SDR Frames and Legacy I2C Coexistence

Read an SDR write and read bit by bit, say who drives each ninth bit, and explain how a legacy I2C target shares the wires without seeing the I3C traffic.

Lesson
P9.2
Time
30 min
Runs on
Your browser
Check
4 questions

A legacy temperature sensor stayed on a new I3C bus because "I3C is backward compatible". It had no 50 ns input filter, so every 12.5 MHz frame reached its START detector and clocked its shift register. MIPI I3C Basic v1.0 names the condition: on a fast mixed bus, legacy targets need a true 50 ns spike filter on SCL (§5.1.2.4).

An SDR Private Write: Pointer 0x10, Then 0x3c and 0x01Lanes: SCL and SDA, then who drives SDA low or high, and the drive style. The target only drives in the ACK slots.
START7e/W (open drain) + ACKSr08/W (push-pull) + ACK10 + T03c + T101 + T0STOP 0123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191SCLSDActrl_lowctrl_hightgt_lowtgt_highdriveodppodppodSASrAT=0T=1T=0PSDA sampled at 6SDA sampled at 10SDA sampled at 14SDA sampled at 18SDA sampled at 22SDA sampled at 26SDA sampled at 30SDA sampled at 34SDA sampled at 38SDA sampled at 46SDA sampled at 50SDA sampled at 54SDA sampled at 58SDA sampled at 62SDA sampled at 66SDA sampled at 70SDA sampled at 74SDA sampled at 78SDA sampled at 82SDA sampled at 86SDA sampled at 90SDA sampled at 94SDA sampled at 98SDA sampled at 102SDA sampled at 106SDA sampled at 110SDA sampled at 114SDA sampled at 118SDA sampled at 122SDA sampled at 126SDA sampled at 130SDA sampled at 134SDA sampled at 138SDA sampled at 142SDA sampled at 146SDA sampled at 150SDA sampled at 154SDA sampled at 158SDA sampled at 162SDA sampled at 166SDA sampled at 170SDA sampled at 174SDA sampled at 178SDA sampled at 182SDA sampled at 186
Read phases and sample points (quarter bit)
  • START: columns 2 through 3.
  • 7e/W (open drain) + ACK: columns 4 through 39.
  • Sr: columns 40 through 43.
  • 08/W (push-pull) + ACK: columns 44 through 79.
  • 10 + T0: columns 80 through 115.
  • 3c + T1: columns 116 through 151.
  • 01 + T0: columns 152 through 187.
  • STOP: columns 188 through 191.
  • SDA sampled at 6, 10, 14, 18, 22, 26, 30, 34, 38, 46, 50, 54, 58, 62, 66, 70, 74, 78, 82, 86, 90, 94, 98, 102, 106, 110, 114, 118, 122, 126, 130, 134, 138, 142, 146, 150, 154, 158, 162, 166, 170, 174, 178, 182, 186.
  1. Cycle 78

    Header ACK: the target pulls SDA in open drain, exactly as in I2C.

  2. Cycle 79

    Handoff: the controller pulls SDA low just after the SCL rise, while the target lets go. Both low for a moment is safe (MIPI §5.1.2.3.1).

  3. Cycle 114

    Ninth bit of 0x10: the controller drives the parity, XOR(data, 1) = 0. The target drives nothing.

  4. Cycle 150

    Ninth bit of 0x3c: four 1s, so parity 1. Still the controller, still push-pull.

The private write form that opens with 7E (MIPI Annex A, Figure 47). Generated and decoded back; the bench printed I3C S 7e W A Sr 08 W A 10 T0 3c T1 01 T0 P. Parity: 0x10 and 0x01 have one 1 each, so T = 0; 0x3c has four, so T = 1.

The Header Is I2C's

Seven address bits, R/W and an ACK: the same bits as I2C (MIPI §5.1.2.2, Figure 9). A frame normally opens with the broadcast address 7E in open drain, then addresses one target after Sr in push-pull. I3C targets answer only 7E and their own dynamic address (§5.1.2.1).

An SDR Read of Two Bytes: The Target Ends ItAfter the pointer write and Sr, the target drives data in push-pull and uses the ninth bit to say whether more follows.
START7e/W (open drain) + ACKSr08/W (push-pull) + ACK10 + T0Sr08/R (push-pull) + ACK10 + T111 + T0STOP 0123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231SCLSDActrl_lowctrl_hightgt_lowtgt_highdriveodppodppodppodppodSASrAT=0SrAT=1 moreT=0 endPSDA sampled at 6SDA sampled at 10SDA sampled at 14SDA sampled at 18SDA sampled at 22SDA sampled at 26SDA sampled at 30SDA sampled at 34SDA sampled at 38SDA sampled at 46SDA sampled at 50SDA sampled at 54SDA sampled at 58SDA sampled at 62SDA sampled at 66SDA sampled at 70SDA sampled at 74SDA sampled at 78SDA sampled at 82SDA sampled at 86SDA sampled at 90SDA sampled at 94SDA sampled at 98SDA sampled at 102SDA sampled at 106SDA sampled at 110SDA sampled at 114SDA sampled at 122SDA sampled at 126SDA sampled at 130SDA sampled at 134SDA sampled at 138SDA sampled at 142SDA sampled at 146SDA sampled at 150SDA sampled at 154SDA sampled at 158SDA sampled at 162SDA sampled at 166SDA sampled at 170SDA sampled at 174SDA sampled at 178SDA sampled at 182SDA sampled at 186SDA sampled at 190SDA sampled at 194SDA sampled at 198SDA sampled at 202SDA sampled at 206SDA sampled at 210SDA sampled at 214SDA sampled at 218SDA sampled at 222SDA sampled at 226
Read phases and sample points (quarter bit)
  • START: columns 2 through 3.
  • 7e/W (open drain) + ACK: columns 4 through 39.
  • Sr: columns 40 through 43.
  • 08/W (push-pull) + ACK: columns 44 through 79.
  • 10 + T0: columns 80 through 115.
  • Sr: columns 116 through 119.
  • 08/R (push-pull) + ACK: columns 120 through 155.
  • 10 + T1: columns 156 through 191.
  • 11 + T0: columns 192 through 227.
  • STOP: columns 228 through 231.
  • SDA sampled at 6, 10, 14, 18, 22, 26, 30, 34, 38, 46, 50, 54, 58, 62, 66, 70, 74, 78, 82, 86, 90, 94, 98, 102, 106, 110, 114, 122, 126, 130, 134, 138, 142, 146, 150, 154, 158, 162, 166, 170, 174, 178, 182, 186, 190, 194, 198, 202, 206, 210, 214, 218, 222, 226.
  1. Cycle 190

    T = 1: the target drives SDA high, then lets go at the SCL rise. The keeper holds it high; the controller lets the next byte come (§5.1.2.3.4).

  2. Cycle 226

    T = 0: the target has no more data. It drives low, the controller overlaps low after the rise, then makes STOP or Sr.

Generated and decoded back; with target1.max_read = 2 the bench printed I3C S 7e W A Sr 08 W A 10 T0 Sr 08 R A 10 T1 11 T0 P.

The Ninth Bit of Data

I2C byte (UM10204)SDR write wordSDR read word
Ninth bitACK or NACKparity T = XOR(data, 1)T: 1 more, 0 end
Driven bythe receiverthe controllerthe target
Drive styleopen drainpush-pullpush-pull, released at the SCL rise
Measured bit time2500 ns (Fm)80 ns80 ns
Who ends a readcontroller (NACK)n/atarget (T = 0), or controller abort (Sr after T = 1)

MIPI I3C Basic v1.0 §5.1.2.3 and its sub-sections. In I2C the receiver speaks in the ninth bit; in SDR data the transmitter does. The bit times are SCL periods measured during an I3C and an I2C read.

A controller may also stop a read early: after a T = 1 it pulls SDA low while SCL is high, which is a repeated START. With target1.max_read = 4 and two bytes wanted the bench prints I3C S 7e W A Sr 08 W A 10 T0 Sr 08 R A 10 T1 11 T1 Sr P.

The Legacy Neighbour

What the Legacy Target SeesThe same SCL wire, before and after a 50 ns spike filter.
What the legacy target seesThe same SCL wire, before and after a 50 ns spike filter. component I2C message SCL high 1200 ns(Fm) component I3C message SCL high 40 ns(SDR) component 50 ns filter drops shorter pulses component 50 ns filter drops shorter pulses component Clocks the target decodesthe byte component SCL looks low no bits, nothing toanswer
  1. Fm passes

    An I2C clock high lasts far longer than 50 ns, so the legacy target sees every bit (MIPI Table 57).

  2. SDR does not

    On a mixed fast bus the I3C SCL high stays under tDIG_H_MIXED, 45 ns at most (Table 59), and never gets through.

Read the diagram as text
  • I2C message: SCL high 1200 ns (Fm)
  • I3C message: SCL high 40 ns (SDR)
  • 50 ns filter: drops shorter pulses
  • 50 ns filter: drops shorter pulses
  • Clocks: the target decodes the byte
  • SCL looks low: no bits, nothing to answer
  • I2C message → 50 ns filter
  • 50 ns filter → Clocks
  • I3C message → 50 ns filter
  • 50 ns filter → SCL looks low

MIPI I3C Basic v1.0 §5.1.2.4 and Figure 45. The bench models the filter as a 50 ns inertial delay on SCL and SDA.

Legacy target on the I3C benchDuring two I3C framesIts register after an I2C write of 0x3c
50 ns spike filter (default)6 STARTs, 4 SCL clocks, 0 SDA pulls0x3c
legacy.no_spike_filter = 15 STARTs, 86 SCL clocks, 0 SDA pulls0x3c

Measured. The filter is an inertial delay of 50 ns on SCL and SDA (UM10204 Table 10 tSP; MIPI Table 57 tSPIKE). It swallows every 40 ns I3C SCL high. What gets through are a few edges near each repeated START and STOP, never eight clocks in a row, so never a byte. Neither version ever pulls SDA, because no I3C header carries 0x50.

The legacy target is P8's register target behind the filter. It is addressed in I2C mode at Fm timing (MIPI Table 57) and wrote 0x3c as asked: I2C S 50 W A 20 A 3c A P. In the I3C frames the SCL high lasts 40 ns, under tDIG_H_MIXED, so the filter hides it (Table 59).

Two Habits from I2C

TwinMeasured
legacy.legacy_stretches = 1: the legacy target stretches SCL after its ACKI3C CHECK legacy_no_stretch at 70456 then x on SCL at 71706 then I2C S 50 W A 20 NA 3c NA P then I3C CHECK legacy_no_stretch at 141856 then I2C S 50 W A 20 NA 50 NA bf NA P then legacy register 0x20 = 7f
target1.t_bit_wrong = 1: an I3C target ACKs the ninth bit of each word it receivesI3C CHECK no_pp_contention at 51852 then x on SDA at 51852 then I3C CHECK t_bit at 51886 then I3C S 7e W A Sr 08 W A 10 T0 3c Tx P then I3C S 7e W A Sr 08 W A 10 T0 Sr 08 R A 10 T0 P then register 0x10 = 10, target1 parity errors 1

Measured. A legacy target may not stretch SCL on an I3C bus (MIPI Table 56). The controller drives SCL push-pull, so the stretch fights it: SCL itself goes to x, the write is lost and the read returns garbage. The T-bit ACK collides only when parity is 1.

The ACK habit hides on 0x10, whose parity is 0, and shows on 0x3c. The target sees x in its own parity bit, counts an error and drops the rest of the message, as error type S2 says (§5.1.10.1.3). Register 0x10 keeps its old value.

Try It

The write stores 0x3c in register 0x10. The read starts at 0x10 again; target1.max_read = 2 makes the target return two bytes and end with T = 0 on the second.

Set target1.max_read = 1 and the target ends after one byte with T = 0, although the controller asked for two: the second byte is never read and prints as xx.

