Capstone: The I3C Target Bug Hunt
Run seven programs against seven faults, read the fault matrix, and choose a stimulus set and the checking that together catch them all.
- Lesson
- P9.8
- Time
- 40 min
- Runs on
- Your browser
- Check
- 4 questions
An I3C target passed every directed test on a bus of one. In the product it shared the bus with a legacy sensor and a sibling. DAA gave it the address its sibling also took, its interrupt arrived without the promised byte, and after the first HDR entry it never answered again. Each fault needed more than one device, or one more program, to show.
| Fault | DAA | Private write and read | GETBCR and a direct DISEC | IBI on a free bus | Two IBIs at once | HDR enter and exit, then a read | I2C write and read to the legacy target |
|---|---|---|---|---|---|---|---|
| none (clean) | pass | pass | pass | pass | pass | pass | pass |
| target2.pid_tie_bug | FAIL | pass | pass | pass | pass | pass | pass |
| target2.addr_parity_wrong | FAIL | pass | pass | pass | pass | pass | pass |
| target2.ibi_without_mdb | pass | pass | pass | FAIL | FAIL | pass | pass |
| target2.misses_hdr_exit | pass | pass | pass | pass | pass | FAIL | pass |
| target2.t_bit_wrong | pass | FAIL | pass | pass | pass | FAIL | pass |
| target2.pp_too_early | pass | pass | pass | FAIL | FAIL | pass | pass |
| legacy.legacy_stretches | pass | pass | pass | pass | pass | pass | FAIL |
Measured: 56 runs, one fault at a time on target2 (or the legacy target). A cell fails when the checker fires or a black-box self-check disagrees. The most any program catches is 2 faults; the clean row passes everywhere.
Who Catches What
| Fault | Caught by | What the run printed |
|---|---|---|
| target2.pid_tie_bug | DAA | SELF DAA assigned 1 of 2 |
| target2.addr_parity_wrong | DAA | SELF DAA assigned 1 of 2 |
| target2.ibi_without_mdb | IBI on a free bus, Two IBIs at once | ibi_mdb_present, SELF IBIs 1 MDB ff, SELF second 09 MDB ff IBIs 2 |
| target2.misses_hdr_exit | HDR enter and exit, then a read | SELF read xx |
| target2.t_bit_wrong | Private write and read, HDR enter and exit, then a read | no_pp_contention, t_bit, SELF read 10, SELF read 00 |
| target2.pp_too_early | IBI on a free bus, Two IBIs at once | od_in_header, no_pp_contention, SELF second 08 MDB a5 IBIs 1 |
| legacy.legacy_stretches | I2C write and read to the legacy target | legacy_no_stretch, SELF legacy read 7f |
Measured. Checker rules appear by name; SELF lines are the program's own comparisons of what it read with what it expected.
Read the rows, not the columns. pid_tie_bug needs DAA with a second target whose ID is close enough to hide the loss. pp_too_early on target2 shows as od_in_header in any of its IBI headers, and as contention when target1 raises at the same time. The clean row is the control: every program passes without a fault.
Weak Stimulus, Weak Checking
| Stimulus and checking | Faults missed |
|---|---|
| Private write and read only | pid_tie_bug, addr_parity_wrong, ibi_without_mdb, misses_hdr_exit, pp_too_early, legacy_stretches |
| Everything except interrupts | ibi_without_mdb, pp_too_early |
| Everything except the legacy target | legacy_stretches |
| All seven programs, checker only (no self-checks) | pid_tie_bug, addr_parity_wrong, misses_hdr_exit |
| All seven programs, self-checks only (no driver view) | none |
| All seven programs, both | none |
Computed from the measured matrix. The checker alone misses faults that leave the wires legal; self-checks alone miss faults that only the driver view can attribute.
A pass is a statement about the program as much as the target. The first row is the bus-of-one test from the hook, and it misses most of the bank.
The Eyes
Illustrative sequence
- The decoder
Turns the wires into frames; the checker uses its phase to know which rule applies.
- Self-checks
Catch what is legal on the wire but wrong in effect: a shared address, a target that never came back from HDR.
- Driver view
Catches what the wire hides: who drove high in an open-drain header, two drivers in one slot.
- The neighbour
Coexistence is part of the bus (MIPI §5.1.1, Table 56); a stretch only shows with a legacy target present.
Read the diagram as text
- SCL + SDA: controller, two targets, legacy
- Decoder: frames from the wires
- Self-checks: values, counts, IBIs
- Driver view: *_low, *_high per device
- Legacy neighbour: an I2C target on the bus
- SCL + SDA → Decoder
- SCL + SDA → Self-checks
- SCL + SDA → Driver view
- Legacy neighbour → SCL + SDA
As in P8.11, plus the *_high lanes: in I3C a push-pull fault is attributable only when you can see who drives a 1.
Try It
One cell of the matrix: the HDR program against target2.misses_hdr_exit. Addresses come from SETAASA, so a DAA fault cannot hide this one. The exit pattern goes by, target2 stays in HDR, and the read of its register is not acknowledged.
Replace the fault in pre with target2.t_bit_wrong = 1: the same program fails for a different reason, because its pointer write (0x3c, parity 1) collides with the target's ACK habit.
RUNIcarus Verilog · in your browser
Expected:
I3C S 7e W A 29 T0 P I3C S 7e W A 8e T1 Sr 08 R A 06 T0 P I3C S 7e W A 8e T1 Sr 09 R A 06 T0 P I3C S 7e W A 20 T0 HDR EXIT P I3C S 7e W A Sr 09 W NA P SELF read xx VERDICT FAIL (checker 0)Read included file: i3c_ctrl.sv
`timescale 1ns/1ns
// I3C controller (v1.0: Master), SDR. Task calls drive the pins; SCL is push-pull and driven by this device
// alone (§5.1.2). SDA is open drain in the arbitrable header after S, in every ACK slot and in DAA; push-pull
// in the header after Sr and in write data (§5.1.2.2, §5.1.2.3, §5.1.4.2).
module i3c_ctrl(inout wire scl,sda,output reg sda_low=0,sda_high=0);
parameter time PP_LOW=40,PP_HIGH=40,OD_LOW=200,OD_HIGH=40,HOLD=5,T_CAS=40,TBUF=1300,
FM_LOW=1300,FM_HIGH=1200,FM_HOLD=100,FM_SETUP=600,T_MMOVERLAP=220;
// START_AS_CONTROLLER = 0: a secondary controller's controller half, SCL released until a handoff (§5.1.6.3).
parameter START_AS_CONTROLLER=1;
// Fault switches.
bit pp_too_early=0,od_always=0,directed_as_broadcast=0;
// Policy and an error injector: flip_mask flips bits of the next written word on the wire (noise);
// the T-bit is still the parity of the intended byte.
bit ibi_accept=1,hj_accept=1,trace=0;reg [7:0] flip_mask=0;
// Mastership: accept requests from secondary controllers; this device's own dynamic address for DEFSLVS.
