UVM Architecture for DDR

// ---------------------------------------------------------------------
// ddr_env_topology -- records the environment's structure and refuses
// the topologies the preceding chapters prove are blind.
//
// CLASSIFICATION: educational, SIMULATION-ONLY.
//
// WHY REFUSALS AND NOT WARNINGS: each of the three below removes a
// class of finding entirely rather than degrading one.
//   - no device-level checker: 27.4 §6's cross-bank obligations have
//     no owner, and §4's worked failure passes sixteen scoreboards.
//   - no sideband agent: Module 21's training and Module 24's power
//     transitions are commanded through register access, so the
//     environment can only start already-trained.
//   - a correlator with no ordering policy: §5 -- it will fall back
//     to simulation time, which orders events the protocol defines
//     as simultaneous and therefore never reports ambiguity.
//
// WHAT IT DOES NOT MODEL:
//   - the UVM factory, phasing, or build_phase (the UVM track owns
//     those); this records the PLAN, not the built hierarchy
//
// WHAT IT WOULD MISS:
//   - a topology declared here and built differently. A declared
//     device-level checker nobody connected passes every check.
// ---------------------------------------------------------------------
typedef enum { IF_HOST,      // §1: requests arrive whole
               IF_DDR,       // §1: pins, and a transaction is derived
               IF_SIDEBAND   // §1: a different protocol entirely
             } ddr_if_e;

typedef enum { AG_ABSENT, AG_PASSIVE, AG_ACTIVE } ag_mode_e;

// §5's three substitutes for a time base. ORD_SIM_TIME is included
// so it can be REFUSED by name rather than merely omitted.
typedef enum { ORD_NONE,       // no policy declared -- refused
               ORD_SIM_TIME,   // always works, invents an order
               ORD_CAUSAL      // correct and partial -- §5's row three
             } order_policy_e;

class ddr_env_topology extends uvm_object;
  `uvm_object_utils(ddr_env_topology)

  protected ag_mode_e      m_agent[ddr_if_e];
  protected bit            m_device_level_checker;
  protected bit            m_coverage_model;
  protected bit            m_closure_argument;
  protected int            m_bank_scoreboards;
  protected order_policy_e m_order_policy;
  protected string         m_refusal[$];

  function new(string name = "ddr_env_topology");
    super.new(name);
    m_agent[IF_HOST]     = AG_ABSENT;
    m_agent[IF_DDR]      = AG_ABSENT;
    m_agent[IF_SIDEBAND] = AG_ABSENT;
    m_order_policy       = ORD_NONE;
  endfunction

  function void declare_agent(ddr_if_e which, ag_mode_e mode);
    m_agent[which] = mode;
  endfunction

  // §3: a DDR-side agent is passive against a controller DUT and
  // active against a device or PHY. Both are legal; ABSENT is not,
  // because 27.3's monitor is the only source of transactions.
  function ag_mode_e agent_mode(ddr_if_e which);
    return m_agent[which];
  endfunction

  function void declare_bank_scoreboards(int n);
    if (n < 1) begin
      `uvm_error("TOPO", "a distributed scoreboard needs at least one bank")
      return;
    end
    m_bank_scoreboards = n;
  endfunction

  function void declare_device_level_checker(bit present);
    m_device_level_checker = present;
  endfunction

  function void declare_coverage_model(bit present);
    m_coverage_model = present;
  endfunction

  function void declare_closure_argument(bit present);
    m_closure_argument = present;
  endfunction

  // §5: the policy must be stated. ORD_SIM_TIME is refused by name
  // rather than silently accepted, because it is the substitute that
  // always works and therefore never reports ambiguity.
  function void declare_order_policy(order_policy_e p);
    m_order_policy = p;
  endfunction

  protected function void refuse(string why);
    foreach (m_refusal[i]) if (m_refusal[i] == why) return;
    m_refusal.push_back(why);
  endfunction

