DDR Functional Coverage

   axis            bins   source
   ----            ----   ------
   command          5     ACT, RD, WR, PRE, REF  (ILLUSTRATIVE subset)
   bank            16     5.3
   bank group       4     5.3
   bank state       4     IDLE, ACTIVE, ACT_PENDING, PRE_PENDING
   page state       3     NA, HIT, MISS
   spacing class    3     AT_MIN, ABOVE_MIN, FAR

   naive product : 5 x 16 x 4 x 4 x 3 x 3  =  11,520 bins

   naive bins       60      4 states x 5 commands x 3 page states
   legal bins        6      10.0%
   unreachable      54      90.0%

   the six legal bins:
     IDLE    ACT  NA        ACTIVE  RD   HIT
     IDLE    PRE  NA        ACTIVE  WR   HIT
     IDLE    REF  NA        ACTIVE  PRE  NA

   ordered command pairs        25      5 x 5
   pairs WITH a spacing rule    14
   pairs with NO rule           11

   crossed with 3 spacing classes:
     naive bins                 75
     bins under a rule          42
     bins with NO rule          33     spacing class carries nothing
     AT_MIN bins                14     18.7% of naive -- the target

// ---------------------------------------------------------------------
// ddr_reachability_model -- makes §4's stated legality rule executable
// so a coverage denominator is DERIVED rather than assumed.
//
// CLASSIFICATION: educational, SIMULATION-ONLY.
//
// WHY THIS EXISTS: §4. The naive cross of six axes is 11,520 bins, of
// which 288 are legal and 96 test a margin that can fail. A coverage
// percentage whose denominator is 11,520 is a percentage of a number
// nobody chose -- and 41% of 11,520 is not merely optimistic, it is
// impossible, which makes it evidence the model is miscounting.
//
// WHY illegal() AND unreachable() ARE SEPARATE (§6): an illegal
// combination must FAIL when hit, because hitting it is a test bug.
// An unreachable one must be excluded from the denominator. Putting
// an illegal case in ignore_bins discards the finding silently, so
// when unsure this model reports illegal -- a false alarm costs an
// investigation, a silent discard costs the bug.
//
// WHAT IT DOES NOT MODEL:
//   - the command truth table in full (Module 7 owns it)
//   - mode registers, training states, timing parameter VALUES
//
// WHAT IT WOULD MISS:
//   - anything its reduced rule calls unreachable that a real device
//     permits. That produces a wrong DENOMINATOR, which is why the
//     pairing with illegal() above is deliberate.
// ---------------------------------------------------------------------
typedef enum { BS_IDLE, BS_ACTIVE, BS_ACT_PENDING, BS_PRE_PENDING } bank_state_e;
typedef enum { CMD_ACT, CMD_RD, CMD_WR, CMD_PRE, CMD_REF }          cov_cmd_e;
typedef enum { PG_NA, PG_HIT, PG_MISS }                             page_state_e;
typedef enum { SP_AT_MIN, SP_ABOVE_MIN, SP_FAR }                    spacing_e;

// §6's four categories, kept distinct because conflating the first
// two is how a coverage model becomes unauditable.
typedef enum { BIN_INTERESTING, BIN_ILLEGAL, BIN_UNREACHABLE,
               BIN_MEANINGLESS } bin_class_e;

class ddr_reachability_model extends uvm_object;
  `uvm_object_utils(ddr_reachability_model)

  function new(string name = "ddr_reachability_model");
    super.new(name);
  endfunction

  // §4's stated rule, exactly. A bank in transition accepts nothing.
  function bit legal(bank_state_e s, cov_cmd_e c, page_state_e p);
    case (c)
      CMD_ACT: return (s == BS_IDLE) && (p == PG_NA);
      // A read of a row that is not open is not a legal command --
      // it is a DIFFERENT command sequence (precharge, activate,
      // read), which is why PG_MISS is excluded rather than binned.
      CMD_RD,
      CMD_WR : return (s == BS_ACTIVE) && (p == PG_HIT);
      CMD_PRE: return ((s == BS_IDLE) || (s == BS_ACTIVE)) && (p == PG_NA);
      CMD_REF: return (s == BS_IDLE) && (p == PG_NA);
      default: return 0;
    endcase
  endfunction