// Clock stalling (§5.1.2.5.1): extra SCL low in the next header ACK slot, at most 100 µs (Table 11).
bit mr_accept=1,mr_seen=0,handed_over=0,scl_en=START_AS_CONTROLLER;reg [6:0] mr_addr=0,own_da=7'h20;
int stall_ack_ns=0;time ext_low=0;reg [6:0] leg_addr=0;reg [7:0] leg_lvr=0;
// State.
reg scl_out=1;bit active=0,sr_done=0,lost=0,serviced=0,hj_seen=0,daa_error=0,legacy=0;time stopped=0;
reg [6:0] req_addr=0;bit req_rw=0;logic [7:0] mdb;logic tbit;
int daa_count=0,daa_expect=0,ibis=0;reg [6:0] daa_next=7'h08;
reg [6:0] daa_addr[0:7];reg [47:0] daa_pid[0:7];reg [7:0] daa_bcr[0:7],daa_dcr[0:7];
reg [7:0] wbuf[0:7];logic [7:0] rbuf[0:7];int rcount=0;
assign scl=scl_en?scl_out:1'bz;assign sda=sda_low?1'b0:sda_high?1'b1:1'bz;
localparam PP=0,OD=1,FM=2,REL=0,DRV_OD=1,DRV_PP=2;
task automatic set_sda(input int how,input logic v);
if(how==REL)begin sda_low=0;sda_high=0;end else if(how==DRV_OD)begin sda_low=!v;sda_high=0;end else begin sda_low=!v;sda_high=v;end
endtask
// One SCL pulse; SCL is low on entry and on exit. post: 0 nothing; 1 pull SDA low just after the rise
// when the sample is 0 (ACK to write data handoff, §5.1.2.3.1); 2 release 12 ns after the rise (IBI ACK
// to mandatory byte handoff, §5.1.2.3.2).
task automatic clock(input int speed,input int how,input logic v,input int post,output logic s);
time lo,hi,hd;lo=speed==FM?FM_LOW:speed==OD?OD_LOW:PP_LOW;hi=speed==FM?FM_HIGH:speed==OD?OD_HIGH:PP_HIGH;hd=speed==FM?FM_HOLD:HOLD;
#(hd);set_sda(how,v);#(lo-hd+ext_low);ext_low=0;scl_out=1;#1;s=sda;
if(post==1&&s===1'b0)begin sda_low=1;sda_high=0;end
if(post==2)begin #11;sda_low=0;#(hi-12);end else #(hi-1);
scl_out=0;
endtask
// Next free dynamic address, skipping the reserved values of Table 9.
function automatic [6:0] next_free(input [6:0] a);
reg [6:0] n;n=a+1;while(n==7'h3e||n==7'h5e||n==7'h6e||n==7'h76||n==7'h7a||n==7'h7c||n>=7'h7e)n=n+1;next_free=n;
endfunction
function automatic [7:0] bcr_of(input [6:0] a);
bcr_of=0;for(int i=0;i<daa_count;i++)if(daa_addr[i]==a)bcr_of=daa_bcr[i];
endfunction
function automatic bit known(input [6:0] a);
known=0;for(int i=0;i<daa_count;i++)if(daa_addr[i]==a)known=1;
endfunction
task automatic start();
if(stopped>0&&$time-stopped<TBUF)#(TBUF-($time-stopped));
serviced=0;lost=0;sr_done=0;legacy=0;
if(trace&&sda===1'b0)$display("CTRL START request from a target at %0t",$time);
sda_low=1;sda_high=0;#(T_CAS);scl_out=0;active=1;
endtask
// Repeated START. A read abort (T-bit) has already made one: then there is nothing to do.
task automatic restart(input bit od);
if(sr_done)sr_done=0;
else begin
#(HOLD);if(od)set_sda(REL,1);else set_sda(DRV_PP,1);#((od?OD_LOW:PP_LOW)-HOLD);
scl_out=1;#(T_CAS/2);sda_low=1;sda_high=0;#(T_CAS);scl_out=0;
end
endtask
task automatic stop();
sr_done=0;#(legacy?FM_HOLD:HOLD);sda_low=1;sda_high=0;#(legacy?FM_LOW:PP_LOW);
scl_out=1;#(legacy?FM_SETUP:T_CAS);sda_low=0;sda_high=0;stopped=$time;active=0;legacy=0;#1;
endtask
// Read one SDR word: eight data bits and the target's T-bit (§5.1.2.3.4). T = 0 ends the read: the
// controller overlaps it low after the rise. T = 1 offers more: continue (more = 1) or abort with Sr.
task automatic read_word(output logic [7:0] d,output logic t,input bit more);
logic s;
for(int b=7;b>=0;b--)begin clock(PP,REL,1,0,s);d[b]=s;end
#(HOLD);set_sda(REL,1);#(PP_LOW-HOLD);scl_out=1;#1;t=sda;
if(t===1'b0)begin sda_low=1;#(PP_HIGH-1);scl_out=0;end
else if(more)begin #(PP_HIGH-1);scl_out=0;end
else begin #9;sda_low=1;#(T_CAS);scl_out=0;sr_done=1;end
endtask
// Write one SDR word: eight data bits and the odd-parity T-bit, XOR(data, 1) (§5.1.2.3.3).
task automatic write_word(input [7:0] d);
logic s;reg [7:0] w;w=d^flip_mask;flip_mask=0;
for(int b=7;b>=0;b--)clock(od_always?OD:PP,od_always?DRV_OD:DRV_PP,w[b],0,s);
clock(od_always?OD:PP,od_always?DRV_OD:DRV_PP,~^d,0,s);
endtask
// Address header. arb = 1 after S: open drain, and a target may win it (§5.1.2.2.1). arb = 0 after Sr:
// push-pull, never arbitrated (§5.1.2.2.4). The ACK slot is always open drain.
task automatic header(input [6:0] addr,input bit rw,input bit arb,output bit ack);
reg [7:0] v,seen;logic s;v={addr,rw};lost=0;ack=0;
for(int b=7;b>=0;b--)begin
if(arb)begin clock(OD,lost?REL:DRV_OD,v[b],0,s);if(!lost&&v[b]&&s===1'b0)lost=1;end
else clock(PP,DRV_PP,v[b],0,s);
seen[b]=(s===1'b1);
end
if(!lost)begin
ext_low=stall_ack_ns;clock(OD,(pp_too_early&&!arb)?DRV_PP:REL,1,rw?0:1,s);ack=(s===1'b0);
end else begin
// A target won the header: an In-Band Interrupt (its address, R), a Hot-Join (7'h02, W) or a
// controller-role request (its address, W) (§5.1.2.2).
req_addr=seen[7:1];req_rw=seen[0];serviced=1;
if(req_rw&&ibi_accept&&known(req_addr))begin
clock(OD,DRV_OD,0,(bcr_of(req_addr)&8'h04)!=0 ? 2 : 0,s);ack=1;ibis++;
if(bcr_of(req_addr)&8'h04)begin read_word(mdb,tbit,0);if(trace)$display("CTRL IBI from %02h accepted, MDB %02h T%0d",req_addr,mdb,tbit);end
else if(trace)$display("CTRL IBI from %02h accepted, no MDB (BCR[2] = 0)",req_addr);
end else if(!req_rw&&req_addr!=7'h02&&mr_accept&&known(req_addr)&&(bcr_of(req_addr)>>6)==2'b01)begin
// A controller-role request from a secondary controller (BCR[7:6] = 01): ACK, then GETACCMST (§5.1.6.3).
clock(OD,DRV_OD,0,0,s);ack=1;mr_seen=1;mr_addr=req_addr;if(trace)$display("CTRL controller-role request from %02h accepted",req_addr);
end else if(!req_rw&&req_addr==7'h02&&hj_accept)begin
clock(OD,DRV_OD,0,0,s);ack=1;hj_seen=1;if(trace)$display("CTRL Hot-Join request accepted");
end else begin
clock(OD,REL,1,0,s);if(trace)$display("CTRL request from %02h %s refused (NACK)",req_addr,req_rw?"R":"W");
end
end
endtask
// S 7'h7E/W, arbitrable. A request that wins is served first; then 7'h7E/W is sent again after Sr.
task automatic open_frame(output bit ack);
start();header(7'h7e,0,1,ack);
if(serviced)begin restart(0);header(7'h7e,0,0,ack);end
endtask
// Broadcast CCC (codes 0x00 to 0x7F): S 7'h7E/W, code, optional byte, P (§5.1.9.1, Figure 21).
task automatic ccc_broadcast(input [7:0] code,input bit has_data,input [7:0] data);
bit ack;open_frame(ack);if(ack)begin write_word(code);if(has_data)write_word(data);end stop();
endtask
// Direct CCC (codes 0x80 to 0xFE): S 7'h7E/W, code, Sr, address/W, optional byte, P (Figure 22).