  // The three structural refusals, plus the two that follow from
  // 27.4 and 27.5. Recomputed on each call so a later declaration
  // clears an earlier refusal.
  function bit sound(ref string problems[$]);
    m_refusal.delete();

    if (m_agent[IF_DDR] == AG_ABSENT)
      refuse("no DDR-side agent: 27.3's monitor is the only source of transactions");

    if (m_bank_scoreboards >= 1 && !m_device_level_checker)
      refuse("distributed scoreboards with no device-level checker: 27.4 §6's cross-bank obligations are unowned");

    if (m_agent[IF_SIDEBAND] == AG_ABSENT)
      refuse("no sideband agent: training and power transitions cannot be commanded (Modules 21, 24)");

    if (m_order_policy == ORD_NONE)
      refuse("no ordering policy declared: §5 -- the fallback is simulation time");

    if (m_order_policy == ORD_SIM_TIME)
      refuse("simulation time as an ordering policy: §5 -- it orders events the protocol defines as simultaneous");

    if (m_coverage_model && !m_closure_argument)
      refuse("a coverage model with no closure argument: 27.5 §11 -- a percentage with nothing to qualify it");

    problems = m_refusal;
    return m_refusal.size() == 0;
  endfunction

  // §4: the device-level checker consumes the RAW stream, not the
  // scoreboards' summaries. A component built from sixteen summaries
  // could not count a rolling window, because summing per-bank
  // totals over a run discards the times.
  function bit device_checker_sees_raw_stream();
    return m_device_level_checker && (m_agent[IF_DDR] != AG_ABSENT);
  endfunction

  function int refusals();  return m_refusal.size();  endfunction

  function void report_phase(uvm_phase phase);
    string problems[$];
    bit ok = sound(problems);
    `uvm_info("TOPO", $sformatf(
      "host=%s ddr=%s sideband=%s banks=%0d devchk=%0b cov=%0b closure=%0b order=%s sound=%0b",
      m_agent[IF_HOST].name(), m_agent[IF_DDR].name(),
      m_agent[IF_SIDEBAND].name(), m_bank_scoreboards,
      m_device_level_checker, m_coverage_model, m_closure_argument,
      m_order_policy.name(), ok), UVM_LOW)
    foreach (problems[i])
      `uvm_error("TOPO", $sformatf("topology refused: %s", problems[i]))
  endfunction
endclass

// ---------------------------------------------------------------------
// ddr_device_level_check -- CLASSIFICATION: synthesisable, BINDABLE.
//
// 27.4 §6's cross-bank obligations, at the pins. Every rule here
// counts across banks, which is exactly why no per-bank component can
// see it -- §4's callout works the rolling-window case through.
//
// Every property is guarded by `disable iff (!rst_n)`: 27.2's census
// measured 769 of this curriculum's 843 named properties with such a
// guard and 74 without, and the 74 are where reset-time noise comes
// from.
// ---------------------------------------------------------------------
module ddr_device_level_check #(
  parameter int BANKS       = 16,
  parameter int GROUPS      = 4,
  parameter int FAW_WINDOW  = 30,   // ILLUSTRATIVE cycles; Module 14 owns real values
  parameter int FAW_LIMIT   = 4,    // 14.8: activates permitted in the window
  parameter int TREFI       = 3900  // ILLUSTRATIVE cycles between refreshes
)(
  input  logic                      clk,
  input  logic                      rst_n,
  input  logic                      act_valid,
  input  logic [$clog2(BANKS)-1:0]  act_bank,
  input  logic                      pre_valid,
  input  logic                      pre_all,        // precharge-all
  input  logic                      ref_valid,
  input  logic                      pd_entry,       // power-down entry
  input  logic                      pd_exit,
  input  logic                      any_cmd_valid
);
  // COUNT vs INDEX: a counter holding up to N needs $clog2(N+1) bits,
  // not $clog2(N), and the ternary guards the degenerate case -- a bare
  // $clog2 is 0 at 1, giving an illegal [-1:0] vector.
  //
  // AND THE WIDTH MUST BE CHOSEN FOR WHAT THE CHECKER MUST REPRESENT,
  // WHICH IS NOT FAW_LIMIT. In correct operation the window holds at
  // most FAW_LIMIT activates -- but this checker exists to detect the
  // case where it holds MORE, and a counter sized for FAW_LIMIT
  // saturates exactly in the failure it is meant to report. Sizing it
  // for the legal maximum would make the count wrong precisely when it
  // matters, which is the same shape of error as a checker that cannot
  // fail. So it is sized for FAW_WINDOW.
  localparam int CNT_W   = (FAW_WINDOW < 2) ? 1 : $clog2(FAW_WINDOW + 1);
  // Kept for the contrast: this is the width a counter for the LEGAL
  // maximum would have, and using it for act_in_window is the bug.
  localparam int LIMIT_W = (FAW_LIMIT + 1 < 2)
                         ? 1 : $clog2(FAW_LIMIT + 1);