RUNIcarus Verilog · in your browser
Edit the code, then run it
Expected: I3C S 7e W A Sr 08 W A 10 T0 3c T1 P I3C S 7e W A Sr 08 W A 10 T0 Sr 08 R A 3c T1 11 T0 P read 3c 11
Read included file: i3c_ctrl.sv
`timescale 1ns/1ns
// I3C controller (v1.0: Master), SDR. Task calls drive the pins; SCL is push-pull and driven by this device
// alone (§5.1.2). SDA is open drain in the arbitrable header after S, in every ACK slot and in DAA; push-pull
// in the header after Sr and in write data (§5.1.2.2, §5.1.2.3, §5.1.4.2).
module i3c_ctrl(inout wire scl,sda,output reg sda_low=0,sda_high=0);
 parameter time PP_LOW=40,PP_HIGH=40,OD_LOW=200,OD_HIGH=40,HOLD=5,T_CAS=40,TBUF=1300,
                FM_LOW=1300,FM_HIGH=1200,FM_HOLD=100,FM_SETUP=600,T_MMOVERLAP=220;
 // START_AS_CONTROLLER = 0: a secondary controller's controller half, SCL released until a handoff (§5.1.6.3).
 parameter START_AS_CONTROLLER=1;
 // Fault switches.
 bit pp_too_early=0,od_always=0,directed_as_broadcast=0;
 // Policy and an error injector: flip_mask flips bits of the next written word on the wire (noise);
 // the T-bit is still the parity of the intended byte.
 bit ibi_accept=1,hj_accept=1,trace=0;reg [7:0] flip_mask=0;
 // Mastership: accept requests from secondary controllers; this device's own dynamic address for DEFSLVS.
 // Clock stalling (§5.1.2.5.1): extra SCL low in the next header ACK slot, at most 100 µs (Table 11).
 bit mr_accept=1,mr_seen=0,handed_over=0,scl_en=START_AS_CONTROLLER;reg [6:0] mr_addr=0,own_da=7'h20;
 int stall_ack_ns=0;time ext_low=0;reg [6:0] leg_addr=0;reg [7:0] leg_lvr=0;
 // State.
 reg scl_out=1;bit active=0,sr_done=0,lost=0,serviced=0,hj_seen=0,daa_error=0,legacy=0;time stopped=0;
 reg [6:0] req_addr=0;bit req_rw=0;logic [7:0] mdb;logic tbit;
 int daa_count=0,daa_expect=0,ibis=0;reg [6:0] daa_next=7'h08;
 reg [6:0] daa_addr[0:7];reg [47:0] daa_pid[0:7];reg [7:0] daa_bcr[0:7],daa_dcr[0:7];
 reg [7:0] wbuf[0:7];logic [7:0] rbuf[0:7];int rcount=0;
 assign scl=scl_en?scl_out:1'bz;assign sda=sda_low?1'b0:sda_high?1'b1:1'bz;
 localparam PP=0,OD=1,FM=2,REL=0,DRV_OD=1,DRV_PP=2;
 task automatic set_sda(input int how,input logic v);
  if(how==REL)begin sda_low=0;sda_high=0;end else if(how==DRV_OD)begin sda_low=!v;sda_high=0;end else begin sda_low=!v;sda_high=v;end
 endtask
 // One SCL pulse; SCL is low on entry and on exit. post: 0 nothing; 1 pull SDA low just after the rise
 // when the sample is 0 (ACK to write data handoff, §5.1.2.3.1); 2 release 12 ns after the rise (IBI ACK
 // to mandatory byte handoff, §5.1.2.3.2).
 task automatic clock(input int speed,input int how,input logic v,input int post,output logic s);
  time lo,hi,hd;lo=speed==FM?FM_LOW:speed==OD?OD_LOW:PP_LOW;hi=speed==FM?FM_HIGH:speed==OD?OD_HIGH:PP_HIGH;hd=speed==FM?FM_HOLD:HOLD;
  #(hd);set_sda(how,v);#(lo-hd+ext_low);ext_low=0;scl_out=1;#1;s=sda;
  if(post==1&&s===1'b0)begin sda_low=1;sda_high=0;end
  if(post==2)begin #11;sda_low=0;#(hi-12);end else #(hi-1);
  scl_out=0;
 endtask
 // Next free dynamic address, skipping the reserved values of Table 9.
 function automatic [6:0] next_free(input [6:0] a);
  reg [6:0] n;n=a+1;while(n==7'h3e||n==7'h5e||n==7'h6e||n==7'h76||n==7'h7a||n==7'h7c||n>=7'h7e)n=n+1;next_free=n;
 endfunction
 function automatic [7:0] bcr_of(input [6:0] a);
  bcr_of=0;for(int i=0;i<daa_count;i++)if(daa_addr[i]==a)bcr_of=daa_bcr[i];
 endfunction
 function automatic bit known(input [6:0] a);
  known=0;for(int i=0;i<daa_count;i++)if(daa_addr[i]==a)known=1;
 endfunction
 task automatic start();
  if(stopped>0&&$time-stopped<TBUF)#(TBUF-($time-stopped));
  serviced=0;lost=0;sr_done=0;legacy=0;
  if(trace&&sda===1'b0)$display("CTRL START request from a target at %0t",$time);
  sda_low=1;sda_high=0;#(T_CAS);scl_out=0;active=1;
 endtask
 // Repeated START. A read abort (T-bit) has already made one: then there is nothing to do.
 task automatic restart(input bit od);
  if(sr_done)sr_done=0;
  else begin
   #(HOLD);if(od)set_sda(REL,1);else set_sda(DRV_PP,1);#((od?OD_LOW:PP_LOW)-HOLD);
   scl_out=1;#(T_CAS/2);sda_low=1;sda_high=0;#(T_CAS);scl_out=0;
  end
 endtask
 task automatic stop();
  sr_done=0;#(legacy?FM_HOLD:HOLD);sda_low=1;sda_high=0;#(legacy?FM_LOW:PP_LOW);
  scl_out=1;#(legacy?FM_SETUP:T_CAS);sda_low=0;sda_high=0;stopped=$time;active=0;legacy=0;#1;
 endtask
 // Read one SDR word: eight data bits and the target's T-bit (§5.1.2.3.4). T = 0 ends the read: the
 // controller overlaps it low after the rise. T = 1 offers more: continue (more = 1) or abort with Sr.
 task automatic read_word(output logic [7:0] d,output logic t,input bit more);
  logic s;
  for(int b=7;b>=0;b--)begin clock(PP,REL,1,0,s);d[b]=s;end
  #(HOLD);set_sda(REL,1);#(PP_LOW-HOLD);scl_out=1;#1;t=sda;
  if(t===1'b0)begin sda_low=1;#(PP_HIGH-1);scl_out=0;end
  else if(more)begin #(PP_HIGH-1);scl_out=0;end
  else begin #9;sda_low=1;#(T_CAS);scl_out=0;sr_done=1;end
 endtask
 // Write one SDR word: eight data bits and the odd-parity T-bit, XOR(data, 1) (§5.1.2.3.3).
 task automatic write_word(input [7:0] d);
  logic s;reg [7:0] w;w=d^flip_mask;flip_mask=0;
  for(int b=7;b>=0;b--)clock(od_always?OD:PP,od_always?DRV_OD:DRV_PP,w[b],0,s);
  clock(od_always?OD:PP,od_always?DRV_OD:DRV_PP,~^d,0,s);
 endtask
 // Address header. arb = 1 after S: open drain, and a target may win it (§5.1.2.2.1). arb = 0 after Sr:
 // push-pull, never arbitrated (§5.1.2.2.4). The ACK slot is always open drain.
 task automatic header(input [6:0] addr,input bit rw,input bit arb,output bit ack);
  reg [7:0] v,seen;logic s;v={addr,rw};lost=0;ack=0;
  for(int b=7;b>=0;b--)begin
   if(arb)begin clock(OD,lost?REL:DRV_OD,v[b],0,s);if(!lost&&v[b]&&s===1'b0)lost=1;end
   else clock(PP,DRV_PP,v[b],0,s);
   seen[b]=(s===1'b1);
  end
  if(!lost)begin
   ext_low=stall_ack_ns;clock(OD,(pp_too_early&&!arb)?DRV_PP:REL,1,rw?0:1,s);ack=(s===1'b0);
  end else begin
   // A target won the header: an In-Band Interrupt (its address, R), a Hot-Join (7'h02, W) or a
   // controller-role request (its address, W) (§5.1.2.2).
   req_addr=seen[7:1];req_rw=seen[0];serviced=1;
   if(req_rw&&ibi_accept&&known(req_addr))begin
    clock(OD,DRV_OD,0,(bcr_of(req_addr)&8'h04)!=0 ? 2 : 0,s);ack=1;ibis++;
    if(bcr_of(req_addr)&8'h04)begin read_word(mdb,tbit,0);if(trace)$display("CTRL IBI from %02h accepted, MDB %02h T%0d",req_addr,mdb,tbit);end
    else if(trace)$display("CTRL IBI from %02h accepted, no MDB (BCR[2] = 0)",req_addr);
   end else if(!req_rw&&req_addr!=7'h02&&mr_accept&&known(req_addr)&&(bcr_of(req_addr)>>6)==2'b01)begin
    // A controller-role request from a secondary controller (BCR[7:6] = 01): ACK, then GETACCMST (§5.1.6.3).
    clock(OD,DRV_OD,0,0,s);ack=1;mr_seen=1;mr_addr=req_addr;if(trace)$display("CTRL controller-role request from %02h accepted",req_addr);
   end else if(!req_rw&&req_addr==7'h02&&hj_accept)begin
    clock(OD,DRV_OD,0,0,s);ack=1;hj_seen=1;if(trace)$display("CTRL Hot-Join request accepted");
   end else begin
    clock(OD,REL,1,0,s);if(trace)$display("CTRL request from %02h %s refused (NACK)",req_addr,req_rw?"R":"W");
   end
  end
 endtask
 // S 7'h7E/W, arbitrable. A request that wins is served first; then 7'h7E/W is sent again after Sr.
 task automatic open_frame(output bit ack);
  start();header(7'h7e,0,1,ack);
  if(serviced)begin restart(0);header(7'h7e,0,0,ack);end
 endtask
 // Broadcast CCC (codes 0x00 to 0x7F): S 7'h7E/W, code, optional byte, P (§5.1.9.1, Figure 21).
 task automatic ccc_broadcast(input [7:0] code,input bit has_data,input [7:0] data);
  bit ack;open_frame(ack);if(ack)begin write_word(code);if(has_data)write_word(data);end stop();
 endtask
 // Direct CCC (codes 0x80 to 0xFE): S 7'h7E/W, code, Sr, address/W, optional byte, P (Figure 22).
 // directed_as_broadcast: sends the broadcast form instead (code with bit 7 clear, the byte, P).
 task automatic ccc_direct(input [7:0] code,input [6:0] addr,input bit has_data,input [7:0] data,output bit ack);
  bit a;open_frame(a);
  if(directed_as_broadcast)begin write_word(code&8'h7f);if(has_data)write_word(data);ack=a;end
  else begin write_word(code);restart(0);header(addr,0,0,ack);if(ack&&has_data)write_word(data);end
  stop();
 endtask
 // Direct GET CCC: S 7'h7E/W, code, Sr, address/R, n bytes into rbuf (the target ends with T = 0).
 task automatic ccc_get(input [7:0] code,input [6:0] addr,input int n,output bit ack);
  bit a;logic t;logic [7:0] rb;open_frame(a);write_word(code);restart(0);header(addr,1,0,ack);rcount=0;
  if(ack)begin t=1;for(int i=0;i<n&&t!==1'b0;i++)begin read_word(rb,t,i<n-1);rbuf[i]=rb;rcount++;end end
  stop();
 endtask
 // Private transfers in the form that starts with 7'h7E (MIPI v1.0 Figure 47): S 7'h7E/W, Sr, address.
 task automatic write_regs(input [6:0] da,input [7:0] ptr,input int n,output bit ack);
  bit a;open_frame(a);restart(0);header(da,0,0,ack);
  if(ack)begin write_word(ptr);for(int i=0;i<n;i++)write_word(wbuf[i]);end
  stop();
 endtask
 task automatic write_reg(input [6:0] da,input [7:0] ptr,input [7:0] d,output bit ack);wbuf[0]=d;write_regs(da,ptr,1,ack);endtask
 // Pointer write, Sr, then read until the target ends (T = 0) or n bytes are in rbuf.
 task automatic read_regs(input [6:0] da,input [7:0] ptr,input int n,output bit ack);
  bit a;logic t;logic [7:0] rb;open_frame(a);restart(0);header(da,0,0,ack);rcount=0;
  if(ack)begin write_word(ptr);restart(0);header(da,1,0,ack);
   if(ack)begin t=1;for(int i=0;i<n&&t!==1'b0;i++)begin read_word(rb,t,i<n-1);rbuf[i]=rb;rcount++;end end
  end
  stop();
 endtask
 task automatic read_reg(input [6:0] da,input [7:0] ptr,output logic [7:0] v);bit ack;rbuf[0]=8'hxx;read_regs(da,ptr,1,ack);v=rbuf[0];endtask
 // Legacy I2C message to a static address at Fm timing (MIPI v1.0 Table 57): open drain, ninth bit = ACK.
 task automatic i2c_start();
  if(stopped>0&&$time-stopped<TBUF)#(TBUF-($time-stopped));
  serviced=0;lost=0;sr_done=0;legacy=1;sda_low=1;sda_high=0;#(FM_SETUP);scl_out=0;active=1;
 endtask
 task automatic i2c_byte(input [7:0] v,output bit ack);logic s;
  for(int b=7;b>=0;b--)clock(FM,DRV_OD,v[b],0,s);clock(FM,REL,1,0,s);ack=(s===1'b0);
 endtask
 task automatic i2c_write(input [6:0] a,input [7:0] ptr,input [7:0] d,output bit ack);
  bit k;i2c_start();i2c_byte({a,1'b0},ack);if(ack)begin i2c_byte(ptr,k);i2c_byte(d,k);end stop();
 endtask
 task automatic i2c_read(input [6:0] a,input [7:0] ptr,output logic [7:0] v);
  bit ack;logic s;i2c_start();i2c_byte({a,1'b0},ack);i2c_byte(ptr,ack);
  #(FM_HOLD);set_sda(REL,1);#(FM_LOW-FM_HOLD);scl_out=1;#(FM_SETUP);sda_low=1;#(FM_SETUP);scl_out=0;
  i2c_byte({a,1'b1},ack);for(int b=7;b>=0;b--)begin clock(FM,REL,1,0,s);v[b]=s;end clock(FM,REL,1,0,s);stop();
 endtask
 // ENTDAA (§5.1.4.2, Figure 19): broadcast 0x07, then rounds of Sr 7'h7E/R (open drain), 64 arbitrated bits
 // (provisional ID, BCR, DCR) from the targets, a 7-bit address plus odd parity from the controller and the
 // winner's ACK. A NACKed address is offered once more; a second NACK ends DAA (§5.1.4.2 notes).
 task automatic entdaa();
  bit ack;open_frame(ack);if(ack)write_word(8'h07);daa_rounds();
 endtask
 task automatic daa_rounds();
  bit ack,a2,retry,done;logic s;reg [63:0] id;reg [7:0] w;
  retry=0;done=0;
  while(!done)begin
   restart(1);header(7'h7e,1,1,ack);
   if(!ack)done=1;
   else begin
    for(int k=63;k>=0;k--)begin clock(OD,REL,1,0,s);id[k]=(s===1'b1);end
    w={daa_next,~^daa_next};
    for(int k=7;k>=0;k--)clock(OD,DRV_OD,w[k],0,s);
    clock(OD,REL,1,0,s);a2=(s===1'b0);
    if(a2)begin
     daa_addr[daa_count]=daa_next;daa_pid[daa_count]=id[63:16];daa_bcr[daa_count]=id[15:8];daa_dcr[daa_count]=id[7:0];
     if(trace)$display("CTRL DAA PID %012h BCR %02h DCR %02h -> %02h",id[63:16],id[15:8],id[7:0],daa_next);
     daa_count++;daa_next=next_free(daa_next);retry=0;
    end else if(!retry)begin retry=1;if(trace)$display("CTRL DAA %02h NACKed, offering it again",daa_next);end
    else begin daa_error=1;done=1;if(trace)$display("CTRL DAA %02h NACKed twice: DAA ends with an error",daa_next);end
   end
  end
  stop();
  if(daa_expect&&daa_count<daa_expect&&trace)$display("CTRL DAA assigned %0d of %0d expected addresses",daa_count,daa_expect);
 endtask
 // Wait for a target's START request on a free bus, then clock it out (§5.1.2.2 condition 2, §5.1.6.2).
 // A Hot-Join is answered with ENTDAA in the same frame (§5.1.5 step 4c).
 task automatic serve_request(input time limit);
  time t0;bit ack;t0=$time;
  while(sda!==1'b0&&$time-t0<limit)#10;
  if(sda===1'b0)begin
   start();header(7'h7e,0,1,ack);
   if(hj_seen)begin hj_seen=0;restart(0);header(7'h7e,0,0,ack);if(ack)write_word(8'h07);daa_rounds();end
   else if(mr_seen)begin mr_seen=0;getaccmst(mr_addr,1,ack);end
   else stop();
  end else if(trace)$display("CTRL no request within %0t ns",limit);
 endtask
 // GETACCMST (0x91, §5.1.9.3.16): a direct GET to a secondary controller, after its request (in the same
 // frame, after Sr) or as an offer. An accepted reply is its own address with a parity bit (the bench uses the
 // odd parity of §5.1.4.2); then STOP, and this controller releases SCL after tMMoverlap (§5.1.6.3, Figure 44).
 // A NACK or a wrong address cancels the handoff (Tables 43, 44).
 task automatic getaccmst(input [6:0] a,input bit in_frame,output bit ok);
  bit ack;logic [7:0] b;logic t;b=8'hxx;
  if(in_frame)begin restart(0);header(7'h7e,0,0,ack);end else open_frame(ack);
  write_word(8'h91);restart(0);header(a,1,0,ack);