// directed_as_broadcast: sends the broadcast form instead (code with bit 7 clear, the byte, P).
task automatic ccc_direct(input [7:0] code,input [6:0] addr,input bit has_data,input [7:0] data,output bit ack);
bit a;open_frame(a);
if(directed_as_broadcast)begin write_word(code&8'h7f);if(has_data)write_word(data);ack=a;end
else begin write_word(code);restart(0);header(addr,0,0,ack);if(ack&&has_data)write_word(data);end
stop();
endtask
// Direct GET CCC: S 7'h7E/W, code, Sr, address/R, n bytes into rbuf (the target ends with T = 0).
task automatic ccc_get(input [7:0] code,input [6:0] addr,input int n,output bit ack);
bit a;logic t;logic [7:0] rb;open_frame(a);write_word(code);restart(0);header(addr,1,0,ack);rcount=0;
if(ack)begin t=1;for(int i=0;i<n&&t!==1'b0;i++)begin read_word(rb,t,i<n-1);rbuf[i]=rb;rcount++;end end
stop();
endtask
// Private transfers in the form that starts with 7'h7E (MIPI v1.0 Figure 47): S 7'h7E/W, Sr, address.
task automatic write_regs(input [6:0] da,input [7:0] ptr,input int n,output bit ack);
bit a;open_frame(a);restart(0);header(da,0,0,ack);
if(ack)begin write_word(ptr);for(int i=0;i<n;i++)write_word(wbuf[i]);end
stop();
endtask
task automatic write_reg(input [6:0] da,input [7:0] ptr,input [7:0] d,output bit ack);wbuf[0]=d;write_regs(da,ptr,1,ack);endtask
// Pointer write, Sr, then read until the target ends (T = 0) or n bytes are in rbuf.
task automatic read_regs(input [6:0] da,input [7:0] ptr,input int n,output bit ack);
bit a;logic t;logic [7:0] rb;open_frame(a);restart(0);header(da,0,0,ack);rcount=0;
if(ack)begin write_word(ptr);restart(0);header(da,1,0,ack);
if(ack)begin t=1;for(int i=0;i<n&&t!==1'b0;i++)begin read_word(rb,t,i<n-1);rbuf[i]=rb;rcount++;end end
end
stop();
endtask
task automatic read_reg(input [6:0] da,input [7:0] ptr,output logic [7:0] v);bit ack;rbuf[0]=8'hxx;read_regs(da,ptr,1,ack);v=rbuf[0];endtask
// Legacy I2C message to a static address at Fm timing (MIPI v1.0 Table 57): open drain, ninth bit = ACK.
task automatic i2c_start();
if(stopped>0&&$time-stopped<TBUF)#(TBUF-($time-stopped));
serviced=0;lost=0;sr_done=0;legacy=1;sda_low=1;sda_high=0;#(FM_SETUP);scl_out=0;active=1;
endtask
task automatic i2c_byte(input [7:0] v,output bit ack);logic s;
for(int b=7;b>=0;b--)clock(FM,DRV_OD,v[b],0,s);clock(FM,REL,1,0,s);ack=(s===1'b0);
endtask
task automatic i2c_write(input [6:0] a,input [7:0] ptr,input [7:0] d,output bit ack);
bit k;i2c_start();i2c_byte({a,1'b0},ack);if(ack)begin i2c_byte(ptr,k);i2c_byte(d,k);end stop();
endtask
task automatic i2c_read(input [6:0] a,input [7:0] ptr,output logic [7:0] v);
bit ack;logic s;i2c_start();i2c_byte({a,1'b0},ack);i2c_byte(ptr,ack);
#(FM_HOLD);set_sda(REL,1);#(FM_LOW-FM_HOLD);scl_out=1;#(FM_SETUP);sda_low=1;#(FM_SETUP);scl_out=0;
i2c_byte({a,1'b1},ack);for(int b=7;b>=0;b--)begin clock(FM,REL,1,0,s);v[b]=s;end clock(FM,REL,1,0,s);stop();
endtask
// ENTDAA (§5.1.4.2, Figure 19): broadcast 0x07, then rounds of Sr 7'h7E/R (open drain), 64 arbitrated bits
// (provisional ID, BCR, DCR) from the targets, a 7-bit address plus odd parity from the controller and the
// winner's ACK. A NACKed address is offered once more; a second NACK ends DAA (§5.1.4.2 notes).
task automatic entdaa();
bit ack;open_frame(ack);if(ack)write_word(8'h07);daa_rounds();
endtask
task automatic daa_rounds();
bit ack,a2,retry,done;logic s;reg [63:0] id;reg [7:0] w;
retry=0;done=0;
while(!done)begin
restart(1);header(7'h7e,1,1,ack);
if(!ack)done=1;
else begin
for(int k=63;k>=0;k--)begin clock(OD,REL,1,0,s);id[k]=(s===1'b1);end
w={daa_next,~^daa_next};
for(int k=7;k>=0;k--)clock(OD,DRV_OD,w[k],0,s);
clock(OD,REL,1,0,s);a2=(s===1'b0);
if(a2)begin
daa_addr[daa_count]=daa_next;daa_pid[daa_count]=id[63:16];daa_bcr[daa_count]=id[15:8];daa_dcr[daa_count]=id[7:0];
if(trace)$display("CTRL DAA PID %012h BCR %02h DCR %02h -> %02h",id[63:16],id[15:8],id[7:0],daa_next);
daa_count++;daa_next=next_free(daa_next);retry=0;
end else if(!retry)begin retry=1;if(trace)$display("CTRL DAA %02h NACKed, offering it again",daa_next);end
else begin daa_error=1;done=1;if(trace)$display("CTRL DAA %02h NACKed twice: DAA ends with an error",daa_next);end
end
end
stop();
if(daa_expect&&daa_count<daa_expect&&trace)$display("CTRL DAA assigned %0d of %0d expected addresses",daa_count,daa_expect);
endtask
// Wait for a target's START request on a free bus, then clock it out (§5.1.2.2 condition 2, §5.1.6.2).
// A Hot-Join is answered with ENTDAA in the same frame (§5.1.5 step 4c).
task automatic serve_request(input time limit);
time t0;bit ack;t0=$time;
while(sda!==1'b0&&$time-t0<limit)#10;
if(sda===1'b0)begin
start();header(7'h7e,0,1,ack);
if(hj_seen)begin hj_seen=0;restart(0);header(7'h7e,0,0,ack);if(ack)write_word(8'h07);daa_rounds();end
else if(mr_seen)begin mr_seen=0;getaccmst(mr_addr,1,ack);end
else stop();
end else if(trace)$display("CTRL no request within %0t ns",limit);
endtask
// GETACCMST (0x91, §5.1.9.3.16): a direct GET to a secondary controller, after its request (in the same
// frame, after Sr) or as an offer. An accepted reply is its own address with a parity bit (the bench uses the
// odd parity of §5.1.4.2); then STOP, and this controller releases SCL after tMMoverlap (§5.1.6.3, Figure 44).
