A Method for Debugging Ethernet

A debugging method is a decision procedure over a space of candidate faults, and the first thing to know about it is how many of those candidates the instrumentation can actually tell apart.

Rows four and five are the chapter's subject. Five of the twelve sites — the address filter, VLAN membership, the receive FIFO, the DMA path and the host driver — produce identical readings on every counter the standard requires. A frame arrives, a frame does not reach the host, and no error counter moves, because none of those five is an error.

Rows six and seven are the chapter's second subject. Twelve candidates is 3.58 bits, so four binary observations should suffice. Seven are needed, because the counters do not partition the space evenly — four of them split off exactly one site each, and a question that eliminates one candidate in twelve carries 0.414 bits.

And the counter everybody looks at first carries none at all.

1. Scope, and a Fault Space With Twelve Members

Scope: the receive path, from the channel to host memory, as a space of fault sites; the counters that observe it; and what a procedure over the two can and cannot conclude.

Not in scope: the individual failure modes. Chapter 21.2 is the catalogue and Chapter 21.3 is the first entry in it. This chapter is the method, and a method is worth writing down separately because its quality is measurable — Sections 4, 6 and 8 measure it.

Start by enumerating the space, because everything after depends on it being the right size.

Twelve, and the number matters more than the list does. A procedure that starts from "the link is broken" is searching a space of twelve, which is 3.585 bits — so four well-chosen binary observations would be enough if the observations were well chosen, and Section 8 shows they cannot be.

Three things this list deliberately is and is not.

Row two is the distinction the whole chapter turns on. "CRC errors are climbing" is a symptom and it is consistent with sites 1, 2, 3, 5 and 6 — five of the twelve. Chapter 21.2 is the catalogue of symptoms; this chapter is about getting from a symptom to a site, and the distance between those two is exactly what Section 4 measures.

2. The Observable Set, and What It Actually Separates

Eleven counters. Six are required by the RMON standard and five are a vendor's choice, and the split is not where anybody would put it.

Every one of the five optional counters observes a site that produces no error. A filtered frame is not an error, a non-member VLAN frame is not an error, a FIFO drop under a stalled consumer is not an error, and a descriptor the driver did not post is not an error either — Chapter 20.3 §13 listed exactly this family. The standard requires counters for the error cases and leaves the non-error cases to the vendor, which is defensible and is the reason the largest indistinguishable class exists.

Now build the table that decides everything: which counters move for which sites.

Rows eight to twelve are identical. Five sites, one signature, and the signature is "frames went in, fewer came out, nothing else moved."

Rows two and three are identical as well, which is a smaller problem and a real one: a PHY lane-alignment fault and an xMII timing fault both produce CRC errors and alignment errors on frames that were counted at the port. The difference between them is a symbol-error counter inside the PHY, which is row seven of the previous table and is optional.

Five optional counters are the difference between a diagnosis and a shortlist of five.

And it is worth walking the twelve rows once, because each one is a chapter's failure mode reduced to a counter signature, and three of them are counter-intuitive.

Rows five and six are the two that surprise people and they surprise in opposite directions.

Row five's frames_in is the one entry in the table that reads "no" where instinct says yes. The port's frame counter increments when a frame is received — at the Chapter 5.2 delimiter, before anything is parsed — so a parser that misreads the length has not affected it at all. That single "no" is what separates site 5 from sites 1, 2 and 3, and it is the second-best question in the method precisely because it is counter-intuitive.

Row six is the case where the frames were never damaged. A fault in Chapter 19.4's residue comparison declares good frames bad, so c_crc_errors climbs on a perfect wire — and every instinct points outward at a cable. The distinguishing evidence is that nothing else moves: no alignment errors, no size errors, and frames_in unaffected. A CRC counter climbing alone is the signature of the check engine, not of the channel.

3. RTL 1 — The Debug Package and the Candidate Mask

// ---------------------------------------------------------------------
// debugm_pkg -- a fault space as a bit mask, and the observations that
// narrow it.
//
// The whole method is: start with twelve bits set, and clear bits.
// Writing it that way makes two things checkable that a prose
// procedure hides -- whether an observation narrowed anything, and
// whether the remaining set is a single site or a class.
// ---------------------------------------------------------------------
package debugm_pkg;

  // Section 1's twelve sites, in receive order. The ORDER matters:
  // Section 7's conservation checker cuts the space at a boundary,
  // and a boundary is only meaningful if the sites are ordered.
  typedef enum logic [3:0] {
    SITE_CHANNEL   = 4'd0,
    SITE_PHY_LANES = 4'd1,
    SITE_XMII      = 4'd2,
    SITE_PREAMBLE  = 4'd3,
    SITE_PARSER    = 4'd4,
    SITE_CRC_LOGIC = 4'd5,
    SITE_VALIDITY  = 4'd6,
    SITE_FILTER    = 4'd7,
    SITE_VLAN      = 4'd8,
    SITE_FIFO      = 4'd9,
    SITE_DMA       = 4'd10,
    SITE_DRIVER    = 4'd11
  } site_e;

  typedef logic [11:0] site_mask_t;

  localparam site_mask_t ALL_SITES = 12'hFFF;

  // Section 2's table, one row per counter: the sites at which a fault
  // makes this counter move. These are the ONLY facts the method has.
  localparam site_mask_t M_CRC       = 12'b0000_0011_0111;  // 0,1,2,4,5
  localparam site_mask_t M_ALIGN     = 12'b0000_0000_0111;  // 0,1,2
  localparam site_mask_t M_UNDERSIZE = 12'b0000_0101_0001;  // 0,4,6
  localparam site_mask_t M_OVERSIZE  = 12'b0000_0101_0000;  // 4,6
  localparam site_mask_t M_FRAMES_IN = 12'b0000_0000_1111;  // 0,1,2,3
  localparam site_mask_t M_SYMBOL    = 12'b0000_0000_0011;  // 0,1
  localparam site_mask_t M_FILTERED  = 12'b0000_1000_0000;  // 7
  localparam site_mask_t M_VLAN_DISC = 12'b0001_0000_0000;  // 8
  localparam site_mask_t M_FIFO_DROP = 12'b0010_0000_0000;  // 9
  localparam site_mask_t M_DESC_ERR  = 12'b0100_0000_0000;  // 10

  // Section 4: the RMON-required six leave these five sites with one
  // signature between them. Naming the class is what stops a report
  // from claiming a site.
  localparam site_mask_t CLASS_SILENT = 12'b1111_1000_0000;  // 7..11

  typedef enum logic [1:0] {
    EV_MOVED    = 2'd0,   // the counter is climbing
    EV_ZERO     = 2'd1,   // it is not -- Section 10 on what that means
    EV_ABSENT   = 2'd2    // the counter is not implemented
  } evidence_e;

  function automatic int popcount12(site_mask_t m);
    int n = 0;
    for (int i = 0; i < 12; i++) if (m[i]) n++;
    return n;
  endfunction

endpackage

Classification: a package that is one table, and the table is the chapter's entire factual content.

What it teaches: that a debugging method can be written as a set intersection, and that writing it that way makes the two useful questions mechanical. "Did that observation narrow anything?" is a mask comparison; "have we reached a site or a class?" is a population count. A prose procedure answers neither, which is why a prose procedure can run for a day without anybody noticing it stopped making progress.

And it teaches that EV_ABSENT is a third value and not a missing one. A counter that is not implemented is different from a counter reading zero: zero is evidence, absence is not. Section 2 found five optional counters, so EV_ABSENT is the common case on the observations that matter most, and a method that treats absence as zero concludes the fault is not at a site it cannot see.

