Multi-bit control signals: which value can release the request?

The failed image from lesson 3 still needs a closed fetch gate. This time, the verifier sends four bits instead of one. The receiver must decide which of sixteen values means permission. That decision matters as much as the encoder.

Start at the receiver

A school laboratory uses four-position passes: 1001 refuses entry; 0110 permits it. A desk checking the whole 0110 accepts one pattern. A desk asking only whether the card differs from 1001 also lets 1000 through. These are strict and loose decoding. The same card can face different rules; fourteen invalid patterns do not become fourteen legitimate permissions. The pass illustrates logic rather than measured physical forgery resistance.

Video timing correction (English 03:54–04:00): The film says the accepting edge changes. Read this as “Acceptance at edge 1 changes; the request schedule stays fixed.” The model presents the same request at edge 1: strict refuses, loose accepts. Changing decoding policy does not move the sampling edge. The original film and captions remain intact; this is an explicit correction, not a claim that the film was remade.

A multi-bit control is one decision represented by a codeword. Our four-bit example uses FAIL=1001 and PASS=0110. These values differ in four positions. Hamming distance counts those differing positions; it describes codeword separation, not physical attack difficulty.

The receiver can compare all four bits with PASS. This strict decoder grants only 0110. Another receiver might grant whenever the value differs from FAIL. That loose decoder grants fifteen values, including fourteen invalid codes. The same four wires now have very different behavior.

Flip the lowest bit of FAIL with mask 0001. The receiver sees 1000. Strict decoding rejects it. Loose decoding permits it. An invalid-code detector can raise an alert, but the loose example deliberately leaves that detector out of the grant path. A visible alert therefore does not make this example safe.

OpenTitan names distinct strict and loose MuBi tests in its source. Its four-bit constants are 6 and 9. Our exercise uses those public values to explain the choice; it does not test OpenTitan or establish that a loose test is wrong in every context. Denial conditions can require a different interpretation. MuBi source

One invalid value, two receiver decisions

Change the lowest position of the refusal card: 1001 XOR 0001 gives 1000. The format checker reports bad=1, yet a loose desk still opens. An observed format error and blocking before entry are separate outcomes. Mask 1 selects a position in binary; it is not student number 1 or an event count. An error signal disconnected from permission cannot block this entry.

PASS=0110 and FAIL=1001. A one in the XOR mask flips that bit; a zero preserves it. Decimal mask=1 means binary 0001, not “injection event number one.”

1001 XOR 0001 = 1000. Since 1000 is neither PASS nor FAIL, bad=1. Strict “equal to 0110” decoding returns 0. Loose “not equal to 1001” decoding returns 1. Unless bad also gates the loose receiver's grant, it accepts the failed image despite reporting an error.

seen	bad	strict: seen==PASS	loose: seen!=FAIL
1001	0	0	0
1000	1	0	1
0110	0	1	1

Select target=code, an unauthorized image and mask=1. Switch strict/loose and compare seen, bad and commit in the same row. Then run an authorized image with mask=0 as a positive control. Strict should permit legal work, rather than simply fail every request.

State the budget before claiming distance

Allow one stored-pass alteration per application, affecting at most three positions. All four differ between 1001 and 0110, so that budget cannot reach the permitted card. Four-position mask 1111 can. Storage followed by presentation corresponds to after edge 0 and edge 1. An action that can alter the whole card exceeds the three-position premise. The four paper positions do not specify how many chip bits one disturbance can affect.

The storage experiment starts with a captured FAIL code. One event XORs one four-bit register after edge 0. The changed code persists until the request at edge 1. All sixteen masks are enumerated, including zero as a control. The request is valid and ready at that edge.

A claim for at most three flipped bits excludes mask 1111. Every nonzero mask within that budget makes FAIL invalid under strict decoding. Mask 1111 reaches legal PASS. If one physical event can invert the entire word, a four-bit code cannot rely on the three-bit budget.

The image, independent reference, completion status, encoder, decoder, clock/reset and accepted handshake are trusted in this storage experiment. The reference records the failed image and never copies the corrupted code. Without that separation, a wrong PASS can also rewrite the test oracle.

A valid code can carry a wrong decision

If the approval is forged before printing, the printer makes an exact 0110 and the strict desk accepts it. The original application was never approved: source failure disagrees with the independent reference. A separate final-permission change is the grant target and leaves the pass intact. These are separate experiments outside the stored-pass table. Four wires do not supply four independent source decisions.

Now move the target upstream. One boolean authorization input is inverted before capture. The encoder receives true and stores legal PASS. Strict equality succeeds because the code is perfectly formed. The failure entered before the code existed.

This is a separate experiment with one source target. It does not also flip stored bits. A second expanded experiment inverts only final grant at edge 1. Both keep the accepting interface trusted. These cases identify two boundaries that storage distance cannot protect.

A designer can keep encoded decisions along more of the path, check provenance, or use separately generated evidence at the consumer. Each choice needs an explicit trust argument. Encoding one faulted boolean four times does not create four independent decisions.

Reproduce the two decoding policies

Keep the unauthorized application and 1000 pass fixed in the lab, changing only the desk rule. Strict refuses; loose accepts. Exported seen and bad match while commit differs, tracing the result to decoding policy. Then test an approved 0110 with no alteration to show normal entry remains possible. This comparison adds no fault probabilities. A desk refusing every student is not a complete product.

Open the lab and leave authorization false. Select code target, strict policy and mask 1. Inspect raw, seen, bad and commit. Change only the policy to loose. The accepting edge changes while the source and fault remain identical. Export both traces and explain the gate responsible.