// A NACK or a wrong address cancels the handoff (Tables 43, 44).
task automatic getaccmst(input [6:0] a,input bit in_frame,output bit ok);
bit ack;logic [7:0] b;logic t;b=8'hxx;
if(in_frame)begin restart(0);header(7'h7e,0,0,ack);end else open_frame(ack);
write_word(8'h91);restart(0);header(a,1,0,ack);
if(ack)read_word(b,t,0);
ok=ack&&(b==={a,~^a});
stop();
if(ok)begin #(T_MMOVERLAP);scl_en=0;handed_over=1;end
if(trace)begin
if(!ack)$display("CTRL GETACCMST %02h NACKed: mastership kept",a);
else if(ok)$display("CTRL GETACCMST %02h replied %02h: SCL released",a,b);
else $display("CTRL GETACCMST %02h replied %02h, not %02h: mastership kept",a,b,{a,~^a});
end
endtask
// DEFSLVS (0x08, §5.1.9.3.7, Table 30): a count, four bytes for this controller (its address, DCR, BCR, static
// 7'h7E), then four per target (address<<1, DCR, BCR, static<<1); a legacy target has address 0 and its LVR.
task automatic defslvs();
bit ack;open_frame(ack);write_word(8'h08);write_word(daa_count+(leg_addr!=0));
write_word({own_da,1'b0});write_word(8'h00);write_word(8'h40);write_word({7'h7e,1'b0});
for(int i=0;i<daa_count;i++)begin write_word({daa_addr[i],1'b0});write_word(daa_dcr[i]);write_word(daa_bcr[i]);write_word(8'h00);end
if(leg_addr!=0)begin write_word(8'h00);write_word(leg_lvr);write_word(8'h00);write_word({leg_addr,1'b0});end
stop();
endtask
// Learn a target's BCR with GETBCR, for a target given its address by SETAASA or SETDASA (no DAA record).
task automatic learn(input [6:0] a);bit ack;ccc_get(8'h8e,a,1,ack);
if(ack)begin daa_addr[daa_count]=a;daa_bcr[daa_count]=rbuf[0];daa_pid[daa_count]=0;daa_dcr[daa_count]=0;daa_count++;end
endtask
// ENTHDRx (codes 0x20 to 0x27, Table 15). Basic v1.0 has no HDR mode, so nothing is sent in HDR.
task automatic hdr_enter(input [2:0] mode);bit ack;open_frame(ack);write_word(8'h20|mode);endtask
// HDR Exit Pattern (§5.2.1.1, Figure 25): SCL low, SDA falls four times at least tDIG_H apart, then SCL
// rises and SDA rises: a STOP.
task automatic hdr_exit();
#(HOLD);sda_low=0;sda_high=1;#(PP_LOW);
repeat(3)begin sda_low=1;sda_high=0;#(PP_HIGH);sda_low=0;sda_high=1;#(PP_HIGH);end
sda_low=1;sda_high=0;#(PP_HIGH);scl_out=1;#(T_CAS);sda_low=0;sda_high=0;stopped=$time;active=0;#1;
endtask
// HDR Restart Pattern (§5.2.1.2, Figure 26): SCL low, SDA high, then fall, rise, fall, rise at least tDIG_H
// apart; the next edge is SCL rising. The bus stays in HDR: a new HDR command would follow.
task automatic hdr_restart();
#(HOLD);sda_low=0;sda_high=1;#(PP_LOW);
repeat(2)begin sda_low=1;sda_high=0;#(PP_HIGH);sda_low=0;sda_high=1;#(PP_HIGH);end
scl_out=1;#(PP_HIGH);scl_out=0;
endtask
// A stand-in for HDR traffic: no HDR coding, only the property of §5.2.2's introduction that SDA may change
// after either SCL edge. The 16 bits of w go out one per SCL edge, so SDA also changes while SCL is high.
task automatic hdr_burst(input [15:0] w);
for(int b=15;b>=0;b--)begin #(HOLD);sda_low=!w[b];sda_high=w[b];#(PP_LOW-HOLD);scl_out=!scl_out;end
if(scl_out)begin #(PP_LOW);scl_out=0;end
endtask
// Error Type M2 recovery: S 7'h7E/W, ACK or NACK ignored, HDR Exit Pattern, STOP (§5.1.10.2.3, §5.1.10.2.4).
task automatic recover();bit ack;start();header(7'h7e,0,1,ack);hdr_exit();endtask
endmodule
Read included file: i3c_target.sv
`timescale 1ns/1ns
// I3C target (v1.0: Slave), SDR. A register map like the P8 target: mem[i] = i ^ MEM_XOR; a private write's
// first byte is the pointer. It answers 7'h7E and its dynamic address only (§5.1.2.1), takes part in ENTDAA
// while it has no address, raises In-Band Interrupts with a mandatory byte (BCR[2]) and recognises the HDR
// Exit Pattern. HOT_JOIN targets stay silent until hot_join() is called (§5.1.5).
module i3c_target #(parameter [47:0] PID=48'h0,parameter [7:0] BCR=8'h06,DCR=8'h00,parameter [6:0] STATIC_ADDR=7'h00,
parameter [7:0] MEM_XOR=8'h00,parameter HOT_JOIN=0,parameter time T_AVAL=1000,T_IDLE=200000)
(inout wire scl,sda,output reg sda_low=0,sda_high=0);
// Fault switches.
bit pid_tie_bug=0,addr_parity_wrong=0,ibi_without_mdb=0,misses_hdr_exit=0,t_bit_wrong=0,pp_too_early=0,ibi_loses_and_retries_wrong=0,restart_as_exit=0,accmst_wrong_addr=0;
// A secondary controller's target half (BCR[7:6] = 01): controller-role request, DEFSLVS list, GETACCMST.
bit mr_req=0,mr_en=1,accept_mastership=1,accmst_sent=0,became_current=0,my_rw=1;reg [7:0] defs[0:39];int ndefs=0;
// Activity state (ENTASx, §5.1.3.5) and the protocol-error flag GETSTATUS reports (Table 41).
reg [1:0] activity=0;bit perr=0;
// Counters: SDR STARTs acted on, HDR Restart patterns seen while in HDR.
int sdr_starts=0,hdr_restarts=0;bit poss_restart=0;time requested=0,req_gap=0; // when, and how long after the bus went free, it last pulled SDA
// Configuration and state. max_read: bytes returned per private read before T = 0.