  // Unreachable is NARROWER than "not legal": these are combinations
  // no stimulus can construct, as opposed to ones a broken test can.
  // §6: a test CAN issue RD from IDLE, so that is illegal, not
  // unreachable, and it must fail rather than be ignored.
  function bit unreachable(bank_state_e s, cov_cmd_e c, page_state_e p);
    // A page state other than NA is meaningless for a command that
    // carries no row comparison -- no stimulus produces it.
    if ((c == CMD_ACT || c == CMD_PRE || c == CMD_REF) && (p != PG_NA))
      return 1;
    // A bank in transition is not addressable by any command.
    if (s == BS_ACT_PENDING || s == BS_PRE_PENDING)
      return 1;
    return 0;
  endfunction

  // §6's asymmetry, encoded: unreachable is checked FIRST, and
  // anything left that is not legal is ILLEGAL rather than ignored.
  function bin_class_e classify(bank_state_e s, cov_cmd_e c,
                                page_state_e p);
    if (unreachable(s, c, p)) return BIN_UNREACHABLE;
    if (!legal(s, c, p))      return BIN_ILLEGAL;
    return BIN_INTERESTING;
  endfunction

  // §5: a spacing class carries information only for a pair that has
  // a minimum-spacing rule between it. 14 of 25 ordered pairs do, in
  // this ILLUSTRATIVE table, which leaves 33 of 75 spacing bins
  // measuring a relationship that does not exist.
  function bit pair_has_spacing_rule(cov_cmd_e prev, cov_cmd_e curr);
    case (prev)
      CMD_ACT: return (curr inside {CMD_RD, CMD_WR, CMD_PRE, CMD_ACT});
      CMD_RD : return (curr inside {CMD_PRE, CMD_WR, CMD_RD});
      CMD_WR : return (curr inside {CMD_PRE, CMD_RD, CMD_WR});
      CMD_PRE: return (curr inside {CMD_ACT, CMD_REF});
      CMD_REF: return (curr inside {CMD_ACT, CMD_REF});
      default: return 0;
    endcase
  endfunction

  function bin_class_e classify_spacing(cov_cmd_e prev, cov_cmd_e curr,
                                        spacing_e sp);
    if (!pair_has_spacing_rule(prev, curr)) return BIN_MEANINGLESS;
    // §5: AT_MIN is the only value at which a minimum can fail. The
    // other two prove the test can produce something else.
    return BIN_INTERESTING;
  endfunction

  // DERIVED, and recomputed by enumeration rather than asserted --
  // §4's table is this function's output.
  function void enumerate(output int naive, output int legal_n,
                          output int unreach_n, output int illegal_n);
    naive = 0; legal_n = 0; unreach_n = 0; illegal_n = 0;
    for (int si = 0; si < 4; si++)
      for (int ci = 0; ci < 5; ci++)
        for (int pi = 0; pi < 3; pi++) begin
          bank_state_e s = bank_state_e'(si);
          cov_cmd_e    c = cov_cmd_e'(ci);
          page_state_e p = page_state_e'(pi);
          naive++;
          case (classify(s, c, p))
            BIN_INTERESTING: legal_n++;
            BIN_UNREACHABLE: unreach_n++;
            BIN_ILLEGAL:     illegal_n++;
            default: ;
          endcase
        end
  endfunction

  // The bank/group dependency of §4: 16 banks across 4 groups gives
  // 16 consistent pairs, not 64, so a naive product over-counts by 4
  // before legality is considered at all.
  function int consistent_bank_group_pairs(int banks, int groups);
    if (groups <= 0) return 0;
    if (banks % groups != 0) begin
      `uvm_error("REACH", $sformatf(
        "%0d banks do not divide into %0d groups", banks, groups))
      return 0;
    end
    return banks;      // each bank belongs to exactly one group
  endfunction
endclass

