I'm building an FPGA feed handler and one of the problems is I want to do Monte-Carlo simulations which require a high-quality entropy source, i.e. a pseudo-random LSR implementation won't do. I've read that one can try using metastability as a source of randomness, does anyone do this, is this a viable option?
Also, since FPGAs have external clock inputs, can those be leveraged by some hardware "true RNG" solution? Do such solutions exist on the market?
Metastability is really not a viable option in a modern FPGA technology because the metastable timing window is tiny - many orders of magnitude smaller than the setup/hold timing uncertainty window, which is dominated by things like clock skew, routing delays and variations with voltage and temperature.
Unfortunately there's a lot of confusion about metastability and this timing window is sometimes called the metastable timing window, as other (sometimes unexpected) sources of uncertainty in an output due to clock timings are loosely lumped together and incorrectly called metastability.
While this wider window generates uncertainty in the output, it's highly correlated with the above causes, not entropic (outside the tiny true metastable window).
If you need the mathematical and practical details, search the Usenet comp.arch.fpga newsgroup for "metastability" and "Peter Alfke".
TL/DR : look elsewhere for entropy : an avalanche diode, (i.e. a zener well above 6V, say 12V) amplified, sliced to logic levels, fed to an input pin would be one good choice.
You can get some randomness from an unstable combinatorial circuit like a ring oscillator. One way to do it is to have as many XOR gates as bits you want in the output, where each gate is the XOR of itself and its two neighbours. An odd number of the XOR gates should be inverted at the output to prevent it falling into a stable pattern. This generates a non-uniformly distributed set of random numbers (some bits will be 1 significantly more/less than 50% of the time). By feeding this into a pseudo-random generator like a LHCA you can generate high quality random numbers. There is much more information here: http://forums.xilinx.com/xlnx/attachments/xlnx/EDK/27322/1/HighSpeedTrueRandomNumberGeneratorsinXilinxFPGAs.pdf
With their implementation you can get arbitrarily wide random numbers, at a high clock rate, that pass the diehard tests for randomness for the price of 2 LUTs and 2 registers per output bit.
Code for 8 bit random numbers, output in rnd:
(* ALLOW_COMBINATORIAL_LOOPS = "TRUE", KEEP = "TRUE" *) wire [7:0] ring;
(* ASYNC_REG = "TRUE" *) reg [7:0] ring_reg;
assign ring = {ring, ring[7]} ^ ring ^ ({ring[0], ring}>>1) ^ {3{2'b01}};
always @(posedge clk) begin
ring_reg <= ring;
rnd <= {rnd, 1'b0} ^ ring_reg ^ (rnd & 8'h06) ^ ({1'b0, rnd}>>1);
end
the 8'h06 is the diagonal elements of the LHCA from the paper. You might need to change the attributes to stop your synthesis tool screwing it up by 'optimising' the logic. This works for me on Vivado 2016.3, and generates what appear to be uniformly distributed random numbers (I haven't run proper statistical tests).
One option could be to use a higher quality random number generator such as mersenne twister and then seed that from something external. Other options may not be able to provide enough bandwidth for running a simulation.
Here is one such implementation: https://github.com/alexforencich/verilog-mersenne/blob/master/rtl/axis_mt19937.v
Another advantage to using this type of generator is that it's relatively easy to seed with a known value for debugging - i.e. it makes it straightforward to seed the hardware exactly the same as the functional simulation to ensure you're getting the same result.
