8. Counters

A counter is a sequential circuit that cycles through a fixed sequence of states with each clock pulse. It is the simplest non-trivial FSM.

8.1 Asynchronous (ripple) counters

In a ripple counter, each flip-flop is clocked by the previous flip-flop's output rather than by a global clock. The "clock" effectively ripples up the chain.

   CLK ──→ T-FF₀ ──Q₀──→ T-FF₁ ──Q₁──→ T-FF₂ ──Q₂──→ T-FF₃ ──Q₃

Each T flip-flop has T tied to 1 so it toggles on every input edge. The output bits form a binary counter: $Q_3 Q_2 Q_1 Q_0$ counts 0000, 0001, 0010, …, 1111, then wraps.

Simple, but the carry ripples: $Q_1$ changes one flip-flop delay after $Q_0$, $Q_2$ another delay later, and so on. A 4-bit ripple counter has total propagation delay of 4 t_pd from input clock to settled $Q_3$. This is fine at low speeds but disastrous at GHz rates; the high bits would not have time to settle before the next edge arrives.

8.2 Synchronous counters

All flip-flops share the same clock. Combinational "next-state" logic feeds each flip-flop based on the current count.

For a 4-bit binary counter with T flip-flops:

• $T_0 = 1$ (always toggle)
• $T_1 = Q_0$
• $T_2 = Q_0 Q_1$
• $T_3 = Q_0 Q_1 Q_2$

Each bit toggles when all lower bits are 1. The combinational logic is a chain of ANDs, which has its own delay but is bounded by one clock period rather than scaling with bit count.

Synchronous counters are the standard. The 74LS161 (4-bit synchronous counter with parallel load) was a TTL workhorse, replaced today by HDL inferences inside FPGAs and ASICs.

8.3 Up/down counters

Add a direction control input. When DIR=1, the counter increments; when DIR=0, it decrements. The next-state logic XORs each lower-bit AND chain with $\overline{DIR}$ or DIR appropriately. Used in stepper motor controllers, digital potentiometers, audio volume up/down buttons.

8.4 Modulo-N counters

A counter that counts 0, 1, …, N−1, then wraps to 0. Built from a binary counter plus a comparator that detects "count == N−1" and asynchronously resets all flip-flops on the next edge, or by gating the next-state logic to load 0 when the terminal count is reached.

The most common modulo counter is mod-10 (BCD), used in clock chips, frequency dividers, and seven-segment digit drivers. A BCD counter cycles 0000–1001, then resets to 0000 instead of advancing to 1010.

A clock chip combines several BCD counters: a mod-60 for seconds (one mod-6 cascaded with one mod-10), another mod-60 for minutes, and a mod-12 or mod-24 for hours. The 32.768 kHz quartz crystal feeds a $2^{15}$ ripple counter to derive 1 Hz, then the BCD chain for human time. Every digital wristwatch on Earth is built this way.

8.5 Ring counters

A ring counter cycles a single 1 through a chain of flip-flops:

   1 → 0 → 0 → 0 → 1 → 0 → 0 → 0 → 1 → ...

The output of the last flip-flop loops back to the input of the first. With $N$ flip-flops, you get $N$ states. Inefficient (uses $N$ flip-flops to encode $N$ states, while $\log_2 N$ would suffice) but extremely simple to decode: each state has exactly one bit set, so the bit position itself tells you the state. Used in step sequencers, certain types of barrel shifters, and one-hot state machines.

8.6 Johnson counters (twisted-ring)

Like a ring but with the complement of the last flip-flop fed back to the first. With $N$ flip-flops, you get $2N$ states. A 4-bit Johnson counter cycles through:

   0000 → 1000 → 1100 → 1110 → 1111 → 0111 → 0011 → 0001 → 0000 → ...

Adjacent states differ in one bit (it is a Gray-style sequence!), making decoding glitch-free. Used in certain frequency-synthesis chips, decade-counter ICs (the CD4017 is a Johnson counter), and step-by-step sequencers in MIDI controllers.

8.7 Counters in security

Counters are deceptively rich for hardware security:

• Anti-rollback counters. A monotonic up-counter implemented in OTP fuses or secure NVRAM. When you boot signed firmware, you check that its embedded version counter is greater than or equal to the stored counter, then increment the stored counter. A downgrade to old firmware (perhaps with known vulnerabilities) is impossible because the counter has already advanced. Apple's secure enclave, modern Android trusted execution environments, and TPM dictionary-attack lockouts all use this pattern.
• Power-side-channel from carry chains. A ripple counter's high bits flip far less often than its low bits. Looking at the chip's power consumption, an attacker can sometimes infer which bit just toggled. In an LFSR-based stream cipher (next section), this can leak the internal state.
• Timing channels in modulo counters. Older modulo counters that asynchronously reset can have unequal cycle lengths near the wrap, leaking information about the internal state through subtle timing variations.