"Switches Eliminate Broadcasts"

84 octets on the wire → 100 × 10⁹ ÷ (84 × 8) = 148.81 Mpps
× 63 copies = 9.375 Gpps of frame emission

// ---------------------------------------------------------------------
// bcastmyth_pkg -- the constants a flooding argument needs at Chapter
// 23.3's scale, with every derived figure computed here.
//
// Unit: Chapter 23.3 Section 2's bitcell equivalent.
//   1 BCE = 0.35 GE = one bit of usable on-die SRAM
//   1 flip-flop = 20 BCE
//   Chapter 19.7 Section 19's MAC receive datapath = 283 320 BCE
//   Chapter 23.3's switch: 64 ports, 9.524 Gpps, table 128k x 96 b
// ---------------------------------------------------------------------
package bcastmyth_pkg;

  localparam int unsigned DATAPATH_BCE = 283_320;
  localparam int unsigned BCE_PER_FLOP = 20;

  localparam int unsigned PORTS          = 64;
  localparam int unsigned MIN_SLOT_OCT   = 84;     // Chapter 24.3 Sec 1
  localparam int unsigned BUDGET_PPS_K   = 9_524_000;

  // ---- Chapter 12.5's table, at Chapter 23.3's size --------------------
  localparam int unsigned TBL_ENTRIES = 128 * 1024;
  localparam int unsigned TBL_WAYS    = 4;
  localparam int unsigned TBL_SETS    = TBL_ENTRIES / TBL_WAYS;   // 32 768
  localparam int unsigned TBL_WIDTH   = 96;

  // ---- Chapter 12.5 Section 5's ageing, Chapter 25.2 Section 8's churn --
  localparam int unsigned AGEING_SECONDS = 300;

  typedef enum logic [1:0] {
    FLOOD_NONE     = 2'd0,
    FLOOD_BCAST    = 2'd1,   // by specification
    FLOOD_UNKNOWN  = 2'd2,   // because the table has no entry
    FLOOD_MCAST    = 2'd3    // no membership -- Chapter 12.4 Section 13
  } floodcause_e;

  // ---- derived: replication ---------------------------------------------
  function automatic int unsigned copies(int unsigned members);
    return (members == 0) ? 0 : (members - 1);
  endfunction

  function automatic int unsigned pps_at(int unsigned gbps,
                                         int unsigned slot_oct);
    // frames per second, in thousands, to keep the product in range.
    return (gbps * 1_000_000) / (slot_oct * 8);
  endfunction

  // ---- derived: effective capacity, Chapter 12.5 Section 9 --------------
  // stored = S x E[min(Load, W)] with Load ~ Poisson(n/S), so the
  // refused share depends only on the LOAD -- offered addresses per
  // set -- and not on the key's width. Chapter 13.4 Section 8's result.
  //
  // Integer hardware cannot evaluate exp, so the curve is tabulated at
  // eight anchors and interpolated between them. The anchors, at W = 4:
  //   load 1.00 ->  0.435%     load 2.00 ->  3.757%
  //   load 3.00 -> 10.645%     load 4.00 -> 19.537%
  //   load 5.00 -> 28.737%     load 6.00 -> 37.217%
  //   load 8.00 -> 50.744%     load 16.00 -> 75.001%
  // Worst interpolation error is about six per cent, at load 12.
  function automatic int unsigned load_x100(int unsigned offered,
                                            int unsigned sets);
    return (offered * 100) / sets;
  endfunction

  function automatic int unsigned refused_ppm(int unsigned offered,
                                              int unsigned sets);
    int unsigned l;
    l = load_x100(offered, sets);
    if (l <=  100) return (l * 43);
    if (l <=  200) return   4_349 + ((l -  100) * 332);
    if (l <=  300) return  37_571 + ((l -  200) * 688);
    if (l <=  400) return 106_452 + ((l -  300) * 889);
    if (l <=  500) return 195_367 + ((l -  400) * 920);
    if (l <=  600) return 287_369 + ((l -  500) * 847);
    if (l <=  800) return 372_167 + ((l -  600) * 676);
    if (l <= 1600) return 507_436 + ((l -  800) * 303);
    return 750_007;
  endfunction

  function automatic int unsigned datapaths_milli(int unsigned bce);
    return (bce * 1000) / DATAPATH_BCE;
  endfunction