  if(ack)read_word(b,t,0);
  ok=ack&&(b==={a,~^a});
  stop();
  if(ok)begin #(T_MMOVERLAP);scl_en=0;handed_over=1;end
  if(trace)begin
   if(!ack)$display("CTRL GETACCMST %02h NACKed: mastership kept",a);
   else if(ok)$display("CTRL GETACCMST %02h replied %02h: SCL released",a,b);
   else $display("CTRL GETACCMST %02h replied %02h, not %02h: mastership kept",a,b,{a,~^a});
  end
 endtask
 // DEFSLVS (0x08, §5.1.9.3.7, Table 30): a count, four bytes for this controller (its address, DCR, BCR, static
 // 7'h7E), then four per target (address<<1, DCR, BCR, static<<1); a legacy target has address 0 and its LVR.
 task automatic defslvs();
  bit ack;open_frame(ack);write_word(8'h08);write_word(daa_count+(leg_addr!=0));
  write_word({own_da,1'b0});write_word(8'h00);write_word(8'h40);write_word({7'h7e,1'b0});
  for(int i=0;i<daa_count;i++)begin write_word({daa_addr[i],1'b0});write_word(daa_dcr[i]);write_word(daa_bcr[i]);write_word(8'h00);end
  if(leg_addr!=0)begin write_word(8'h00);write_word(leg_lvr);write_word(8'h00);write_word({leg_addr,1'b0});end
  stop();
 endtask
 // Learn a target's BCR with GETBCR, for a target given its address by SETAASA or SETDASA (no DAA record).
 task automatic learn(input [6:0] a);bit ack;ccc_get(8'h8e,a,1,ack);
  if(ack)begin daa_addr[daa_count]=a;daa_bcr[daa_count]=rbuf[0];daa_pid[daa_count]=0;daa_dcr[daa_count]=0;daa_count++;end
 endtask
 // ENTHDRx (codes 0x20 to 0x27, Table 15). Basic v1.0 has no HDR mode, so nothing is sent in HDR.
 task automatic hdr_enter(input [2:0] mode);bit ack;open_frame(ack);write_word(8'h20|mode);endtask
 // HDR Exit Pattern (§5.2.1.1, Figure 25): SCL low, SDA falls four times at least tDIG_H apart, then SCL
 // rises and SDA rises: a STOP.
 task automatic hdr_exit();
  #(HOLD);sda_low=0;sda_high=1;#(PP_LOW);
  repeat(3)begin sda_low=1;sda_high=0;#(PP_HIGH);sda_low=0;sda_high=1;#(PP_HIGH);end
  sda_low=1;sda_high=0;#(PP_HIGH);scl_out=1;#(T_CAS);sda_low=0;sda_high=0;stopped=$time;active=0;#1;
 endtask
 // HDR Restart Pattern (§5.2.1.2, Figure 26): SCL low, SDA high, then fall, rise, fall, rise at least tDIG_H
 // apart; the next edge is SCL rising. The bus stays in HDR: a new HDR command would follow.
 task automatic hdr_restart();
  #(HOLD);sda_low=0;sda_high=1;#(PP_LOW);
  repeat(2)begin sda_low=1;sda_high=0;#(PP_HIGH);sda_low=0;sda_high=1;#(PP_HIGH);end
  scl_out=1;#(PP_HIGH);scl_out=0;
 endtask
 // A stand-in for HDR traffic: no HDR coding, only the property of §5.2.2's introduction that SDA may change
 // after either SCL edge. The 16 bits of w go out one per SCL edge, so SDA also changes while SCL is high.
 task automatic hdr_burst(input [15:0] w);
  for(int b=15;b>=0;b--)begin #(HOLD);sda_low=!w[b];sda_high=w[b];#(PP_LOW-HOLD);scl_out=!scl_out;end
  if(scl_out)begin #(PP_LOW);scl_out=0;end
 endtask
 // Error Type M2 recovery: S 7'h7E/W, ACK or NACK ignored, HDR Exit Pattern, STOP (§5.1.10.2.3, §5.1.10.2.4).
 task automatic recover();bit ack;start();header(7'h7e,0,1,ack);hdr_exit();endtask
endmodule
Read included file: i3c_target.sv
`timescale 1ns/1ns
// I3C target (v1.0: Slave), SDR. A register map like the P8 target: mem[i] = i ^ MEM_XOR; a private write's
// first byte is the pointer. It answers 7'h7E and its dynamic address only (§5.1.2.1), takes part in ENTDAA
// while it has no address, raises In-Band Interrupts with a mandatory byte (BCR[2]) and recognises the HDR
// Exit Pattern. HOT_JOIN targets stay silent until hot_join() is called (§5.1.5).
module i3c_target #(parameter [47:0] PID=48'h0,parameter [7:0] BCR=8'h06,DCR=8'h00,parameter [6:0] STATIC_ADDR=7'h00,
  parameter [7:0] MEM_XOR=8'h00,parameter HOT_JOIN=0,parameter time T_AVAL=1000,T_IDLE=200000)
 (inout wire scl,sda,output reg sda_low=0,sda_high=0);
 // Fault switches.
 bit pid_tie_bug=0,addr_parity_wrong=0,ibi_without_mdb=0,misses_hdr_exit=0,t_bit_wrong=0,pp_too_early=0,ibi_loses_and_retries_wrong=0,restart_as_exit=0,accmst_wrong_addr=0;
 // A secondary controller's target half (BCR[7:6] = 01): controller-role request, DEFSLVS list, GETACCMST.
 bit mr_req=0,mr_en=1,accept_mastership=1,accmst_sent=0,became_current=0,my_rw=1;reg [7:0] defs[0:39];int ndefs=0;
 // Activity state (ENTASx, §5.1.3.5) and the protocol-error flag GETSTATUS reports (Table 41).
 reg [1:0] activity=0;bit perr=0;
 // Counters: SDR STARTs acted on, HDR Restart patterns seen while in HDR.
 int sdr_starts=0,hdr_restarts=0;bit poss_restart=0;time requested=0,req_gap=0;   // when, and how long after the bus went free, it last pulled SDA
 // Configuration and state. max_read: bytes returned per private read before T = 0.
 int max_read=1;reg [7:0] mdb=8'ha5;
 reg [6:0] da=0;bit has_da=0,ibi_en=1,hj_en=1,powered=!HOT_JOIN,ibi_req=0,hj_req=0;
 reg [7:0] mem[0:255];reg [7:0] ptr=0;
 int st=0,cnt=0,sent=0,errors=0;reg [8:0] sh=0;reg [63:0] daa_word;reg [7:0] tx;reg [7:0] code=0;
 bit active=0,after_s=0,arb=0,arb_lost=0,lost_this_frame=0,daa_mode=0,direct=0,code_next=0,need_ptr=1,ccc_target=0,self_start=0;
 bit hdr_mode=0,err_exit=0,write_ack_release=0,reading=0,daa_won=0,t_ack=0;int falls=0;reg [6:0] my_hdr;time free_since=0;
 bit was_ibi=0,ibi_more=0,ack_pending=0,daa_hdr=0;
 // st: 0 idle, 1 header, 2 header ACK, 3 write word, 4 read word, 5 ignore until Sr/P, 6 DAA ID, 7 DAA address, 8 DAA ACK
 localparam IDLE=0,HDR=1,HACK=2,WR=3,RD=4,IGN=5,DID=6,DAD=7,DACK=8;
 assign sda=sda_low?1'b0:sda_high?1'b1:1'bz;
 initial for(int i=0;i<256;i++)mem[i]=i[7:0]^MEM_XOR;
 task automatic release_sda();sda_low=0;sda_high=0;endtask
 task automatic raise_ibi();ibi_req=1;endtask
 task automatic request_mastership();mr_req=1;endtask
 task automatic hot_join();powered=1;hj_req=1;free_since=$time;endtask
 function automatic bit bad_addr(input [6:0] a);bad_addr=a==7'h3e||a==7'h5e||a==7'h6e||a==7'h76||a==7'h7a||a==7'h7c||a==7'h7f;endfunction
 // START or Repeated START.
 always @(negedge sda)if(scl===1'b1&&powered&&!hdr_mode&&!err_exit)begin
  after_s=!active;sdr_starts++;
  if(!active)begin daa_mode=0;direct=0;lost_this_frame=0;end
  active=1;st=HDR;cnt=0;sh=0;code_next=0;ccc_target=0;reading=0;was_ibi=0;
  // A request rides only on the header after S (§5.1.2.2); ibi_loses_and_retries_wrong also tries after Sr.
  arb=0;arb_lost=0;
  if(has_da&&ibi_req&&ibi_en&&(after_s||(ibi_loses_and_retries_wrong&&lost_this_frame)))begin arb=1;my_hdr=da;my_rw=1;end
  else if(has_da&&mr_req&&mr_en&&after_s)begin arb=1;my_hdr=da;my_rw=0;end
  else if(hj_req&&hj_en&&after_s)begin arb=1;my_hdr=7'h02;my_rw=0;end
  if(accmst_sent&&!after_s)accmst_sent=0;     // Sr after GETACCMST cancels it (§5.1.9.3.16 step 4)
 end
 // STOP.
 always @(posedge sda)if(scl===1'b1&&powered&&!hdr_mode&&!err_exit&&active)begin
  if(accmst_sent)begin accmst_sent=0;became_current=1;end
  active=0;st=IDLE;daa_mode=0;direct=0;release_sda();free_since=$time;self_start=0;
 end
 // HDR Exit Pattern detector (§5.2.1.3, Figure 27): SDA falls counted while SCL stays low; SCL high resets.
 always @(negedge sda)if((hdr_mode||err_exit)&&scl===1'b0)begin falls++;
  if(falls==4&&!misses_hdr_exit)begin hdr_mode=0;err_exit=0;active=1;st=IGN;falls=0;end
 end
 // Restart (§5.2.1.4): exactly two falls, then an SDA rise, then SCL rises. A Basic target supports no HDR mode,
 // so it notes the Restart and stays in HDR until the Exit; restart_as_exit leaves HDR on it (a fault).
 always @(posedge sda)if((hdr_mode||err_exit)&&scl===1'b0)poss_restart=(falls==2);
 always @(posedge scl)if(hdr_mode||err_exit)begin
  if(poss_restart&&hdr_mode)begin hdr_restarts++;if(restart_as_exit)begin hdr_mode=0;active=1;st=IGN;end end
  poss_restart=0;falls=0;
 end
 // Bus Available (tAVAL) or Bus Idle (tIDLE for Hot-Join): pull SDA low to request a START (§5.1.3, §5.1.5).
 always #10 if(powered&&!active&&!self_start&&scl===1'b1&&sda===1'b1&&!hdr_mode&&!err_exit)begin
  if(has_da&&(ibi_req&&ibi_en||mr_req&&mr_en)&&$time-free_since>=T_AVAL)begin self_start=1;sda_low=1;requested=$time;req_gap=$time-free_since;end
  else if(hj_req&&hj_en&&$time-free_since>=T_IDLE)begin self_start=1;sda_low=1;end
 end
 // Sample on the rising edge.
 always @(posedge scl)if(powered&&active&&!hdr_mode&&!err_exit)begin
  case(st)
  HDR:begin
   sh={sh[7:0],sda};cnt++;
   if(arb&&!arb_lost&&my_bit(cnt-1)&&sda===1'b0)begin arb_lost=1;lost_this_frame=1;end
   if(cnt==8)decode_header();
  end
  HACK:begin
   if(arb&&!arb_lost)begin
    // My request won; the controller ACKs or NACKs it.
    if(sda===1'b0)begin
     if(my_hdr==7'h02)begin hj_req=0;st=IGN;end
     else if(!my_rw)begin mr_req=0;st=IGN;end
     else begin ibi_req=0;was_ibi=1;
      if(BCR[2]&&!ibi_without_mdb)begin #2;sda_low=1;sda_high=0;tx=mdb;st=RD;cnt=0;end else st=IGN;
     end
    end else st=IGN;
    self_start=0;
   end else if(daa_hdr)begin daa_hdr=0;st=DID;cnt=0;daa_word={PID,BCR,DCR};end
   else if(write_ack_release)begin #2;release_sda();write_ack_release=0;end
  end
  WR:begin
   sh={sh[7:0],sda};cnt++;
   if(cnt==9)begin cnt=0;
    if(sh[0]!==~^sh[8:1])begin errors++;
     perr=1;if(code_next)begin err_exit=1;falls=0;st=IGN;end else st=IGN;   // S1: wait for the HDR Exit Pattern; S2: wait for Sr/P
    end else if(code_next)begin code_next=0;do_ccc(sh[8:1]);end
    else if(ccc_target)begin ccc_data(sh[8:1]);end
    else if(need_ptr)begin ptr=sh[8:1];need_ptr=0;end
    else begin mem[ptr]=sh[8:1];ptr=ptr+1;end
   end
  end
  RD:begin
   cnt++;
   if(cnt==9)begin cnt=0;#2;release_sda();
    if(ccc_target&&code==8'h91)accmst_sent=1;   // GETACCMST answered: mastership passes at the STOP
    if(!ibi_more)st=IGN;
   end
  end
  DID:begin
   if(!pid_tie_bug&&daa_word[63-cnt]&&sda===1'b0)begin st=IGN;end   // lost: withdraw until the next Sr
   cnt++;if(cnt==64&&st==DID)begin st=DAD;cnt=0;sh=0;end
  end
  DAD:begin sh={sh[7:0],sda};cnt++;if(cnt==8)begin st=DACK;daa_won=((^sh[7:0])==1'b1)^addr_parity_wrong;end end
  DACK:begin if(daa_won)begin da=sh[7:1];has_da=1;end st=IGN;end
  endcase
 end
 function automatic bit my_bit(input int i);reg [7:0] v;v={my_hdr,my_rw};my_bit=v[7-i];endfunction
 task automatic decode_header();
  reg [6:0] a;bit rw;a=sh[7:1];rw=sh[0];cnt=0;
  if(arb&&!arb_lost)begin st=HACK;end
  else if(a==7'h7e&&!rw)begin st=HACK;sda_ack(1);code_next=1;need_ptr=1;end
  else if(a==7'h7e&&rw&&daa_mode&&!has_da&&!hj_req)begin st=HACK;sda_ack(1);daa_hdr=1;end   // then 64 bits (§5.1.4.2 steps 4 to 8)
  else if(a==7'h7e&&rw&&!daa_mode)begin errors++;err_exit=1;falls=0;st=IGN;end    // S0: 7'h7E/R outside DAA
  else if(daa_mode)begin st=IGN;end                                                  // S4 or already assigned
  else if(direct&&((has_da&&a==da)||(code==8'h87&&STATIC_ADDR!=0&&a==STATIC_ADDR)))begin st=HACK;sda_ack(1);ccc_target=1;reading=rw;
   if(code==8'h86)begin has_da=0;da=0;end
   if(code>=8'h82&&code<=8'h85)activity=code-8'h82;
   if(code==8'h91&&(BCR[7:6]!=2'b01||!accept_mastership))begin ack_pending=0;st=IGN;ccc_target=0;end end
  else if(has_da&&a==da)begin st=HACK;sda_ack(1);reading=rw;need_ptr=!rw;end
  else if(bad_addr(a)&&!rw)begin errors++;err_exit=1;falls=0;st=IGN;end              // S0: broken 7'h7E/W
  else st=IGN;
 endtask
 task automatic sda_ack(input bit a);ack_pending=a;endtask
 // Drive 6 ns after the falling edge, one after the controller's 5 ns hold, so no handoff overlaps a 1 and a 0.
 always @(negedge scl)if(powered&&active&&!hdr_mode&&!err_exit)begin
  #6;
  case(st)
  HDR:begin
   if(arb&&!arb_lost)begin
    if(pp_too_early)begin sda_low=!my_bit(cnt);sda_high=my_bit(cnt);end else begin sda_low=!my_bit(cnt);sda_high=0;end
   end else if(arb&&arb_lost)release_sda();
  end
  HACK:begin
   if(arb&&!arb_lost)release_sda();
   else if(ack_pending)begin sda_low=1;sda_high=0;ack_pending=0;
    // Write: release just after the rise (handoff, §5.1.2.3.1). Read: keep low, then send data.
    if(!reading)write_ack_release=1;
   end else if(reading)begin
    st=RD;cnt=0;ibi_more=0;
    if(ccc_target)begin tx=ccc_reply(0);end else begin tx=mem[ptr];ptr=ptr+1;end
    sent=0;drive_bit(tx[7]);
   end else begin
    st=WR;cnt=0;sh=0;
   end
  end
  WR:begin
   release_sda();
   if(cnt==8&&t_bit_wrong&&!code_next&&!ccc_target)sda_low=1;   // the I2C habit: ACK the ninth bit, hold it until SCL falls
  end
  RD:begin
   if(cnt<8)drive_bit(tx[7-cnt]);
   else begin
    // T-bit: 1 = more data (continue), 0 = end of data.
    sent++;ibi_more=was_ibi?0:(ccc_target?ccc_more(sent):sent<max_read);
    sda_low=!ibi_more;sda_high=ibi_more;
   end
  end
  DID:begin sda_low=!daa_word[63-cnt];sda_high=0;end
  DAD:release_sda();
  DACK:begin sda_low=daa_won;sda_high=0;end
  IGN:release_sda();
  endcase
 end
 task automatic drive_bit(input bit v);sda_low=!v;sda_high=v;endtask
 // After a T = 1 the controller either lets the next byte come or pulls SDA low (Sr = abort).
 always @(negedge scl)if(powered&&active&&st==RD&&cnt==0&&ibi_more)begin
  if(sda===1'b0)st=IGN;
  else begin if(ccc_target)tx=ccc_reply(sent);else begin tx=mem[ptr];ptr=ptr+1;end end
 end
 task automatic do_ccc(input [7:0] c);
  code=c;direct=c[7];
  if(c==8'h07)daa_mode=1;
  else if(c==8'h06)begin has_da=0;da=0;end
  else if(c==8'h29&&STATIC_ADDR!=0&&!has_da)begin da=STATIC_ADDR;has_da=1;end
  else if(c>=8'h20&&c<=8'h27)begin hdr_mode=1;falls=0;active=0;st=IDLE;end
  else if(c==8'h00||c==8'h01)begin ccc_target=1;end     // event byte follows
  else if(c>=8'h02&&c<=8'h05)activity=c-8'h02;
