The controller is checking an unauthorized image. Its six-bit state changes from CHECK to RELEASE without a completed authorization. The new code is legal. A state decoder recognizes it and opens the gate. We first count which substitutions can do that.
Write the whole state map
An equipment room uses six-position signs for waiting, checking, release, and error: WAIT, CHECK, RELEASE, and ERROR. Only four patterns are named; all others are invalid. Each named pair differs in four positions, so one to three alterations cannot reach another named sign, while four can. The distance concerns stored state only. It does not establish that the equipment was checked or the student was authorized.
Video timing correction (English 01:17–01:24): The film says the default branch runs after the accepting edge, which conflates calculation with storage. Combinational logic can calculate next-state ERROR before the edge; the state register updates after sampling at that edge. Current outputs still need their own safe handover gating. Use this distinction when viewing that passage. The original film and captions remain intact; this is an explicit correction, not a claim that the film was remade.
A finite-state machine, FSM, stores its current phase in a register. Sparse encoding assigns a small set of legal values within a larger bit space. The unassigned values are useful only if the implementation recognizes them and rejects unsafe outputs.
Our original six-bit map is WAIT=000000, CHECK=001111, RELEASE=110011 and ERROR=111100. All six distinct state pairs differ in four bits. Checking only CHECK-to-RELEASE would miss a closer pair elsewhere; the minimum must cover the entire map.
One, two or three stored-bit flips cannot turn any named state into another named state in this map. They produce invalid values. Four flips can reach another valid state. Distance therefore supports a bounded substitution claim when the legality check and output gate remain trusted.
Which flips does distance exclude?
CHECK is 001111. Mask 111100 changes it to 110011, RELEASE. Although the mask matches ERROR’s 111100 pattern, it only names positions to alter; it is not the resulting sign. XOR first, then consult the state map, rather than reading CHECK→ERROR. This is mask 60. It exceeds a three-position budget and does not demonstrate normal flow reaching RELEASE.
| Name | Six stored bits | Hex |
|---|---|---|
| WAIT | 000000 | 00 |
| CHECK | 001111 | 0f |
| RELEASE | 110011 | 33 |
| ERROR | 111100 | 3c |
Compute CHECK XOR RELEASE: 001111 XOR 110011 = 111100. Four ones mean distance 4. The other five pairs—WAIT/CHECK, WAIT/RELEASE, WAIT/ERROR, CHECK/ERROR and RELEASE/ERROR—also have four ones in their XOR. One to three flips cannot turn any named state into another named state. They can produce an invalid value, which still needs same-edge rejection.
Decimal mask=60 is hex 3c, or binary 111100. CHECK XOR mask = 001111 XOR 111100 = 110011, producing RELEASE. The mask happens to match ERROR’s codeword, but a mask is an operand, not the resulting state. Four flips exceed the one-to-three-bit budget. This witness neither refutes the bounded claim nor makes that claim cover four-bit faults.
In RELEASE, exact decoding and the illegal-state check both pass. Permission still depends on whether this transaction was authorized. Binding authorization blocks this unauthorized substitution. The substitution exercise does not prove normal FSM reachability.
Block unsafe output in the current cycle
The desk must reject an unknown sign before this handover. A promise to replace it with ERROR at the next bell changes next state; it cannot undo equipment already released. This separates exact current RELEASE decoding from a next-state default. Exact equality already refuses invalid signs, so a nearby bad label is not a second independent defense. The story also does not guarantee these encodings survive synthesis.
A default branch can compute ERROR before the edge, but the state register changes only after sampling at that edge. If an unsafe output decoder already permits an invalid current state, next-cycle recovery is too late. Decode RELEASE with full equality and let present invalid state suppress the same accepting edge.
Our small decoder grants only state==RELEASE. Invalid states are reported separately as bad. A sticky flag could record them for later recovery; it cannot replace current blocking. In this specific decoder equality already rejects invalid states, so do not claim a second gate independently adds coverage.
