How Scrambling Works — XOR with Pseudo-Random Bits
A scrambler is brutally simple at its core: it XORs every data bit with a pseudo-random bit from a Linear Feedback Shift Register (LFSR). The LFSR generates a sequence that looks random but is perfectly predictable — both transmitter and receiver know the polynomial and starting seed.
Data bit stream
→
⊕ XOR
→
Scrambled stream
↑
LFSR PRBS
Descrambling is the exact same operation: XOR the scrambled bits with the same LFSR sequence. Since A ⊕ B ⊕ B = A, the scrambling cancels perfectly and the original data is recovered — as you can see in the lab above.
Key insight: The scrambler and descrambler are the same circuit. The only requirement is that both start with the same LFSR state (seed synchronization). In PCIe, the seed is reset at the start of each packet.
Why High-Speed Links Need Scrambling
- DC balance: AC-coupled links (capacitors between chips) block DC. A long run of 1s or 0s creates a DC component that charges the coupling cap and causes voltage droop. Scrambling ensures ~50% ones density regardless of payload.
- Clock recovery: Receiver PLLs need frequent bit transitions to stay phase-locked. All-zeros data has zero transitions → PLL loses lock → link fails. Scrambling guarantees transitions even for pathological data patterns.
- EMI reduction: Repetitive bit patterns create strong spectral peaks in the RF spectrum. Pseudo-random scrambling spreads the energy across frequencies, reducing peak EMI emissions — critical for FCC/CE compliance.
- Bit error detection: Scrambling spreads a single-bit burst error across multiple bits in the descrambled output, making error detection patterns more reliable.
LFSR Theory — How the Pseudo-Random Sequence Is Generated
A Linear Feedback Shift Register (LFSR) is a shift register where the input bit is a linear function (XOR) of its previous state. The feedback taps are defined by a polynomial over GF(2). For a maximal-length LFSR of degree n, the output sequence has period 2ⁿ − 1 — it cycles through every possible non-zero n-bit pattern exactly once before repeating.
Fibonacci LFSR — The Standard Implementation
For polynomial x^n + x^k + 1, the new bit entering the register = state[n−1] ⊕ state[k−1]. The register shifts, and this new bit enters at the LSB position. The output bit (used for scrambling) is the feedback bit.
// 4-bit LFSR: x⁴ + x³ + 1, taps at positions 4 and 3 (1-indexed)
// Trace with seed = 0xF (1111):
// Step State Feedback Output New State
// ──── ───── ──────── ────── ─────────
// 0 1111 1⊕1=0 0 1110
// 1 1110 1⊕1=0 0 1100
// 2 1100 1⊕1=0 0 1000
// 3 1000 1⊕0=1 1 0001
// 4 0001 0⊕0=0 0 0010
// ... period = 15, visits all 15 non-zero states
module lfsr_4bit (
input clk, rst_n,
output reg [3:0] state,
output bit_out
);
wire feedback = state[3] ^ state[2]; // taps at positions 4,3 (0-indexed: 3,2)
assign bit_out = feedback;
always @(posedge clk or negedge rst_n)
if (!rst_n) state <= 4'hF; // seed = 1111
else state <= {state[2:0], feedback};
endmodule
Protocol Polynomials at a Glance
| Protocol | Polynomial | Width | Period | Seed |
|---|---|---|---|---|
| PCIe Gen 1/2/3 | x²³ + x²¹ + 1 | 23-bit | 8,388,607 | 0x7FFFFF |
| SATA | x¹⁶ + x¹⁵ + x¹³ + x⁴ + 1 | 16-bit | 65,535 | 0xFFFF |
| USB 3.x | x¹⁶ + x⁵ + x⁴ + x³ + 1 | 16-bit | 65,535 | 0xFFFF |
| Ethernet 10GbE | x⁵⁸ + x³⁹ + 1 | 58-bit | 2⁵⁸−1 | all-1s |
| Tutorial | x⁴ + x³ + 1 | 4-bit | 15 | 0xF |
Verilog Implementation — Generic Scrambler
A parameterized Verilog scrambler works for any width and polynomial. The core is a 1-bit-per-cycle LFSR that generates the PRBS, XOR'd with the serial data stream. In real systems, the scrambler often runs at the SerDes layer, below the protocol stack.