  else if(c==8'h08&&BCR[7:6]==2'b01)begin ccc_target=1;ndefs=0;end   // DEFSLVS: only secondary controllers keep it
 endtask
 task automatic ccc_data(input [7:0] d);
  if(code==8'h00||code==8'h80)begin if(d[0])ibi_en=1;if(d[1])mr_en=1;if(d[3])hj_en=1;end
  else if(code==8'h01||code==8'h81)begin if(d[0])ibi_en=0;if(d[1])mr_en=0;if(d[3])hj_en=0;end
  else if(code==8'h08)begin if(ndefs<40)defs[ndefs]=d;ndefs++;end
  else if(code==8'h87||code==8'h88)begin da=d[7:1];has_da=1;end
 endtask
 function automatic [7:0] ccc_reply(input int i);
  case(code)
   8'h8d:ccc_reply=PID>>(8*(5-i));
   8'h8e:ccc_reply=BCR;
   8'h8f:ccc_reply=DCR;
   8'h90:begin ccc_reply=i==0?8'h00:{activity,perr,5'b0};if(i==1)perr=0;end   // GETSTATUS MSB, LSB (Table 41)
   8'h91:ccc_reply={da^{6'b0,accmst_wrong_addr},~^da};
   default:ccc_reply=8'hff;
  endcase
 endfunction
 function automatic bit ccc_more(input int n);ccc_more=(code==8'h8d)?n<6:(code==8'h90)?n<2:0;endfunction
endmodule
Read included file: i3c_hdr_detect.sv
`timescale 1ns/1ns
module i3c_hdr_detect(input wire scl,sda,in_hdr);
 bit misses_restart=0,restart_as_exit=0;int restarts=0,exits=0,falls=0;bit poss=0;
 always @(negedge sda)if(in_hdr&&scl===1'b0)begin falls++;if(falls==4)exits++;end
 always @(posedge sda)if(in_hdr&&scl===1'b0)poss=(falls==2);
 always @(posedge scl)begin
  if(in_hdr&&poss&&!misses_restart)begin if(restart_as_exit)exits++;else restarts++;end
  poss=0;falls=0;
 end
endmodule
Read included file: i3c_secondary.sv
`timescale 1ns/1ns
module i3c_secondary #(parameter [47:0] PID=48'h0,parameter [7:0] BCR=8'h46,DCR=8'h00)
 (inout wire scl,sda,output wire tgt_low,tgt_high,ctl_low,ctl_high);
 bit takes_scl_early=0;
 i3c_target #(.PID(PID),.BCR(BCR),.DCR(DCR)) tgt(scl,sda,tgt_low,tgt_high);
 i3c_ctrl #(.START_AS_CONTROLLER(0)) ctl(scl,sda,ctl_low,ctl_high);
 always @(posedge tgt.accmst_sent)if(takes_scl_early)ctl.scl_en=1;
 always @(posedge tgt.became_current)begin
  #12;ctl.scl_en=1;ctl.stopped=$time;ctl.daa_count=0;ctl.own_da=tgt.da;
  for(int g=5;g+3<tgt.ndefs&&g+3<40;g+=4)if(tgt.defs[g]!=0&&tgt.defs[g][7:1]!=tgt.da)begin
   ctl.daa_addr[ctl.daa_count]=tgt.defs[g][7:1];ctl.daa_dcr[ctl.daa_count]=tgt.defs[g+1];ctl.daa_bcr[ctl.daa_count]=tgt.defs[g+2];ctl.daa_count++;
  end
 end
endmodule
Read included file: i2c_legacy.sv
`timescale 1ns/1ns
module i2c_legacy #(parameter [6:0] ADDRESS=7'h50,parameter time FILTER=50,STRETCH=3000)
 (inout wire scl,sda,output wire scl_low,sda_low);
 bit no_spike_filter=0,legacy_stretches=0;int starts=0,clocks=0,pulls=0;
 wire scl_f,sda_f;assign #(FILTER) scl_f=scl;assign #(FILTER) sda_f=sda;
 tri1 lscl,lsda;wire hd;
 assign lscl=((no_spike_filter?scl:scl_f)===1'b0)?1'b0:1'bz;
 assign lsda=((no_spike_filter?sda:sda_f)===1'b0)?1'b0:1'bz;
 i2c_target #(.ADDRESS({3'b000,ADDRESS})) dev(lscl,lsda,scl_low,sda_low,hd);
 assign scl=scl_low?1'b0:1'bz;assign sda=sda_low?1'b0:1'bz;
 always @(legacy_stretches)dev.stretch_ns=legacy_stretches?STRETCH:0;
 always @(negedge lsda)if(lscl===1'b1)starts++;
 always @(posedge lscl)clocks++;
 always @(posedge sda_low)pulls++;
endmodule
Read included file: i2c_target.sv
`timescale 1ns/1ns
module i2c_target #(parameter [9:0] ADDRESS=10'h050,parameter TEN_BIT=0)
 (inout wire scl,sda,output reg scl_low=0,sda_low=0,output wire high_drive);
 bit ack_not_released=0,ack_wrong_clock=0,stretch_never_released=0,wrong_addr_ack=0,no_stop_detect=0,autoinc_wrap_bug=0,push_pull_target=0,ignores_sr=0;
 // Legal receiver responses, not faults. rx_limit counts post-address bytes,
 // including the pointer byte; -1 is unlimited. A busy address is declined once.
 bit busy_nack=0;int rx_limit=-1,rx_count=0;
 // Optional general-call software reset: UM10204 §§3.1.13–14. This model
 // restores mem[i]=i and ptr=0; ADDRESS is fixed, not a programmable register.
 // Fault switches and bench configuration are not device reset state.
 time stretch_ns=0;bit general_call=1,software_reset=1,general_selected=0,reset_pending=0;int resets=0;
 reg [7:0] mem[0:255];reg [7:0] ptr=0,shift=0,tx=0;
 int state=0,count=0,bytes=0;bit active=0,selected=0,reading=0,need_ptr=1,ack_value=0,ack_active=0,low_addr_next=0,addressed10=0,reading_ack=0;
 // state: 0 receive, 1 receiver ACK, 2 transmit, 3 controller ACK, 4 ignore.
 assign high_drive=push_pull_target&&!sda_low;
 assign sda=sda_low?1'b0:high_drive?1'b1:1'bz;assign scl=scl_low?1'b0:1'bz;
 initial for(int i=0;i<256;i++)mem[i]=i[7:0];
 function automatic [7:0] increment(input reg [7:0] p);increment=autoinc_wrap_bug?((p+1)&8'h0f):p+1'b1;endfunction
 always @(negedge sda)if(scl===1)begin
  if(!(ignores_sr&&active))begin active=1;selected=0;state=0;count=0;bytes=0;rx_count=0;shift=0;reading=0;ack_active=0;sda_low=0;low_addr_next=0;general_selected=0;reset_pending=0;end
 end
 always @(posedge sda)if(scl===1&&active&&!no_stop_detect)begin active=0;selected=0;state=0;count=0;sda_low=0;addressed10=0;end
 always @(posedge scl)if(active)begin
  if(state==0)begin
   shift={shift[6:0],sda};count++;
   if(count==8)begin
    ack_value=0;
    if(bytes==0)begin
      reading=shift[0];
      general_selected=general_call&&shift==0;
      if(general_selected)begin selected=1;low_addr_next=0;end
      else if(TEN_BIT)begin selected=(shift[7:3]==5'b11110&&shift[2:1]==ADDRESS[9:8]&&(!reading||addressed10));low_addr_next=!reading;end
      else selected=(shift[7:1]==ADDRESS[6:0]||(wrong_addr_ack&&shift[7:1]==ADDRESS[6:0]+1'b1));
      if(selected&&busy_nack)begin selected=0;busy_nack=0;end
      ack_value=selected;need_ptr=1;
    end else if(low_addr_next)begin selected=selected&&shift==ADDRESS[7:0];ack_value=selected;addressed10=selected;low_addr_next=0;end
    else if(selected)begin
      ack_value=rx_limit<0||rx_count<rx_limit;
      if(general_selected)begin
       // Unsupported general-call commands are NACKed, never register writes.
       ack_value=ack_value&&bytes==1&&software_reset&&shift==8'h06;
       reset_pending=ack_value;
      end else if(ack_value)begin rx_count++;if(need_ptr)begin ptr=shift;need_ptr=0;end else begin mem[ptr]=shift;ptr=increment(ptr);end end
      if(!ack_value)selected=0;
    end
    bytes++;state=1;ack_active=0;count=0;
   end
  end else if(state==2)begin count++;if(count==8)begin state=3;count=0;reading_ack=0;end end
  else if(state==3&&reading_ack)begin if(sda===0)begin ptr=increment(ptr);tx=mem[ptr];state=2;count=0;end else state=4;end
 end
 always @(negedge scl)if(active)begin
  // Deliberate early-ACK fault: after seven samples, pull for clock 8.
  // The address prefix is already known; its R/W bit has not arrived yet.
  if(state==0&&count==7&&ack_wrong_clock)begin
   if(bytes==0)sda_low=!busy_nack&&((general_call&&shift[6:0]==0)||(TEN_BIT?(shift[6:2]==5'b11110&&shift[1:0]==ADDRESS[9:8]):(shift[6:0]==ADDRESS[6:0]||(wrong_addr_ack&&shift[6:0]==ADDRESS[6:0]+1'b1))));
   else sda_low=selected&&(rx_limit<0||rx_count<rx_limit);
  end else if(state==1)begin
   if(!ack_active)begin
    sda_low=ack_value&&!ack_wrong_clock;ack_active=1;
   end else begin
    sda_low=ack_not_released&&ack_value;ack_active=0;
    if(reset_pending)begin
     // Finish the ninth ACK clock before resetting and releasing the bus.
     for(int i=0;i<256;i++)mem[i]=i[7:0];
     ptr=0;shift=0;tx=0;count=0;bytes=0;rx_count=0;need_ptr=1;
     selected=0;reading=0;reading_ack=0;low_addr_next=0;addressed10=0;
     general_selected=0;reset_pending=0;resets++;sda_low=0;scl_low=0;state=4;
    end else if(!selected)state=4;
    else if(reading)begin state=2;tx=mem[ptr];count=0;sda_low=!tx[7];end
    else state=0;
    // Byte-level stretch after the ACK, as in UM10204 §3.1.9. Prepare
    // outgoing data before releasing SCL; overlap the controller's LOW.
    if(selected&&ack_value&&(stretch_ns>0||stretch_never_released))begin scl_low=1;if(!stretch_never_released)begin #(stretch_ns);scl_low=0;end end
   end
  end else if(state==2)sda_low=!tx[7-count];
  else if(state==3)begin sda_low=0;reading_ack=1;end
  else if(state==4)sda_low=0;
 end
endmodule
Read included file: i3c_mon.sv
`timescale 1ns/1ns
// Bus decoder: one line per frame, from SCL and SDA only. The ninth bit is an ACK after an address and a
// T-bit after a data word (§5.1.2.3); frames to the legacy address are decoded as I2C. phase (an output
// the checker reads): 0 idle, 1 header after S, 2 header after Sr, 3 ACK, 4 write word, 5 read word,
// 6 DAA ID, 7 DAA address, 8 DAA ACK, 9 HDR, 10 I2C byte, 11 I2C ACK, 12 waiting for Sr or P.
module i3c_mon #(parameter [6:0] LEGACY=7'h50)(input wire scl,sda,output reg [3:0] phase=0);
 bit trace=0,active=0,daa=0,hdr=0,legacy=0,code_next=0;int cnt=0,frames=0,starts=0,exits=0,falls=0;
 reg [63:0] sh=0;reg [6:0] addr=0;bit rw=0;string text="";
 always @(negedge sda)if(scl===1'b1&&!hdr)begin
  if(active)text={text," Sr"};else begin text=" S";daa=0;legacy=0;end
  phase=active?2:1;active=1;cnt=0;sh=0;starts++;code_next=0;
 end
 always @(posedge sda)if(scl===1'b1&&active&&!hdr)begin
  text={text," P"};if(trace)$display("%s%s",legacy?"I2C":"I3C",text);text="";active=0;phase=0;frames++;
 end
 // HDR Exit Pattern: four SDA falls while SCL stays low (§5.2.1.1). Seen in or out of HDR (M2 recovery).
 always @(negedge sda)if(scl===1'b0&&(hdr||active))begin falls++;if(falls==4)begin hdr=0;falls=0;text={text," EXIT"};exits++;phase=12;end end
 bit poss=0;int restarts=0;
 always @(posedge sda)if(scl===1'b0&&hdr)poss=(falls==2);
 always @(posedge scl)begin if(hdr&&poss)begin text={text," RESTART"};restarts++;end poss=0;falls=0;end
 always @(posedge scl)if(active&&!hdr)begin
  sh={sh[62:0],sda};cnt++;
  case(phase)
  1,2:if(cnt==8)begin addr=sh[7:1];rw=sh[0];cnt=0;
     if(phase==1&&addr==LEGACY)legacy=1;
     text={text,$sformatf(" %02h %s",addr,rw?"R":"W")};phase=legacy?11:3;end
  3:begin cnt=0;text={text,sda===1'b0 ? " A" : sda===1'b1 ? " NA" : " A=x"};
     if(sda!==1'b0)phase=12;
     else if(daa&&addr==7'h7e&&rw)phase=6;
     else if(!rw)begin phase=4;code_next=(addr==7'h7e);end
     else phase=5;
    end
  4,5:if(cnt==9)begin cnt=0;text={text,$sformatf(" %02h T%0d",sh[8:1],sh[0])};
     if(phase==4&&code_next)begin code_next=0;
      if(sh[8:1]==8'h07)daa=1;
      if(sh[8:1]>=8'h20&&sh[8:1]<=8'h27)begin hdr=1;falls=0;phase=9;text={text," HDR"};end
     end
     if(phase==5&&sh[0]===1'b0)phase=12;
    end
  6:if(cnt==64)begin cnt=0;text={text,$sformatf(" id %012h bcr %02h dcr %02h",sh[63:16],sh[15:8],sh[7:0])};phase=7;end
  7:if(cnt==8)begin cnt=0;text={text,$sformatf(" da %02h par %0d",sh[7:1],sh[0])};phase=8;end
  8:begin cnt=0;text={text,sda===1'b0 ? " A" : sda===1'b1 ? " NA" : " A=x"};phase=12;end
  10:if(cnt==8)begin cnt=0;text={text,$sformatf(" %02h",sh[7:0])};phase=11;end
  11:begin cnt=0;text={text,sda===1'b0 ? " A" : sda===1'b1 ? " NA" : " A=x"};phase=10;end
  default:cnt=0;
  endcase
 end
endmodule
Read included file: i3c_checker.sv
`timescale 1ns/1ns
// Wire rules with the driver view. Index 0 of lows/highs is the controller; the others are targets.
// Each rule prints at most once per frame (S to P) and counts every time it fires.
//  no_pp_contention   one device drives SDA high while another pulls it low (§5.1.2.3: handoffs are specified)
//  od_in_header       a device drives SDA high in the arbitrable header after S or its ACK (§5.1.2.2.1)
//  pp_in_data         the controller sends a 1 in a write word without driving it high (§5.1.2: data is push-pull)
//  t_bit              the ninth bit of a write word is not XOR(data, 1) (§5.1.2.3.3)
//  ibi_mdb_present    no target drives the byte after an accepted header after S with R (BCR[2] = 1, §5.1.6.2)
//  legacy_no_stretch  a legacy target pulls SCL low (MIPI v1.0 Table 56: no clock stretching on I3C)
module i3c_checker #(parameter N=4)(input wire scl,sda,input wire [N-1:0] lows,highs,input wire [3:0] phase,input wire legacy_scl_low);
 int broken=0,contention=0,od_header=0,pp_data=0,tbit=0,mdb=0,stretch=0;bit quiet=0;   // quiet: count, do not print
 reg [5:0] said=0;reg [3:0] ph=0,prev=0;reg [8:0] w=0;int k=0,hk=0,mk=0;bit arb_ack=0,hdr_rw=0,mdb_seen=0,mdb_watch=0,viol=0;
 task automatic bad(input int i,input string rule);broken++;if(!said[i]&&!quiet)$display("I3C CHECK %s at %0t",rule,$time);said[i]=1;endtask
 always @(negedge sda)if(scl===1'b1)begin k=0;viol=0;end
 always @(posedge sda)if(scl===1'b1)said=0;
 always @(negedge scl)begin prev=ph;ph=phase;if(ph!=prev)begin k=0;hk=0;end
  if(ph!=prev&&ph==3)arb_ack=(prev==1);
  if(ph==5&&prev==3&&arb_ack&&hdr_rw)begin mdb_watch=1;mdb_seen=0;mk=0;end
 end
 always @(lows or highs)begin #1;if(|lows&&|highs)begin contention++;bad(0,"no_pp_contention");end end
 always @(posedge scl)begin
  if((ph==1||(ph==3&&arb_ack))&&|highs)begin od_header++;bad(1,"od_in_header");end
  if(ph==1)begin hk++;if(hk==8)hdr_rw=(sda===1'b1);end
  if(ph==4)begin k++;w={w[7:0],sda};
   if(k<=8&&sda===1'b1&&!highs[0])viol=1;
   if(k==9)begin if(viol)begin pp_data++;bad(2,"pp_in_data");end if(w[0]!==~^w[8:1])begin tbit++;bad(3,"t_bit");end k=0;viol=0;end
  end
  if(mdb_watch)begin mk++;if(|lows[N-1:1]|||highs[N-1:1])mdb_seen=1;
   if(mk==8)begin mdb_watch=0;if(!mdb_seen)begin mdb++;bad(4,"ibi_mdb_present");end end
  end
 end
 always @(posedge legacy_scl_low)begin stretch++;bad(5,"legacy_no_stretch");end
 // A missing mandatory byte turns the controller's handoff release into a STOP inside the ACK slot.
 always @(posedge sda)if(scl===1'b1&&ph==3&&arb_ack&&hdr_rw)begin mdb++;bad(4,"ibi_mdb_present");end
endmodule