An encoding constant in RTL does not prove that synthesis preserves it. Examine recoding, register width and output cones in the produced netlist. OpenTitan provides a primitive flop wrapper for sparse FSM storage; its assertions and instantiation do not by themselves prove a complete controller secure. Sparse FSM source
Enumerate substitutions without confusing transitions
This experiment begins with a stored CHECK sign and observes handover at edge 1 after one alteration. Four changed positions produce valid RELEASE, so the format checker reports no invalid state even though original permission is refused. Bind adds independent authorization from the harness. The exercise substitutes a sign; it does not execute the full WAIT→CHECK→RELEASE flow or implement the harness permission in a product.
The main experiment begins with a captured CHECK. One event XORs its six stored bits before accepting edge 1. All sixty-four masks are examined. The reference image is unauthorized. The state decoder, source, clock/reset and final consumer remain trusted.
Mask 111100, hexadecimal 3c, changes 001111 into 110011. The decoder sees valid RELEASE, bad stays false and the request commits. That mask affects four bits. It lies outside a three-bit claim and inside a four-bit expanded budget.
The optional bind policy also requires independent authorization. It blocks this valid-state witness because the current image lacks permission. The model supplies that value from a trusted harness. The exercise identifies the missing condition; a real design must establish its provenance and integrity.
Find the nearest valid release code
Alter one CHECK position to see refusal, then four to obtain RELEASE and see acceptance without binding. Other four-position changes can reach WAIT or ERROR: no handover does not necessarily mean an invalid-state report. These are legal destinations among the 64 masks. An authorized, unaltered RELEASE control checks decoding only; the next lesson tests a transaction’s flow.
Select CHECK, mask 1 and no binding. The result is invalid and commit is false. Try masks of weight two or three. Then enter 60, the decimal form of 0x3c. The displayed code becomes RELEASE and the request is accepted. Save this trace beside the state map.
The executed campaign checked every mask from CHECK and every state-pair distance. Exactly one of the sixty-four CHECK masks reached unauthorized RELEASE. Other four-bit masks can reach WAIT or ERROR and still remain legal. No-commit traces therefore must not all be labeled detected.
Set RELEASE, authorization true, binding true and mask zero for the positive decoder control. Lesson 8 separately runs a normal WAIT-to-CHECK-to-RELEASE transaction. A decoder control alone does not show the full controller reaches release or that its transition conditions are authentic.
Proposed RTL / SVA
The four signs become RTL constants. The desk compares against full RELEASE and checks separately justified auth_bound_i. For every recorded handover, the audit checks reference_complete and reference_pass. Paper signs illustrate encodings only. Uncompiled SVA does not prove the synthesized representation, scan access, or output path is safe.
Read this lesson’s property: State codes and authorization
An auditor asks separately whether the sign is valid and whether this handover is authorized. A four-position substitution to RELEASE passes the first check but fails the independent permission assertion. Cover uses authorized RELEASE to check one releasable case. Permanent WAIT can satisfy rejection while providing no service. These checks still do not establish trustworthy transition conditions.
SVA means SystemVerilog Assertions. An assertion checks a rule; it is not the permission gate. At each rising edge outside reset, if accepted_commit (csr_commit in Lesson 9) is one, |-> requires the right-hand condition on that same edge. With no acceptance, this implication raises no authorization failure; positive controls must still demonstrate useful work. disable iff (!rst_n) excludes active reset, without proving reset safety.
Cover seeks one matching path, rather than proving every transaction correct. Reference independently records the expected result in the testbench. The harness supplies inputs, fault budgets and this oracle; DUT means design under test. A two-state model uses only 0/1 logic, excluding X and intra-cycle delay; it does not mean a two-state FSM. Revisit Lesson 1 section 5 for syntax and wiring comparisons. These snippets have not been compiled, so listing a property does not establish a proof.
localparam logic [5:0] Wait=6'h00, Check=6'h0f, Release=6'h33, Error=6'h3c;
assign illegal = !(state_q inside {Wait,Check,Release,Error});
assign grant = (state_q == Release) && !illegal && auth_bound_i;
assert property (@(posedge clk) disable iff (!rst_n)
accepted_commit |-> reference_complete && reference_pass);
cover property (@(posedge clk) disable iff (!rst_n)
state_q == Release && reference_pass && accepted_commit);The RTL/SVA sketch has not been compiled. ERROR reachability, output decode failures, scan access and synthesis recoding are separate obligations. Revisit lesson 4 and its separate grant target to test a corrupted post-decoder output; this storage-only campaign excludes that target. A minimum distance of four says nothing about a faulty CHECK condition choosing a legal next state. That is the next lesson.