  initial begin
    if (BANKS < 2)
      $fatal(1, "ddr_device_level_check: BANKS must be >= 2 (got %0d)", BANKS);
    if (GROUPS < 1 || (BANKS % GROUPS) != 0)
      $fatal(1, "ddr_device_level_check: %0d banks do not divide into %0d groups",
             BANKS, GROUPS);
    if (FAW_LIMIT < 1)
      $fatal(1, "ddr_device_level_check: FAW_LIMIT must be >= 1");
    if (FAW_WINDOW < 2)
      $fatal(1, "ddr_device_level_check: FAW_WINDOW must be >= 2");
  end

  // ---- A shift register over the window is the only structure that
  // can answer "how many activates in the LAST N cycles". A running
  // total cannot: it would need to know what to subtract, which is
  // the time information a per-bank summary discards -- §4.
  logic [FAW_WINDOW-1:0]   act_hist;
  logic [CNT_W-1:0]        act_in_window;

  always_ff @(posedge clk) begin
    if (!rst_n) begin
      act_hist      <= '0;
      act_in_window <= '0;
    end else begin
      // Compute from the PRE-shift history plus the incoming
      // activate, so the count and the history describe the same
      // window. Reading act_hist after shifting it would be the
      // stale-register hazard this curriculum has found five times.
      act_in_window <= ($countones(act_hist[FAW_WINDOW-2:0]))
                     + (act_valid ? 1 : 0);
      act_hist      <= {act_hist[FAW_WINDOW-2:0], act_valid};
    end
  end

  // ---- 14.8: the rolling window. This is the obligation §4's
  // callout proves has no per-bank projection.
  property p_faw_respected;
    @(posedge clk) disable iff (!rst_n)
      act_valid |-> ($countones(act_hist[FAW_WINDOW-2:0]) < FAW_LIMIT);
  endproperty
  assert property (p_faw_respected)
    else $error("device: activate %0d inside a window of %0d already holding %0d",
                act_bank, FAW_WINDOW, $countones(act_hist[FAW_WINDOW-2:0]));

  // ---- INVARIANT, not an implication: the window count never
  // exceeds the limit at any cycle. 27.2's census found 21.47% of
  // properties structurally immune to vacuity, and this is one.
  property p_window_count_bounded;
    @(posedge clk) disable iff (!rst_n)
      ($countones(act_hist) <= FAW_LIMIT);
  endproperty
  assert property (p_window_count_bounded)
    else $error("device: window holds %0d activates, limit %0d",
                $countones(act_hist), FAW_LIMIT);

  // ---- The bank index must lie inside the configured geometry. A
  // controller that aliases is a device-level error, not a bank one.
  property p_act_bank_in_range;
    @(posedge clk) disable iff (!rst_n)
      act_valid |-> (act_bank < BANKS);
  endproperty
  assert property (p_act_bank_in_range)
    else $error("device: activate to bank %0d outside %0d banks", act_bank, BANKS);

  // ---- Refresh interval tracking. Module 15 owns the obligation;
  // this counts the interval across all banks, which no per-bank
  // component can do because a refresh addresses all of them.
  logic [CNT_W+16:0] since_ref;
  always_ff @(posedge clk) begin
    if (!rst_n)            since_ref <= '0;
    else if (ref_valid)    since_ref <= '0;
    else if (since_ref != '1) since_ref <= since_ref + 1'b1;
  end

  property p_refresh_interval;
    @(posedge clk) disable iff (!rst_n)
      (since_ref < (TREFI * 9));      // ILLUSTRATIVE postponement allowance
  endproperty
  assert property (p_refresh_interval)
    else $error("device: %0d cycles since the last refresh", since_ref);

  // ---- A refresh and an activate in the same cycle is a device-wide
  // conflict: the refresh addresses every bank.
  property p_no_ref_with_act;
    @(posedge clk) disable iff (!rst_n)
      ref_valid |-> !act_valid;
  endproperty
  assert property (p_no_ref_with_act)
    else $error("device: refresh concurrent with an activate");