Check Yourself

Predict the outputBench defaults with target1.t_bit_wrong = 1. ctrl.write_reg(7'h08, 8'h10, 8'h01, ack) writes pointer 0x10 and data 0x01. The program prints ck.broken, the checker's count. What does it print?
`timescale 1ns/1ns
module tb;
  tri1 scl, sda;                     // tri1: the pull-up and high-keeper of MIPI v1.0 §5.1.3.1
  wire c_low, c_high;                // driver view: the controller pulls SDA low / drives it high
  wire t1_low, t1_high, t2_low, t2_high;   // the same for each I3C target
  wire l_low, l_scl;                 // the legacy I2C target pulls SDA / SCL low
  wire [3:0] phase;                  // the decoder's frame phase, read by the checker
  bit ack; logic [7:0] value;
  i3c_ctrl    ctrl(scl, sda, c_low, c_high);
  i3c_target  #(.PID(48'h02aa01230000)) target1(scl, sda, t1_low, t1_high);
  i3c_target  #(.PID(48'h02aa01231000)) target2(scl, sda, t2_low, t2_high);
  i2c_legacy  #(.ADDRESS(7'h50)) legacy(scl, sda, l_scl, l_low);   // P8's target behind a 50 ns filter
  i3c_mon     mon(scl, sda, phase);                              // prints I3C S 7e W A ... P
  i3c_checker #(.N(4)) ck(scl, sda, {l_low, t2_low, t1_low, c_low}, {1'b0, t2_high, t1_high, c_high}, phase, l_scl);   // prints I3C CHECK <rule>
  initial begin
    ctrl.daa_expect = 2;
    ctrl.entdaa();                   // setup: dynamic addresses from 0x08 in PID order
    ck.quiet = 1;      // one printed line: the answer
    #2000;
    target1.t_bit_wrong = 1;
    ctrl.write_reg(7'h08, 8'h10, 8'h01, ack);
    $display("%0d", ck.broken);
    #2000; $finish;
  end
  initial begin #3000000; $fatal(1, "I3C watchdog"); end
endmodule
Read included file: i3c_ctrl.sv
`timescale 1ns/1ns
// I3C controller (v1.0: Master), SDR. Task calls drive the pins; SCL is push-pull and driven by this device
// alone (§5.1.2). SDA is open drain in the arbitrable header after S, in every ACK slot and in DAA; push-pull
// in the header after Sr and in write data (§5.1.2.2, §5.1.2.3, §5.1.4.2).
module i3c_ctrl(inout wire scl,sda,output reg sda_low=0,sda_high=0);
 parameter time PP_LOW=40,PP_HIGH=40,OD_LOW=200,OD_HIGH=40,HOLD=5,T_CAS=40,TBUF=1300,
                FM_LOW=1300,FM_HIGH=1200,FM_HOLD=100,FM_SETUP=600,T_MMOVERLAP=220;
 // START_AS_CONTROLLER = 0: a secondary controller's controller half, SCL released until a handoff (§5.1.6.3).
 parameter START_AS_CONTROLLER=1;
 // Fault switches.
 bit pp_too_early=0,od_always=0,directed_as_broadcast=0;
 // Policy and an error injector: flip_mask flips bits of the next written word on the wire (noise);
 // the T-bit is still the parity of the intended byte.
 bit ibi_accept=1,hj_accept=1,trace=0;reg [7:0] flip_mask=0;
 // Mastership: accept requests from secondary controllers; this device's own dynamic address for DEFSLVS.
 // Clock stalling (§5.1.2.5.1): extra SCL low in the next header ACK slot, at most 100 µs (Table 11).
 bit mr_accept=1,mr_seen=0,handed_over=0,scl_en=START_AS_CONTROLLER;reg [6:0] mr_addr=0,own_da=7'h20;
 int stall_ack_ns=0;time ext_low=0;reg [6:0] leg_addr=0;reg [7:0] leg_lvr=0;
 // State.
 reg scl_out=1;bit active=0,sr_done=0,lost=0,serviced=0,hj_seen=0,daa_error=0,legacy=0;time stopped=0;
 reg [6:0] req_addr=0;bit req_rw=0;logic [7:0] mdb;logic tbit;
 int daa_count=0,daa_expect=0,ibis=0;reg [6:0] daa_next=7'h08;
 reg [6:0] daa_addr[0:7];reg [47:0] daa_pid[0:7];reg [7:0] daa_bcr[0:7],daa_dcr[0:7];
 reg [7:0] wbuf[0:7];logic [7:0] rbuf[0:7];int rcount=0;
 assign scl=scl_en?scl_out:1'bz;assign sda=sda_low?1'b0:sda_high?1'b1:1'bz;
 localparam PP=0,OD=1,FM=2,REL=0,DRV_OD=1,DRV_PP=2;
 task automatic set_sda(input int how,input logic v);
  if(how==REL)begin sda_low=0;sda_high=0;end else if(how==DRV_OD)begin sda_low=!v;sda_high=0;end else begin sda_low=!v;sda_high=v;end
 endtask
 // One SCL pulse; SCL is low on entry and on exit. post: 0 nothing; 1 pull SDA low just after the rise
 // when the sample is 0 (ACK to write data handoff, §5.1.2.3.1); 2 release 12 ns after the rise (IBI ACK
 // to mandatory byte handoff, §5.1.2.3.2).
 task automatic clock(input int speed,input int how,input logic v,input int post,output logic s);
  time lo,hi,hd;lo=speed==FM?FM_LOW:speed==OD?OD_LOW:PP_LOW;hi=speed==FM?FM_HIGH:speed==OD?OD_HIGH:PP_HIGH;hd=speed==FM?FM_HOLD:HOLD;
  #(hd);set_sda(how,v);#(lo-hd+ext_low);ext_low=0;scl_out=1;#1;s=sda;
  if(post==1&&s===1'b0)begin sda_low=1;sda_high=0;end
  if(post==2)begin #11;sda_low=0;#(hi-12);end else #(hi-1);
  scl_out=0;
 endtask
 // Next free dynamic address, skipping the reserved values of Table 9.
 function automatic [6:0] next_free(input [6:0] a);
  reg [6:0] n;n=a+1;while(n==7'h3e||n==7'h5e||n==7'h6e||n==7'h76||n==7'h7a||n==7'h7c||n>=7'h7e)n=n+1;next_free=n;
 endfunction
 function automatic [7:0] bcr_of(input [6:0] a);
  bcr_of=0;for(int i=0;i<daa_count;i++)if(daa_addr[i]==a)bcr_of=daa_bcr[i];
 endfunction
 function automatic bit known(input [6:0] a);
  known=0;for(int i=0;i<daa_count;i++)if(daa_addr[i]==a)known=1;
 endfunction
 task automatic start();
  if(stopped>0&&$time-stopped<TBUF)#(TBUF-($time-stopped));
  serviced=0;lost=0;sr_done=0;legacy=0;
  if(trace&&sda===1'b0)$display("CTRL START request from a target at %0t",$time);
  sda_low=1;sda_high=0;#(T_CAS);scl_out=0;active=1;
 endtask
 // Repeated START. A read abort (T-bit) has already made one: then there is nothing to do.
 task automatic restart(input bit od);
  if(sr_done)sr_done=0;
  else begin
   #(HOLD);if(od)set_sda(REL,1);else set_sda(DRV_PP,1);#((od?OD_LOW:PP_LOW)-HOLD);
   scl_out=1;#(T_CAS/2);sda_low=1;sda_high=0;#(T_CAS);scl_out=0;
  end
 endtask
 task automatic stop();
  sr_done=0;#(legacy?FM_HOLD:HOLD);sda_low=1;sda_high=0;#(legacy?FM_LOW:PP_LOW);
  scl_out=1;#(legacy?FM_SETUP:T_CAS);sda_low=0;sda_high=0;stopped=$time;active=0;legacy=0;#1;
 endtask
 // Read one SDR word: eight data bits and the target's T-bit (§5.1.2.3.4). T = 0 ends the read: the
 // controller overlaps it low after the rise. T = 1 offers more: continue (more = 1) or abort with Sr.
 task automatic read_word(output logic [7:0] d,output logic t,input bit more);
  logic s;
  for(int b=7;b>=0;b--)begin clock(PP,REL,1,0,s);d[b]=s;end
  #(HOLD);set_sda(REL,1);#(PP_LOW-HOLD);scl_out=1;#1;t=sda;
  if(t===1'b0)begin sda_low=1;#(PP_HIGH-1);scl_out=0;end
  else if(more)begin #(PP_HIGH-1);scl_out=0;end
  else begin #9;sda_low=1;#(T_CAS);scl_out=0;sr_done=1;end
 endtask
 // Write one SDR word: eight data bits and the odd-parity T-bit, XOR(data, 1) (§5.1.2.3.3).
 task automatic write_word(input [7:0] d);
  logic s;reg [7:0] w;w=d^flip_mask;flip_mask=0;
  for(int b=7;b>=0;b--)clock(od_always?OD:PP,od_always?DRV_OD:DRV_PP,w[b],0,s);
  clock(od_always?OD:PP,od_always?DRV_OD:DRV_PP,~^d,0,s);
 endtask
 // Address header. arb = 1 after S: open drain, and a target may win it (§5.1.2.2.1). arb = 0 after Sr:
 // push-pull, never arbitrated (§5.1.2.2.4). The ACK slot is always open drain.
 task automatic header(input [6:0] addr,input bit rw,input bit arb,output bit ack);
  reg [7:0] v,seen;logic s;v={addr,rw};lost=0;ack=0;
  for(int b=7;b>=0;b--)begin
   if(arb)begin clock(OD,lost?REL:DRV_OD,v[b],0,s);if(!lost&&v[b]&&s===1'b0)lost=1;end
   else clock(PP,DRV_PP,v[b],0,s);
   seen[b]=(s===1'b1);
  end
  if(!lost)begin
   ext_low=stall_ack_ns;clock(OD,(pp_too_early&&!arb)?DRV_PP:REL,1,rw?0:1,s);ack=(s===1'b0);
  end else begin
   // A target won the header: an In-Band Interrupt (its address, R), a Hot-Join (7'h02, W) or a
   // controller-role request (its address, W) (§5.1.2.2).
   req_addr=seen[7:1];req_rw=seen[0];serviced=1;
   if(req_rw&&ibi_accept&&known(req_addr))begin
    clock(OD,DRV_OD,0,(bcr_of(req_addr)&8'h04)!=0 ? 2 : 0,s);ack=1;ibis++;
    if(bcr_of(req_addr)&8'h04)begin read_word(mdb,tbit,0);if(trace)$display("CTRL IBI from %02h accepted, MDB %02h T%0d",req_addr,mdb,tbit);end
    else if(trace)$display("CTRL IBI from %02h accepted, no MDB (BCR[2] = 0)",req_addr);
   end else if(!req_rw&&req_addr!=7'h02&&mr_accept&&known(req_addr)&&(bcr_of(req_addr)>>6)==2'b01)begin
    // A controller-role request from a secondary controller (BCR[7:6] = 01): ACK, then GETACCMST (§5.1.6.3).
    clock(OD,DRV_OD,0,0,s);ack=1;mr_seen=1;mr_addr=req_addr;if(trace)$display("CTRL controller-role request from %02h accepted",req_addr);
   end else if(!req_rw&&req_addr==7'h02&&hj_accept)begin
    clock(OD,DRV_OD,0,0,s);ack=1;hj_seen=1;if(trace)$display("CTRL Hot-Join request accepted");
   end else begin
    clock(OD,REL,1,0,s);if(trace)$display("CTRL request from %02h %s refused (NACK)",req_addr,req_rw?"R":"W");
   end
  end
 endtask
 // S 7'h7E/W, arbitrable. A request that wins is served first; then 7'h7E/W is sent again after Sr.
 task automatic open_frame(output bit ack);
  start();header(7'h7e,0,1,ack);
  if(serviced)begin restart(0);header(7'h7e,0,0,ack);end
 endtask
 // Broadcast CCC (codes 0x00 to 0x7F): S 7'h7E/W, code, optional byte, P (§5.1.9.1, Figure 21).
 task automatic ccc_broadcast(input [7:0] code,input bit has_data,input [7:0] data);
  bit ack;open_frame(ack);if(ack)begin write_word(code);if(has_data)write_word(data);end stop();
 endtask
 // Direct CCC (codes 0x80 to 0xFE): S 7'h7E/W, code, Sr, address/W, optional byte, P (Figure 22).
 // directed_as_broadcast: sends the broadcast form instead (code with bit 7 clear, the byte, P).
 task automatic ccc_direct(input [7:0] code,input [6:0] addr,input bit has_data,input [7:0] data,output bit ack);
  bit a;open_frame(a);
  if(directed_as_broadcast)begin write_word(code&8'h7f);if(has_data)write_word(data);ack=a;end
  else begin write_word(code);restart(0);header(addr,0,0,ack);if(ack&&has_data)write_word(data);end
  stop();
 endtask
 // Direct GET CCC: S 7'h7E/W, code, Sr, address/R, n bytes into rbuf (the target ends with T = 0).
 task automatic ccc_get(input [7:0] code,input [6:0] addr,input int n,output bit ack);
  bit a;logic t;logic [7:0] rb;open_frame(a);write_word(code);restart(0);header(addr,1,0,ack);rcount=0;
  if(ack)begin t=1;for(int i=0;i<n&&t!==1'b0;i++)begin read_word(rb,t,i<n-1);rbuf[i]=rb;rcount++;end end
  stop();
 endtask
 // Private transfers in the form that starts with 7'h7E (MIPI v1.0 Figure 47): S 7'h7E/W, Sr, address.
 task automatic write_regs(input [6:0] da,input [7:0] ptr,input int n,output bit ack);
  bit a;open_frame(a);restart(0);header(da,0,0,ack);
  if(ack)begin write_word(ptr);for(int i=0;i<n;i++)write_word(wbuf[i]);end
  stop();
 endtask
 task automatic write_reg(input [6:0] da,input [7:0] ptr,input [7:0] d,output bit ack);wbuf[0]=d;write_regs(da,ptr,1,ack);endtask
 // Pointer write, Sr, then read until the target ends (T = 0) or n bytes are in rbuf.