endpackage

// ---------------------------------------------------------------------
// flood_amplification_model -- what a flooding port asks of a switch,
// at the scale Chapter 23.3 built.
//
// The output that matters is budget_share_ppm, which reaches 984 252
// for one port at 64 -- and the fact that it cannot be delivered is
// why the symptom is "the network is slow" rather than "port 7 is".
// ---------------------------------------------------------------------
module flood_amplification_model
  import bcastmyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  input  logic [15:0] members,
  input  logic [15:0] port_gbps,
  input  logic [15:0] slot_octets,
  input  logic [31:0] budget_pps_k,

  output logic [15:0] copies_o,
  output logic [31:0] port_pps_k,
  output logic [31:0] emissions_pps_k,
  output logic [31:0] budget_share_ppm,
  output logic [31:0] egress_bw_gbps,
  output logic [31:0] egress_share_ppm,
  output logic        exceeds_budget,
  output logic        bigger_switch_helps,
  output logic [31:0] c_over_budget
);
  always_comb begin
    copies_o   = 16'(copies(int'(members)));
    port_pps_k = 32'(pps_at(int'(port_gbps), int'(slot_octets)));

    emissions_pps_k = port_pps_k * 32'(copies_o);

    budget_share_ppm = (budget_pps_k == 0) ? 32'd0
                     : ((emissions_pps_k * 1_000_000) / budget_pps_k);

    egress_bw_gbps   = 32'(port_gbps) * 32'(copies_o);
    egress_share_ppm = (members == 0) ? 32'd0
                     : ((32'(copies_o) * 1_000_000) / 32'(members));

    exceeds_budget = (emissions_pps_k > budget_pps_k);

    // Chapter 12.4 Section 3's observation: the amplification scales
    // WITH the port count, so a larger part suffers the same share.
    bigger_switch_helps = 1'b0;
  end

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n)               c_over_budget <= '0;
    else if (exceeds_budget)  c_over_budget <= c_over_budget + 32'd1;
  end
endmodule

// ---------------------------------------------------------------------
// unknown_unicast_classifier -- why this frame is flooding, and how
// long the reason will last.
//
// The output that matters is reason_is_permanent, which is true for
// exactly one of the four causes and is the one nothing reports.
// ---------------------------------------------------------------------
module unknown_unicast_classifier
  import bcastmyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  input  logic        frame_valid,
  input  logic        dest_is_broadcast,
  input  logic        dest_is_multicast,
  input  logic        lookup_hit,
  input  logic        insert_was_refused,
  input  logic        entry_aged_out,
  input  logic        topology_changed,
  input  logic        never_seen,
  input  logic [15:0] members,

  output logic  [1:0] cause,
  output logic        is_flooding,
  output logic [15:0] copies_now,
  output logic        reason_is_permanent,
  output logic        host_cost_is_zero,
  output logic        anybody_will_notice,
  output logic [31:0] c_bcast,
  output logic [31:0] c_unknown,
  output logic [31:0] c_unknown_permanent,
  output logic [31:0] c_mcast
);
  always_comb begin
    cause = dest_is_broadcast ? 2'(FLOOD_BCAST)
          : (!lookup_hit && !dest_is_multicast) ? 2'(FLOOD_UNKNOWN)
          : (dest_is_multicast && !lookup_hit)  ? 2'(FLOOD_MCAST)
                                                 : 2'(FLOOD_NONE);

    is_flooding = (cause != 2'(FLOOD_NONE));
    copies_now  = is_flooding ? 16'(copies(int'(members))) : 16'd1;

    // Section 4's table: four reasons an entry is absent and one has
    // no expiry. A refused insert is not retried and never ages.
    reason_is_permanent = (cause == 2'(FLOOD_UNKNOWN)) && insert_was_refused;

    // Chapter 12.4 Section 6: an exact 48-bit compare discards it.
    host_cost_is_zero = (cause == 2'(FLOOD_UNKNOWN));

    // Which is why nobody reports it.
    anybody_will_notice = (cause == 2'(FLOOD_BCAST));
  end

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      c_bcast <= '0; c_unknown <= '0; c_unknown_permanent <= '0; c_mcast <= '0;
    end else if (frame_valid && is_flooding) begin
      case (cause)
        2'(FLOOD_BCAST):   c_bcast   <= c_bcast + 32'd1;
        2'(FLOOD_MCAST):   c_mcast   <= c_mcast + 32'd1;
        default: begin
          c_unknown <= c_unknown + 32'd1;
          if (reason_is_permanent)
            c_unknown_permanent <= c_unknown_permanent + 32'd1;
        end
      endcase
    end
  end
endmodule

