Pipe Guard Kick Window

The electrical cabinet at Marsh Lane pushes a small protective current into 11 km of buried gas pipe. That current is what stops the pipe from corroding. The cabinet's controller board locks up in thunderstorms. A watchdog should catch that: a checker circuit that the firmware must pulse (kick) at regular intervals to prove it is alive. But the plain watchdog got fooled last autumn. A failed firmware update left the board in a boot loop, and the startup code pulses the kick line first thing. So the board kicked, crashed, and rebooted, around and around. After 6 weeks of that, the pipe's protective voltage was out of spec down the whole southern section. Corrosion does not send alarms.

Your task: build the replacement supervisor. It watches when the kick arrives, not just whether it arrives. A kick that lands too soon means the firmware is stuck in a loop, and that is as much a fault as silence. The service switch en disarms the supervisor for board swaps. Arming grants one full period of grace, because a freshly booted controller cannot hit a window it has never seen. The two fault flags, early and late, run to the telemetry dialer on separate wires. That way the repair crew knows whether to bring a firmware probe or a spare board.

Interface

Behavior

• Everything is sampled at rising clock edges
• When en is sampled high while the supervisor is disarmed (after reset, or after any edge that sampled en low), that edge arms it. Call the edges that follow position 1, 2, 3 and so on
• Arming opens the grace period: the first kick may land at any position 1 through 16 with no early fault possible. The arming edge itself does not sample the kick line
• A kick sampled high at an allowed position is accepted, and position counting restarts at the following edge
• After an accepted kick the window rules apply: positions 1 through 8 are closed, and a kick sampled at any of them sets early
• Positions 9 through 16 are open, and a kick there is accepted
• If position 17 is reached with nothing accepted since the last accept or arm, late sets at that edge
• A kick arriving at position 17 does not rescue the period; the deadline has already passed
• A kick held high across an accepted position is sampled again one edge later, at position 1 of the new period. That position is closed, so it sets early: a hung controller pinning the line high is a fault, not a heartbeat
• early and late are sticky: once either is set the supervisor freezes, kicks are ignored, and the other flag can no longer set
• en sampled low at any edge disarms and clears both flags at that edge. The next edge that samples en high arms afresh with a new grace period
• rst = 1 at an edge clears both flags and disarms regardless of en; kicks are ignored while disarmed

What the bench checks

• The testbench checks early and late on every cycle
• The testbench drives kicks at positions 8, 9, 16 and 17 exactly, the grace period from both ends, and a held kick
• It also drives a reset mid-period, re-arming after each kind of fault, and kicks while disarmed

Constraints

Do not add ports.