 task automatic read_regs(input [6:0] da,input [7:0] ptr,input int n,output bit ack);
  bit a;logic t;logic [7:0] rb;open_frame(a);restart(0);header(da,0,0,ack);rcount=0;
  if(ack)begin write_word(ptr);restart(0);header(da,1,0,ack);
   if(ack)begin t=1;for(int i=0;i<n&&t!==1'b0;i++)begin read_word(rb,t,i<n-1);rbuf[i]=rb;rcount++;end end
  end
  stop();
 endtask
 task automatic read_reg(input [6:0] da,input [7:0] ptr,output logic [7:0] v);bit ack;rbuf[0]=8'hxx;read_regs(da,ptr,1,ack);v=rbuf[0];endtask
 // Legacy I2C message to a static address at Fm timing (MIPI v1.0 Table 57): open drain, ninth bit = ACK.
 task automatic i2c_start();
  if(stopped>0&&$time-stopped<TBUF)#(TBUF-($time-stopped));
  serviced=0;lost=0;sr_done=0;legacy=1;sda_low=1;sda_high=0;#(FM_SETUP);scl_out=0;active=1;
 endtask
 task automatic i2c_byte(input [7:0] v,output bit ack);logic s;
  for(int b=7;b>=0;b--)clock(FM,DRV_OD,v[b],0,s);clock(FM,REL,1,0,s);ack=(s===1'b0);
 endtask
 task automatic i2c_write(input [6:0] a,input [7:0] ptr,input [7:0] d,output bit ack);
  bit k;i2c_start();i2c_byte({a,1'b0},ack);if(ack)begin i2c_byte(ptr,k);i2c_byte(d,k);end stop();
 endtask
 task automatic i2c_read(input [6:0] a,input [7:0] ptr,output logic [7:0] v);
  bit ack;logic s;i2c_start();i2c_byte({a,1'b0},ack);i2c_byte(ptr,ack);
  #(FM_HOLD);set_sda(REL,1);#(FM_LOW-FM_HOLD);scl_out=1;#(FM_SETUP);sda_low=1;#(FM_SETUP);scl_out=0;
  i2c_byte({a,1'b1},ack);for(int b=7;b>=0;b--)begin clock(FM,REL,1,0,s);v[b]=s;end clock(FM,REL,1,0,s);stop();
 endtask
 // ENTDAA (§5.1.4.2, Figure 19): broadcast 0x07, then rounds of Sr 7'h7E/R (open drain), 64 arbitrated bits
 // (provisional ID, BCR, DCR) from the targets, a 7-bit address plus odd parity from the controller and the
 // winner's ACK. A NACKed address is offered once more; a second NACK ends DAA (§5.1.4.2 notes).
 task automatic entdaa();
  bit ack;open_frame(ack);if(ack)write_word(8'h07);daa_rounds();
 endtask
 task automatic daa_rounds();
  bit ack,a2,retry,done;logic s;reg [63:0] id;reg [7:0] w;
  retry=0;done=0;
  while(!done)begin
   restart(1);header(7'h7e,1,1,ack);
   if(!ack)done=1;
   else begin
    for(int k=63;k>=0;k--)begin clock(OD,REL,1,0,s);id[k]=(s===1'b1);end
    w={daa_next,~^daa_next};
    for(int k=7;k>=0;k--)clock(OD,DRV_OD,w[k],0,s);
    clock(OD,REL,1,0,s);a2=(s===1'b0);
    if(a2)begin
     daa_addr[daa_count]=daa_next;daa_pid[daa_count]=id[63:16];daa_bcr[daa_count]=id[15:8];daa_dcr[daa_count]=id[7:0];
     if(trace)$display("CTRL DAA PID %012h BCR %02h DCR %02h -> %02h",id[63:16],id[15:8],id[7:0],daa_next);
     daa_count++;daa_next=next_free(daa_next);retry=0;
    end else if(!retry)begin retry=1;if(trace)$display("CTRL DAA %02h NACKed, offering it again",daa_next);end
    else begin daa_error=1;done=1;if(trace)$display("CTRL DAA %02h NACKed twice: DAA ends with an error",daa_next);end
   end
  end
  stop();
  if(daa_expect&&daa_count<daa_expect&&trace)$display("CTRL DAA assigned %0d of %0d expected addresses",daa_count,daa_expect);
 endtask
 // Wait for a target's START request on a free bus, then clock it out (§5.1.2.2 condition 2, §5.1.6.2).
 // A Hot-Join is answered with ENTDAA in the same frame (§5.1.5 step 4c).
 task automatic serve_request(input time limit);
  time t0;bit ack;t0=$time;
  while(sda!==1'b0&&$time-t0<limit)#10;
  if(sda===1'b0)begin
   start();header(7'h7e,0,1,ack);
   if(hj_seen)begin hj_seen=0;restart(0);header(7'h7e,0,0,ack);if(ack)write_word(8'h07);daa_rounds();end
   else if(mr_seen)begin mr_seen=0;getaccmst(mr_addr,1,ack);end
   else stop();
  end else if(trace)$display("CTRL no request within %0t ns",limit);
 endtask
 // GETACCMST (0x91, §5.1.9.3.16): a direct GET to a secondary controller, after its request (in the same
 // frame, after Sr) or as an offer. An accepted reply is its own address with a parity bit (the bench uses the
 // odd parity of §5.1.4.2); then STOP, and this controller releases SCL after tMMoverlap (§5.1.6.3, Figure 44).
 // A NACK or a wrong address cancels the handoff (Tables 43, 44).
 task automatic getaccmst(input [6:0] a,input bit in_frame,output bit ok);
  bit ack;logic [7:0] b;logic t;b=8'hxx;
  if(in_frame)begin restart(0);header(7'h7e,0,0,ack);end else open_frame(ack);
  write_word(8'h91);restart(0);header(a,1,0,ack);
  if(ack)read_word(b,t,0);
  ok=ack&&(b==={a,~^a});
  stop();
  if(ok)begin #(T_MMOVERLAP);scl_en=0;handed_over=1;end
  if(trace)begin
   if(!ack)$display("CTRL GETACCMST %02h NACKed: mastership kept",a);
   else if(ok)$display("CTRL GETACCMST %02h replied %02h: SCL released",a,b);
   else $display("CTRL GETACCMST %02h replied %02h, not %02h: mastership kept",a,b,{a,~^a});
  end
 endtask
 // DEFSLVS (0x08, §5.1.9.3.7, Table 30): a count, four bytes for this controller (its address, DCR, BCR, static
 // 7'h7E), then four per target (address<<1, DCR, BCR, static<<1); a legacy target has address 0 and its LVR.
 task automatic defslvs();
  bit ack;open_frame(ack);write_word(8'h08);write_word(daa_count+(leg_addr!=0));
  write_word({own_da,1'b0});write_word(8'h00);write_word(8'h40);write_word({7'h7e,1'b0});
  for(int i=0;i<daa_count;i++)begin write_word({daa_addr[i],1'b0});write_word(daa_dcr[i]);write_word(daa_bcr[i]);write_word(8'h00);end
  if(leg_addr!=0)begin write_word(8'h00);write_word(leg_lvr);write_word(8'h00);write_word({leg_addr,1'b0});end
  stop();
 endtask
 // Learn a target's BCR with GETBCR, for a target given its address by SETAASA or SETDASA (no DAA record).
 task automatic learn(input [6:0] a);bit ack;ccc_get(8'h8e,a,1,ack);
  if(ack)begin daa_addr[daa_count]=a;daa_bcr[daa_count]=rbuf[0];daa_pid[daa_count]=0;daa_dcr[daa_count]=0;daa_count++;end
 endtask
 // ENTHDRx (codes 0x20 to 0x27, Table 15). Basic v1.0 has no HDR mode, so nothing is sent in HDR.
 task automatic hdr_enter(input [2:0] mode);bit ack;open_frame(ack);write_word(8'h20|mode);endtask
 // HDR Exit Pattern (§5.2.1.1, Figure 25): SCL low, SDA falls four times at least tDIG_H apart, then SCL
 // rises and SDA rises: a STOP.
 task automatic hdr_exit();
  #(HOLD);sda_low=0;sda_high=1;#(PP_LOW);
  repeat(3)begin sda_low=1;sda_high=0;#(PP_HIGH);sda_low=0;sda_high=1;#(PP_HIGH);end
  sda_low=1;sda_high=0;#(PP_HIGH);scl_out=1;#(T_CAS);sda_low=0;sda_high=0;stopped=$time;active=0;#1;
 endtask
 // HDR Restart Pattern (§5.2.1.2, Figure 26): SCL low, SDA high, then fall, rise, fall, rise at least tDIG_H
 // apart; the next edge is SCL rising. The bus stays in HDR: a new HDR command would follow.
 task automatic hdr_restart();
  #(HOLD);sda_low=0;sda_high=1;#(PP_LOW);
  repeat(2)begin sda_low=1;sda_high=0;#(PP_HIGH);sda_low=0;sda_high=1;#(PP_HIGH);end
  scl_out=1;#(PP_HIGH);scl_out=0;
 endtask
 // A stand-in for HDR traffic: no HDR coding, only the property of §5.2.2's introduction that SDA may change
 // after either SCL edge. The 16 bits of w go out one per SCL edge, so SDA also changes while SCL is high.
 task automatic hdr_burst(input [15:0] w);
  for(int b=15;b>=0;b--)begin #(HOLD);sda_low=!w[b];sda_high=w[b];#(PP_LOW-HOLD);scl_out=!scl_out;end
  if(scl_out)begin #(PP_LOW);scl_out=0;end
 endtask
 // Error Type M2 recovery: S 7'h7E/W, ACK or NACK ignored, HDR Exit Pattern, STOP (§5.1.10.2.3, §5.1.10.2.4).
 task automatic recover();bit ack;start();header(7'h7e,0,1,ack);hdr_exit();endtask
endmodule
Read included file: i3c_target.sv
`timescale 1ns/1ns
// I3C target (v1.0: Slave), SDR. A register map like the P8 target: mem[i] = i ^ MEM_XOR; a private write's
// first byte is the pointer. It answers 7'h7E and its dynamic address only (§5.1.2.1), takes part in ENTDAA
// while it has no address, raises In-Band Interrupts with a mandatory byte (BCR[2]) and recognises the HDR
// Exit Pattern. HOT_JOIN targets stay silent until hot_join() is called (§5.1.5).
module i3c_target #(parameter [47:0] PID=48'h0,parameter [7:0] BCR=8'h06,DCR=8'h00,parameter [6:0] STATIC_ADDR=7'h00,
  parameter [7:0] MEM_XOR=8'h00,parameter HOT_JOIN=0,parameter time T_AVAL=1000,T_IDLE=200000)
 (inout wire scl,sda,output reg sda_low=0,sda_high=0);
 // Fault switches.
 bit pid_tie_bug=0,addr_parity_wrong=0,ibi_without_mdb=0,misses_hdr_exit=0,t_bit_wrong=0,pp_too_early=0,ibi_loses_and_retries_wrong=0,restart_as_exit=0,accmst_wrong_addr=0;
 // A secondary controller's target half (BCR[7:6] = 01): controller-role request, DEFSLVS list, GETACCMST.
 bit mr_req=0,mr_en=1,accept_mastership=1,accmst_sent=0,became_current=0,my_rw=1;reg [7:0] defs[0:39];int ndefs=0;
 // Activity state (ENTASx, §5.1.3.5) and the protocol-error flag GETSTATUS reports (Table 41).
 reg [1:0] activity=0;bit perr=0;
 // Counters: SDR STARTs acted on, HDR Restart patterns seen while in HDR.
 int sdr_starts=0,hdr_restarts=0;bit poss_restart=0;time requested=0,req_gap=0;   // when, and how long after the bus went free, it last pulled SDA
 // Configuration and state. max_read: bytes returned per private read before T = 0.
 int max_read=1;reg [7:0] mdb=8'ha5;
 reg [6:0] da=0;bit has_da=0,ibi_en=1,hj_en=1,powered=!HOT_JOIN,ibi_req=0,hj_req=0;
 reg [7:0] mem[0:255];reg [7:0] ptr=0;
 int st=0,cnt=0,sent=0,errors=0;reg [8:0] sh=0;reg [63:0] daa_word;reg [7:0] tx;reg [7:0] code=0;
 bit active=0,after_s=0,arb=0,arb_lost=0,lost_this_frame=0,daa_mode=0,direct=0,code_next=0,need_ptr=1,ccc_target=0,self_start=0;
 bit hdr_mode=0,err_exit=0,write_ack_release=0,reading=0,daa_won=0,t_ack=0;int falls=0;reg [6:0] my_hdr;time free_since=0;
 bit was_ibi=0,ibi_more=0,ack_pending=0,daa_hdr=0;
 // st: 0 idle, 1 header, 2 header ACK, 3 write word, 4 read word, 5 ignore until Sr/P, 6 DAA ID, 7 DAA address, 8 DAA ACK
 localparam IDLE=0,HDR=1,HACK=2,WR=3,RD=4,IGN=5,DID=6,DAD=7,DACK=8;
 assign sda=sda_low?1'b0:sda_high?1'b1:1'bz;
 initial for(int i=0;i<256;i++)mem[i]=i[7:0]^MEM_XOR;
 task automatic release_sda();sda_low=0;sda_high=0;endtask
 task automatic raise_ibi();ibi_req=1;endtask
 task automatic request_mastership();mr_req=1;endtask
 task automatic hot_join();powered=1;hj_req=1;free_since=$time;endtask
 function automatic bit bad_addr(input [6:0] a);bad_addr=a==7'h3e||a==7'h5e||a==7'h6e||a==7'h76||a==7'h7a||a==7'h7c||a==7'h7f;endfunction
 // START or Repeated START.
 always @(negedge sda)if(scl===1'b1&&powered&&!hdr_mode&&!err_exit)begin
  after_s=!active;sdr_starts++;
  if(!active)begin daa_mode=0;direct=0;lost_this_frame=0;end
  active=1;st=HDR;cnt=0;sh=0;code_next=0;ccc_target=0;reading=0;was_ibi=0;
  // A request rides only on the header after S (§5.1.2.2); ibi_loses_and_retries_wrong also tries after Sr.
  arb=0;arb_lost=0;
  if(has_da&&ibi_req&&ibi_en&&(after_s||(ibi_loses_and_retries_wrong&&lost_this_frame)))begin arb=1;my_hdr=da;my_rw=1;end
