Measurable requirement anatomy
Write the proof boundary into the requirement.
The DMA subsystem shall sustain at least 12 GB/s of accepted payload across four continuously active channels, using legal 16-beat transfers on a 256-bit, 500 MHz downstream interface, while preserving per-channel ordering and propagating backpressure without data loss.
- Actor
- Complete DMA subsystem, not one channel in isolation
- Stimulus envelope
- Four active channels, legal aligned transfers, stated mix
- Measured outcome
- Accepted payload bytes per elapsed second
- Observation boundary
- Downstream VALID and READY acceptance events
- Correctness invariant
- No loss, duplication, or per-channel reordering
- Verification method
- Analysis plus constrained traffic tests and scoreboards
“The DMA should be fast and handle backpressure.”
“Fast” has no unit, traffic model, measurement boundary, or correctness clause. The team cannot tell whether peak issue rate, accepted bytes, or completion rate is intended.
Rate + envelope + acceptance + invariant
The rewritten requirement creates testable conditions and exposes missing decisions: allowed latency, downstream service guarantee, error policy, reset behavior, and implementation margin.
The datapath is not buildable until its operating envelope is.
These worked-example targets show the review depth expected before architecture freeze; project values must come from the real product and signoff plan.
| Requirement | Concrete contract | Architecture consequence | Required evidence |
|---|---|---|---|
| RequirementNFR-CLKClock + reset | Concrete contractclk_dma is a defined 500 MHz generated clock. Every asynchronous crossing is classified, and reset deasserts locally only after its clock is stable. | Architecture consequenceGenerated-clock constraints, CDC structures, reset synchronizers, and domain_ready gating are part of the block interface. | Required evidenceSTA clock coverage · CDC/RDC · reset-sequence assertions |
| RequirementNFR-PWRPower | Concrete contractIllustrative active power is capped at 120 mW for the named workload and PVT view; idle admission stops before clocks gate. | Architecture consequenceActivity assumptions, clock-gating eligibility, wake latency, isolation, and retained state are budgeted before freeze. | Required evidencePower analysis · gate checks · power-aware sleep/wake tests |
| RequirementNFR-DFTDFT | Concrete contractSequential state is scan-visible unless waived; SRAMs have an MBIST path; test controls can override functional clock gates and resets safely. | Architecture consequenceTest muxing, scan modes, macro wrappers, and at-speed capture clocks are architectural ports, not late netlist patches. | Required evidenceScan/MBIST rules · test-mode STA · coverage report |
| RequirementNFR-SECSecurity | Concrete contractEvery descriptor is checked against its programmed privilege and address window before any fabric transaction is issued. | Architecture consequenceUnauthorized work creates no downstream side effect and retires with precise, auditable status. | Required evidenceNegative-access tests · formal range proof · audit-status coverage |
| RequirementNFR-SAFESafety + reliability | Concrete contractDescriptor and response state detect corruption; a bounded timeout converts a lost response into one fail-stop completion. | Architecture consequenceParity/ECC choice, timeout ownership, first-error capture, recovery, and diagnostic observability are explicit. | Required evidenceFault injection · timeout/liveness assertions · diagnostic coverage |
| RequirementNFR-PHYPhysical feasibility | Concrete contractThe 500 MHz path budget, memory ports, block-boundary registers, macro placement, and congestion margin close in an early floorplan. | Architecture consequencePipeline cuts and replicated state are chosen while architecture can still change, with PPA ownership attached. | Required evidenceEarly synthesis · floorplan/congestion · MMMC timing · power estimate |
Scenario before block diagram
Trace the failure before choosing the machinery.
Four legal descriptors become eligible.
Arrival synchrony creates the worst arbitration instant.One burst from each channel enters the issue window.
A fixed-priority policy can satisfy aggregate rate while starving C3.Accepted beats average 0.75 per cycle.
Counting VALID without READY overstates delivered bandwidth.Per-channel completions become visible in legal order.
Global order is unnecessary; per-channel precision is mandatory.Measure accepted bytes, not issued requests. Fair service and 75% average fabric utilization must coexist without one channel carrying all of the progress.
Check your understanding
Questions to reason through.
What makes a hardware requirement verifiable?+
It names an observable subject, a measurable behavior or limit, the operating conditions, and an unambiguous pass condition. “High performance” is an aspiration; “sustain 12 GB/s for legal 256-byte bursts at 500 MHz while honoring downstream backpressure” can be designed, constrained, and tested.
Put it into practice
Explain the decision behind the design.
Practice Specification to Microarchitecture in the question bank →Continue the learning path