stored = S × E[min(Load, W)],  Load ~ Poisson(n ÷ S),  S = 32 768,  W = 4

// ---------------------------------------------------------------------
// table_capacity_model -- Chapter 12.5 Section 9's arithmetic at
// Chapter 23.3's scale, reporting the refused share as a flood rate.
//
// The output that matters is flood_share_is_permanent, because the
// refusals in this model do not age, retry or heal.
// ---------------------------------------------------------------------
module table_capacity_model
  import bcastmyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  input  logic [31:0] offered_addresses,
  input  logic [31:0] sets,
  input  logic [15:0] ways,
  input  logic [15:0] members,

  output logic [31:0] nominal_entries,
  output logic [31:0] load_x100_o,
  output logic [31:0] refused_ppm_o,
  output logic [31:0] stored_estimate,
  output logic [31:0] refused_estimate,
  output logic [15:0] effective_capacity_pct,
  output logic [31:0] occupancy_pct_x100,
  output logic [31:0] mean_copies_x1000,
  output logic        flood_share_is_permanent,
  output logic        occupancy_reads_healthy,
  output logic [31:0] c_evaluations
);
  always_comb begin
    nominal_entries = sets * 32'(ways);

    load_x100_o   = 32'(load_x100(int'(offered_addresses), int'(sets)));
    refused_ppm_o = 32'(refused_ppm(int'(offered_addresses), int'(sets)));

    refused_estimate = (offered_addresses * refused_ppm_o) / 32'd1_000_000;
    stored_estimate  = offered_addresses - refused_estimate;

    effective_capacity_pct = (offered_addresses == 0) ? 16'd100
                           : 16'((stored_estimate * 32'd100)
                                 / offered_addresses);

    // THE field that reads healthy while a fifth of the network floods.
    occupancy_pct_x100 = (nominal_entries == 0) ? 32'd0
                       : ((stored_estimate * 32'd10_000) / nominal_entries);

    // Chapter 12.4 Section 3's amplification, weighted by the refusals.
    mean_copies_x1000 = 32'd1000
      + ((refused_ppm_o * (32'(copies(int'(members))) - 32'd1)) / 32'd1000);

    // Section 4's table, row four: a refused insert is not retried.
    flood_share_is_permanent = (refused_ppm_o != 32'd0);

    // And the observation this chapter exists for.
    occupancy_reads_healthy = (occupancy_pct_x100 < 32'd9000)
                           && (refused_ppm_o > 32'd100_000);
  end

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) c_evaluations <= '0;
    else        c_evaluations <= c_evaluations + 32'd1;
  end
endmodule

// ---------------------------------------------------------------------
// miss_amplifier -- how a table's refusal rate becomes an egress
// demand, and what the occupancy metric says while it does.
//
// The output that matters is alarm_can_fire, which is low across the
// whole operating range of a four-way table -- the metric's ceiling
// is beneath the threshold, and Section 20's refused property is the
// assertion built on it.
// ---------------------------------------------------------------------
module miss_amplifier
  import bcastmyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  input  logic [31:0] refused_ppm_i,
  input  logic [31:0] occupancy_pct_x100_i,
  input  logic [15:0] occupancy_alarm_pct,
  input  logic [15:0] members,
  input  logic [31:0] frames_per_s_k,

  output logic [31:0] mean_copies_x1000,
  output logic [31:0] egress_demand_pps_k,
  output logic [31:0] demand_vs_flat_x100,
  output logic [31:0] effective_ceiling_pct,
  output logic        alarm_can_fire,
  output logic        alarm_is_silent_at_failure,
  output logic        refusal_is_an_event,
  output logic [31:0] c_silent_failures
);
  always_comb begin
    // Chapter 12.4 Section 3's amplification, weighted by the refusals.
    mean_copies_x1000 = 32'd1000
      + ((refused_ppm_i * (32'(copies(int'(members))) - 32'd1)) / 32'd1000);

    egress_demand_pps_k = (frames_per_s_k * mean_copies_x1000) / 32'd1000;

    demand_vs_flat_x100 = mean_copies_x1000 / 32'd10;

    // Chapter 12.5 Section 9's effective capacity for this structure.
    // At four ways it is 80.5%, and it is a CEILING.
    effective_ceiling_pct = 32'd80;

    // THE finding. An alarm above the ceiling is unreachable.
    alarm_can_fire = (32'(occupancy_alarm_pct) <= effective_ceiling_pct);

    alarm_is_silent_at_failure = !alarm_can_fire
                              && (refused_ppm_i > 32'd100_000);

    // The metric that CAN see it is an event, not a level.
    refusal_is_an_event = 1'b1;
  end

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n)                          c_silent_failures <= '0;
    else if (alarm_is_silent_at_failure) c_silent_failures <= c_silent_failures + 32'd1;
  end
endmodule

teardown interval = 3 600 ÷ churn per hour
stale entries held = 300 ÷ teardown interval