int max_read=1;reg [7:0] mdb=8'ha5;
reg [6:0] da=0;bit has_da=0,ibi_en=1,hj_en=1,powered=!HOT_JOIN,ibi_req=0,hj_req=0;
reg [7:0] mem[0:255];reg [7:0] ptr=0;
int st=0,cnt=0,sent=0,errors=0;reg [8:0] sh=0;reg [63:0] daa_word;reg [7:0] tx;reg [7:0] code=0;
bit active=0,after_s=0,arb=0,arb_lost=0,lost_this_frame=0,daa_mode=0,direct=0,code_next=0,need_ptr=1,ccc_target=0,self_start=0;
bit hdr_mode=0,err_exit=0,write_ack_release=0,reading=0,daa_won=0,t_ack=0;int falls=0;reg [6:0] my_hdr;time free_since=0;
bit was_ibi=0,ibi_more=0,ack_pending=0,daa_hdr=0;
// st: 0 idle, 1 header, 2 header ACK, 3 write word, 4 read word, 5 ignore until Sr/P, 6 DAA ID, 7 DAA address, 8 DAA ACK
localparam IDLE=0,HDR=1,HACK=2,WR=3,RD=4,IGN=5,DID=6,DAD=7,DACK=8;
assign sda=sda_low?1'b0:sda_high?1'b1:1'bz;
initial for(int i=0;i<256;i++)mem[i]=i[7:0]^MEM_XOR;
task automatic release_sda();sda_low=0;sda_high=0;endtask
task automatic raise_ibi();ibi_req=1;endtask
task automatic request_mastership();mr_req=1;endtask
task automatic hot_join();powered=1;hj_req=1;free_since=$time;endtask
function automatic bit bad_addr(input [6:0] a);bad_addr=a==7'h3e||a==7'h5e||a==7'h6e||a==7'h76||a==7'h7a||a==7'h7c||a==7'h7f;endfunction
// START or Repeated START.
always @(negedge sda)if(scl===1'b1&&powered&&!hdr_mode&&!err_exit)begin
after_s=!active;sdr_starts++;
if(!active)begin daa_mode=0;direct=0;lost_this_frame=0;end
active=1;st=HDR;cnt=0;sh=0;code_next=0;ccc_target=0;reading=0;was_ibi=0;
// A request rides only on the header after S (§5.1.2.2); ibi_loses_and_retries_wrong also tries after Sr.
arb=0;arb_lost=0;
if(has_da&&ibi_req&&ibi_en&&(after_s||(ibi_loses_and_retries_wrong&&lost_this_frame)))begin arb=1;my_hdr=da;my_rw=1;end
else if(has_da&&mr_req&&mr_en&&after_s)begin arb=1;my_hdr=da;my_rw=0;end
else if(hj_req&&hj_en&&after_s)begin arb=1;my_hdr=7'h02;my_rw=0;end
if(accmst_sent&&!after_s)accmst_sent=0; // Sr after GETACCMST cancels it (§5.1.9.3.16 step 4)
end
// STOP.
always @(posedge sda)if(scl===1'b1&&powered&&!hdr_mode&&!err_exit&&active)begin
if(accmst_sent)begin accmst_sent=0;became_current=1;end
active=0;st=IDLE;daa_mode=0;direct=0;release_sda();free_since=$time;self_start=0;
end
// HDR Exit Pattern detector (§5.2.1.3, Figure 27): SDA falls counted while SCL stays low; SCL high resets.
always @(negedge sda)if((hdr_mode||err_exit)&&scl===1'b0)begin falls++;
if(falls==4&&!misses_hdr_exit)begin hdr_mode=0;err_exit=0;active=1;st=IGN;falls=0;end
end
// Restart (§5.2.1.4): exactly two falls, then an SDA rise, then SCL rises. A Basic target supports no HDR mode,
// so it notes the Restart and stays in HDR until the Exit; restart_as_exit leaves HDR on it (a fault).
always @(posedge sda)if((hdr_mode||err_exit)&&scl===1'b0)poss_restart=(falls==2);
always @(posedge scl)if(hdr_mode||err_exit)begin
if(poss_restart&&hdr_mode)begin hdr_restarts++;if(restart_as_exit)begin hdr_mode=0;active=1;st=IGN;end end
poss_restart=0;falls=0;
end
// Bus Available (tAVAL) or Bus Idle (tIDLE for Hot-Join): pull SDA low to request a START (§5.1.3, §5.1.5).
always #10 if(powered&&!active&&!self_start&&scl===1'b1&&sda===1'b1&&!hdr_mode&&!err_exit)begin
if(has_da&&(ibi_req&&ibi_en||mr_req&&mr_en)&&$time-free_since>=T_AVAL)begin self_start=1;sda_low=1;requested=$time;req_gap=$time-free_since;end
else if(hj_req&&hj_en&&$time-free_since>=T_IDLE)begin self_start=1;sda_low=1;end
end
// Sample on the rising edge.
always @(posedge scl)if(powered&&active&&!hdr_mode&&!err_exit)begin
case(st)
HDR:begin
sh={sh[7:0],sda};cnt++;
if(arb&&!arb_lost&&my_bit(cnt-1)&&sda===1'b0)begin arb_lost=1;lost_this_frame=1;end
if(cnt==8)decode_header();
end
HACK:begin
if(arb&&!arb_lost)begin
// My request won; the controller ACKs or NACKs it.
if(sda===1'b0)begin
if(my_hdr==7'h02)begin hj_req=0;st=IGN;end
else if(!my_rw)begin mr_req=0;st=IGN;end
else begin ibi_req=0;was_ibi=1;
if(BCR[2]&&!ibi_without_mdb)begin #2;sda_low=1;sda_high=0;tx=mdb;st=RD;cnt=0;end else st=IGN;
end
end else st=IGN;
self_start=0;
end else if(daa_hdr)begin daa_hdr=0;st=DID;cnt=0;daa_word={PID,BCR,DCR};end
else if(write_ack_release)begin #2;release_sda();write_ack_release=0;end
end
WR:begin
sh={sh[7:0],sda};cnt++;
if(cnt==9)begin cnt=0;
if(sh[0]!==~^sh[8:1])begin errors++;
perr=1;if(code_next)begin err_exit=1;falls=0;st=IGN;end else st=IGN; // S1: wait for the HDR Exit Pattern; S2: wait for Sr/P
end else if(code_next)begin code_next=0;do_ccc(sh[8:1]);end
else if(ccc_target)begin ccc_data(sh[8:1]);end
else if(need_ptr)begin ptr=sh[8:1];need_ptr=0;end
else begin mem[ptr]=sh[8:1];ptr=ptr+1;end
end
end
RD:begin
cnt++;
if(cnt==9)begin cnt=0;#2;release_sda();
if(ccc_target&&code==8'h91)accmst_sent=1; // GETACCMST answered: mastership passes at the STOP
if(!ibi_more)st=IGN;
end
end
DID:begin
if(!pid_tie_bug&&daa_word[63-cnt]&&sda===1'b0)begin st=IGN;end // lost: withdraw until the next Sr
cnt++;if(cnt==64&&st==DID)begin st=DAD;cnt=0;sh=0;end
end
DAD:begin sh={sh[7:0],sda};cnt++;if(cnt==8)begin st=DACK;daa_won=((^sh[7:0])==1'b1)^addr_parity_wrong;end end
DACK:begin if(daa_won)begin da=sh[7:1];has_da=1;end st=IGN;end
endcase
end
function automatic bit my_bit(input int i);reg [7:0] v;v={my_hdr,my_rw};my_bit=v[7-i];endfunction
task automatic decode_header();
reg [6:0] a;bit rw;a=sh[7:1];rw=sh[0];cnt=0;
if(arb&&!arb_lost)begin st=HACK;end
else if(a==7'h7e&&!rw)begin st=HACK;sda_ack(1);code_next=1;need_ptr=1;end
else if(a==7'h7e&&rw&&daa_mode&&!has_da&&!hj_req)begin st=HACK;sda_ack(1);daa_hdr=1;end // then 64 bits (§5.1.4.2 steps 4 to 8)
else if(a==7'h7e&&rw&&!daa_mode)begin errors++;err_exit=1;falls=0;st=IGN;end // S0: 7'h7E/R outside DAA
else if(daa_mode)begin st=IGN;end // S4 or already assigned
else if(direct&&((has_da&&a==da)||(code==8'h87&&STATIC_ADDR!=0&&a==STATIC_ADDR)))begin st=HACK;sda_ack(1);ccc_target=1;reading=rw;
if(code==8'h86)begin has_da=0;da=0;end
if(code>=8'h82&&code<=8'h85)activity=code-8'h82;
if(code==8'h91&&(BCR[7:6]!=2'b01||!accept_mastership))begin ack_pending=0;st=IGN;ccc_target=0;end end
else if(has_da&&a==da)begin st=HACK;sda_ack(1);reading=rw;need_ptr=!rw;end
else if(bad_addr(a)&&!rw)begin errors++;err_exit=1;falls=0;st=IGN;end // S0: broken 7'h7E/W
else st=IGN;
endtask
task automatic sda_ack(input bit a);ack_pending=a;endtask
// Drive 6 ns after the falling edge, one after the controller's 5 ns hold, so no handoff overlaps a 1 and a 0.