  else if(has_da&&mr_req&&mr_en&&after_s)begin arb=1;my_hdr=da;my_rw=0;end
  else if(hj_req&&hj_en&&after_s)begin arb=1;my_hdr=7'h02;my_rw=0;end
  if(accmst_sent&&!after_s)accmst_sent=0;     // Sr after GETACCMST cancels it (§5.1.9.3.16 step 4)
 end
 // STOP.
 always @(posedge sda)if(scl===1'b1&&powered&&!hdr_mode&&!err_exit&&active)begin
  if(accmst_sent)begin accmst_sent=0;became_current=1;end
  active=0;st=IDLE;daa_mode=0;direct=0;release_sda();free_since=$time;self_start=0;
 end
 // HDR Exit Pattern detector (§5.2.1.3, Figure 27): SDA falls counted while SCL stays low; SCL high resets.
 always @(negedge sda)if((hdr_mode||err_exit)&&scl===1'b0)begin falls++;
  if(falls==4&&!misses_hdr_exit)begin hdr_mode=0;err_exit=0;active=1;st=IGN;falls=0;end
 end
 // Restart (§5.2.1.4): exactly two falls, then an SDA rise, then SCL rises. A Basic target supports no HDR mode,
 // so it notes the Restart and stays in HDR until the Exit; restart_as_exit leaves HDR on it (a fault).
 always @(posedge sda)if((hdr_mode||err_exit)&&scl===1'b0)poss_restart=(falls==2);
 always @(posedge scl)if(hdr_mode||err_exit)begin
  if(poss_restart&&hdr_mode)begin hdr_restarts++;if(restart_as_exit)begin hdr_mode=0;active=1;st=IGN;end end
  poss_restart=0;falls=0;
 end
 // Bus Available (tAVAL) or Bus Idle (tIDLE for Hot-Join): pull SDA low to request a START (§5.1.3, §5.1.5).
 always #10 if(powered&&!active&&!self_start&&scl===1'b1&&sda===1'b1&&!hdr_mode&&!err_exit)begin
  if(has_da&&(ibi_req&&ibi_en||mr_req&&mr_en)&&$time-free_since>=T_AVAL)begin self_start=1;sda_low=1;requested=$time;req_gap=$time-free_since;end
  else if(hj_req&&hj_en&&$time-free_since>=T_IDLE)begin self_start=1;sda_low=1;end
 end
 // Sample on the rising edge.
 always @(posedge scl)if(powered&&active&&!hdr_mode&&!err_exit)begin
  case(st)
  HDR:begin
   sh={sh[7:0],sda};cnt++;
   if(arb&&!arb_lost&&my_bit(cnt-1)&&sda===1'b0)begin arb_lost=1;lost_this_frame=1;end
   if(cnt==8)decode_header();
  end
  HACK:begin
   if(arb&&!arb_lost)begin
    // My request won; the controller ACKs or NACKs it.
    if(sda===1'b0)begin
     if(my_hdr==7'h02)begin hj_req=0;st=IGN;end
     else if(!my_rw)begin mr_req=0;st=IGN;end
     else begin ibi_req=0;was_ibi=1;
      if(BCR[2]&&!ibi_without_mdb)begin #2;sda_low=1;sda_high=0;tx=mdb;st=RD;cnt=0;end else st=IGN;
     end
    end else st=IGN;
    self_start=0;
   end else if(daa_hdr)begin daa_hdr=0;st=DID;cnt=0;daa_word={PID,BCR,DCR};end
   else if(write_ack_release)begin #2;release_sda();write_ack_release=0;end
  end
  WR:begin
   sh={sh[7:0],sda};cnt++;
   if(cnt==9)begin cnt=0;
    if(sh[0]!==~^sh[8:1])begin errors++;
     perr=1;if(code_next)begin err_exit=1;falls=0;st=IGN;end else st=IGN;   // S1: wait for the HDR Exit Pattern; S2: wait for Sr/P
    end else if(code_next)begin code_next=0;do_ccc(sh[8:1]);end
    else if(ccc_target)begin ccc_data(sh[8:1]);end
    else if(need_ptr)begin ptr=sh[8:1];need_ptr=0;end
    else begin mem[ptr]=sh[8:1];ptr=ptr+1;end
   end
  end
  RD:begin
   cnt++;
   if(cnt==9)begin cnt=0;#2;release_sda();
    if(ccc_target&&code==8'h91)accmst_sent=1;   // GETACCMST answered: mastership passes at the STOP
    if(!ibi_more)st=IGN;
   end
  end
  DID:begin
   if(!pid_tie_bug&&daa_word[63-cnt]&&sda===1'b0)begin st=IGN;end   // lost: withdraw until the next Sr
   cnt++;if(cnt==64&&st==DID)begin st=DAD;cnt=0;sh=0;end
  end
  DAD:begin sh={sh[7:0],sda};cnt++;if(cnt==8)begin st=DACK;daa_won=((^sh[7:0])==1'b1)^addr_parity_wrong;end end
  DACK:begin if(daa_won)begin da=sh[7:1];has_da=1;end st=IGN;end
  endcase
 end
 function automatic bit my_bit(input int i);reg [7:0] v;v={my_hdr,my_rw};my_bit=v[7-i];endfunction
 task automatic decode_header();
  reg [6:0] a;bit rw;a=sh[7:1];rw=sh[0];cnt=0;
  if(arb&&!arb_lost)begin st=HACK;end
  else if(a==7'h7e&&!rw)begin st=HACK;sda_ack(1);code_next=1;need_ptr=1;end
  else if(a==7'h7e&&rw&&daa_mode&&!has_da&&!hj_req)begin st=HACK;sda_ack(1);daa_hdr=1;end   // then 64 bits (§5.1.4.2 steps 4 to 8)
  else if(a==7'h7e&&rw&&!daa_mode)begin errors++;err_exit=1;falls=0;st=IGN;end    // S0: 7'h7E/R outside DAA
  else if(daa_mode)begin st=IGN;end                                                  // S4 or already assigned
  else if(direct&&((has_da&&a==da)||(code==8'h87&&STATIC_ADDR!=0&&a==STATIC_ADDR)))begin st=HACK;sda_ack(1);ccc_target=1;reading=rw;
   if(code==8'h86)begin has_da=0;da=0;end
   if(code>=8'h82&&code<=8'h85)activity=code-8'h82;
   if(code==8'h91&&(BCR[7:6]!=2'b01||!accept_mastership))begin ack_pending=0;st=IGN;ccc_target=0;end end
  else if(has_da&&a==da)begin st=HACK;sda_ack(1);reading=rw;need_ptr=!rw;end
  else if(bad_addr(a)&&!rw)begin errors++;err_exit=1;falls=0;st=IGN;end              // S0: broken 7'h7E/W
  else st=IGN;
 endtask
 task automatic sda_ack(input bit a);ack_pending=a;endtask
 // Drive 6 ns after the falling edge, one after the controller's 5 ns hold, so no handoff overlaps a 1 and a 0.
 always @(negedge scl)if(powered&&active&&!hdr_mode&&!err_exit)begin
  #6;
  case(st)
  HDR:begin
   if(arb&&!arb_lost)begin
    if(pp_too_early)begin sda_low=!my_bit(cnt);sda_high=my_bit(cnt);end else begin sda_low=!my_bit(cnt);sda_high=0;end
   end else if(arb&&arb_lost)release_sda();
  end
  HACK:begin
   if(arb&&!arb_lost)release_sda();
   else if(ack_pending)begin sda_low=1;sda_high=0;ack_pending=0;
    // Write: release just after the rise (handoff, §5.1.2.3.1). Read: keep low, then send data.
    if(!reading)write_ack_release=1;
   end else if(reading)begin
    st=RD;cnt=0;ibi_more=0;
    if(ccc_target)begin tx=ccc_reply(0);end else begin tx=mem[ptr];ptr=ptr+1;end
    sent=0;drive_bit(tx[7]);
   end else begin
    st=WR;cnt=0;sh=0;
   end
  end
  WR:begin
   release_sda();
   if(cnt==8&&t_bit_wrong&&!code_next&&!ccc_target)sda_low=1;   // the I2C habit: ACK the ninth bit, hold it until SCL falls
  end
  RD:begin
   if(cnt<8)drive_bit(tx[7-cnt]);
   else begin
    // T-bit: 1 = more data (continue), 0 = end of data.
    sent++;ibi_more=was_ibi?0:(ccc_target?ccc_more(sent):sent<max_read);
    sda_low=!ibi_more;sda_high=ibi_more;
   end
  end
  DID:begin sda_low=!daa_word[63-cnt];sda_high=0;end
  DAD:release_sda();
  DACK:begin sda_low=daa_won;sda_high=0;end
  IGN:release_sda();
  endcase
 end
 task automatic drive_bit(input bit v);sda_low=!v;sda_high=v;endtask
 // After a T = 1 the controller either lets the next byte come or pulls SDA low (Sr = abort).
 always @(negedge scl)if(powered&&active&&st==RD&&cnt==0&&ibi_more)begin
  if(sda===1'b0)st=IGN;
  else begin if(ccc_target)tx=ccc_reply(sent);else begin tx=mem[ptr];ptr=ptr+1;end end
 end
 task automatic do_ccc(input [7:0] c);
  code=c;direct=c[7];
  if(c==8'h07)daa_mode=1;
  else if(c==8'h06)begin has_da=0;da=0;end
  else if(c==8'h29&&STATIC_ADDR!=0&&!has_da)begin da=STATIC_ADDR;has_da=1;end
  else if(c>=8'h20&&c<=8'h27)begin hdr_mode=1;falls=0;active=0;st=IDLE;end
  else if(c==8'h00||c==8'h01)begin ccc_target=1;end     // event byte follows
  else if(c>=8'h02&&c<=8'h05)activity=c-8'h02;
  else if(c==8'h08&&BCR[7:6]==2'b01)begin ccc_target=1;ndefs=0;end   // DEFSLVS: only secondary controllers keep it
 endtask
 task automatic ccc_data(input [7:0] d);
  if(code==8'h00||code==8'h80)begin if(d[0])ibi_en=1;if(d[1])mr_en=1;if(d[3])hj_en=1;end
  else if(code==8'h01||code==8'h81)begin if(d[0])ibi_en=0;if(d[1])mr_en=0;if(d[3])hj_en=0;end
  else if(code==8'h08)begin if(ndefs<40)defs[ndefs]=d;ndefs++;end
  else if(code==8'h87||code==8'h88)begin da=d[7:1];has_da=1;end
 endtask
 function automatic [7:0] ccc_reply(input int i);
  case(code)
   8'h8d:ccc_reply=PID>>(8*(5-i));
   8'h8e:ccc_reply=BCR;
   8'h8f:ccc_reply=DCR;
   8'h90:begin ccc_reply=i==0?8'h00:{activity,perr,5'b0};if(i==1)perr=0;end   // GETSTATUS MSB, LSB (Table 41)
   8'h91:ccc_reply={da^{6'b0,accmst_wrong_addr},~^da};
   default:ccc_reply=8'hff;
  endcase
 endfunction
 function automatic bit ccc_more(input int n);ccc_more=(code==8'h8d)?n<6:(code==8'h90)?n<2:0;endfunction
endmodule
Read included file: i3c_hdr_detect.sv
`timescale 1ns/1ns
module i3c_hdr_detect(input wire scl,sda,in_hdr);
 bit misses_restart=0,restart_as_exit=0;int restarts=0,exits=0,falls=0;bit poss=0;
 always @(negedge sda)if(in_hdr&&scl===1'b0)begin falls++;if(falls==4)exits++;end
 always @(posedge sda)if(in_hdr&&scl===1'b0)poss=(falls==2);
 always @(posedge scl)begin
  if(in_hdr&&poss&&!misses_restart)begin if(restart_as_exit)exits++;else restarts++;end
  poss=0;falls=0;
 end
endmodule
Read included file: i3c_secondary.sv
`timescale 1ns/1ns
module i3c_secondary #(parameter [47:0] PID=48'h0,parameter [7:0] BCR=8'h46,DCR=8'h00)
 (inout wire scl,sda,output wire tgt_low,tgt_high,ctl_low,ctl_high);
 bit takes_scl_early=0;
 i3c_target #(.PID(PID),.BCR(BCR),.DCR(DCR)) tgt(scl,sda,tgt_low,tgt_high);
 i3c_ctrl #(.START_AS_CONTROLLER(0)) ctl(scl,sda,ctl_low,ctl_high);
 always @(posedge tgt.accmst_sent)if(takes_scl_early)ctl.scl_en=1;
 always @(posedge tgt.became_current)begin
  #12;ctl.scl_en=1;ctl.stopped=$time;ctl.daa_count=0;ctl.own_da=tgt.da;
  for(int g=5;g+3<tgt.ndefs&&g+3<40;g+=4)if(tgt.defs[g]!=0&&tgt.defs[g][7:1]!=tgt.da)begin
   ctl.daa_addr[ctl.daa_count]=tgt.defs[g][7:1];ctl.daa_dcr[ctl.daa_count]=tgt.defs[g+1];ctl.daa_bcr[ctl.daa_count]=tgt.defs[g+2];ctl.daa_count++;
  end
 end
endmodule
Read included file: i2c_legacy.sv
`timescale 1ns/1ns
module i2c_legacy #(parameter [6:0] ADDRESS=7'h50,parameter time FILTER=50,STRETCH=3000)
 (inout wire scl,sda,output wire scl_low,sda_low);
 bit no_spike_filter=0,legacy_stretches=0;int starts=0,clocks=0,pulls=0;
 wire scl_f,sda_f;assign #(FILTER) scl_f=scl;assign #(FILTER) sda_f=sda;
 tri1 lscl,lsda;wire hd;
 assign lscl=((no_spike_filter?scl:scl_f)===1'b0)?1'b0:1'bz;
 assign lsda=((no_spike_filter?sda:sda_f)===1'b0)?1'b0:1'bz;
 i2c_target #(.ADDRESS({3'b000,ADDRESS})) dev(lscl,lsda,scl_low,sda_low,hd);
 assign scl=scl_low?1'b0:1'bz;assign sda=sda_low?1'b0:1'bz;
 always @(legacy_stretches)dev.stretch_ns=legacy_stretches?STRETCH:0;
 always @(negedge lsda)if(lscl===1'b1)starts++;
 always @(posedge lscl)clocks++;
 always @(posedge sda_low)pulls++;
endmodule
Read included file: i2c_target.sv
`timescale 1ns/1ns
module i2c_target #(parameter [9:0] ADDRESS=10'h050,parameter TEN_BIT=0)
 (inout wire scl,sda,output reg scl_low=0,sda_low=0,output wire high_drive);
 bit ack_not_released=0,ack_wrong_clock=0,stretch_never_released=0,wrong_addr_ack=0,no_stop_detect=0,autoinc_wrap_bug=0,push_pull_target=0,ignores_sr=0;
 // Legal receiver responses, not faults. rx_limit counts post-address bytes,
 // including the pointer byte; -1 is unlimited. A busy address is declined once.
 bit busy_nack=0;int rx_limit=-1,rx_count=0;