// ---------------------------------------------------------------------
// ddr_closure_argument -- tracks what a coverage number licenses, and
// refuses to reduce it to one figure.
//
// CLASSIFICATION: educational, SIMULATION-ONLY.
//
// WHY IT REFUSES A PERCENTAGE: §4. 288 of 11,520 bins is 100% of what
// is reachable and looks like 2.5%; 41% of 11,520 is impossible. One
// number cannot distinguish "complete" from "miscounting", so this
// component returns the four figures and lets the reader do the
// division -- the same refusal 27.1 §9's residual() makes.
//
// WHY AN EXCLUSION NEEDS A REASON (§6): an ignore_bins with no
// justification is indistinguishable from an inconvenient bin someone
// removed to raise the number. 27.4 §10's model refuses an
// invalidation without a reason for the same reason.
//
// WHAT IT DOES NOT MODEL:
//   - the design, the test, or the coverage tool
//
// WHAT IT WOULD MISS:
//   - a bin that is HIT but WRONG. Coverage records that a situation
//     occurred, never that it was handled correctly -- which is the
//     100%-with-a-bug lab in uvm/coverage-driven-verification.
// ---------------------------------------------------------------------
class ddr_closure_argument extends uvm_object;
  `uvm_object_utils(ddr_closure_argument)

  protected int m_naive;          // the product, before any reasoning
  protected int m_unreachable;    // excluded: no stimulus constructs it
  protected int m_meaningless;    // excluded: reachable, carries nothing
  protected int m_hit;
  protected string m_exclusion_reason[string];
  protected bit    m_denominator_reviewed;
  protected bit    m_checking_present;

  function new(string name = "ddr_closure_argument");
    super.new(name);
  endfunction

  function void set_naive(int n);
    if (n <= 0) begin
      `uvm_error("CLOSURE", "naive bin count must be positive")
      return;
    end
    m_naive = n;
  endfunction

  // §6: an exclusion with no reason is not an exclusion, it is a
  // number being improved. Refused rather than accepted quietly.
  function void exclude(string bin_name, string reason,
                        bin_class_e why);
    if (reason == "") begin
      `uvm_error("CLOSURE", $sformatf(
        "exclusion of '%s' refused: no reason given", bin_name))
      return;
    end
    if (!(why inside {BIN_UNREACHABLE, BIN_MEANINGLESS})) begin
      // §6's asymmetry: an ILLEGAL bin must fail when hit, never be
      // excluded from the denominator.
      `uvm_error("CLOSURE", $sformatf(
        "exclusion of '%s' refused: illegal bins must fail, not be ignored",
        bin_name))
      return;
    end
    if (m_exclusion_reason.exists(bin_name)) return;   // idempotent
    m_exclusion_reason[bin_name] = reason;
    if (why == BIN_UNREACHABLE) m_unreachable++;
    else                        m_meaningless++;
  endfunction

  function void note_hit(int n = 1);
    m_hit += n;
  endfunction

  // The reviewer asserts that the denominator was examined. Without
  // this, a reachable-bin count is a claim nobody checked.
  function void mark_denominator_reviewed();
    m_denominator_reviewed = 1;
  endfunction

  // A coverage number licenses nothing without checking present --
  // the 100%-with-a-bug case. The environment sets this from whether
  // 27.4's scoreboards reported meaningful results.
  function void mark_checking_present(bit present);
    m_checking_present = present;
  endfunction

  function int reachable();
    int r = m_naive - m_unreachable - m_meaningless;
    return (r < 0) ? 0 : r;
  endfunction

  // Four numbers, no percentage. §4: one figure cannot distinguish
  // complete from miscounting.
  function void report_numbers(output int naive, output int excluded,
                               output int reachable_n, output int hit);
    naive       = m_naive;
    excluded    = m_unreachable + m_meaningless;
    reachable_n = reachable();
    hit         = m_hit;
  endfunction

  // Hitting MORE bins than are reachable is not good news. It means
  // the reachability model and the coverage tool disagree, and one of
  // them is wrong -- §4's "impossible percentage" made detectable.
  function bit counts_consistent();
    return (m_hit <= reachable());
  endfunction

  // What the number licenses, stated as a conjunction so no single
  // condition can carry the argument alone.
  function bit closure_supportable();
    if (m_naive == 0)             return 0;   // nothing enumerated
    if (!m_denominator_reviewed)  return 0;   // §6
    if (!m_checking_present)      return 0;   // the 100%-with-a-bug case
    if (!counts_consistent())     return 0;   // §4
    if (m_hit < reachable())      return 0;   // genuinely incomplete
    return 1;
  endfunction

  function int exclusions_recorded(); return m_exclusion_reason.size(); endfunction
  function int unreachable_n();       return m_unreachable;             endfunction
  function int meaningless_n();       return m_meaningless;             endfunction

  function void report_phase(uvm_phase phase);
    `uvm_info("CLOSURE", $sformatf(
      "naive=%0d excluded=%0d (unreach=%0d meaningless=%0d) reachable=%0d hit=%0d consistent=%0b supportable=%0b",
      m_naive, m_unreachable + m_meaningless, m_unreachable, m_meaningless,
      reachable(), m_hit, counts_consistent(), closure_supportable()), UVM_LOW)
  endfunction
endclass