always @(negedge scl)if(powered&&active&&!hdr_mode&&!err_exit)begin
#6;
case(st)
HDR:begin
if(arb&&!arb_lost)begin
if(pp_too_early)begin sda_low=!my_bit(cnt);sda_high=my_bit(cnt);end else begin sda_low=!my_bit(cnt);sda_high=0;end
end else if(arb&&arb_lost)release_sda();
end
HACK:begin
if(arb&&!arb_lost)release_sda();
else if(ack_pending)begin sda_low=1;sda_high=0;ack_pending=0;
// Write: release just after the rise (handoff, §5.1.2.3.1). Read: keep low, then send data.
if(!reading)write_ack_release=1;
end else if(reading)begin
st=RD;cnt=0;ibi_more=0;
if(ccc_target)begin tx=ccc_reply(0);end else begin tx=mem[ptr];ptr=ptr+1;end
sent=0;drive_bit(tx[7]);
end else begin
st=WR;cnt=0;sh=0;
end
end
WR:begin
release_sda();
if(cnt==8&&t_bit_wrong&&!code_next&&!ccc_target)sda_low=1; // the I2C habit: ACK the ninth bit, hold it until SCL falls
end
RD:begin
if(cnt<8)drive_bit(tx[7-cnt]);
else begin
// T-bit: 1 = more data (continue), 0 = end of data.
sent++;ibi_more=was_ibi?0:(ccc_target?ccc_more(sent):sent<max_read);
sda_low=!ibi_more;sda_high=ibi_more;
end
end
DID:begin sda_low=!daa_word[63-cnt];sda_high=0;end
DAD:release_sda();
DACK:begin sda_low=daa_won;sda_high=0;end
IGN:release_sda();
endcase
end
task automatic drive_bit(input bit v);sda_low=!v;sda_high=v;endtask
// After a T = 1 the controller either lets the next byte come or pulls SDA low (Sr = abort).
always @(negedge scl)if(powered&&active&&st==RD&&cnt==0&&ibi_more)begin
if(sda===1'b0)st=IGN;
else begin if(ccc_target)tx=ccc_reply(sent);else begin tx=mem[ptr];ptr=ptr+1;end end
end
task automatic do_ccc(input [7:0] c);
code=c;direct=c[7];
if(c==8'h07)daa_mode=1;
else if(c==8'h06)begin has_da=0;da=0;end
else if(c==8'h29&&STATIC_ADDR!=0&&!has_da)begin da=STATIC_ADDR;has_da=1;end
else if(c>=8'h20&&c<=8'h27)begin hdr_mode=1;falls=0;active=0;st=IDLE;end
else if(c==8'h00||c==8'h01)begin ccc_target=1;end // event byte follows
else if(c>=8'h02&&c<=8'h05)activity=c-8'h02;
else if(c==8'h08&&BCR[7:6]==2'b01)begin ccc_target=1;ndefs=0;end // DEFSLVS: only secondary controllers keep it
endtask
task automatic ccc_data(input [7:0] d);
if(code==8'h00||code==8'h80)begin if(d[0])ibi_en=1;if(d[1])mr_en=1;if(d[3])hj_en=1;end
else if(code==8'h01||code==8'h81)begin if(d[0])ibi_en=0;if(d[1])mr_en=0;if(d[3])hj_en=0;end
else if(code==8'h08)begin if(ndefs<40)defs[ndefs]=d;ndefs++;end
else if(code==8'h87||code==8'h88)begin da=d[7:1];has_da=1;end
endtask
function automatic [7:0] ccc_reply(input int i);
case(code)
8'h8d:ccc_reply=PID>>(8*(5-i));
8'h8e:ccc_reply=BCR;
8'h8f:ccc_reply=DCR;
8'h90:begin ccc_reply=i==0?8'h00:{activity,perr,5'b0};if(i==1)perr=0;end // GETSTATUS MSB, LSB (Table 41)
8'h91:ccc_reply={da^{6'b0,accmst_wrong_addr},~^da};
default:ccc_reply=8'hff;
endcase
endfunction
function automatic bit ccc_more(input int n);ccc_more=(code==8'h8d)?n<6:(code==8'h90)?n<2:0;endfunction
endmodule
Read included file: i3c_hdr_detect.sv
`timescale 1ns/1ns
module i3c_hdr_detect(input wire scl,sda,in_hdr);
bit misses_restart=0,restart_as_exit=0;int restarts=0,exits=0,falls=0;bit poss=0;
always @(negedge sda)if(in_hdr&&scl===1'b0)begin falls++;if(falls==4)exits++;end
always @(posedge sda)if(in_hdr&&scl===1'b0)poss=(falls==2);
always @(posedge scl)begin
if(in_hdr&&poss&&!misses_restart)begin if(restart_as_exit)exits++;else restarts++;end
poss=0;falls=0;
end
endmodule
Read included file: i3c_secondary.sv
`timescale 1ns/1ns
module i3c_secondary #(parameter [47:0] PID=48'h0,parameter [7:0] BCR=8'h46,DCR=8'h00)
(inout wire scl,sda,output wire tgt_low,tgt_high,ctl_low,ctl_high);
bit takes_scl_early=0;
i3c_target #(.PID(PID),.BCR(BCR),.DCR(DCR)) tgt(scl,sda,tgt_low,tgt_high);
i3c_ctrl #(.START_AS_CONTROLLER(0)) ctl(scl,sda,ctl_low,ctl_high);
always @(posedge tgt.accmst_sent)if(takes_scl_early)ctl.scl_en=1;
always @(posedge tgt.became_current)begin
#12;ctl.scl_en=1;ctl.stopped=$time;ctl.daa_count=0;ctl.own_da=tgt.da;
for(int g=5;g+3<tgt.ndefs&&g+3<40;g+=4)if(tgt.defs[g]!=0&&tgt.defs[g][7:1]!=tgt.da)begin
ctl.daa_addr[ctl.daa_count]=tgt.defs[g][7:1];ctl.daa_dcr[ctl.daa_count]=tgt.defs[g+1];ctl.daa_bcr[ctl.daa_count]=tgt.defs[g+2];ctl.daa_count++;
end
end
endmodule
Read included file: i2c_legacy.sv
`timescale 1ns/1ns
module i2c_legacy #(parameter [6:0] ADDRESS=7'h50,parameter time FILTER=50,STRETCH=3000)
(inout wire scl,sda,output wire scl_low,sda_low);
bit no_spike_filter=0,legacy_stretches=0;int starts=0,clocks=0,pulls=0;
wire scl_f,sda_f;assign #(FILTER) scl_f=scl;assign #(FILTER) sda_f=sda;
tri1 lscl,lsda;wire hd;
assign lscl=((no_spike_filter?scl:scl_f)===1'b0)?1'b0:1'bz;
assign lsda=((no_spike_filter?sda:sda_f)===1'b0)?1'b0:1'bz;
i2c_target #(.ADDRESS({3'b000,ADDRESS})) dev(lscl,lsda,scl_low,sda_low,hd);
assign scl=scl_low?1'b0:1'bz;assign sda=sda_low?1'b0:1'bz;
always @(legacy_stretches)dev.stretch_ns=legacy_stretches?STRETCH:0;
always @(negedge lsda)if(lscl===1'b1)starts++;
always @(posedge lscl)clocks++;
always @(posedge sda_low)pulls++;
endmodule
Read included file: i2c_target.sv
`timescale 1ns/1ns
module i2c_target #(parameter [9:0] ADDRESS=10'h050,parameter TEN_BIT=0)
(inout wire scl,sda,output reg scl_low=0,sda_low=0,output wire high_drive);
bit ack_not_released=0,ack_wrong_clock=0,stretch_never_released=0,wrong_addr_ack=0,no_stop_detect=0,autoinc_wrap_bug=0,push_pull_target=0,ignores_sr=0;
// Legal receiver responses, not faults. rx_limit counts post-address bytes,
// including the pointer byte; -1 is unlimited. A busy address is declined once.