 // Optional general-call software reset: UM10204 §§3.1.13–14. This model
 // restores mem[i]=i and ptr=0; ADDRESS is fixed, not a programmable register.
 // Fault switches and bench configuration are not device reset state.
 time stretch_ns=0;bit general_call=1,software_reset=1,general_selected=0,reset_pending=0;int resets=0;
 reg [7:0] mem[0:255];reg [7:0] ptr=0,shift=0,tx=0;
 int state=0,count=0,bytes=0;bit active=0,selected=0,reading=0,need_ptr=1,ack_value=0,ack_active=0,low_addr_next=0,addressed10=0,reading_ack=0;
 // state: 0 receive, 1 receiver ACK, 2 transmit, 3 controller ACK, 4 ignore.
 assign high_drive=push_pull_target&&!sda_low;
 assign sda=sda_low?1'b0:high_drive?1'b1:1'bz;assign scl=scl_low?1'b0:1'bz;
 initial for(int i=0;i<256;i++)mem[i]=i[7:0];
 function automatic [7:0] increment(input reg [7:0] p);increment=autoinc_wrap_bug?((p+1)&8'h0f):p+1'b1;endfunction
 always @(negedge sda)if(scl===1)begin
  if(!(ignores_sr&&active))begin active=1;selected=0;state=0;count=0;bytes=0;rx_count=0;shift=0;reading=0;ack_active=0;sda_low=0;low_addr_next=0;general_selected=0;reset_pending=0;end
 end
 always @(posedge sda)if(scl===1&&active&&!no_stop_detect)begin active=0;selected=0;state=0;count=0;sda_low=0;addressed10=0;end
 always @(posedge scl)if(active)begin
  if(state==0)begin
   shift={shift[6:0],sda};count++;
   if(count==8)begin
    ack_value=0;
    if(bytes==0)begin
      reading=shift[0];
      general_selected=general_call&&shift==0;
      if(general_selected)begin selected=1;low_addr_next=0;end
      else if(TEN_BIT)begin selected=(shift[7:3]==5'b11110&&shift[2:1]==ADDRESS[9:8]&&(!reading||addressed10));low_addr_next=!reading;end
      else selected=(shift[7:1]==ADDRESS[6:0]||(wrong_addr_ack&&shift[7:1]==ADDRESS[6:0]+1'b1));
      if(selected&&busy_nack)begin selected=0;busy_nack=0;end
      ack_value=selected;need_ptr=1;
    end else if(low_addr_next)begin selected=selected&&shift==ADDRESS[7:0];ack_value=selected;addressed10=selected;low_addr_next=0;end
    else if(selected)begin
      ack_value=rx_limit<0||rx_count<rx_limit;
      if(general_selected)begin
       // Unsupported general-call commands are NACKed, never register writes.
       ack_value=ack_value&&bytes==1&&software_reset&&shift==8'h06;
       reset_pending=ack_value;
      end else if(ack_value)begin rx_count++;if(need_ptr)begin ptr=shift;need_ptr=0;end else begin mem[ptr]=shift;ptr=increment(ptr);end end
      if(!ack_value)selected=0;
    end
    bytes++;state=1;ack_active=0;count=0;
   end
  end else if(state==2)begin count++;if(count==8)begin state=3;count=0;reading_ack=0;end end
  else if(state==3&&reading_ack)begin if(sda===0)begin ptr=increment(ptr);tx=mem[ptr];state=2;count=0;end else state=4;end
 end
 always @(negedge scl)if(active)begin
  // Deliberate early-ACK fault: after seven samples, pull for clock 8.
  // The address prefix is already known; its R/W bit has not arrived yet.
  if(state==0&&count==7&&ack_wrong_clock)begin
   if(bytes==0)sda_low=!busy_nack&&((general_call&&shift[6:0]==0)||(TEN_BIT?(shift[6:2]==5'b11110&&shift[1:0]==ADDRESS[9:8]):(shift[6:0]==ADDRESS[6:0]||(wrong_addr_ack&&shift[6:0]==ADDRESS[6:0]+1'b1))));
   else sda_low=selected&&(rx_limit<0||rx_count<rx_limit);
  end else if(state==1)begin
   if(!ack_active)begin
    sda_low=ack_value&&!ack_wrong_clock;ack_active=1;
   end else begin
    sda_low=ack_not_released&&ack_value;ack_active=0;
    if(reset_pending)begin
     // Finish the ninth ACK clock before resetting and releasing the bus.
     for(int i=0;i<256;i++)mem[i]=i[7:0];
     ptr=0;shift=0;tx=0;count=0;bytes=0;rx_count=0;need_ptr=1;
     selected=0;reading=0;reading_ack=0;low_addr_next=0;addressed10=0;
     general_selected=0;reset_pending=0;resets++;sda_low=0;scl_low=0;state=4;
    end else if(!selected)state=4;
    else if(reading)begin state=2;tx=mem[ptr];count=0;sda_low=!tx[7];end
    else state=0;
    // Byte-level stretch after the ACK, as in UM10204 §3.1.9. Prepare
    // outgoing data before releasing SCL; overlap the controller's LOW.
    if(selected&&ack_value&&(stretch_ns>0||stretch_never_released))begin scl_low=1;if(!stretch_never_released)begin #(stretch_ns);scl_low=0;end end
   end
  end else if(state==2)sda_low=!tx[7-count];
  else if(state==3)begin sda_low=0;reading_ack=1;end
  else if(state==4)sda_low=0;
 end
endmodule
Read included file: i3c_mon.sv
`timescale 1ns/1ns
// Bus decoder: one line per frame, from SCL and SDA only. The ninth bit is an ACK after an address and a
// T-bit after a data word (§5.1.2.3); frames to the legacy address are decoded as I2C. phase (an output
// the checker reads): 0 idle, 1 header after S, 2 header after Sr, 3 ACK, 4 write word, 5 read word,
// 6 DAA ID, 7 DAA address, 8 DAA ACK, 9 HDR, 10 I2C byte, 11 I2C ACK, 12 waiting for Sr or P.
module i3c_mon #(parameter [6:0] LEGACY=7'h50)(input wire scl,sda,output reg [3:0] phase=0);
 bit trace=0,active=0,daa=0,hdr=0,legacy=0,code_next=0;int cnt=0,frames=0,starts=0,exits=0,falls=0;
 reg [63:0] sh=0;reg [6:0] addr=0;bit rw=0;string text="";
 always @(negedge sda)if(scl===1'b1&&!hdr)begin
  if(active)text={text," Sr"};else begin text=" S";daa=0;legacy=0;end
  phase=active?2:1;active=1;cnt=0;sh=0;starts++;code_next=0;
 end
 always @(posedge sda)if(scl===1'b1&&active&&!hdr)begin
  text={text," P"};if(trace)$display("%s%s",legacy?"I2C":"I3C",text);text="";active=0;phase=0;frames++;
 end
 // HDR Exit Pattern: four SDA falls while SCL stays low (§5.2.1.1). Seen in or out of HDR (M2 recovery).
 always @(negedge sda)if(scl===1'b0&&(hdr||active))begin falls++;if(falls==4)begin hdr=0;falls=0;text={text," EXIT"};exits++;phase=12;end end
 bit poss=0;int restarts=0;
 always @(posedge sda)if(scl===1'b0&&hdr)poss=(falls==2);
 always @(posedge scl)begin if(hdr&&poss)begin text={text," RESTART"};restarts++;end poss=0;falls=0;end
 always @(posedge scl)if(active&&!hdr)begin
  sh={sh[62:0],sda};cnt++;
  case(phase)
  1,2:if(cnt==8)begin addr=sh[7:1];rw=sh[0];cnt=0;
     if(phase==1&&addr==LEGACY)legacy=1;
     text={text,$sformatf(" %02h %s",addr,rw?"R":"W")};phase=legacy?11:3;end
  3:begin cnt=0;text={text,sda===1'b0 ? " A" : sda===1'b1 ? " NA" : " A=x"};
     if(sda!==1'b0)phase=12;
     else if(daa&&addr==7'h7e&&rw)phase=6;
     else if(!rw)begin phase=4;code_next=(addr==7'h7e);end
     else phase=5;
    end
  4,5:if(cnt==9)begin cnt=0;text={text,$sformatf(" %02h T%0d",sh[8:1],sh[0])};
     if(phase==4&&code_next)begin code_next=0;
      if(sh[8:1]==8'h07)daa=1;
      if(sh[8:1]>=8'h20&&sh[8:1]<=8'h27)begin hdr=1;falls=0;phase=9;text={text," HDR"};end
     end
     if(phase==5&&sh[0]===1'b0)phase=12;
    end
  6:if(cnt==64)begin cnt=0;text={text,$sformatf(" id %012h bcr %02h dcr %02h",sh[63:16],sh[15:8],sh[7:0])};phase=7;end
  7:if(cnt==8)begin cnt=0;text={text,$sformatf(" da %02h par %0d",sh[7:1],sh[0])};phase=8;end
  8:begin cnt=0;text={text,sda===1'b0 ? " A" : sda===1'b1 ? " NA" : " A=x"};phase=12;end
  10:if(cnt==8)begin cnt=0;text={text,$sformatf(" %02h",sh[7:0])};phase=11;end
  11:begin cnt=0;text={text,sda===1'b0 ? " A" : sda===1'b1 ? " NA" : " A=x"};phase=10;end
  default:cnt=0;
  endcase
 end
endmodule
Read included file: i3c_checker.sv
`timescale 1ns/1ns
// Wire rules with the driver view. Index 0 of lows/highs is the controller; the others are targets.
// Each rule prints at most once per frame (S to P) and counts every time it fires.
//  no_pp_contention   one device drives SDA high while another pulls it low (§5.1.2.3: handoffs are specified)
//  od_in_header       a device drives SDA high in the arbitrable header after S or its ACK (§5.1.2.2.1)
//  pp_in_data         the controller sends a 1 in a write word without driving it high (§5.1.2: data is push-pull)
//  t_bit              the ninth bit of a write word is not XOR(data, 1) (§5.1.2.3.3)
//  ibi_mdb_present    no target drives the byte after an accepted header after S with R (BCR[2] = 1, §5.1.6.2)
//  legacy_no_stretch  a legacy target pulls SCL low (MIPI v1.0 Table 56: no clock stretching on I3C)
module i3c_checker #(parameter N=4)(input wire scl,sda,input wire [N-1:0] lows,highs,input wire [3:0] phase,input wire legacy_scl_low);
 int broken=0,contention=0,od_header=0,pp_data=0,tbit=0,mdb=0,stretch=0;bit quiet=0;   // quiet: count, do not print
 reg [5:0] said=0;reg [3:0] ph=0,prev=0;reg [8:0] w=0;int k=0,hk=0,mk=0;bit arb_ack=0,hdr_rw=0,mdb_seen=0,mdb_watch=0,viol=0;
 task automatic bad(input int i,input string rule);broken++;if(!said[i]&&!quiet)$display("I3C CHECK %s at %0t",rule,$time);said[i]=1;endtask
 always @(negedge sda)if(scl===1'b1)begin k=0;viol=0;end
 always @(posedge sda)if(scl===1'b1)said=0;
 always @(negedge scl)begin prev=ph;ph=phase;if(ph!=prev)begin k=0;hk=0;end
  if(ph!=prev&&ph==3)arb_ack=(prev==1);
  if(ph==5&&prev==3&&arb_ack&&hdr_rw)begin mdb_watch=1;mdb_seen=0;mk=0;end
 end
 always @(lows or highs)begin #1;if(|lows&&|highs)begin contention++;bad(0,"no_pp_contention");end end
 always @(posedge scl)begin
  if((ph==1||(ph==3&&arb_ack))&&|highs)begin od_header++;bad(1,"od_in_header");end
  if(ph==1)begin hk++;if(hk==8)hdr_rw=(sda===1'b1);end
  if(ph==4)begin k++;w={w[7:0],sda};
   if(k<=8&&sda===1'b1&&!highs[0])viol=1;
   if(k==9)begin if(viol)begin pp_data++;bad(2,"pp_in_data");end if(w[0]!==~^w[8:1])begin tbit++;bad(3,"t_bit");end k=0;viol=0;end
  end
  if(mdb_watch)begin mk++;if(|lows[N-1:1]|||highs[N-1:1])mdb_seen=1;
   if(mk==8)begin mdb_watch=0;if(!mdb_seen)begin mdb++;bad(4,"ibi_mdb_present");end end
  end
 end
 always @(posedge legacy_scl_low)begin stretch++;bad(5,"legacy_no_stretch");end
 // A missing mandatory byte turns the controller's handoff release into a STOP inside the ACK slot.
 always @(posedge sda)if(scl===1'b1&&ph==3&&arb_ack&&hdr_rw)begin mdb++;bad(4,"ibi_mdb_present");end
endmodule
Spot the bugEach option is the body of ninth_ok, a decoder rule for the ninth bit of an SDR data word. An option passes when it accepts legal ninth bits and rejects bad parity. Which option fails?
ConceptWhy does a legacy I2C target need a 50 ns spike filter to share a fast I3C bus?
ConceptIn an SDR read, who drives the ninth bit of each data word, and what does a 0 mean?

Remember

  • The SDR header is I2C's: seven address bits, R/W and an ACK.
  • The ninth bit of a write word is odd parity from the controller; of a read word, end-of-data from the target.
  • The target ends an SDR read; the controller can abort one after a T = 1 with a repeated START.
  • A legacy target with a 50 ns filter never sees the 40 ns I3C clock highs.
  • Clock stretching and ACKing the T-bit are I2C habits that break on I3C.

Practice