// SIMULATION-ONLY. Three covergroups: device state, request history,
// and the instruments of 27.2 through 27.4. The axes are §2's, the
// exclusions are §6's, and the denominator is §10's model's output.
//
// illegal_bins vs ignore_bins throughout follows §6's asymmetry: when
// unsure, illegal_bins, because a false alarm costs an investigation
// and a silent discard costs the finding.

covergroup ddr_state_cg with function sample(
    bank_state_e s, cov_cmd_e c, page_state_e p, int bank, int grp,
    int pwr_state);
  option.per_instance = 1;

  cp_state : coverpoint s;

  cp_cmd : coverpoint c;

  cp_page : coverpoint p;

  // §1: bank index carries almost nothing on its own, so it is binned
  // to its edges rather than 16 ways. The full spread lives in the
  // cross below, where it is crossed with something informative.
  cp_bank_edge : coverpoint bank {
    bins first = {0};
    bins mid   = {[1:14]};
    bins last  = {15};
  }

  cp_group : coverpoint grp { bins g[] = {[0:3]}; }

  // Module 24: a command arriving as the device exits a low-power
  // state pays an exit latency, which is a different event.
  cp_power : coverpoint pwr_state {
    bins active    = {0};
    bins pd_exit   = {1};
    bins sr_exit   = {2};
  }

  // §4's cross, with the 54 unreachable and illegal combinations
  // removed by construction. What remains is the six legal bins.
  x_state_cmd_page : cross cp_state, cp_cmd, cp_page {
    // ILLEGAL -- a test CAN construct these, so hitting one is a
    // test bug and must fail. §6: never ignore_bins.
    illegal_bins rd_from_idle =
      binsof(cp_cmd) intersect {CMD_RD, CMD_WR} &&
      binsof(cp_state) intersect {BS_IDLE};
    illegal_bins rd_on_miss =
      binsof(cp_cmd) intersect {CMD_RD, CMD_WR} &&
      binsof(cp_page) intersect {PG_MISS};
    illegal_bins act_on_active =
      binsof(cp_cmd) intersect {CMD_ACT} &&
      binsof(cp_state) intersect {BS_ACTIVE};
    // UNREACHABLE -- no stimulus constructs a command to a bank in
    // transition, or a page comparison for a command with no row.
    ignore_bins in_transition =
      binsof(cp_state) intersect {BS_ACT_PENDING, BS_PRE_PENDING};
    ignore_bins no_row_to_compare =
      binsof(cp_cmd) intersect {CMD_ACT, CMD_PRE, CMD_REF} &&
      binsof(cp_page) intersect {PG_HIT, PG_MISS};
  }

  // The cross that gives bank index its meaning: a command to the
  // LAST bank while the device is exiting power-down exercises a path
  // an index coverpoint alone never distinguishes.
  x_bank_power : cross cp_bank_edge, cp_power;
endgroup


covergroup ddr_history_cg with function sample(
    cov_cmd_e prev, cov_cmd_e curr, spacing_e sp, int same_bank,
    int same_group, int activates_in_window, int inflight_depth);
  option.per_instance = 1;

  cp_prev : coverpoint prev;

  cp_curr : coverpoint curr;

  // §5: the most important coverpoint in this chapter. AT_MIN is the
  // only spacing at which a minimum-spacing rule can fail.
  cp_spacing : coverpoint sp {
    bins at_min    = {SP_AT_MIN};
    bins above_min = {SP_ABOVE_MIN};
    bins far       = {SP_FAR};
  }

  cp_same_bank : coverpoint same_bank {
    bins same  = {1};
    bins other = {0};
  }

  cp_same_group : coverpoint same_group {
    bins same  = {1};
    bins other = {0};
  }

  // 14.8: the rolling activate window is a HISTORICAL limit, so the
  // interesting bin is the one at the limit.
  cp_faw : coverpoint activates_in_window {
    bins below     = {[0:2]};
    bins at_limit  = {3};
    bins over      = {[4:$]};      // the controller should never do this
  }