Deliberately simplified: the masks are literals rather than derived from a machine-readable model of the design, so a design change silently invalidates them. CLASS_SILENT is named once here and used as a constant, where it should fall out of the RMON subset by construction — Section 16's monitor recomputes it and compares. And the whole table is receive-only, so a transmit fault presents as twelve candidates none of which is right.

Production implication: the ordering of site_e is load-bearing and it is the cheapest thing in the block. Chapter 20.3 §13's conservation identity cuts the path at the MAC's output, and a cut is only a cut if the sites on each side are contiguous in the enumeration. Sites 0 to 6 are before the MAC's frame counters and sites 7 to 11 are after — one comparison separates them, and it is the first observation Section 12's procedure makes.

// ---------------------------------------------------------------------
// candidate_mask -- the state of a diagnosis: which sites are still
// possible, and whether the last observation helped.
//
// narrowed_nothing is the output that matters. A procedure whose
// observations stop narrowing has finished, and "finished" is not the
// same as "solved" -- Section 4.
// ---------------------------------------------------------------------
module candidate_mask
  import debugm_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,
  input  logic        restart,

  input  logic        obs_valid,
  input  site_mask_t  obs_consistent,   // sites consistent with the reading
  input  evidence_e   obs_kind,

  output site_mask_t  candidates,
  output logic [3:0]  n_candidates,
  output logic        narrowed_nothing,
  output logic        converged,        // exactly one site left
  output logic        class_only,       // several, and none separable
  output logic [3:0]  n_observations
);
  site_mask_t next_mask;

  always_comb next_mask = candidates & obs_consistent;

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n || restart) begin
      candidates       <= ALL_SITES;
      n_observations   <= 4'd0;
      narrowed_nothing <= 1'b0;
    end else if (obs_valid && obs_kind != EV_ABSENT) begin
      narrowed_nothing <= (next_mask == candidates);
      candidates       <= next_mask;
      n_observations   <= n_observations + 4'd1;
    end
  end

  assign n_candidates = 4'(popcount12(candidates));
  assign converged    = (n_candidates == 4'd1);
  // Section 4: the five silent sites survive every RMON observation
  // together, so a mask equal to CLASS_SILENT is a finished diagnosis
  // that has not identified a site.
  assign class_only   = (candidates == CLASS_SILENT);
endmodule

Classification: a state machine with one state variable, whose interesting outputs are both about having stopped.

What it teaches: that converged and class_only are different terminal conditions and a method must distinguish them. A procedure that runs until n_candidates stops falling reaches CLASS_SILENT on every one of the five silent faults — and reports "five candidates" rather than a site. That is the correct answer and Section 20's rejected property is what happens when somebody asserts it cannot occur.

And it teaches why obs_kind != EV_ABSENT gates the update. An absent counter contributes no mask — not the empty mask, which would clear every candidate, and not the full mask, which would be free. It contributes nothing and must not increment n_observations either, because a procedure that counts unavailable observations as steps reports progress it did not make.

Deliberately simplified: obs_consistent is supplied by the caller rather than derived from a counter reading and its mask, so the block cannot check that the caller used the right table. narrowed_nothing is a single-cycle flag and not sticky. And class_only compares against exactly one class, where Section 4 found two — the silent five and the PHY/xMII pair.

Production implication: n_observations against n_candidates is the number that tells a team whether its instrumentation or its method is the problem. Section 8 derives the optimum: 12 candidates should fall to 1 in seven observations. A diagnosis that has made ten observations and has five candidates left has an instrumentation problem, not a method problem — and the two conclusions lead to entirely different meetings.

4. Seven Classes, and the One That Holds Five

Run Section 2's table through Section 3's intersection and the twelve sites collapse. With the RMON-required six counters, the distinct signatures are these.

Seven classes from twelve sites, and the useful way to read that is as the method's ceiling: no procedure using only the required counters can do better than name one of these seven.

Class G is the problem and it is worth stating exactly what it contains.

Every member of class G is a legal discard, which is why no error counter moves — and three of the five are Chapter 20.3 §13's legal drop reasons, the other two being past the MAC entirely. The instrumentation is behaving correctly and the fault is invisible for exactly that reason.

Class B is the smaller version of the same thing. A PHY lane-alignment fault and an xMII timing fault produce the same six readings, and the counter that separates them — c_symbol_errors — lives inside the PHY and is reached over MDIO, which is Chapter 4.5's interface and is not always wired.

Now add the optional counters one at a time, best first, and watch the classes.

Row two is the shape of the whole problem. Adding the symbol-error counter splits class B and does nothing at all to class G — it raises the class count and leaves the largest class exactly where it was. The four counters that matter are the four that observe non-errors, and each of them splits off exactly one site.

Class G does not shrink by cleverness. It shrinks one site per counter, and the counters are the ones no standard requires.

Which gives the method its most useful precondition, and it is a question to ask before any waveform is opened:

Four yes/no questions, asked of a datasheet rather than of a waveform, decide whether the coming investigation has five candidates or one. They take a minute and they are almost never the first thing anybody does.

5. RTL 2 — The Symptom Classifier

// ---------------------------------------------------------------------
// symptom_classifier -- turn a set of counter readings into the mask
// of sites consistent with them.
//
// The block is trivial and the discipline is not: a reading that is
// ZERO narrows the space by INTERSECTING WITH THE COMPLEMENT, and a
// reading that is ABSENT narrows it by nothing at all. Conflating the
// second with the first is the most common error in this chapter and
// Section 10 measures what it costs.
// ---------------------------------------------------------------------
module symptom_classifier
  import debugm_pkg::*;
(
  input  logic       clk,
  input  logic       rst_n,

  input  logic       sample,
  input  logic [31:0] d_crc,        // deltas over the sample window
  input  logic [31:0] d_align,
  input  logic [31:0] d_undersize,
  input  logic [31:0] d_oversize,
  input  logic [31:0] d_frames_in,
  input  logic [31:0] d_frames_out,

  // Which of the optional counters this platform actually has.
  input  logic [4:0]  optional_present,   // symbol, filtered, vlan, fifo, desc
  input  logic [31:0] d_symbol,
  input  logic [31:0] d_filtered,
  input  logic [31:0] d_vlan_disc,
  input  logic [31:0] d_fifo_drop,
  input  logic [31:0] d_desc_err,

  output site_mask_t  consistent,
  output logic        consistent_valid,
  output logic [3:0]  observations_usable,
  output logic        symptom_is_silent    // Section 4's class G
);
  site_mask_t m;
  logic [3:0] usable;

  // One helper, applied ten times. A counter that moved keeps the
  // sites it moves for; a counter at zero keeps the complement.
  function automatic site_mask_t apply(site_mask_t cur, logic present,
                                       logic [31:0] delta, site_mask_t moves);
    if (!present)      return cur;            // EV_ABSENT -- no evidence
    else if (delta != 32'd0) return cur & moves;
    else                     return cur & ~moves;
  endfunction

  always_comb begin
    m      = ALL_SITES;
    usable = 4'd0;

    m = apply(m, 1'b1, d_crc,       M_CRC);       usable++;
    m = apply(m, 1'b1, d_align,     M_ALIGN);     usable++;
    m = apply(m, 1'b1, d_undersize, M_UNDERSIZE); usable++;
    m = apply(m, 1'b1, d_oversize,  M_OVERSIZE);  usable++;
    m = apply(m, 1'b1, d_frames_in, M_FRAMES_IN); usable++;
    // d_frames_out is deliberately NOT applied. Section 6.

    m = apply(m, optional_present[0], d_symbol,    M_SYMBOL);
    m = apply(m, optional_present[1], d_filtered,  M_FILTERED);
    m = apply(m, optional_present[2], d_vlan_disc, M_VLAN_DISC);
    m = apply(m, optional_present[3], d_fifo_drop, M_FIFO_DROP);
    m = apply(m, optional_present[4], d_desc_err,  M_DESC_ERR);
    for (int i = 0; i < 5; i++) if (optional_present[i]) usable++;

    consistent          = m;
    observations_usable = usable;
    symptom_is_silent   = (d_frames_in != 32'd0) &&
                          (d_frames_out < d_frames_in) &&
                          (d_crc == 32'd0) && (d_align == 32'd0) &&
                          (d_undersize == 32'd0) && (d_oversize == 32'd0);
  end

  assign consistent_valid = sample;
endmodule

Classification: a ten-way intersection whose whole content is one three-valued helper function.