// Generic 1-bit/cycle scrambler (Fibonacci LFSR)
// Works for PCIe (N=23, POLY=23'h600000), SATA, etc.
module scrambler #(
parameter N = 23, // LFSR width
parameter POLY = 23'h600000, // PCIe: x²³+x²¹+1 → taps at [22],[20]
parameter SEED = 23'h7FFFFF // initial state (all ones)
)(
input clk, rst_n,
input data_in, valid_in,
output data_out, valid_out
);
reg [N-1:0] lfsr;
wire feedback = ^(lfsr & POLY); // XOR of tap positions
always @(posedge clk or negedge rst_n) begin
if (!rst_n) lfsr <= SEED;
else if (valid_in)
lfsr <= {lfsr[N-2:0], feedback}; // shift, insert feedback at LSB
end
assign data_out = data_in ^ feedback; // XOR scrambles / descrambles
assign valid_out = valid_in;
endmodule
// Descrambler is IDENTICAL — same module, same polynomial, same seed.
// Both sides must reset LFSR to SEED at the start of each packet.
Note: The scrambler and descrambler are the same Verilog module. Instantiate it on the TX side with data_in = payload → scrambled output. Instantiate it on the RX side with data_in = scrambled_in → recovered data. Same polynomial, same seed = same LFSR sequence = XOR cancels.
Scrambler FAQ — Questions Every Protocol Engineer Gets Asked
Scrambling uses a public, known polynomial and seed — there is no secret. Anyone who knows the polynomial can immediately descramble the data. Its purpose is signal conditioning (DC balance, EMI, clock recovery), not confidentiality. Encryption (AES, ChaCha20) happens at a higher layer and keeps the key secret. PCIe, SATA, and USB scrambling are fully transparent to the data's content — they just reshape the bit stream for reliable physical transmission.
If the descrambler's LFSR state drifts from the scrambler's state (due to a bit error, reset mismatch, or missed packet boundary), every subsequent bit will be wrong — the recovered data is corrupted for the entire duration of the drift. This is why protocols like PCIe reset the LFSR at well-defined boundaries (SKP ordered sets, EIEOS), and why the LFSR seed must be included in link training.
8b/10b encoding (used in PCIe Gen 1/2, SATA 1/2, USB 2.0) provides DC balance and transition density by encoding 8 bits as 10 bits with a controlled disparity — so scrambling adds redundancy. But 8b/10b has 20% overhead. Newer protocols (PCIe Gen 3+, SATA 3, USB 3.x) use 128b/130b or 128b/132b encoding with only ~1.5% overhead, relying on scrambling for DC balance instead. Both approaches achieve the same goal differently.
A maximal-length LFSR (m-sequence) of degree n cycles through all 2ⁿ−1 non-zero states exactly once before repeating. This gives the longest possible period and the best pseudo-random properties (balanced 1s and 0s, good autocorrelation). Not every polynomial achieves this — only primitive polynomials over GF(2) do. The 4-bit tutorial uses x⁴+x³+1, which IS primitive (period = 15). The all-zeros state is excluded because XOR of zeros is always zero — it would lock the LFSR.
PCIe Gen 4 and Gen 5 use the same 23-bit scrambler polynomial (x²³ + x²¹ + 1) but operate at higher data rates (16 GT/s and 32 GT/s respectively). Gen 3 introduced the polynomial change from Gen 1/2 (which also used 23-bit but had slightly different implementation details). The scrambler is applied after 128b/130b encoding in Gen 3+, and the sync header bits (01 or 10) are never scrambled.