bit busy_nack=0;int rx_limit=-1,rx_count=0;
// Optional general-call software reset: UM10204 §§3.1.13–14. This model
// restores mem[i]=i and ptr=0; ADDRESS is fixed, not a programmable register.
// Fault switches and bench configuration are not device reset state.
time stretch_ns=0;bit general_call=1,software_reset=1,general_selected=0,reset_pending=0;int resets=0;
reg [7:0] mem[0:255];reg [7:0] ptr=0,shift=0,tx=0;
int state=0,count=0,bytes=0;bit active=0,selected=0,reading=0,need_ptr=1,ack_value=0,ack_active=0,low_addr_next=0,addressed10=0,reading_ack=0;
// state: 0 receive, 1 receiver ACK, 2 transmit, 3 controller ACK, 4 ignore.
assign high_drive=push_pull_target&&!sda_low;
assign sda=sda_low?1'b0:high_drive?1'b1:1'bz;assign scl=scl_low?1'b0:1'bz;
initial for(int i=0;i<256;i++)mem[i]=i[7:0];
function automatic [7:0] increment(input reg [7:0] p);increment=autoinc_wrap_bug?((p+1)&8'h0f):p+1'b1;endfunction
always @(negedge sda)if(scl===1)begin
if(!(ignores_sr&&active))begin active=1;selected=0;state=0;count=0;bytes=0;rx_count=0;shift=0;reading=0;ack_active=0;sda_low=0;low_addr_next=0;general_selected=0;reset_pending=0;end
end
always @(posedge sda)if(scl===1&&active&&!no_stop_detect)begin active=0;selected=0;state=0;count=0;sda_low=0;addressed10=0;end
always @(posedge scl)if(active)begin
if(state==0)begin
shift={shift[6:0],sda};count++;
if(count==8)begin
ack_value=0;
if(bytes==0)begin
reading=shift[0];
general_selected=general_call&&shift==0;
if(general_selected)begin selected=1;low_addr_next=0;end
else if(TEN_BIT)begin selected=(shift[7:3]==5'b11110&&shift[2:1]==ADDRESS[9:8]&&(!reading||addressed10));low_addr_next=!reading;end
else selected=(shift[7:1]==ADDRESS[6:0]||(wrong_addr_ack&&shift[7:1]==ADDRESS[6:0]+1'b1));
if(selected&&busy_nack)begin selected=0;busy_nack=0;end
ack_value=selected;need_ptr=1;
end else if(low_addr_next)begin selected=selected&&shift==ADDRESS[7:0];ack_value=selected;addressed10=selected;low_addr_next=0;end
else if(selected)begin
ack_value=rx_limit<0||rx_count<rx_limit;
if(general_selected)begin
// Unsupported general-call commands are NACKed, never register writes.
ack_value=ack_value&&bytes==1&&software_reset&&shift==8'h06;
reset_pending=ack_value;
end else if(ack_value)begin rx_count++;if(need_ptr)begin ptr=shift;need_ptr=0;end else begin mem[ptr]=shift;ptr=increment(ptr);end end
if(!ack_value)selected=0;
end
bytes++;state=1;ack_active=0;count=0;
end
end else if(state==2)begin count++;if(count==8)begin state=3;count=0;reading_ack=0;end end
else if(state==3&&reading_ack)begin if(sda===0)begin ptr=increment(ptr);tx=mem[ptr];state=2;count=0;end else state=4;end
end
always @(negedge scl)if(active)begin
// Deliberate early-ACK fault: after seven samples, pull for clock 8.
// The address prefix is already known; its R/W bit has not arrived yet.
if(state==0&&count==7&&ack_wrong_clock)begin
if(bytes==0)sda_low=!busy_nack&&((general_call&&shift[6:0]==0)||(TEN_BIT?(shift[6:2]==5'b11110&&shift[1:0]==ADDRESS[9:8]):(shift[6:0]==ADDRESS[6:0]||(wrong_addr_ack&&shift[6:0]==ADDRESS[6:0]+1'b1))));
else sda_low=selected&&(rx_limit<0||rx_count<rx_limit);
end else if(state==1)begin
if(!ack_active)begin
sda_low=ack_value&&!ack_wrong_clock;ack_active=1;
end else begin
sda_low=ack_not_released&&ack_value;ack_active=0;
if(reset_pending)begin
// Finish the ninth ACK clock before resetting and releasing the bus.
for(int i=0;i<256;i++)mem[i]=i[7:0];
ptr=0;shift=0;tx=0;count=0;bytes=0;rx_count=0;need_ptr=1;
selected=0;reading=0;reading_ack=0;low_addr_next=0;addressed10=0;
general_selected=0;reset_pending=0;resets++;sda_low=0;scl_low=0;state=4;
end else if(!selected)state=4;
else if(reading)begin state=2;tx=mem[ptr];count=0;sda_low=!tx[7];end
else state=0;
// Byte-level stretch after the ACK, as in UM10204 §3.1.9. Prepare
// outgoing data before releasing SCL; overlap the controller's LOW.
if(selected&&ack_value&&(stretch_ns>0||stretch_never_released))begin scl_low=1;if(!stretch_never_released)begin #(stretch_ns);scl_low=0;end end
end
end else if(state==2)sda_low=!tx[7-count];
else if(state==3)begin sda_low=0;reading_ack=1;end
else if(state==4)sda_low=0;
end
endmodule
Read included file: i3c_mon.sv
`timescale 1ns/1ns
// Bus decoder: one line per frame, from SCL and SDA only. The ninth bit is an ACK after an address and a
// T-bit after a data word (§5.1.2.3); frames to the legacy address are decoded as I2C. phase (an output
// the checker reads): 0 idle, 1 header after S, 2 header after Sr, 3 ACK, 4 write word, 5 read word,
// 6 DAA ID, 7 DAA address, 8 DAA ACK, 9 HDR, 10 I2C byte, 11 I2C ACK, 12 waiting for Sr or P.