What it teaches: that the three cases of apply are the method. A counter that moved intersects with its mask; a counter at zero intersects with its complement — which is a real narrowing and is the half people forget — and a counter that is absent intersects with nothing. Writing them as one function with a present argument makes the third case impossible to skip, where a procedure written as prose skips it every time.

And it teaches that symptom_is_silent is a named symptom rather than a derived one. It is the signature of Section 4's class G — frames in, fewer out, no error counter moving — and it is worth its own output because it is the single most common real-world Ethernet complaint and the one where the RMON set has already said everything it can.

Deliberately simplified: the six required counters are assumed present, which is what "required" means and is not always true of a switch's per-port statistics. The deltas are supplied rather than sampled, so the block has no opinion about the window length — Section 18's row three. usable++ in a for loop is not synthesisable as written. And a counter that moved by one in a million frames is treated identically to one that moved on every frame, which Section 17 argues is sometimes the whole answer.

Production implication: observations_usable is the number to print at the top of a diagnostic report. It is 5 on a platform with only the required counters — because frames_out is excluded — and 10 on a fully instrumented one. The rest of the report should be read against it: a five-observation diagnosis that names a site has either been lucky or has been wrong, and Section 8 says which is more likely.

6. Why frames_out Carries Zero Bits

Every diagnosis starts by looking at whether frames are reaching the host. That observation carries no information at all, and the arithmetic is one line.

An observation's value is how much it narrows the candidate set. Formally, for a space of twelve sites and a counter that moves for k of them, the reading's entropy is:

H = −p·log2(p) − (1−p)·log2(1−p),   p = k / 12

The last row is the finding. frames_out falls short for every one of the twelve sites — that is what "the link is broken" means — so the reading is the same whatever the fault is and it eliminates nothing. It is the observation that starts every investigation and it is worth zero bits.

That is not an argument against looking at it. frames_out is what tells you there is a fault; it is the trigger, not a measurement, and confusing the two is why investigations spend their first hour confirming what the ticket said.

Row two is the procedure's actual first step and it is worth knowing why. c_crc_errors moves for the channel, the PHY lanes, the xMII, the parser and the CRC engine's own logic — five of twelve, the closest any counter comes to an even split — so it is the best available question and it is still only 0.98 of a bit. A perfectly balanced question would be worth 1.000.

And the bottom of the table is the reason Section 8's answer is seven and not four. Four of the counters are worth 0.414 bits each, and they cannot be combined: each splits off exactly one site. There is no clever ordering that makes them worth more, because information that is not there cannot be rearranged into existence.

7. RTL 3 — The Conservation Checker

// ---------------------------------------------------------------------
// conservation_checker -- Chapter 20.3 Section 13's identity, used as
// a diagnostic cut rather than as a scoreboard check.
//
//   frames_in - frames_out == crc + filtered + dropped + under + over
//
// If the identity HOLDS, every missing frame is accounted for by a
// counter and the fault is at a site the instrumentation names. If it
// does NOT hold, frames are disappearing somewhere no counter watches,
// which is a different and much shorter list.
// ---------------------------------------------------------------------
module conservation_checker
  import debugm_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  input  logic [31:0] d_frames_in,
  input  logic [31:0] d_frames_out,
  input  logic [31:0] d_crc,
  input  logic [31:0] d_undersize,
  input  logic [31:0] d_oversize,
  input  logic [31:0] d_filtered,       // may be absent
  input  logic [31:0] d_fifo_drop,      // may be absent
  input  logic [4:0]  optional_present,

  input  logic [31:0] skew_bound,       // Chapter 19.1 Section 6's 12

  output logic        identity_holds,
  output logic        identity_undecidable,
  output site_mask_t  cut_mask,
  output logic [31:0] unaccounted
);
  logic [31:0] accounted, missing;

  always_comb begin
    missing   = d_frames_in - d_frames_out;
    accounted = d_crc + d_undersize + d_oversize
              + (optional_present[1] ? d_filtered  : 32'd0)
              + (optional_present[3] ? d_fifo_drop : 32'd0);

    unaccounted = (missing > accounted) ? (missing - accounted) : 32'd0;

    // Chapter 20.3 Section 13: the identity is exact only when the
    // pipeline is empty. Under load the counters commit at different
    // depths, so a skew of up to twelve frames is not a discrepancy.
    identity_holds = (unaccounted <= skew_bound);

    // An identity that needs counters this platform does not have
    // cannot be evaluated -- and reporting it as FALSE would blame the
    // design for the instrumentation.
    identity_undecidable = !optional_present[1] || !optional_present[3];

    // The cut. If frames are unaccounted for, no counter watches the
    // site, so the candidates are the ones with no counter of their
    // own: preamble detection, VLAN membership, DMA and the driver.
    cut_mask = identity_undecidable ? ALL_SITES
             : (identity_holds ? ~12'b1101_0000_1000 : 12'b1101_0000_1000);
  end
endmodule

Classification: a conservation law used backwards — as a partition of a fault space rather than as a check on a design.

What it teaches: that Chapter 20.3 §13's identity is worth more as a diagnostic than as an assertion. As an assertion it says "frames are not being lost"; as a cut it says which half of the space to search, because a frame that vanishes without incrementing anything can only have vanished where nothing counts. Four of the twelve sites have no counter of their own — preamble detection, VLAN membership, the DMA path and the driver — and the identity separates those four from the other eight in one arithmetic step.

And it teaches that identity_undecidable must be a distinct output from !identity_holds. The identity needs c_filtered and c_fifo_drops; both are optional. On a platform without them the sum is short by construction, unaccounted is large, and a checker that reports "the identity fails" has reported a missing counter as a design fault.

Deliberately simplified: skew_bound is an input rather than derived, where Chapter 19.1 §6's twelve frames in flight is the correct value at 100 Gb/s and 0.19 at 1 Gb/s — the same constant is wrong by a factor of 63 across the family, which is Chapter 20.6 §6's problem arriving in a debugger. missing can underflow if frames_out exceeds frames_in, which happens across a counter wrap. And the cut mask is a literal, where it should be computed as the sites with no counter mask covering them.

Production implication: the identity is the cheapest step in the whole method and it is usually skipped, because it requires reading six counters and doing arithmetic rather than looking at one. It is worth roughly a bit and a half on its own — four sites against eight — and it needs no waveform, no capture and no traffic generator. A procedure whose first two steps are this identity and c_crc_errors has spent no equipment time and has 3 or 4 candidates left.

8. Seven Observations, Not Four

Twelve candidates is 3.585 bits, so four binary observations is the floor. A perfectly played diagnosis needs seven, and the gap is a property of the counters rather than of the player.

Row three is not better than row two; it is a different question. With only the required counters the space has seven distinguishable classes, and three observations reach them — ceil(log2 7) is 3, and the RMON counters happen to partition evenly enough to achieve it. The procedure finishes quickly and finishes on a class of five.

Row two is what it costs to go from seven classes to twelve sites, and the cost is four more observations for five more distinctions — a rate of 1.25 observations per site, which is the arithmetic of a linear search and not of a binary one.