  // ---- 6.2's command-qualification contract: no command is accepted
  // while the device is powered down. This is UNIVERSAL DDR, not an
  // LPDDR feature -- 24.2 owns the LPDDR state SET, 6.2 owns the
  // contract. Per-bank state says nothing about the device's power
  // state -- §4's fourth row.
  logic powered_down;
  always_ff @(posedge clk) begin
    if (!rst_n)          powered_down <= 1'b0;
    else if (pd_exit)    powered_down <= 1'b0;
    else if (pd_entry)   powered_down <= 1'b1;
  end

  property p_no_cmd_while_down;
    @(posedge clk) disable iff (!rst_n)
      powered_down |-> !any_cmd_valid;
  endproperty
  assert property (p_no_cmd_while_down)
    else $error("device: a command arrived while powered down");

  // ---- INVARIANT: entry and exit never coincide.
  property p_pd_edges_exclusive;
    @(posedge clk) disable iff (!rst_n)
      !(pd_entry && pd_exit);
  endproperty
  assert property (p_pd_edges_exclusive)
    else $error("device: power-down entry and exit in one cycle");

  // ---- Power-down entry requires no activates in the window still
  // settling, which is again a cross-bank condition.
  property p_pd_entry_quiescent;
    @(posedge clk) disable iff (!rst_n)
      pd_entry |-> !act_valid;
  endproperty
  assert property (p_pd_entry_quiescent)
    else $error("device: power-down entry concurrent with an activate");

  // ---- A precharge-all is device-wide, so it may not coincide with
  // a bank-specific activate.
  property p_pre_all_exclusive;
    @(posedge clk) disable iff (!rst_n)
      (pre_valid && pre_all) |-> !act_valid;
  endproperty
  assert property (p_pre_all_exclusive)
    else $error("device: precharge-all concurrent with an activate");

  // ---- A refresh requires the array precharged, which per-bank
  // models can each satisfy while the device does not.
  property p_ref_after_precharge;
    @(posedge clk) disable iff (!rst_n)
      ref_valid |-> $past(pre_valid, 1) || $past(pre_valid, 2)
                 || $past(pre_valid, 3) || (since_ref == '0);
  endproperty
  assert property (p_ref_after_precharge)
    else $error("device: refresh with no preceding precharge");

  // ---- IMPLICATION: pre_all is only meaningful alongside pre_valid,
  // so this is gated and is vacuity-exposed like the rest. A
  // precharge-all implies a precharge.
  property p_pre_all_implies_pre;
    @(posedge clk) disable iff (!rst_n)
      pre_all |-> pre_valid;
  endproperty
  assert property (p_pre_all_implies_pre)
    else $error("device: precharge-all asserted without a precharge");

  // ---- INVARIANT: the history register and the derived count agree.
  // This is the stale-register guard made into a property, because
  // the two are updated in one always_ff and a future edit could
  // reorder them.
  // EQUALITY, not a bound. Both registers are written from the same
  // pre-shift value in one always_ff, so after any edge
  //   countones({hist[W-2:0], act_valid}) == countones(hist[W-2:0]) + act_valid
  // which is exactly what act_in_window received. They are therefore
  // equal every cycle, reset included -- so a loose "<= +1" bound would
  // accept the reordering this property exists to catch.
  property p_count_matches_history;
    @(posedge clk) disable iff (!rst_n)
      (act_in_window == $countones(act_hist));
  endproperty
  assert property (p_count_matches_history)
    else $error("device: window count %0d disagrees with history %0d",
                act_in_window, $countones(act_hist));

  // ---- 27.2 §7: publish every antecedent, or a silent pass is
  // indistinguishable from a set that never armed.
  cover property (@(posedge clk) disable iff (!rst_n) act_valid);
  cover property (@(posedge clk) disable iff (!rst_n) ref_valid);
  cover property (@(posedge clk) disable iff (!rst_n) pre_valid);
  cover property (@(posedge clk) disable iff (!rst_n) pre_valid && pre_all);
  cover property (@(posedge clk) disable iff (!rst_n) pd_entry);
  cover property (@(posedge clk) disable iff (!rst_n) pd_exit);
  cover property (@(posedge clk) disable iff (!rst_n) powered_down);