  // 27.4 §3: in-flight depth is what makes the expected value a set.
  cp_inflight : coverpoint inflight_depth {
    bins none = {0};
    bins one  = {1};
    bins some = {[2:4]};
    bins deep = {[5:$]};
  }

  // The chapter's central cross. §5: 14 of 25 ordered pairs have a
  // spacing rule, so the 33 bins for pairs without one are excluded
  // WITH a recorded reason -- they are reachable and meaningless,
  // which is §6's third category.
  x_pair_spacing : cross cp_prev, cp_curr, cp_spacing {
    ignore_bins no_spacing_rule =
      (binsof(cp_prev) intersect {CMD_ACT} &&
       binsof(cp_curr) intersect {CMD_REF}) ||
      (binsof(cp_prev) intersect {CMD_RD} &&
       binsof(cp_curr) intersect {CMD_ACT, CMD_REF}) ||
      (binsof(cp_prev) intersect {CMD_WR} &&
       binsof(cp_curr) intersect {CMD_ACT, CMD_REF}) ||
      (binsof(cp_prev) intersect {CMD_PRE} &&
       binsof(cp_curr) intersect {CMD_RD, CMD_WR, CMD_PRE}) ||
      (binsof(cp_prev) intersect {CMD_REF} &&
       binsof(cp_curr) intersect {CMD_RD, CMD_WR, CMD_PRE});
  }

  // A spacing rule is between commands to the SAME bank for most
  // parameters, so the cross with locality is what makes AT_MIN mean
  // what it appears to mean.
  x_spacing_locality : cross cp_spacing, cp_same_bank, cp_same_group;

  // 14.8 against locality: the activate window counts activates in
  // ANY bank, which is exactly why a per-bank view misses it.
  x_faw_locality : cross cp_faw, cp_same_bank;
endgroup


covergroup ddr_instrument_cg with function sample(
    int antecedent_hits, int resolution_code, int set_size,
    int outcome_code, int vacuous);
  option.per_instance = 1;

  // §7, row one. 27.2 measured 662 of 843 properties as implications
  // -- 78.53% vacuity-exposed. A property whose antecedent bin is
  // empty proved nothing, and this is the bin that says so.
  cp_antecedent : coverpoint antecedent_hits {
    bins never_armed = {0};
    bins armed_once  = {1};
    bins armed_few   = {[2:99]};
    bins armed_many  = {[100:$]};
  }

  // 27.3 §6's three-valued resolution flag.
  cp_resolution : coverpoint resolution_code {
    bins known   = {0};
    bins unknown = {1};
    bins config  = {2};
  }

  // 27.4 §3's legal-set size.
  cp_set_size : coverpoint set_size {
    bins unchecked = {0};
    bins exact     = {1};
    bins pair      = {2};
    bins wide      = {[3:$]};
  }

  // 27.4's five outcomes, kept apart.
  cp_outcome : coverpoint outcome_code {
    bins match          = {0};
    bins mismatch       = {1};
    bins unchecked      = {2};
    bins skip_row       = {3};
    bins skip_abandoned = {4};
  }

  cp_vacuous : coverpoint vacuous {
    bins non_vacuous = {0};
    bins vacuous     = {1};
  }

  // A property that armed AND a scoreboard that compared: the
  // conjunction §11's closure_supportable() requires, made visible.
  x_armed_checked : cross cp_antecedent, cp_outcome;

  // And vacuity against set size, which is the pair of weakenings
  // that 27.2 and 27.4 each reported separately.
  x_vacuity_setsize : cross cp_vacuous, cp_set_size;
endgroup

// SIMULATION-ONLY. Immediate assertions over §10's arithmetic and
// §11's refusals.
task automatic check_coverage_model_invariants();
  ddr_reachability_model rm = ddr_reachability_model::type_id::create("rm");
  ddr_closure_argument   ca = ddr_closure_argument::type_id::create("ca");
  int naive, lg, unreach, illeg;

  rm.enumerate(naive, lg, unreach, illeg);

  // P1 -- the enumeration is a partition. Every bin is interesting,
  // unreachable or illegal; none is two of those and none is none.
  assert (lg + unreach + illeg == naive)
    else $error("P1: bin classes do not partition (%0d+%0d+%0d != %0d)",
                lg, unreach, illeg, naive);