Why the tail is linear:

Stages four to seven are the linear tail and they are forced. Each of those four counters moves for exactly one site, so each question can only ever answer "is it this one?" — and four such questions are needed to separate five candidates, regardless of order.

A fault space is searchable in log2(n) steps only when the observations partition it. Ethernet's do not, because four of the five decisive counters are one-site indicators.

Which suggests the one instrumentation change that would matter, and it is not another counter.

Row three is what a designer can do for a debugger and nobody does. A single counter at each of the twelve boundaries — frames entering the parser, entering the filter, entering the FIFO, entering the DMA — turns the search into a bisection, and a bisection over twelve reaches a site in four observations, which is the floor.

Eight and a half per cent of a datapath to take every future localisation from seven observations to four — and the reason nobody spends it is that the benefit accrues to a different team from the one that pays, which is not an engineering argument and is the real one.

9. RTL 4 — The Discriminator Ranker

// ---------------------------------------------------------------------
// discriminator_ranker -- given the surviving candidates, say which
// observation to make next.
//
// The ranking is by how evenly a counter splits the CURRENT candidate
// set, not the whole space. A counter worth 0.98 bits at the start can
// be worth zero three steps in, because every site it distinguishes
// has already been eliminated.
// ---------------------------------------------------------------------
module discriminator_ranker
  import debugm_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  input  site_mask_t  candidates,
  input  logic [4:0]  optional_present,

  output logic [3:0]  best_counter,      // index into the ten
  output logic [3:0]  best_split,        // candidates it would remove
  output logic        no_useful_question,
  output logic [3:0]  questions_left
);
  site_mask_t masks [10];
  logic       avail [10];

  always_comb begin
    masks[0] = M_CRC;       avail[0] = 1'b1;
    masks[1] = M_ALIGN;     avail[1] = 1'b1;
    masks[2] = M_UNDERSIZE; avail[2] = 1'b1;
    masks[3] = M_OVERSIZE;  avail[3] = 1'b1;
    masks[4] = M_FRAMES_IN; avail[4] = 1'b1;
    masks[5] = M_SYMBOL;    avail[5] = optional_present[0];
    masks[6] = M_FILTERED;  avail[6] = optional_present[1];
    masks[7] = M_VLAN_DISC; avail[7] = optional_present[2];
    masks[8] = M_FIFO_DROP; avail[8] = optional_present[3];
    masks[9] = M_DESC_ERR;  avail[9] = optional_present[4];
  end

  logic [3:0] n_cand, yes_n, best_score;

  always_comb begin
    n_cand       = 4'(popcount12(candidates));
    best_counter = 4'd0;
    best_score   = 4'd0;
    questions_left = 4'd0;

    for (int i = 0; i < 10; i++) begin
      if (avail[i]) begin
        yes_n = 4'(popcount12(candidates & masks[i]));
        // An even split is the best question. The score is the size of
        // the SMALLER half -- maximising it maximises the guaranteed
        // reduction, which is the right objective for a worst case.
        if (yes_n != 4'd0 && yes_n != n_cand) begin
          questions_left = questions_left + 4'd1;
          if (((yes_n < (n_cand - yes_n)) ? yes_n : (n_cand - yes_n)) > best_score) begin
            best_score   = (yes_n < (n_cand - yes_n)) ? yes_n : (n_cand - yes_n);
            best_counter = 4'(i);
          end
        end
      end
    end

    best_split         = best_score;
    // Section 4's class G: every remaining counter either moves for
    // all the candidates or for none of them.
    no_useful_question = (questions_left == 4'd0) && (n_cand > 4'd1);
  end
endmodule

Classification: a greedy chooser whose objective is the worst case rather than the average.

What it teaches: that the right score is the size of the smaller half. Maximising the expected reduction favours a lopsided question that is usually cheap; maximising the smaller half bounds the number of steps whatever the answer is — and a debugging procedure is judged on its worst case, because the failures that reach an engineer are the ones the easy path did not solve.

And it teaches that no_useful_question is the method's honest terminal state. When every available counter moves for all the surviving candidates or for none of them, the procedure is finished and has not converged. That is class G with the optional counters absent, it is the common case, and Section 20's rejected property is the assertion that it cannot happen.

Deliberately simplified: the ranking ignores the cost of an observation, and the costs differ by three orders of magnitude — a register read is microseconds, an MDIO transaction is milliseconds, and a capture at a different point in the topology is a site visit. A real ranker divides the score by the cost. The for loop over ten masks with a nested population count is combinational and enormous. And best_counter breaks ties by index rather than by cost, so it will send an engineer to MDIO before checking a free local register.

Production implication: the block's most useful output is the one that looks least interesting. questions_left counts the observations that would still narrow something, and when it reaches zero the correct action is to change the instrumentation, not to keep measuring. Teams reliably do the opposite: the tenth measurement on a converged mask feels like progress and Section 22's first complaint is exactly that pattern.

10. What a Zero Rules Out

A counter that moves is a strong statement. A counter reading zero is a weaker one and is not a worthless one, and the difference between those two claims is where most Ethernet debugging goes wrong.

Formally, a zero reading intersects the candidate set with the counter's complement — so it eliminates exactly the sites the counter moves for.

Both columns of every row sum to twelve, which is the point: a reading eliminates the sites it is inconsistent with, and "moved" and "zero" are inconsistent with complementary sets. The asymmetry is not in the information; it is in which set is bigger.

Three zeros are worth having and the rest are nearly free of content.

Row one is the single most valuable observation in the method and it is a zero. c_crc_errors at zero over a window in which frames were lost eliminates everything from the connector to the check engine — five of twelve sites, 0.98 bits — and it costs one register read. The instinct to go looking for CRC errors is right; the instinct to stop when there are none is exactly wrong.

And there is one reading that is not evidence at all, which Section 3's EV_ABSENT exists for:

Row three is the trap and it is a hardware fact rather than a methodological one. An unimplemented register in a MAC's statistics block very often reads as zero rather than faulting — so the two readings are byte-identical and the only way to tell them apart is the datasheet. A method that does not check implementation first will confidently eliminate a site on the strength of a register that does not exist, which is the most expensive single error available in this chapter.

A zero eliminates the counter's sites. An absent counter eliminates nothing. On most hardware they read the same, so implementation is a precondition and not a detail.

One more asymmetry, because it decides the order of Section 12's steps.

A moving counter and a zero counter carry the same information in the formal sense — they eliminate complementary sets — but they do not carry the same risk.

A counter that moves is self-validating: something incremented it. A counter at zero is a claim about the absence of an event, and three separate mechanisms produce that reading without the absence being real — the register does not exist, the window was too short, or Chapter 19.7 §7's addend is undersized on exactly this traffic.

Which is why the procedure reads the most informative counter first and treats its zero as the strongest step it will take. c_crc_errors at zero eliminates five sites — the largest single move in the method — and it is also the single reading most worth double-checking, by lengthening the window before acting on it.