  // ---- 14.8's interesting bin: an activate with the window already
  // at limit minus one. 27.5 §5 argues AT_MIN is the only value that
  // tests a rule, and this is that value for the rolling window.
  cover property (@(posedge clk) disable iff (!rst_n)
                  act_valid && ($countones(act_hist[FAW_WINDOW-2:0])
                                == FAW_LIMIT - 1));

  // ---- An activate spread across banks inside one window, which is
  // §4's worked failure shape when it is legal.
  cover property (@(posedge clk) disable iff (!rst_n)
                  act_valid && ($countones(act_hist) >= 2));

  // ---- A refresh arriving near the interval limit.
  cover property (@(posedge clk) disable iff (!rst_n)
                  ref_valid && (since_ref > TREFI));

  // ---- And a command attempted at power-down, so the error path's
  // silence is distinguishable from an unexercised one.
  cover property (@(posedge clk) disable iff (!rst_n)
                  pd_entry && $past(any_cmd_valid, 1));
endmodule

// ---------------------------------------------------------------------
// ddr_cross_domain_correlator -- orders events across domains that
// share no time base, and reports what it could not order.
//
// CLASSIFICATION: educational, SIMULATION-ONLY.
//
// WHY CAUSALITY AND NOT SIMULATION TIME (§5): $realtime gives every
// pair of events an order, so a correlator built on it NEVER reports
// ambiguity -- and two commands in one DDR cycle are simultaneous to
// the protocol and ordered by the simulator. A checker relying on
// that distinction passes in simulation and describes nothing real.
//
// SO THE HONEST RESULT IS PARTIAL: most pairs get no order, which is
// 27.4 §3's ambiguity arriving from a second direction. The number
// this class exists to publish is how often that happened.
//
// WHAT IT DOES NOT MODEL:
//   - either clock, any CDC structure, the controller's address map
//
// WHAT IT WOULD MISS:
//   - every ordering that is real but unobserved. Two host requests
//     whose bursts interleave have a true order inside the
//     controller and no observable one.
// ---------------------------------------------------------------------
typedef enum { DOM_HOST, DOM_DDR, DOM_SIDEBAND } domain_e;

typedef enum { ORD_BEFORE,      // a dependency establishes a precedes b
               ORD_AFTER,
               ORD_UNORDERED    // §5 -- and this is not a failure
             } rel_e;

class dom_event extends uvm_object;
  `uvm_object_utils(dom_event)
  domain_e      domain;
  int unsigned  seq;         // monotonic WITHIN its own domain only
  string        tag;
  int unsigned  depends_on;  // seq of an event it causally follows, or 0
  bit           has_dep;
  function new(string name = "dom_event");
    super.new(name);
    has_dep = 0;
  endfunction
endclass


class ddr_cross_domain_correlator extends uvm_component;
  `uvm_component_utils(ddr_cross_domain_correlator)

  protected dom_event m_ev[$];
  protected int m_ordered;
  protected int m_unordered;
  protected int m_same_domain;
  protected int m_dep_missing;

  function new(string name, uvm_component parent);
    super.new(name, parent);
  endfunction

  function void note(domain_e d, int unsigned seq, string tag,
                     bit has_dep = 0, int unsigned depends_on = 0);
    dom_event e = dom_event::type_id::create("e");
    if (tag == "") begin
      `uvm_error("CORR", "an event needs a tag")
      return;
    end
    e.domain = d; e.seq = seq; e.tag = tag;
    e.has_dep = has_dep; e.depends_on = depends_on;
    m_ev.push_back(e);
  endfunction

  protected function bit find(domain_e d, int unsigned seq,
                              output int idx);
    foreach (m_ev[i])
      if (m_ev[i].domain == d && m_ev[i].seq == seq) begin
        idx = i;
        return 1;
      end
    return 0;
  endfunction

  // The heart of §5. Two events in ONE domain are ordered by that
  // domain's clock. Across domains, only an observed dependency
  // orders them -- and there is deliberately no fallback.
  function rel_e relate(domain_e da, int unsigned sa,
                        domain_e db, int unsigned sb);
    int ia, ib;
    if (!find(da, sa, ia) || !find(db, sb, ib)) begin
      `uvm_error("CORR", "relate() on an event that was never noted")
      return ORD_UNORDERED;
    end