  // P2 -- §4's derived figures, recomputed rather than trusted.
  assert (naive == 60 && lg == 6)
    else $error("P2: enumeration gives naive=%0d legal=%0d, expected 60 and 6",
                naive, lg);

  // P3 -- FORBIDDEN. A read from an idle bank is ILLEGAL, never
  // unreachable. §6: a test can construct it, so it must fail rather
  // than be quietly excluded from the denominator.
  assert (rm.classify(BS_IDLE, CMD_RD, PG_NA) == BIN_ILLEGAL)
    else $error("P3: RD from IDLE was not classified illegal");

  // P4 -- FORBIDDEN. A read on a page miss is likewise illegal, not
  // unreachable: it is a different command SEQUENCE, not an
  // impossible one.
  assert (rm.classify(BS_ACTIVE, CMD_RD, PG_MISS) == BIN_ILLEGAL)
    else $error("P4: RD on a page miss was not classified illegal");

  // P5 -- a bank in transition is UNREACHABLE, because no stimulus
  // constructs a command to it.
  assert (rm.classify(BS_ACT_PENDING, CMD_RD, PG_HIT) == BIN_UNREACHABLE)
    else $error("P5: a command to a transitioning bank was not unreachable");

  // P6 -- FORBIDDEN. A page comparison for a command carrying no row
  // is unreachable, not illegal -- nothing can produce it.
  assert (rm.classify(BS_IDLE, CMD_ACT, PG_HIT) == BIN_UNREACHABLE)
    else $error("P6: ACT with a page state was not unreachable");

  // P7 -- the six legal bins are exactly §4's six.
  assert (rm.legal(BS_IDLE,   CMD_ACT, PG_NA)  &&
          rm.legal(BS_IDLE,   CMD_PRE, PG_NA)  &&
          rm.legal(BS_IDLE,   CMD_REF, PG_NA)  &&
          rm.legal(BS_ACTIVE, CMD_RD,  PG_HIT) &&
          rm.legal(BS_ACTIVE, CMD_WR,  PG_HIT) &&
          rm.legal(BS_ACTIVE, CMD_PRE, PG_NA))
    else $error("P7: the six legal combinations are not all legal");

  // P8 -- §4's bank/group dependency. 16 banks in 4 groups gives 16
  // consistent pairs, not 64.
  assert (rm.consistent_bank_group_pairs(16, 4) == 16)
    else $error("P8: bank/group pairs miscounted as %0d",
                rm.consistent_bank_group_pairs(16, 4));

  // P9 -- FORBIDDEN. A bank count that does not divide the group
  // count is reported, not silently rounded.
  assert (rm.consistent_bank_group_pairs(15, 4) == 0)
    else $error("P9: an inconsistent bank/group split was accepted");

  // P10 -- FORBIDDEN. A spacing class is meaningless for a pair with
  // no spacing rule. §5: 33 of 75 bins measure a relationship that
  // does not exist.
  assert (rm.classify_spacing(CMD_PRE, CMD_RD, SP_AT_MIN) == BIN_MEANINGLESS)
    else $error("P10: a pair with no spacing rule was called interesting");

  // P11 -- and AT_MIN for a pair that HAS a rule is the interesting
  // case. §5: it is the only value at which a minimum can fail.
  assert (rm.classify_spacing(CMD_ACT, CMD_RD, SP_AT_MIN) == BIN_INTERESTING)
    else $error("P11: ACT->RD at minimum spacing was not interesting");

  // P12 -- FORBIDDEN. An exclusion with no reason is refused. §6: it
  // is indistinguishable from a number being improved.
  ca.set_naive(11520);
  ca.exclude("in_transition", "", BIN_UNREACHABLE);
  assert (ca.exclusions_recorded() == 0)
    else $error("P12: an exclusion with no reason was accepted");

  // P13 -- FORBIDDEN. An ILLEGAL bin can never be excluded from the
  // denominator, whatever reason is offered.
  ca.exclude("rd_from_idle", "inconvenient", BIN_ILLEGAL);
  assert (ca.exclusions_recorded() == 0)
    else $error("P13: an illegal bin was excluded from the denominator");