11. RTL 5 — The Zero-Evidence Guard

// ---------------------------------------------------------------------
// zero_evidence_guard -- distinguish "this counter read zero" from
// "this counter does not exist", when the register returns zero in
// both cases.
//
// The trick is that an unimplemented counter is zero under conditions
// where an implemented one CANNOT be. If frames are being filtered --
// which a deliberately wrong destination address guarantees -- then a
// c_filtered of zero is proof the counter is not there.
// ---------------------------------------------------------------------
module zero_evidence_guard
  import debugm_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  // A probe: traffic the environment KNOWS must move each counter.
  input  logic        probe_active,
  input  logic [2:0]  probe_kind,        // 0 filtered, 1 vlan, 2 fifo, 3 desc
  input  logic [31:0] probe_frames_sent,

  input  logic [31:0] d_filtered,
  input  logic [31:0] d_vlan_disc,
  input  logic [31:0] d_fifo_drop,
  input  logic [31:0] d_desc_err,

  output logic [4:0]  proven_present,
  output logic [4:0]  proven_absent,
  output logic        probe_inconclusive
);
  localparam int PROBE_MIN = 1000;

  logic enough;
  assign enough = probe_active && (probe_frames_sent >= 32'(PROBE_MIN));

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      proven_present <= 5'd0;
      proven_absent  <= 5'd0;
    end else if (enough) begin
      case (probe_kind)
        3'd0: if (d_filtered  != 32'd0) proven_present[1] <= 1'b1;
              else                      proven_absent [1] <= 1'b1;
        3'd1: if (d_vlan_disc != 32'd0) proven_present[2] <= 1'b1;
              else                      proven_absent [2] <= 1'b1;
        3'd2: if (d_fifo_drop != 32'd0) proven_present[3] <= 1'b1;
              else                      proven_absent [3] <= 1'b1;
        default: if (d_desc_err != 32'd0) proven_present[4] <= 1'b1;
                 else                     proven_absent [4] <= 1'b1;
      endcase
    end
  end

  // Section 12's precondition, as a bit: until every optional counter
  // has been probed, a zero reading on any of them is not evidence.
  assign probe_inconclusive = ((proven_present | proven_absent) != 5'b11110);
endmodule

Classification: an instrumentation test, which is a different kind of block from everything else in the chapter.

What it teaches: that the way to tell a zero from an absence is to make the counter move on purpose. Send a thousand frames to a destination address the port does not own; Chapter 7.4's filter must discard every one of them. If c_filtered is still zero, the counter is not implemented — and that is now a proven fact rather than an assumption. The probe is Chapter 20.5's error injector used against the instrumentation instead of against the design.

And it teaches that this is a precondition rather than a step. probe_inconclusive should be checked before the first diagnostic observation, because every subsequent conclusion drawn from a zero depends on it — and a procedure that probes after the fact has to discard everything it concluded.

Deliberately simplified: PROBE_MIN is 1 000 frames, which is a guess at how many are needed for a counter to be visibly non-zero and takes no account of a counter that samples. The FIFO probe cannot be performed from the wire at all — Chapter 20.5 §12 proved no sequence of frames overflows a correctly sized FIFO — so probe_kind 2 requires a stalled consumer, which this block silently assumes somebody arranged. And proven_absent is never cleared, so a platform change mid-session is not noticed.

Production implication: the FIFO row is the one that makes this block honest about its limits. Three of the four optional counters can be probed from the wire with one malformed or misaddressed frame each; the fourth cannot be probed from the wire at all. So on a platform where c_fifo_drops reads zero and cannot be provoked, the receive FIFO remains in the candidate set permanently — and Chapter 19.5 §14's truncation path is exactly the failure that most needs localising. The chapter's method is strongest where the design is easiest and weakest where it is hardest, which is worth knowing before an outage rather than during one.

12. The Procedure, Written Down

Eight steps. The first three cost nothing, the next three cost a register read each, and only the last two need equipment.

Step 6's position is the whole argument for writing the procedure down. Every step above it is a register read, and together they take a candidate space of twelve to a single site on a fully instrumented platform or to a class of five otherwise. A capture answers one question and takes three hours; a register read answers a question worth 0.98 bits and takes a millisecond.

The steps in order, with what each one is actually asking.

Step 0 — implementation. Four questions of a datasheet. The answers decide whether the investigation can end with a site or with a shortlist, and they are free.

Step 0b — the probe. Three of the four optional counters can be made to move deliberately. Do it once per platform, not once per outage — Section 11.

Step 1 — the trigger. frames_out short of frames_in confirms a fault and eliminates nothing. Its value is that it bounds the window: the counters read from here are deltas, and Section 18's row three is about how long that window should be.

Step 2 — conservation. Does the arithmetic balance? Chapter 20.3 §13's identity, with Chapter 19.1 §6's twelve-frame skew allowance. It balances → the missing frames are accounted for by a named counter. It does not → they vanished where nothing counts, which is four sites.

Step 3 — the best single question. c_crc_errors splits five from seven — the most even split any counter offers. Moving points at the channel, the PHY, the xMII, the parser or the CRC logic; zero eliminates all five.

Step 4 — the separators. c_alignment_errors separates the physical sites from the logical ones; c_undersize and c_oversize separate the parser from the validity classifier, which is the one pair in the space that is genuinely easy to confuse and genuinely easy to separate.

Step 5 — the linear tail. Four counters, four sites, one at a time. Section 8's arithmetic says this cannot be improved with these counters.

Step 6 — equipment. By now the candidate set is a site or a class of five, and a capture taken at step 6 is aimed — at one interface, for one condition, with an oracle. A capture taken at step 1 is a fishing expedition and Chapter 21.9 is about what it can and cannot show.

And the procedure's own stopping rule, which is the part people leave out:

Stop when questions_left is zero. If the mask is a single site, that is the answer. If it is a class, the answer is "these five, and here is the counter that would separate them" — and that is a finished diagnosis, not a failed one.

And there is a variant of the procedure worth naming, because it is what a monitoring system should run rather than what a person runs.

Every step up to 5 is a register read, so the whole thing can be executed continuously on every port in a fleet, at no cost, with nobody watching.

Row five is the one that changes how a team spends its time. site_unreachable is a property of the port, it never changes, and knowing it for every port before anybody is paged turns "this link is dropping frames" into either a one-hour investigation or a four-hour one, decided in advance. The reads cost nothing and the inventory is built once.

Row four is the state nobody plans for and it happens. An empty candidate mask means two observations contradicted each other under Section 2's table — which is not a design fault and not an instrumentation fault. It is a fault in the table, and the correct response is to find which pair of observations is inconsistent rather than to keep measuring.

13. RTL 6 — The Evidence Recorder

// ---------------------------------------------------------------------
// evidence_recorder -- what was observed, in what order, and what each
// observation ruled out.
//
// The output that matters is not the conclusion. It is the AUDIT: a
// diagnosis that cannot say which observation eliminated which site
// cannot be reviewed, and an unreviewable diagnosis is an opinion.
// ---------------------------------------------------------------------
module evidence_recorder
  import debugm_pkg::*;
#(
  parameter int MAX_STEPS = 16
)(
  input  logic        clk,
  input  logic        rst_n,
  input  logic        restart,

  input  logic        obs_valid,
  input  logic [3:0]  obs_counter,       // which of the ten
  input  evidence_e   obs_kind,
  input  site_mask_t  before_mask,
  input  site_mask_t  after_mask,

  output logic [3:0]  n_steps,
  output site_mask_t  eliminated_by [MAX_STEPS],
  output logic [3:0]  counter_of    [MAX_STEPS],
  output logic [3:0]  wasted_steps,
  output logic        contradiction
);
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n || restart) begin
      n_steps       <= 4'd0;
      wasted_steps  <= 4'd0;
      contradiction <= 1'b0;
      for (int i = 0; i < MAX_STEPS; i++) begin
        eliminated_by[i] <= 12'd0;
        counter_of[i]    <= 4'd0;
      end
    end else if (obs_valid && n_steps < 4'(MAX_STEPS)) begin
      eliminated_by[n_steps] <= before_mask & ~after_mask;
      counter_of[n_steps]    <= obs_counter;
      n_steps                <= n_steps + 4'd1;

      // An observation that eliminated nothing. Section 9's ranker
      // should have prevented it; recording it is how a team finds
      // out the ranker was bypassed.
      if ((before_mask & ~after_mask) == 12'd0)
        wasted_steps <= wasted_steps + 4'd1;

      // Section 12's row four: two readings that cannot both be true
      // under Section 2's table.
      if (after_mask == 12'd0) contradiction <= 1'b1;
    end
  end
endmodule

Classification: a log, and the only block in the chapter whose value is entirely retrospective.

