;
end architecture sim;

$ iverilog -g2001 -o sim uart_idle_qualify_v.v tb_uart_idle_qualify_v.v && ./sim
== uart_idle_qualify_v : self-checking Verilog testbench ==
  PASS reset: NOT idle -- idle must be earned
  PASS one tick short of a frame time: not idle
  PASS full frame time of mark: idle asserted
  PASS a single low clears idle at once
  PASS re-qualification is not shortened
  PASS long idle: counter saturates, stays idle
  PASS 8x/7-bit qualifies at 56 ticks
  PASS 16x/10-bit has NOT qualified yet
  PASS a busy line never qualifies as idle
  PASS reset drops idle -- it must be re-earned
== 14 checks, 0 failures ==
   RESULT: ALL VERILOG IDLE-QUALIFY TESTS PASSED

reset released mid-frame, no idle detection
-> one fabricated byte (0xFA from a frame carrying 0xA6), status clean
-> subsequent frames correct

// Assertion — idle is never claimed while the line is low.
property p_idle_implies_mark;
    @(posedge clk) disable iff (!rst_n)
        line_idle_o |-> rx_sync_i;
endproperty
assert property (p_idle_implies_mark);

// Assertion — idle cannot be claimed before a full frame time of mark.
property p_no_early_idle;
    @(posedge clk) disable iff (!rst_n)
        $rose(line_idle_o) |-> ($past(mark_cnt_q) == CNT_W'(IDLE_TICKS - 1));
endproperty
assert property (p_no_early_idle);

// Assertion — the counter saturates, matching Chapter 9.4's policy.
property p_idle_counter_saturates;
    @(posedge clk) disable iff (!rst_n)
        mark_cnt_q <= CNT_W'(IDLE_TICKS);
endproperty
assert property (p_idle_counter_saturates);

// Assertion — with idle gating fitted, no start is accepted from a line
// that has not proven itself idle. This is the block's entire purpose.
property p_no_start_without_idle;
    @(posedge clk) disable iff (!rst_n)
        start_accept_o |-> $past(line_idle_o);
endproperty
assert property (p_no_start_without_idle);