    // Within one domain the clock provides the order, for free.
    if (da == db) begin
      m_same_domain++;
      return (sa < sb) ? ORD_BEFORE : (sa > sb) ? ORD_AFTER : ORD_UNORDERED;
    end

    // Across domains: a dependency, or nothing. NOT $realtime.
    if (m_ev[ib].has_dep && m_ev[ib].depends_on == sa) begin
      m_ordered++;
      return ORD_BEFORE;
    end
    if (m_ev[ia].has_dep && m_ev[ia].depends_on == sb) begin
      m_ordered++;
      return ORD_AFTER;
    end

    m_unordered++;
    return ORD_UNORDERED;
  endfunction

  // A declared dependency whose target was never observed is a
  // finding about the monitors, not about ordering.
  function int dangling_dependencies();
    int n = 0, idx;
    foreach (m_ev[i])
      if (m_ev[i].has_dep && !find(m_ev[i].domain, m_ev[i].depends_on, idx))
        n++;
    m_dep_missing = n;
    return n;
  endfunction

  function int ordered();      return m_ordered;      endfunction
  function int unordered();    return m_unordered;    endfunction
  function int same_domain();  return m_same_domain;  endfunction
  function int events();       return m_ev.size();    endfunction

  // §5: a correlator that orders every cross-domain pair is using a
  // time base the protocol does not define. So an unordered count of
  // ZERO over a non-trivial run is the symptom, not the goal.
  function bit ordering_is_honest();
    if (m_ordered + m_unordered == 0) return 0;   // nothing related
    return m_unordered > 0;
  endfunction

  function void report_phase(uvm_phase phase);
    void'(dangling_dependencies());
    `uvm_info("CORR", $sformatf(
      "events=%0d same_domain=%0d cross_ordered=%0d cross_unordered=%0d dangling_deps=%0d honest=%0b",
      m_ev.size(), m_same_domain, m_ordered, m_unordered,
      m_dep_missing, ordering_is_honest()), UVM_LOW)
    if (m_dep_missing != 0)
      `uvm_error("CORR", $sformatf(
        "%0d declared dependencies name an event nobody observed", m_dep_missing))
  endfunction
endclass

// ---------------------------------------------------------------------
// ddr_sync_contract -- records how a cross-domain sequence
// synchronises, and refuses one that does not.
//
// CLASSIFICATION: educational, SIMULATION-ONLY.
//
// WHY A DELAY IS REFUSED: §5 and this section. A virtual sequence
// cannot count another domain's cycles, so "wait N cycles then enter
// power-down" is timing one domain by another's clock. It works in
// simulation at one frequency ratio and races at every other.
//
// WHAT IT DOES NOT MODEL:
//   - the sequencer, arbitration, or any UVM sequencing mechanism
//
// WHAT IT WOULD MISS:
//   - a sync point declared and never waited on. This checks the
//     DECLARATION, exactly as §9's topology does.
// ---------------------------------------------------------------------
typedef enum { SYNC_NONE,        // refused
               SYNC_DELAY,       // refused BY NAME -- the plausible error
               SYNC_DDR_DRAIN,   // a condition observed on the DDR side
               SYNC_HOST_RESP,   // a completion observed on the host side
               SYNC_QUIESCENT    // an explicit window with no driver
             } sync_e;

class ddr_sync_contract extends uvm_object;
  `uvm_object_utils(ddr_sync_contract)

  protected sync_e m_sync[string];
  protected string m_domains[string];
  protected bit    m_invalidates_params[string];

  function new(string name = "ddr_sync_contract");
    super.new(name);
  endfunction

  // A sequence spanning ONE domain needs no synchronisation point --
  // that domain's clock orders it. Only cross-domain sequences do.
  function bit declare(string seq, string domains, sync_e s,
                       bit invalidates_params = 0);
    if (seq == "" || domains == "") begin
      `uvm_error("SYNC", "a sequence needs a name and its domains")
      return 0;
    end
    if (s == SYNC_NONE) begin
      `uvm_error("SYNC", $sformatf(
        "'%s' refused: a cross-domain sequence needs a sync point (§12)", seq))
      return 0;
    end
    if (s == SYNC_DELAY) begin
      `uvm_error("SYNC", $sformatf(
        "'%s' refused: a delay times one domain by another's clock (§5)", seq))
      return 0;
    end
    m_sync[seq]                = s;
    m_domains[seq]             = domains;
    m_invalidates_params[seq]  = invalidates_params;
    return 1;
  endfunction

  function int declared(); return m_sync.size(); endfunction

  function int count_with(sync_e s);
    int n = 0;
    foreach (m_sync[k]) if (m_sync[k] == s) n++;
    return n;
  endfunction