What it teaches: that eliminated_by is the field that makes a diagnosis reviewable. "It is the DMA" is an opinion; "c_crc_errors was zero, which eliminated five sites; the conservation identity held, which eliminated four more; c_filtered and c_vlan_discards were zero, which eliminated two" is an argument — and the difference is that the second one can be checked by somebody who was not there.

And it teaches that wasted_steps is a measurement of the procedure rather than of the fault. A step that eliminated nothing was a question whose answer was already known, and Section 9's ranker exists to prevent exactly that. A post-mortem with three wasted steps out of seven has found a process problem, and it is a process problem that costs about three hours per outage.

Deliberately simplified: the recorder stores MAX_STEPS masks in flops — 16 × 12 bits plus 16 × 4 is 256 flops — where a real one writes to a log. There is no timestamp, so the record cannot say how long each step took, which is the other number a post-mortem wants. And contradiction is set and never explained: the block knows the mask went empty and not which earlier observation the last one contradicted.

Production implication: the contradiction case is worth instrumenting properly, because it is the one that indicts Section 2's table. When a mask goes empty, one of the ten mask constants is wrong for this design — a counter that moves for a site the table says it does not, or the reverse. Storing before_mask for every step makes it a five-minute search; storing only the conclusion makes it unfindable, and the table then stays wrong for every future investigation.

14. What a Debugging Method Must Never Do

Six prohibitions. Three are about evidence and three are about stopping, and every one of them produces a confident wrong answer rather than a visible failure.

Row two is the one that is violated hourly and it has a name in this track. "CRC errors are climbing, so the cable is bad" is Chapter 11.4 §15's class 48 — a symptom implying a cause where the mapping is many-to-many — arriving as an operational habit rather than as an assertion. It is right about five twelfths of the time and it is the reason cables get replaced on links whose fault is in the parser's offset arithmetic.

Row four is the one that damages a team's credibility. Reporting "the fault is in the DMA" when the evidence supports "the filter, VLAN, the FIFO, the DMA or the driver" is a one-in-five guess dressed as a conclusion. When it is wrong, the next investigation starts from a discredited method — and the honest report costs nothing: five candidates, and c_fifo_drops would separate them.

And the two that look like impatience and are not:

Both produce activity that looks like progress and is not, which is the property all six share and is why a procedure needs a stopping rule written down before the outage rather than during it.

15. RTL 7 — Debug Telemetry

// ---------------------------------------------------------------------
// debugm_telemetry -- how well the method is doing, which is a
// different question from what the fault is.
//
// Two groups. "Progress" says whether the procedure is still
// narrowing. "Ceiling" says how good an answer this platform can
// produce at all -- and the second is knowable before the first step.
// ---------------------------------------------------------------------
module debugm_telemetry
  import debugm_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  input  site_mask_t  candidates,
  input  logic [3:0]  n_observations,
  input  logic [3:0]  wasted_steps,
  input  logic [4:0]  optional_present,
  input  logic        probe_inconclusive,
  input  logic        contradiction,
  input  logic        no_useful_question,

  // Progress.
  output logic [3:0]  n_candidates,
  output logic [15:0] efficiency_pct,
  output logic        stalled,

  // Ceiling -- all knowable at step 0.
  output logic [3:0]  classes_available,
  output logic [3:0]  largest_class,
  output logic [3:0]  best_possible_answer,
  output logic        site_unreachable
);
  localparam int OPTIMAL_STEPS = 7;

  assign n_candidates = 4'(popcount12(candidates));

  // What fraction of the observations made were useful.
  always_comb
    efficiency_pct = (n_observations == 4'd0) ? 16'd100
      : 16'(((32'(n_observations) - 32'(wasted_steps)) * 32'd100)
            / 32'(n_observations));

  assign stalled = no_useful_question || contradiction;

  // Section 4's table as arithmetic: seven classes with the required
  // six, and one more class per optional counter present.
  always_comb begin
    classes_available = 4'd7;
    for (int i = 0; i < 5; i++)
      if (optional_present[i]) classes_available = classes_available + 4'd1;

    // The silent class shrinks by one per NON-symbol optional counter.
    largest_class = 4'd5;
    for (int i = 1; i < 5; i++)
      if (optional_present[i] && largest_class > 4'd1)
        largest_class = largest_class - 4'd1;
  end

  assign best_possible_answer = largest_class;
  // A platform on which the answer can never be a single site.
  assign site_unreachable = (largest_class > 4'd1) || probe_inconclusive;
endmodule

Classification: a reporting block whose second group of outputs does not depend on any observation at all.

What it teaches: that best_possible_answer is computable at step 0 — from a datasheet, before any traffic — and that it is the single most useful thing to tell a team at the start of an investigation. "On this platform the best answer available is a class of three" changes the plan; discovering it after four hours changes only the mood.

And it teaches that efficiency_pct measures the procedure and n_candidates measures the fault. They are independent: a procedure can be 100% efficient and still finish with five candidates, which is the platform's fault, and it can be 40% efficient and finish with one, which is luck. Reporting only the second is how a bad method survives a good outcome.

Deliberately simplified: largest_class decrements once per optional counter without checking which — so a platform with c_symbol_errors and nothing else gets credit it has not earned, since the symbol counter splits class B and not class G. The loop starts at index 1 to exclude it, which is correct and is a hardcoded fact about Section 4's table. OPTIMAL_STEPS is declared and unused, which is where an efficiency figure against the seven-step optimum should go.

Production implication: site_unreachable is the bit that should appear in a monitoring system rather than in a debug session. It is a property of the platform, it never changes, and knowing it for every port in a fleet turns "this link is dropping frames" into either a four-hour investigation or a one-hour one before anybody is paged. Chapter 19.7 §15's telemetry made the same argument about the design; this is the same argument about the instrumentation around it.

16. RTL 8 — The Debug Conformance Monitor

// ---------------------------------------------------------------------
// debugm_conformance_monitor -- six verdicts about the METHOD, and
// four of them fire on a method that is being followed correctly.
//
// That ratio is the chapter's point. Most of what limits an Ethernet
// diagnosis is not the investigator; it is a counter that does not
// exist, and no amount of care substitutes for it.
// ---------------------------------------------------------------------
module debugm_conformance_monitor
  import debugm_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  input  site_mask_t  candidates,
  input  logic [3:0]  n_observations,
  input  logic [3:0]  wasted_steps,
  input  logic [4:0]  optional_present,
  input  logic        probe_inconclusive,
  input  logic        contradiction,
  input  logic        capture_taken,
  input  logic [3:0]  capture_at_step,

  output logic        instrumentation_limited,
  output logic        probe_skipped,
  output logic        capture_premature,
  output logic        steps_wasted,
  output logic        table_wrong,
  output logic        method_exhausted,
  output logic        method_sound
);
  localparam int CAPTURE_MIN_STEP = 5;

  // Section 4: the four non-symbol optional counters are what shrink
  // class G, and their absence is a platform fact.
  assign instrumentation_limited = (optional_present[4:1] != 4'b1111);

  // Section 11: a zero reading is not evidence until the counter is
  // proven to exist.
  assign probe_skipped = probe_inconclusive && (n_observations > 4'd0);

  // Section 12's row three. A capture before the register reads are
  // exhausted costs hours and is worth about a bit.
  assign capture_premature = capture_taken &&
                             (capture_at_step < 4'(CAPTURE_MIN_STEP));

  assign steps_wasted = (wasted_steps > 4'd0);

  // Section 13: an empty mask means two observations contradicted each
  // other under Section 2's table, which indicts the table.
  assign table_wrong = contradiction;

  assign method_exhausted = (popcount12(candidates) > 1) &&
                            (n_observations >= 4'd7);

  assign method_sound = !probe_skipped && !capture_premature &&
                        !steps_wasted && !table_wrong;

  always_ff @(posedge clk) begin
    if (rst_n && instrumentation_limited)
      $display("[debug] best possible answer on this platform is a class, not a site");
  end
endmodule

Classification: an auditor of a procedure, whose most-fired verdict is not about the procedure.