module i3c_mon #(parameter [6:0] LEGACY=7'h50)(input wire scl,sda,output reg [3:0] phase=0);
bit trace=0,active=0,daa=0,hdr=0,legacy=0,code_next=0;int cnt=0,frames=0,starts=0,exits=0,falls=0;
reg [63:0] sh=0;reg [6:0] addr=0;bit rw=0;string text="";
always @(negedge sda)if(scl===1'b1&&!hdr)begin
if(active)text={text," Sr"};else begin text=" S";daa=0;legacy=0;end
phase=active?2:1;active=1;cnt=0;sh=0;starts++;code_next=0;
end
always @(posedge sda)if(scl===1'b1&&active&&!hdr)begin
text={text," P"};if(trace)$display("%s%s",legacy?"I2C":"I3C",text);text="";active=0;phase=0;frames++;
end
// HDR Exit Pattern: four SDA falls while SCL stays low (§5.2.1.1). Seen in or out of HDR (M2 recovery).
always @(negedge sda)if(scl===1'b0&&(hdr||active))begin falls++;if(falls==4)begin hdr=0;falls=0;text={text," EXIT"};exits++;phase=12;end end
bit poss=0;int restarts=0;
always @(posedge sda)if(scl===1'b0&&hdr)poss=(falls==2);
always @(posedge scl)begin if(hdr&&poss)begin text={text," RESTART"};restarts++;end poss=0;falls=0;end
always @(posedge scl)if(active&&!hdr)begin
sh={sh[62:0],sda};cnt++;
case(phase)
1,2:if(cnt==8)begin addr=sh[7:1];rw=sh[0];cnt=0;
if(phase==1&&addr==LEGACY)legacy=1;
text={text,$sformatf(" %02h %s",addr,rw?"R":"W")};phase=legacy?11:3;end
3:begin cnt=0;text={text,sda===1'b0 ? " A" : sda===1'b1 ? " NA" : " A=x"};
if(sda!==1'b0)phase=12;
else if(daa&&addr==7'h7e&&rw)phase=6;
else if(!rw)begin phase=4;code_next=(addr==7'h7e);end
else phase=5;
end
4,5:if(cnt==9)begin cnt=0;text={text,$sformatf(" %02h T%0d",sh[8:1],sh[0])};
if(phase==4&&code_next)begin code_next=0;
if(sh[8:1]==8'h07)daa=1;
if(sh[8:1]>=8'h20&&sh[8:1]<=8'h27)begin hdr=1;falls=0;phase=9;text={text," HDR"};end
end
if(phase==5&&sh[0]===1'b0)phase=12;
end
6:if(cnt==64)begin cnt=0;text={text,$sformatf(" id %012h bcr %02h dcr %02h",sh[63:16],sh[15:8],sh[7:0])};phase=7;end
7:if(cnt==8)begin cnt=0;text={text,$sformatf(" da %02h par %0d",sh[7:1],sh[0])};phase=8;end
8:begin cnt=0;text={text,sda===1'b0 ? " A" : sda===1'b1 ? " NA" : " A=x"};phase=12;end
10:if(cnt==8)begin cnt=0;text={text,$sformatf(" %02h",sh[7:0])};phase=11;end
11:begin cnt=0;text={text,sda===1'b0 ? " A" : sda===1'b1 ? " NA" : " A=x"};phase=10;end
default:cnt=0;
endcase
end
endmodule
Read included file: i3c_checker.sv
`timescale 1ns/1ns
// Wire rules with the driver view. Index 0 of lows/highs is the controller; the others are targets.
// Each rule prints at most once per frame (S to P) and counts every time it fires.
// no_pp_contention one device drives SDA high while another pulls it low (§5.1.2.3: handoffs are specified)
// od_in_header a device drives SDA high in the arbitrable header after S or its ACK (§5.1.2.2.1)
// pp_in_data the controller sends a 1 in a write word without driving it high (§5.1.2: data is push-pull)
// t_bit the ninth bit of a write word is not XOR(data, 1) (§5.1.2.3.3)
// ibi_mdb_present no target drives the byte after an accepted header after S with R (BCR[2] = 1, §5.1.6.2)
// legacy_no_stretch a legacy target pulls SCL low (MIPI v1.0 Table 56: no clock stretching on I3C)
module i3c_checker #(parameter N=4)(input wire scl,sda,input wire [N-1:0] lows,highs,input wire [3:0] phase,input wire legacy_scl_low);
int broken=0,contention=0,od_header=0,pp_data=0,tbit=0,mdb=0,stretch=0;bit quiet=0; // quiet: count, do not print
reg [5:0] said=0;reg [3:0] ph=0,prev=0;reg [8:0] w=0;int k=0,hk=0,mk=0;bit arb_ack=0,hdr_rw=0,mdb_seen=0,mdb_watch=0,viol=0;
task automatic bad(input int i,input string rule);broken++;if(!said[i]&&!quiet)$display("I3C CHECK %s at %0t",rule,$time);said[i]=1;endtask
always @(negedge sda)if(scl===1'b1)begin k=0;viol=0;end
always @(posedge sda)if(scl===1'b1)said=0;
always @(negedge scl)begin prev=ph;ph=phase;if(ph!=prev)begin k=0;hk=0;end
if(ph!=prev&&ph==3)arb_ack=(prev==1);
if(ph==5&&prev==3&&arb_ack&&hdr_rw)begin mdb_watch=1;mdb_seen=0;mk=0;end
end
always @(lows or highs)begin #1;if(|lows&&|highs)begin contention++;bad(0,"no_pp_contention");end end
always @(posedge scl)begin
if((ph==1||(ph==3&&arb_ack))&&|highs)begin od_header++;bad(1,"od_in_header");end
if(ph==1)begin hk++;if(hk==8)hdr_rw=(sda===1'b1);end
if(ph==4)begin k++;w={w[7:0],sda};
if(k<=8&&sda===1'b1&&!highs[0])viol=1;
if(k==9)begin if(viol)begin pp_data++;bad(2,"pp_in_data");end if(w[0]!==~^w[8:1])begin tbit++;bad(3,"t_bit");end k=0;viol=0;end
end
if(mdb_watch)begin mk++;if(|lows[N-1:1]|||highs[N-1:1])mdb_seen=1;
if(mk==8)begin mdb_watch=0;if(!mdb_seen)begin mdb++;bad(4,"ibi_mdb_present");end end
end
end
always @(posedge legacy_scl_low)begin stretch++;bad(5,"legacy_no_stretch");end
// A missing mandatory byte turns the controller's handoff release into a STOP inside the ACK slot.
always @(posedge sda)if(scl===1'b1&&ph==3&&arb_ack&&hdr_rw)begin mdb++;bad(4,"ibi_mdb_present");end
endmodule
Check Yourself
Remember
- Multi-device faults need multi-device programs: two targets for DAA ties, two IBIs for header contention.
- Each program catches at most two of the seven faults; only the full set catches them all.
- The checker and the driver view catch illegal wires; self-checks catch legal wires with the wrong effect.
- The legacy neighbour is part of the bench because coexistence is part of the bus.
- A green cell says the program could not see the fault, not that the fault is absent.
Practice
- Catch Contention and Legacy Stretching Verify · Medium