The executed Node campaign found one unauthorized mask under strict decoding and fifteen under loose decoding across the sixteen masks. These counts include the weight-four counterexample. They are enumeration counts, not attack probabilities. Fault-free authorized PASS is accepted; fault-free FAIL is rejected.

Switch to source and then grant, using a nonzero mask as the injection enable. Here mask magnitude does not count source bits: each expanded target is one boolean. Keep those traces out of the storage-mask table. Finally set authorized true and mask zero to check that the strict gate can open normally.

Proposed RTL / SVA

A programmed desk still needs an independent application ledger for auditing. The desk asks for an exact permitted pass and completion; the ledger asks whether this application was actually approved at the handover edge. These are grant and the reference assertion. Writing rules does not mean the controller has been compiled or tested. The SVA needs a harness and positive controls.

Read this lesson's property: Code decoding and authorization

If nobody enters all day, the rule that every entrant is authorized stays satisfied without exercising permission. Present an approved, unaltered 0110 to check that a legitimate handover is reachable: cover and a positive control. The independent ledger must not copy the altered pass. One reachable path does not prove timely entry for every authorized student.

SVA means SystemVerilog Assertions. An assertion checks a rule; it is not the permission gate. At each rising edge outside reset, if accepted_commit (csr_commit in Lesson 9) is one, |-> requires the right-hand condition on that same edge. With no acceptance, this implication raises no authorization failure; positive controls must still demonstrate useful work. disable iff (!rst_n) excludes active reset, without proving reset safety.

Cover seeks one matching path, rather than proving every transaction correct. Reference independently records the expected result in the testbench. The harness supplies inputs, fault budgets and this oracle; DUT means design under test. A two-state model uses only 0/1 logic, excluding X and intra-cycle delay; it does not mean a two-state FSM. Revisit Lesson 1 section 5 for syntax and wiring comparisons. These snippets have not been compiled, so listing a property does not establish a proof.

localparam logic [3:0] Pass = 4'h6, Fail = 4'h9;
assign invalid = (code_q != Pass) && (code_q != Fail);
assign local_bad = invalid; // strict model: no independent detector added
assign grant = complete_q && (code_q == Pass) && !local_bad;
assign accepted_commit = req_valid && req_ready && grant;
// reference_pass is a trusted harness signal, not code_q.
assert property (@(posedge clk) disable iff (!rst_n)
  accepted_commit |-> reference_complete && reference_pass);
cover property (@(posedge clk) disable iff (!rst_n)
  reference_complete && reference_pass && accepted_commit);

This RTL/SVA fragment is proposed, not compiled. Four-state X propagation, synthesis of equality logic, encoded AND/OR semantics and post-decode faults need separate work. The full source-to-consumer path must be mapped after synthesis. Lesson 5 examines whether redundant producers actually fail independently.

Check your reasoning

Before the questions, predict three passes: 1001 is refused; loose accepts 1000; normal permission accepts 0110. Then ask whether 0110 could come from a wrong printing decision or final permission could be altered separately. These are decoding, source, and grant layers. Naming the card pattern alone does not establish this student's entitlement.

1. Why does mask 1 bypass loose decoding?

It produces 1000, which differs from FAIL.

2. How many flips convert FAIL to PASS?

Four, with mask 1111.

3. Does strict decoding protect a source boolean?

No; the wrong source can generate valid PASS.

4. What positive control prevents a permanently closed gate from passing unnoticed?

Authorized PASS with mask zero must commit.

5. Allow final grant inversion. Which assumption changes?

The trusted decoder-to-consumer boundary now includes a fault target.

Engineering wrap-up

Put the handover back on the application flowchart: retain the altered position, decoding rule, and original approval. The wrap-up uses the same four-position pass to organize the model and counterexample. It adds neither an injection nor another hardware defense.

Threat and fault model: One alteration of at most three refusal-pass positions cannot reach 0110. Altering all four needs a wider bit budget. This is a storage-target premise, excluding source and final permission.

One persistent four-bit storage XOR after edge 0; accepting edge 1. At most three bits for the bounded rejection claim, with four-bit and source/grant cases reported separately. The oracle and non-target circuitry remain trusted.
Root cause: A loose desk accepts 1000 while bad=1. The receiver rule causes the error; reporting it does not establish blocked entry.

Loose decoding accepts invalid values. Strict decoding still accepts a valid wrong code created upstream or by a four-bit replacement.
Defense: Exact 0110 comparison rejects 1000, but its approval source still needs checking. Strict protects a decoding segment, not the printer input.

Compare full PASS at the permission consumer and bind the source separately. Include present local errors in the accepting gate.
Validation: Present all sixteen patterns to the same desk and separately test a normal approved pass. This is mask enumeration and a positive control, not an RTL run.

Node executed all sixteen masks, source/grant witnesses and fault-free positive/negative controls. RTL/SVA and physical implementation remain unverified.
Limits: Four visible pass positions do not reveal how many chip bits a disturbance can alter. Two-state enumeration provides no glitch or physical reach evidence.

Two-state word substitution excludes timing glitches, physical independence and decoder implementation faults in the main campaign.
Transfer exercise: If one action alters the entire pass, 1001 can become 0110 and pass strict. State the four-bit effect and reassess the three-bit claim; one-event wording alone is insufficient.

Make a bus-wide inversion one permitted event. Explain why event count alone cannot justify the three-bit claim.