Kiln Certificate Bridge

A pottery plant scans a short ticket for each fired batch. The scanner and label printer run on separate clocks.

An old direct link sometimes mixed the job number from one ticket with the recipe from the next. The wrong label then followed the batch into shipping.

Check each ticket on the scanner clock. Carry each good job and recipe safely to the printer clock. Then print its six-word record.

The printer may stop on any word. While one ticket crosses or prints, the scanner must wait before it starts another.

Interface

Port	Direction	Type	Description
scan_rst_i	in	1 bit	Synchronous active-high reset for the scanner domain
scan_clk_i	in	1 bit	Scanner-side clock
print_rst_i	in	1 bit	Synchronous active-high reset for the printer domain
print_clk_i	in	1 bit	Printer-side clock, unrelated to scan_clk_i
kiln_id_i	in	9-bit vector	This kiln's identifier
revision_i	in	7-bit vector	Certificate format revision
health_i	in	5-bit vector	Current printer health code
ticket_valid_i	in	1 bit	A scanner ticket word is present
ticket_first_i	in	1 bit	Marks the first transferred ticket word
ticket_last_i	in	1 bit	Marks the final transferred ticket word
ticket_word_i	in	12-bit vector	Scanner ticket word
ticket_ready_o	out	1 bit	Scanner word can transfer
cert_valid_o	out	1 bit	A certificate word is present
cert_ready_i	in	1 bit	Printer accepts the presented certificate word
cert_word_o	out	12-bit vector	Certificate word
cert_last_o	out	1 bit	High only on the sixth certificate word

kiln_id_i, revision_i, and health_i may change only while both resets are high. They remain stable after reset release.

Scanner ticket

A scanner word transfers on a rising scan_clk_i edge when both ticket_valid_i and ticket_ready_o are high. A ticket has exactly four transferred words. ticket_first_i is high only on word 0, and ticket_last_i is high only on word 3.

The scanner may leave any number of cycles between transferred words. While ticket_valid_i is high and ticket_ready_o is low, it must either hold the word and both markers stable or withdraw the offer before ready returns.

Word	Layout
0	Signature 12'hB6D
1	Opcode 3'b101 in bits 11 through 9; target kiln in bits 8 through 0
2	12-bit job token
3	7-bit recipe in bits 11 through 5; guard 5'b11010 in bits 4 through 0

Accept a ticket only when its length, markers, signature, opcode, target kiln, and guard all match. Reject malformed tickets silently.

Ignore transferred words while no ticket is active unless ticket_first_i is high. If a new first word transfers during a partial or overlength ticket, abandon the old ticket and begin again with that word.

Certificate

For every accepted ticket, emit exactly six words in this order:

Word	Value
0	12'hC7A
1	Captured job token
2	Three zero bits followed by kiln_id_i
3	Five zero bits followed by the captured recipe
4	revision_i followed by health_i
5	Job token XOR (three zero bits followed by kiln_id_i)

cert_last_o is high only with word 5. A certificate word transfers on a rising print_clk_i edge when both cert_valid_o and cert_ready_i are high. While valid is high and ready is low, cert_valid_o, cert_word_o, and cert_last_o remain unchanged.

After word 5 transfers, cert_valid_o and cert_last_o go low. At least one full print-clock cycle separates two certificates.

One-outstanding crossing

The bridge accepts only one ticket at a time. Its one-entry bundled-data crossing follows this sequence:

1. The scan side stores the 19-bit job-and-recipe descriptor, then flips its request toggle.
2. The scan side holds that descriptor unchanged and keeps ticket_ready_o low.
3. The request passes through at least two print_clk_i flip-flops before printer logic uses it.
4. The printer captures the stable descriptor and emits the complete six-word certificate.
5. Only after word 5 transfers does the printer copy the request toggle into its acknowledgement toggle.
6. The acknowledgement passes through at least two scan_clk_i flip-flops before ticket_ready_o rises.

Do not synchronize each descriptor bit independently. Its safety comes from remaining stable for the whole request, print, and acknowledgement transaction.

Printer control samples the two-stage synchronized request on a later edge. A certificate cannot start before the third print_clk_i rising edge strictly after the scan-side request toggle. ticket_ready_o cannot return before the second scan_clk_i rising edge strictly after the final certificate transfer.

Reset

Both resets are synchronous and active high in their own domains. They are power-up resets only. The bench asserts them together for several edges of both clocks. It changes configuration only while both are high. It then releases each on a falling edge while scanner traffic is quiet.

After a reset edge in its domain, the scan side drives ticket_ready_o low. The print side drives cert_valid_o, cert_word_o, and cert_last_o low. No reset is asserted again until the next independent test phase.

What the bench checks

• Exact field filtering, marker rules, and all six output words across varied reset-time configurations
• Unrelated clock periods and changing phase relationships
• Legal gaps between ticket words and restart from a new first marker
• Long stalls on every output word, including stable data and final-word marking
• Strict one-outstanding capacity while a request is crossing or printing
• ticket_ready_o stays low until the final output transfer and a two-stage acknowledgement return
• The certificate cannot begin before a two-stage request crossing
• Short, overlength, unmarked, and individually corrupted tickets produce no output
• No duplicated, dropped, reordered, or phantom certificates

Constraints

CLOCK DOMAINS: scanner parsing and descriptor writes use only scan_clk_i. Certificate generation and descriptor reads use only print_clk_i.

CDC: request and acknowledgement each require at least two receiving-domain flip-flops. Hold the bundled descriptor stable until the complete certificate transfers and its acknowledgement returns.

A simulator cannot model metastability. The bench enforces minimum crossing latency, but the two-stage rule remains part of the contract.

HANDSHAKES: scanner and printer words both use valid and ready. Scanner fields remain stable for as long as a stalled offer stays valid, though the scanner may withdraw it. The bridge must hold every stalled printer output valid and unchanged until transfer.

SCOPE: the scanner, kiln controls, and physical printer are outside this block. Do not add ports.