  // Rows four and five of this section's table: a sequence that
  // changes the device's configuration invalidates §10's
  // elaboration-time parameters, and the bound checker cannot be
  // reparameterised mid-run. So these must be reported, not hidden.
  function int parameter_invalidating();
    int n = 0;
    foreach (m_invalidates_params[k]) if (m_invalidates_params[k]) n++;
    return n;
  endfunction

  function void report_phase(uvm_phase phase);
    `uvm_info("SYNC", $sformatf(
      "sequences=%0d ddr_drain=%0d host_resp=%0d quiescent=%0d param_invalidating=%0d",
      m_sync.size(), count_with(SYNC_DDR_DRAIN), count_with(SYNC_HOST_RESP),
      count_with(SYNC_QUIESCENT), parameter_invalidating()), UVM_LOW)
    foreach (m_invalidates_params[k])
      if (m_invalidates_params[k])
        `uvm_warning("SYNC", $sformatf(
          "'%s' changes device configuration: §10's bound checker holds stale parameters", k))
  endfunction
endclass

// SIMULATION-ONLY. Independent reference for §10's window counter: a
// QUEUE of activate timestamps pruned by age, rather than a shift
// register. A different representation, so agreement is evidence.
class faw_reference;
  int unsigned stamps[$];
  int unsigned window;

  function new(int unsigned w);
    window = w;
  endfunction

  function void activate(int unsigned now);
    stamps.push_back(now);
    prune(now);
  endfunction

  // Drop everything older than the window. This is the time
  // information §4 says a per-bank summary discards.
  function void prune(int unsigned now);
    while (stamps.size() > 0 && (now - stamps[0]) >= window)
      stamps.delete(0);
  endfunction

  function int in_window(int unsigned now);
    prune(now);
    return stamps.size();
  endfunction
endclass

  TWO PASSING ENVIRONMENT REPORTS

  (A) sixteen clean scoreboards and a device outside spec
        topology : 3 agents, 16 bank scoreboards, NO device-level
                   checker (declared absent)
        bank scoreboards      16 x  match=2,411,006  mismatch=0
        every read checked, every payload correct
        --------------------------------------------------
        ddr_env_topology.sound()          FALSE
          refused: distributed scoreboards with no device-level
                   checker -- 27.4 §6's cross-bank obligations are
                   unowned

        the stimulus placed five activates inside one 30-cycle
        window, one per bank. Each scoreboard saw ONE activate,
        legal in isolation and not its job anyway. Every payload was
        correct because the device honoured the commands it was
        given. Sixteen clean results, and 14.8's limit violated.

        the only thing that caught it was the TOPOLOGY check, before
        the run -- which is the argument for refusing a topology
        rather than warning about it.

  (B) a correlator that ordered everything
        topology : 3 agents, device-level checker present,
                   order policy ORD_CAUSAL
        events                          4,112,908
        same_domain                     4,096,110
        cross_ordered                      16,798
        cross_unordered                         0
        dangling_deps                           0
        --------------------------------------------------
        ordering_is_honest()            FALSE

        every cross-domain pair was ordered and nothing was left
        ambiguous. On an interface with no shared time base that is
        not a good result -- §5 says most cross-domain pairs have no
        observable order, so a zero here means the dependencies were
        over-declared: the monitors asserted causal links they had
        not observed.

        and because every pair was ordered, 27.4's scoreboards never
        produced a SET. Their exact-comparison count is 100%, which
        reads as full-strength checking and is 27.4 §7's
        independence failure arriving through the correlator.

    diagnosis : (A) is 27.4 §6, unowned for six chapters and caught
      only by a structural refusal. (B) is §5: the honest ordering
      is partial, so a complete one is evidence the partiality was
      papered over -- and it propagates into the scoreboards as
      false exactness.

    the fix : (A) declare the device-level checker; §10's shift
      register is the only structure that can count the window. (B)
      audit which dependencies the monitors actually observed, and
      expect cross_unordered to be LARGE.