What it teaches: that instrumentation_limited is deliberately not a term of method_sound. A platform missing three optional counters does not make the method unsound — the method is doing everything available correctly and the answer is a class. Folding a platform limitation into a verdict about the investigator's work is how a team learns to distrust its own process for a reason that has nothing to do with it.

And it teaches why method_exhausted is separate from stalled. Section 15's stalled means no question remains; method_exhausted means seven observations have been made and more than one candidate survives — which, by Section 8's arithmetic, should be impossible on a fully instrumented platform. When both are false and the count is above seven, the observations are being wasted, and steps_wasted says so.

Deliberately simplified: CAPTURE_MIN_STEP is 5, which is a judgement and is wrong for a fault whose symptom is a malformed frame — there, a capture at step 1 is the correct first move because the frame's contents are the evidence. The monitor has no notion of symptom class, which Chapter 21.2 supplies. And $display fires every cycle that the condition holds, which is deliberate for the same reason as elsewhere in the track: a silence reads as a pass.

Production implication: probe_skipped is the verdict worth wiring into a team's tooling rather than into a report. It fires the moment somebody draws a conclusion from a counter whose existence has not been established — and Section 10 showed that an unimplemented counter and a genuinely zero one read identically. One bit, checked before the first conclusion, prevents the most expensive single error in the chapter, which is eliminating the site the fault is actually at.

17. Where the Method Stops

The method's output is a mask. This section is about the four ways that mask fails to be a single site, and which of them are the investigator's problem.

And one terminal state that is not in the table because it is not a state of the mask.

The procedure can finish correctly, name a single site, and be wrong — when the fault is not in the space at all. A transmit-side fault at the far end, a misconfigured switch three hops away, an MTU mismatch that drops only large frames: none of the twelve sites is faulty and the method will still converge, because it is an intersection over a table that has no row for "none of the above."

Row three is the one worth knowing about because it has a cheap tell. An MTU mismatch drops only frames above a threshold, so frames_out is short and c_oversize never moves — which looks exactly like class G. The distinguishing evidence is not a counter at all: it is that the loss rate is a function of the frame size, and no register in the RMON set is conditioned on size. Chapter 19.7 §2's histogram is the nearest thing, and comparing its transmit and receive shapes is the one observation that separates a size-dependent drop from an unconditional one.

Rows two and three cover seven of the twelve sites — 58.3% — and neither is anybody's mistake. They are what the RMON standard's scope costs: the standard specifies error counters, and the five sites in class G do not produce errors.

And there is a fifth state the mask cannot represent at all.

Row one is the assumption whose failure is hardest to see. Two simultaneous faults do not produce the union of their signatures — they produce the signature of whichever one the frame meets first, because a frame discarded at the parser never reaches the FIFO. So the candidate mask converges, confidently, on the earlier of the two sites; the fix is applied; the symptom persists; and the second investigation starts from scratch with the first one's conclusion now looking like an error.

The detection is available and it is not in the mask. Chapter 20.3 §13's conservation identity is the one observation that sees all the loss at once:

Row two is the check to run after every fix and before closing anything, and it costs six register reads. A fix that eliminates the symptom and leaves unaccounted non-zero has not finished — and that is the cheapest available protection against the second-fault case, which is otherwise indistinguishable from a bad diagnosis.

And the masking is not symmetric, which is worth one more table because it says which pairs are dangerous.

A frame meets the twelve sites in order. So a fault at site i masks a fault at site j whenever i is less than j and the earlier fault discards the frame — and every one of the twelve except the CRC-logic case does discard it.

Summed over all twelve sites, 66 of the 132 ordered pairs are masking pairs — exactly half. So if two independent faults are present, there is a 50% chance the method sees only one of them, and it sees the earlier one with certainty rather than at random.

The "always the earlier" row is what makes the case tractable. A masked second fault is not a random error; it is systematically downstream of the one that was found — so the re-check after a fix has a direction: look at the sites after the one you just fixed, and the conservation identity says whether you need to. That is a much better position than "the fix did not work", and it costs the same six reads.

18. What the Method Assumes

Nine assumptions. Three are about the counters, three about the fault and three about the design — and the one most likely to be false is about the window.

Row nine is the assumption nothing in this chapter supports and it deserves its own arithmetic. A fault that corrupts one frame in ten million is a real and common failure mode — a marginal connector, a lane at the edge of its eye. At 100 Gb/s and minimum size, 148.9 million frames per second means one corruption every 67 milliseconds, which any window catches. At 1 Gb/s the same rate is 1.488 million frames per second and one corruption every 6.7 seconds — so a one-second window reads c_crc_errors as zero and eliminates five sites that should have stayed.

The same fault, the same counter, and the same window produce a confident elimination at 1 Gb/s and a clear detection at 100. Which gives the rule the method needs and does not have:

A zero is only evidence if the window was long enough for the rarest fault you care about. At 1 Gb/s that is tens of seconds; at 100 Gb/s it is tens of milliseconds.

Row one is the assumption whose failure is the most embarrassing. Chapter 19.7 §7 showed a counter sized for conformant traffic counts exactly half of a 47-octet runt flood, because its addend is one bit where two are needed. A method reading such a counter gets a number that is wrong by a clean fraction — and a clean fraction reads as a real measurement rather than as a bug.

And three things deliberately not assumed:

Row three is the chapter's practical thesis. Everything up to step 5 is a register read, which means the whole method can be run from a script, from a monitoring system, or by somebody with no equipment and a serial console — and it reaches a site or a class of five before anybody unpacks a capture tool.

19. The Cost, Accounted

A debugging method is not hardware, so the accounting here is of two different things: what the method's own machinery costs if you build it, and what the instrumentation it wants costs in the design.

Two hundred and ninety-nine flops is the cheapest structure in Modules 20 and 21, and the reason is that a decision procedure over twelve candidates has almost no state: twelve bits of mask, a step count, and a log. Chapter 20.6 §19's join table was 74 017 flops because it remembers something per frame; this remembers something per observation, and there are seven of those.

The instrumentation is the real cost and it is in the design.

Two hundred and ninety-seven flops — 2.1% of Chapter 19.7 §19's 14 166-flop datapath — is the difference between a diagnosis that names a site and one that names five. That is the whole economic content of this chapter, and it is a smaller number than any single mechanism Module 19 argued about.

Row three is 2.1% and it is not spent, on most parts. Row two is 7.0% and it is spent, because a common reading instant is a correctness requirement and a debuggable fault space is not. Nothing in the standard requires a counter for a non-error, which is the whole reason class G exists — and Section 4's table is what the omission costs, expressed as five candidates instead of one.

And a last comparison, because it is the one that persuades:

There is a second cost this chapter's method imposes that is not flops at all, and it is the one a team actually feels.

Rows one and two are amortised over a platform's whole life and rows three is amortised over nothing because it is free. The entire method costs one minute, once, and then milliseconds per outage — against three hours for the single observation it is designed to postpone.

