Part 1 · Requirements and scenarios

Write measurable requirements and executable scenarios

Replace ambiguous product language with observable contracts, operating envelopes, timelines, failure cases, and invariants that a verification plan can prove.

Learn to expose missing assumptions early, budget throughput and buffering with units, choose structures deliberately, and preserve bidirectional traceability through RTL and verification.

Updated July 20262 connected chaptersInteractive labs + worked examples

Measurable requirement anatomy

Write the proof boundary into the requirement.

A useful requirement names who acts, under which traffic and operating conditions, what is measured, where it is measured, and what happens when the contract cannot be met.

R-DMA-012 · performance

The DMA subsystem shall sustain at least 12 GB/s of accepted payload across four continuously active channels, using legal 16-beat transfers on a 256-bit, 500 MHz downstream interface, while preserving per-channel ordering and propagating backpressure without data loss.

Actor: Complete DMA subsystem, not one channel in isolation
Stimulus envelope: Four active channels, legal aligned transfers, stated mix
Measured outcome: Accepted payload bytes per elapsed second
Observation boundary: Downstream VALID and READY acceptance events
Correctness invariant: No loss, duplication, or per-channel reordering
Verification method: Analysis plus constrained traffic tests and scoreboards

Ambiguous input

“The DMA should be fast and handle backpressure.”

“Fast” has no unit, traffic model, measurement boundary, or correctness clause. The team cannot tell whether peak issue rate, accepted bytes, or completion rate is intended.

Reviewable contract

Rate + envelope + acceptance + invariant

The rewritten requirement creates testable conditions and exposes missing decisions: allowed latency, downstream service guarantee, error policy, reset behavior, and implementation margin.

Nonfunctional contract gate

The datapath is not buildable until its operating envelope is.

These worked-example targets show the review depth expected before architecture freeze; project values must come from the real product and signoff plan.

Requirement	Concrete contract	Architecture consequence	Required evidence
NFR-CLKClock + reset	clk_dma is a defined 500 MHz generated clock. Every asynchronous crossing is classified, and reset deasserts locally only after its clock is stable.	Generated-clock constraints, CDC structures, reset synchronizers, and domain_ready gating are part of the block interface.	STA clock coverage · CDC/RDC · reset-sequence assertions
NFR-PWRPower	Illustrative active power is capped at 120 mW for the named workload and PVT view; idle admission stops before clocks gate.	Activity assumptions, clock-gating eligibility, wake latency, isolation, and retained state are budgeted before freeze.	Power analysis · gate checks · power-aware sleep/wake tests
NFR-DFTDFT	Sequential state is scan-visible unless waived; SRAMs have an MBIST path; test controls can override functional clock gates and resets safely.	Test muxing, scan modes, macro wrappers, and at-speed capture clocks are architectural ports, not late netlist patches.	Scan/MBIST rules · test-mode STA · coverage report
NFR-SECSecurity	Every descriptor is checked against its programmed privilege and address window before any fabric transaction is issued.	Unauthorized work creates no downstream side effect and retires with precise, auditable status.	Negative-access tests · formal range proof · audit-status coverage
NFR-SAFESafety + reliability	Descriptor and response state detect corruption; a bounded timeout converts a lost response into one fail-stop completion.	Parity/ECC choice, timeout ownership, first-error capture, recovery, and diagnostic observability are explicit.	Fault injection · timeout/liveness assertions · diagnostic coverage
NFR-PHYPhysical feasibility	The 500 MHz path budget, memory ports, block-boundary registers, macro placement, and congestion margin close in an early floorplan.	Pipeline cuts and replicated state are chosen while architecture can still change, with PPA ownership attached.	Early synthesis · floorplan/congestion · MMMC timing · power estimate

Scenario before block diagram

Trace the failure before choosing the machinery.

A scenario is an executable statement of intent. It reveals temporal assumptions, state ownership, and failure behavior that a noun-only block list will miss.

Design questionCan all channels remain active while the shared path sustains the system target?

01C0Channels 0–3

Four legal descriptors become eligible.

Arrival synchrony creates the worst arbitration instant.

02C1–C4Scheduler

One burst from each channel enters the issue window.

A fixed-priority policy can satisfy aggregate rate while starving C3.

03C5+Fabric

Accepted beats average 0.75 per cycle.

Counting VALID without READY overstates delivered bandwidth.

04retireResponse ledger

Per-channel completions become visible in legal order.

Global order is unnecessary; per-channel precision is mandatory.

Measure accepted bytes, not issued requests. Fair service and 75% average fabric utilization must coexist without one channel carrying all of the progress.

Reasoning checkpoints

Questions worth answering without notes.

Each answer states the mechanism first, then the consequence.

01What makes a hardware requirement verifiable?

It names an observable subject, a measurable behavior or limit, the operating conditions, and an unambiguous pass condition. “High performance” is an aspiration; “sustain 12 GB/s for legal 256-byte bursts at 500 MHz while honoring downstream backpressure” can be designed, constrained, and tested.

Keep practicing

Move from recognition to explanation.

These links open the existing practice bank without publishing protected solutions on this guide.

Build traceable verification itemsTurn specification statements into measurable evidence.

Continue the system

Connect the adjacent layer.

Logic to reliable timingDigital DesignConnect logic behavior to its physical timing contract, then choose safe structures for paths that cross cycles, clocks, and module boundaries.Safe boundaries across time and voltageClock, Reset, CDC and PowerOperate a dual-clock, power-gated sensor subsystem from cold reset through configuration, streaming, quiesce, sleep, wake, and recovery while every crossing preserves meaning.RTL intent to signoff marginSynthesis and Timing ClosureAutopsy one failing register-to-register path as it moves from elaborated RTL to a mapped netlist, placed design, clock tree, extracted route, and signoff corner.