Metastability and MTBF

`timescale 1ns/1ps
module tb;
  logic clk = 0;
  always #5 clk = ~clk;                   // the sampling clock: rising edges at 5, 15, 25, ... ns
  logic clk_a = 0;                      // the second clock: rising edges at 3.7, 11.1, ... ns
  initial begin
    #3.7;
    forever begin clk_a = 1; #3.7; clk_a = 0; #3.7; end
  end
  logic rst_n = 1;                        // falls at 1 ns: a real edge, so asynchronous resets act before any clock
  int edge_n = -1;                        // the number of the last rising edge of clk
  always @(posedge clk) edge_n = edge_n + 1;
  logic status = 0;                       // the clk_a domain's status flop
  realtime t_change = -100.0;             // when status last changed
  logic idle_q, busy_q;
  int   n_a = 0;
  always @(posedge clk_a) if (rst_n) begin   // the sender: status changes every 3 edges of clk_a
    n_a <= n_a + 1;
    if (n_a % 3 == 2) begin status <= ~status; t_change = $realtime; end
  end
  bit quiet = 0;                          // set after the first 24 edges; the counts go on

  // ---- The metastability model. It is a model: an RTL flop is never metastable. ----
  // 1. When status changed less than WINDOW before an edge of clk, the flop s1 that sampled it is
  //    metastable. It settles to the old or the new value, at random.
  // 2. Settle time: every nanosecond, an unsettled flop stays unsettled with probability 1/2.
  // 3. A flop that samples s1 before it settles reads its own random bit. The state flops have
  //    SLACK_FSM ns left after their next-state logic; a flop with nothing in front has the period.
  // The model writes into the design's flops from here. A model may; design code never should
  // (IEEE 1800-2017 9.2.2.4 gives an always_ff variable one writer; Icarus and Verilator allow this).
  localparam realtime WINDOW = 1.0;
  localparam int SLACK_FSM = 2, PERIOD = 10;
  int unsigned seed = 4;                  // fixed seed: every run prints the same lines
  function automatic bit coin();          // a fair coin from a linear congruential generator
    seed = seed * 32'd1664525 + 32'd1013904223;
    return seed[31];
  endfunction
  int stages = 0;                         // flops from status to the state machine, timed once
  initial begin : calibrate
    int k0;
    @(posedge dut.s1) k0 = edge_n;        // the first change reaches s1 ...
    @(posedge busy_q) stages = edge_n - k0;   // ... and the state machine stages edges later
  end
  int metastable = 0, late = 0, illegal = 0;
  bit was, v; int settle; realtime ahead;
  always @(posedge clk) if (rst_n && stages > 0 && $realtime - t_change < WINDOW) begin : model
    was = dut.s1; settle = 0; ahead = $realtime - t_change;
    metastable++;
    #0.01 v = coin() ? status : was;      // the value s1 settles to
    dut.s1 = v;
    while (settle < 20 && coin()) settle++;
    if (!quiet) $display("  model: status changed %0.2f ns before e%0d; s1 settles to %b after %0d ns", ahead, edge_n, v, settle);
    if (stages == 1 && settle >= SLACK_FSM) begin   // the state flops sample s1 unsettled
      @(posedge clk); #0.01;
      late++;
      dut.idle_q = ~coin();               // each state flop read its own bit
      dut.busy_q = coin();
    end
    else if (stages > 1 && settle >= PERIOD) late++;   // the second flop samples s1 unsettled
  end
  always @(posedge clk) begin #1; if (rst_n && idle_q === busy_q) illegal++; end
  status_rx dut (.clk(clk), .rst_n(rst_n), .status(status), .idle_q(idle_q), .busy_q(busy_q));
  // Advance to the next rising edge of clk, wait for the design to settle, then print.
  task automatic tick();
    @(posedge clk); #1;
    if (quiet) ;
    else if (idle_q === busy_q) $display("e%0d status=%b s1=%b idle_q=%b busy_q=%b ILLEGAL", edge_n, status, dut.s1, idle_q, busy_q);
    else $display("e%0d status=%b s1=%b idle_q=%b busy_q=%b", edge_n, status, dut.s1, idle_q, busy_q);
  endtask
  initial begin
    #1 rst_n = 0; tick(); tick(); rst_n = 1;   // asserted at 1 ns, clk edges 0 and 1 in reset, released 1 ns after edge 1
    repeat (22) tick();
    quiet = 1;
    repeat (1976) tick();
    $display("edges=%0d metastable=%0d read_unsettled=%0d illegal=%0d", edge_n + 1, metastable, late, illegal);
    $finish(0);                             // quiet: no "$finish called" line
  end
endmodule