Which produces the comparison worth putting in front of whoever decides the 2.1%:

Row three is the number that does not appear on any design review slide. A class of five resolved by guessing is wrong four times in five, and each wrong fix is a maintenance window, a change record and a second investigation that starts from a discredited method. Two hundred and ninety-seven flops is about three tenths of what Chapter 19.7's shadow bank costs, and the shadow bank was built without argument because a common reading instant is a correctness requirement. Debuggability is not, which is the entire reason this section exists.

20. Properties Worth Asserting, and One Worth Refusing

Thirty-three properties and eight covers, in four groups: the mask's algebra, the evidence's three-valuedness, the procedure's progress, and the terminal states.

Group one — the mask.

// A candidate set only ever shrinks, and an observation that grows it
// is a table error rather than a new hypothesis.
p_mask_monotone:    assert property (@(posedge clk) disable iff (!rst_n)
                      obs_valid |=> ((candidates & $past(candidates)) == candidates));

p_mask_starts_full: assert property (@(posedge clk) disable iff (!rst_n)
                      restart |=> (candidates == ALL_SITES));

p_mask_intersect:   assert property (@(posedge clk) disable iff (!rst_n)
                      (obs_valid && obs_kind != EV_ABSENT) |=>
                        (candidates == ($past(candidates) & $past(obs_consistent))));

p_count_matches:    assert property (@(posedge clk) disable iff (!rst_n)
                      n_candidates == 4'(popcount12(candidates)));

p_converged_is_one: assert property (@(posedge clk) disable iff (!rst_n)
                      converged |-> (n_candidates == 4'd1));

p_classg_is_five:   assert property (@(posedge clk) disable iff (!rst_n)
                      class_only |-> (n_candidates == 4'd5));

p_no_regrowth:      assert property (@(posedge clk) disable iff (!rst_n)
                      (n_candidates <= $past(n_candidates)) || restart);

p_empty_is_flagged: assert property (@(posedge clk) disable iff (!rst_n)
                      (candidates == 12'd0) |-> contradiction);

Group two — evidence, and its three values. Every property here exists because EV_ABSENT is not EV_ZERO.

p_absent_no_narrow: assert property (@(posedge clk) disable iff (!rst_n)
                      (obs_valid && obs_kind == EV_ABSENT) |=>
                        (candidates == $past(candidates)));

p_absent_no_step:   assert property (@(posedge clk) disable iff (!rst_n)
                      (obs_valid && obs_kind == EV_ABSENT) |=>
                        (n_observations == $past(n_observations)));

p_zero_narrows:     assert property (@(posedge clk) disable iff (!rst_n)
                      (obs_valid && obs_kind == EV_ZERO &&
                       (($past(candidates) & obs_consistent) != $past(candidates)))
                        |=> (n_candidates < $past(n_candidates)));

p_probe_before_use: assert property (@(posedge clk) disable iff (!rst_n)
                      (obs_kind == EV_ZERO && !optional_proven) |-> probe_skipped);

p_probe_is_sticky:  assert property (@(posedge clk) disable iff (!rst_n)
                      proven_present[1] |=> always proven_present[1]);

p_probe_exclusive:  assert property (@(posedge clk) disable iff (!rst_n)
                      !(proven_present & proven_absent));

p_frames_out_unused:assert property (@(posedge clk) disable iff (!rst_n)
                      consistent_valid |-> (consistent == m_without_frames_out));

p_silent_is_classg: assert property (@(posedge clk) disable iff (!rst_n)
                      symptom_is_silent |-> ((consistent & CLASS_SILENT) != 12'd0));

Group three — progress.

p_ranker_narrows:   assert property (@(posedge clk) disable iff (!rst_n)
                      (!no_useful_question && obs_valid &&
                       obs_counter == $past(best_counter)) |=>
                        (n_candidates < $past(n_candidates)));

p_best_split_valid: assert property (@(posedge clk) disable iff (!rst_n)
                      (best_split > 4'd0) |-> !no_useful_question);

p_no_question_stuck:assert property (@(posedge clk) disable iff (!rst_n)
                      no_useful_question |=> $stable(candidates));

p_wasted_counted:   assert property (@(posedge clk) disable iff (!rst_n)
                      (obs_valid && $stable(candidates) && obs_kind != EV_ABSENT)
                        |=> (wasted_steps == $past(wasted_steps) + 4'd1));

p_efficiency_range: assert property (@(posedge clk) disable iff (!rst_n)
                      efficiency_pct <= 16'd100);

p_seven_suffices:   assert property (@(posedge clk) disable iff (!rst_n)
                      ((optional_present == 5'b11111) && (n_observations >= 4'd7) &&
                       (wasted_steps == 4'd0)) |-> converged);

p_conservation_cut: assert property (@(posedge clk) disable iff (!rst_n)
                      (!identity_undecidable && identity_holds) |->
                        ((cut_mask & 12'b1101_0000_1000) == 12'd0));

p_undecidable_full: assert property (@(posedge clk) disable iff (!rst_n)
                      identity_undecidable |-> (cut_mask == ALL_SITES));

p_skew_allowance:   assert property (@(posedge clk) disable iff (!rst_n)
                      (unaccounted <= skew_bound) |-> identity_holds);

Group four — terminal states, and the ceiling.

p_ceiling_static:   assert property (@(posedge clk) disable iff (!rst_n)
                      $stable(optional_present) |=> $stable(best_possible_answer));

p_site_needs_all:   assert property (@(posedge clk) disable iff (!rst_n)
                      (optional_present[4:1] != 4'b1111) |-> site_unreachable);

p_limited_not_fault:assert property (@(posedge clk) disable iff (!rst_n)
                      instrumentation_limited |-> !(method_sound == 1'b0 &&
                                                    !probe_skipped && !steps_wasted));

p_capture_late:     assert property (@(posedge clk) disable iff (!rst_n)
                      (capture_taken && capture_at_step >= 4'd5) |-> !capture_premature);

p_exhausted_needs7: assert property (@(posedge clk) disable iff (!rst_n)
                      method_exhausted |-> (n_observations >= 4'd7));

p_sound_excludes:   assert property (@(posedge clk) disable iff (!rst_n)
                      method_sound |-> (!table_wrong && !capture_premature));

p_table_wrong_stick:assert property (@(posedge clk) disable iff (!rst_n)
                      table_wrong |=> always table_wrong);

p_log_records_all:  assert property (@(posedge clk) disable iff (!rst_n)
                      (obs_valid && n_steps < 4'd16) |=>
                        (n_steps == $past(n_steps) + 4'd1));

p_log_elimination:  assert property (@(posedge clk) disable iff (!rst_n)
                      (obs_valid && n_steps < 4'd16) |=>
                        (eliminated_by[$past(n_steps)] ==
                         ($past(before_mask) & ~$past(after_mask))));

And eight covers, because six of these are states a reviewer wants to have seen rather than to be promised.

c_reached_site:    cover property (@(posedge clk) converged);
c_reached_classg:  cover property (@(posedge clk) class_only);
c_contradiction:   cover property (@(posedge clk) contradiction);
c_absent_counter:  cover property (@(posedge clk) obs_kind == EV_ABSENT);
c_probe_absent:    cover property (@(posedge clk) proven_absent != 5'd0);
c_identity_fails:  cover property (@(posedge clk) !identity_holds && !identity_undecidable);
c_seven_steps:     cover property (@(posedge clk) n_observations == 4'd7);
c_wasted_step:     cover property (@(posedge clk) wasted_steps > 4'd0);

21. Verification Scenarios

Fifty-eight scenarios for a procedure, plus a five-run directed test whose content is an instrumentation change rather than a stimulus one.

The mask algebra — 10 scenarios.

Evidence and its three values — 11 scenarios.