Fault laboratory
In the lab, raw, seen, and state represent the original sign, altered pattern, and decoded name. Bad reports invalid patterns; commit records handover. Reset, retain the same refused eligibility, and toggle binding to see why even valid RELEASE must be refused. The experiment adds neither a real transition history nor measured door timing.
Executed finite, two-state teaching model. RTL simulation, synthesis, formal proof and silicon validation have NOT run. Reference fields are trusted testbench observations; they are not additional chip defenses.
Check your reasoning
Give a classmate all four signs. Ask for the six pair distances, which substituted sign permits a handover, and whether next-edge ERROR can stop a current handover. These correspond to the complete map, output decoding, and acceptance edge. Minimum distance four still says nothing about a false condition selecting a legal next state.
1. How many distinct pairs must this map check?
Six.
2. Does a three-bit fault reach another named state?
No, within this map.
3. Which mask changes CHECK to RELEASE?
0x3c, decimal 60.
4. Does default: ERROR guarantee current-edge blocking?
No; output gating must already be safe.
5. Which evidence must be checked after synthesis?
Actual state codes, storage width and output cone preservation.
MY ACADEMY · LESSON FILM
Lesson video
The film explains this lesson’s data path. After a section, return to the interactive exercise and change the input or fault conditions. The animation presents a teaching model; it does not replace RTL simulation.
Narration uses a synthetic voice. Both the interaction and animation have model boundaries; interpret results using this lesson’s sources and validation scope.
This lesson’s interactive fault laboratory
This laboratory executes a finite, two-state teaching model. RTL/SVA examples remain proposed: RTL simulation, synthesis, formal proof, timing closure and silicon validation have not run. Enumeration counts are not physical attack probabilities.
Wrap-up: take this lesson into a design review
Keep the CHECK sign, four-position mask, and unauthorized handover record together, rather than only a valid RELEASE screenshot. The same equipment-room case grounds the storage budget and authorization gap below. Normal flow and implementation checks remain separate; one sign does not establish the whole controller.
- Threat model and assumptions
Alter the six-position CHECK sign once and inspect handover at edge 1. The at-most-three-position claim trusts decoding and permission and excludes four-position substitution.
One six-bit state XOR before edge 1, all sixty-four masks from CHECK; distance claim limited to weight below four. Other logic and reference remain trusted.
- Why the design fails
Four positions change CHECK into valid RELEASE, yet the student lacks permission. A named sign and actual authorization are different conditions.
Four flips form legal RELEASE. A legality decoder sees no error, while authorization remains false.
- Defenses
Decode full RELEASE, verify independent eligibility, and check that implementation preserves the encoding. Another sign alone does not establish an authorization source.
Strict state/output decoding plus independently justified authorization; verify synthesis preserves the intended representation.
- Validation and checks to perform
Check six pair distances and all 64 CHECK masks, then authorized RELEASE. The latter tests decoding; normal waiting flow is separate.
Node checked all pair distances and sixty-four CHECK masks, plus authorized RELEASE decoding. Normal flow is tested in lesson 8.
- Limits and unverified claims
Substituting a sign does not traverse checking. This trace is not transition, scan, or physical validation; the next lesson covers normal flow.
No transition, netlist, scan, physical or formal result follows from this decoder enumeration.
Try a changed assumption
Move one named sign closer to CHECK, recompute all six distances, and find new one- or two-position substitutions. Checking only CHECK/RELEASE can miss the new minimum.
Replace one code with a closer value. Recompute the minimum and identify the newly allowed lower-weight substitution.
This wrap-up summarizes the lesson’s teaching cases, references and experiment scope. Checks not reported as completed remain future work.