Decision | CP-1 baseline / optional extension |
|---|---|
Input/output format | Signed Q1.15 sample and coefficient; one output per input |
Intermediate width | 32-bit full product F=30; no accumulator in baseline |
Quantization | Nearest-even once; truncation is a separately specified extension |
Overflow | Saturate once; wrapping is an extension with different expected results |
FIFO protection | 32-bit payload SECDED plus metadata parity; parity-only is an alternative detection-only variant |
Fault injection | One-shot XOR after encoding/before checking for transient experiments; persistent corruption needs storage modification and repair/reread evidence |
The arithmetic and reliability decisions now extend the transaction model rather than creating a separate example: data, packet metadata, correction status, and poison state remain aligned through the same pipeline and output scoreboard.
Read top down along one beat. Only the payload goes through the decoder; metadata has its own check.
For SECDED, a correctable payload error is corrected before arithmetic/use and sets ce on the aligned beat. With trusted metadata, an uncorrectable payload sets ue/poison, forces output data to zero, and raises sticky error/IRQ. Baseline payload UE stops acceptance of new packets, completes the currently open input packet, and drains already accepted work; the poisoned beat still retires as delivered. CE/UE snapshots count flagged delivered beats; repeated storage corrections on one beat still count once, and a fault cancelled before delivery is not counted as a delivered UE. Preserve keep/last/owner from trusted metadata; if metadata itself is untrustworthy, quarantine and coordinated-reset cancellation are required, not forwarding a guessed tag or LAST.
A parity-only variant cannot correct and must not produce CE. It detects an odd-bit corruption under its stated fault model, then poisons/contains or cancels under the agreed policy. SECDED guarantees also require the assumed at-most-two-bit fault model. Protection for metadata must be strong enough to preserve ownership or use a separately trusted record; simple parity does not detect every corruption.
Partial final beat | Required aligned result |
|---|---|
Epoch7/op3/tag1/index2, KEEP=0011, LAST=1; one payload bit corrupted in protected storage | SECDED corrects before transform; preserve KEEP/LAST/owner; CE=1, UE=0, poison=0. Increment CE once when this beat transfers at the output |
Same final beat, detected uncorrectable payload error; metadata remains trusted | Output data=0, KEEP=0011, LAST=1, UE=1, poison=1; consumer closes that packet as failed, not valid numeric data. One delivered beat, not a hidden discard |
Detected metadata corruption | Do not guess packet termination or error address from corrupt metadata. Quarantine the affected operation and cancel via coordinated reset; classify remaining owners explicitly |
Transient XOR removed / persistent fault repaired | Transient removal shows normal decode only; prove stored repair by removing injection and rereading the repaired storage, including scrub/write arbitration |
It emulates corruption in storage or transit without changing the normal encoder, allowing the real decoder and reporting path to be tested.