  // P14 -- a justified exclusion is recorded and reduces the
  // reachable count.
  ca.exclude("in_transition", "no stimulus addresses a transitioning bank",
             BIN_UNREACHABLE);
  assert (ca.exclusions_recorded() == 1 && ca.reachable() == 11519)
    else $error("P14: a justified exclusion was not applied (reachable=%0d)",
                ca.reachable());

  // P15 -- FORBIDDEN. Hitting more bins than are reachable is an
  // inconsistency, not good news. §4's impossible percentage, made
  // detectable.
  ca.note_hit(20000);
  assert (!ca.counts_consistent())
    else $error("P15: hitting more bins than reachable was called consistent");

  // P16 -- FORBIDDEN. Closure is never supportable without checking
  // present, however complete the coverage. This is the
  // 100%-with-a-bug case in one line.
  begin
    ddr_closure_argument c2 = ddr_closure_argument::type_id::create("c2");
    c2.set_naive(288);
    c2.mark_denominator_reviewed();
    c2.mark_checking_present(0);
    c2.note_hit(288);                 // every reachable bin hit
    assert (!c2.closure_supportable())
      else $error("P16: closure claimed at full coverage with no checking");
  end
endtask

// SIMULATION-ONLY. Independent reference. Enumerates the same cross
// with an explicit legality TABLE rather than §10's case statements --
// a different representation, so agreement is evidence.
class reachability_reference;
  // One row per legal combination, written out rather than computed.
  typedef struct { int s; int c; int p; } combo_t;
  combo_t legal_table[$];

  function new();
    legal_table.push_back('{0, 0, 0});   // IDLE   ACT  NA
    legal_table.push_back('{0, 3, 0});   // IDLE   PRE  NA
    legal_table.push_back('{0, 4, 0});   // IDLE   REF  NA
    legal_table.push_back('{1, 1, 1});   // ACTIVE RD   HIT
    legal_table.push_back('{1, 2, 1});   // ACTIVE WR   HIT
    legal_table.push_back('{1, 3, 0});   // ACTIVE PRE  NA
  endfunction

  function bit is_legal(int s, int c, int p);
    foreach (legal_table[i])
      if (legal_table[i].s == s && legal_table[i].c == c
          && legal_table[i].p == p) return 1;
    return 0;
  endfunction

  function int count_legal();  return legal_table.size();  endfunction

  // The naive product, computed from the axis cardinalities alone so
  // it cannot inherit an error from the legality model.
  function int naive_product(int cmds, int banks, int groups,
                             int states, int pages, int spacings);
    return cmds * banks * groups * states * pages * spacings;
  endfunction
endclass

  TWO PASSING COVERAGE REPORTS, NEITHER SUPPORTING A SIGN-OFF

  (A) the report that looks finished and tested no timing parameter
        stimulus : 2,000,000 random accesses, no timing pressure
        cp_cmd        : 5 of 5 bins        100%
        cp_state      : 4 of 4 bins        100%
        cp_page       : 3 of 3 bins        100%
        cp_bank_edge  : 3 of 3 bins        100%
        cp_group      : 4 of 4 bins        100%
        ---------------------------------------------
        headline coverpoint score          100%

        cp_spacing.at_min                  0 hits
        x_pair_spacing AT_MIN bins         0 of 14

        every coverpoint is full. §5's argument says the campaign has
        not tested ONE of Module 14's timing parameters, because a
        minimum can only fail at the minimum -- and the headline
        number is 100%.

  (B) the report that is complete, consistent, and still licenses
      nothing
        stimulus : directed at-minimum suite, checking DISABLED
        reachable bins        288
        hit                   288          100% of reachable
        counts_consistent()   TRUE
        denominator_reviewed  TRUE
        checking_present      FALSE
        ---------------------------------------------
        closure_supportable() FALSE

        every reachable bin was visited, the denominator was reviewed
        and the arithmetic is consistent. Nothing checked whether the
        design behaved correctly in any of them, so the report records
        288 situations that OCCURRED and zero that were verified.

    diagnosis : (A) is §1 -- axes that reach 100% carry no
      information, and a headline built from them licenses an
      argument nothing supports. (B) is uvm/coverage-driven-
      verification's lab in this chapter's arithmetic: 100% coverage
      with a data-corruption bug, because coverage records visits.

    the fix : (A) needs §5's AT_MIN bins in the headline, not the
      appendix. (B) needs §11's conjunction, which is why
      closure_supportable() requires checking_present and not merely
      a complete count.