Crossing | CP-1 direction / protocol / owner |
|---|---|
Input complete beat | clk_io -> clk_dp async FIFO; includes owner/framing/status. Source-registered Gray pointers with source-step delay/skew constraints, interstage timing and both-end reset ownership |
Output complete beat | clk_dp -> clk_io async FIFO with identical framing/epoch ownership; hold the external offer independently of internal FIFO reset until shared cancellation is authorized |
START/config snapshot | clk_io -> clk_dp acknowledged stable bundled-data handshake; constrain every bit before earliest capture; one pending configuration; no new operation until completion |
Done/error and final counters | clk_dp -> clk_io acknowledged response record containing epoch/operation, counters and status. Hold until ack; set sticky IO IRQ from that record. No open-loop event toggle or independent per-bit counter synchronization |
Diagnostic live counters (extension) | Explicit snapshot request/ack, or a source-registered unit-step Gray counter with wrap/sampling and skew bounds; not a coherent bitwise binary bus |
Slow readiness level | Local -> clk_io synchronized status; stale status is not immediate fault detection. It participates in a fresh recovery barrier |
Reset/fault/epoch | Always-running clk_io supervisor owns containment and coordinated FIFO/handshake restart; per-domain synchronous release and fresh acknowledgements before epoch reuse |
Every arrow that leaves a box is one row of the table above. Solid arrows carry work; dashed arrows carry control and status.
Assert both domains into safe state.
Release each reset synchronously to its own clock.
Wait for consumer alive/ready before producer sends work.
Define behavior if one domain resets during a transaction.
Verify several clock ratios, phase relationships, and one-sided resets.
The CDC stage produces an explicit recovery rule for stage 5: arithmetic starts only after configuration acknowledgement and a fresh recovery barrier, not alive alone. A one-sided reset first closes admission and invalidates the operation. Flush/reinitialize both FIFO endpoints and request/ack history; acknowledge the new recovery epoch from each clock domain before reuse. Keep old epoch/operation records long enough to classify cancellation, not merely clear the scoreboard.
Step | Supervisor / interface | Accounting and reopening |
|---|---|---|
Epoch7: accepted A/B/C, delivered A | B offered but stalled, C buffered behind B | Two accepted owners remain live |
DP reset/fault detected; DP clock unavailable | Close admission; latch fault; keep B offered unchanged unless the sink participates in shared interface reset | Do not cancel or reinterpret B/C solely from a stale peer-alive flag |
Shared IO/sink reset acknowledged | Authorize cancellation of outstanding old stream offers and complete FIFO flush | Record B/C as cancelled in epoch7 with reset reason; accepted3 = delivered1 + discarded2 |
Peer remains stopped through 1024-cycle recovery watchdog | Keep fault/containment; no readiness or synthetic ack | Epoch8 cannot open; a fixed source-domain timer is not peer evidence |
Peer clock returns and explicit recover is requested | Release locally, complete fresh req/ack flush barrier, confirm both endpoint histories idle | Open epoch8 only after both acknowledgements; late epoch7 response cannot complete epoch8 work |
If the sink cannot acknowledge shared cancellation, preserve B until its handshake and remain closed; no reset-controller assertion may silently retract it. The controller must meet a bounded fault-detection/containment budget, and the scoreboard accounts for work accepted before closure. Use the always-on recovery pilot as a controller-contract starting point, not proof of this integrated peripheral. Actual FIFO resources have their own reset/busy/clock requirements, which implementation must satisfy.
Bits can settle on different cycles and create a configuration that never existed. Hold a snapshot stable and cross it with a handshake.