// ---------------------------------------------------------------------
// stale_entry_model -- Chapter 25.2 Section 8's stale entries, priced
// in the unit Chapter 12.5 Section 7 says is scarce: sets with room.
//
// The output that matters is live_refusals_caused, because it is the
// harm, and it is not the memory the stale entries occupy.
// ---------------------------------------------------------------------
module stale_entry_model
  import bcastmyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  input  logic [31:0] churn_per_hour,
  input  logic [15:0] ageing_seconds,
  input  logic [31:0] live_addresses,
  input  logic [31:0] sets,
  input  logic        eviction_permitted,

  output logic [31:0] teardown_interval_ms,
  output logic [31:0] stale_entries,
  output logic [31:0] stale_share_ppm,
  output logic [31:0] keys_competing,
  output logic [31:0] refused_without_stale,
  output logic [31:0] refused_with_stale,
  output logic [31:0] live_refusals_caused,
  output logic [31:0] dead_per_live_x100,
  output logic        refusal_outlives_the_cause,
  output logic        eviction_would_fix_it,
  output logic [31:0] c_displacements
);
  always_comb begin
    teardown_interval_ms = (churn_per_hour == 0) ? 32'hFFFF_FFFF
                         : (32'd3_600_000 / churn_per_hour);

    stale_entries = (teardown_interval_ms == 0) ? 32'd0
                  : ((32'(ageing_seconds) * 32'd1000) / teardown_interval_ms);

    stale_share_ppm = (live_addresses == 0) ? 32'd0
                    : ((stale_entries * 1_000_000) / live_addresses);

    keys_competing = live_addresses + stale_entries;

    refused_without_stale = (live_addresses
                             * 32'(refused_ppm(int'(live_addresses),
                                               int'(sets)))) / 32'd1_000_000;
    refused_with_stale    = (keys_competing
                             * 32'(refused_ppm(int'(keys_competing),
                                               int'(sets)))) / 32'd1_000_000;

    live_refusals_caused = (refused_with_stale > refused_without_stale)
                         ? (refused_with_stale - refused_without_stale)
                         : 32'd0;

    dead_per_live_x100 = (live_refusals_caused == 0) ? 32'd0
                       : ((stale_entries * 32'd100) / live_refusals_caused);

    // THE asymmetry: the cause ages out and the consequence does not.
    refusal_outlives_the_cause = 1'b1;

    // Chapter 12.5 Section 11's LRU eviction turns a permanent refusal
    // into a transient one, at the cost of being pushable.
    eviction_would_fix_it = !eviction_permitted;
  end

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n)                        c_displacements <= '0;
    else if (live_refusals_caused != 0) c_displacements <= c_displacements
                                                        + live_refusals_caused;
  end
endmodule

// ---------------------------------------------------------------------
// storm_budget -- what a storm-control setting admits, and which
// traffic it discards to get there.
//
// The output that matters is discards_legitimate_traffic, which is
// high whenever the limiter is applied to unknown unicast -- because
// that traffic's destination exists and the switch failed to learn it.
// ---------------------------------------------------------------------
module storm_budget
  import bcastmyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,
  input  logic        tick_us,

  input  logic [15:0] setting_pct_x10,       // tenths of a per cent
  input  logic [31:0] port_pps_k,
  input  logic [15:0] members,
  input  logic [31:0] budget_pps_k,
  input  logic        applies_to_broadcast,
  input  logic        applies_to_unknown,
  input  logic        frame_flooded,
  input  logic  [1:0] cause_i,

  output logic [31:0] admitted_pps_k,
  output logic [31:0] demand_pps_k,
  output logic [31:0] budget_share_ppm,
  output logic        limiter_active,
  output logic        discards_legitimate_traffic,
  output logic        treats_the_cause,
  output logic [31:0] c_discarded_bcast,
  output logic [31:0] c_discarded_unknown,
  output logic [31:0] c_admitted
);
  logic [31:0] tokens;

  always_comb begin
    admitted_pps_k   = (port_pps_k * 32'(setting_pct_x10)) / 32'd1000;
    demand_pps_k     = admitted_pps_k * 32'(copies(int'(members)));
    budget_share_ppm = (budget_pps_k == 0) ? 32'd0
                     : ((demand_pps_k * 1_000_000) / budget_pps_k);

    limiter_active = (setting_pct_x10 < 16'd1000);

    // Section 12's table, row four. A broadcast the limiter drops is
    // a control-plane frame whose protocol retries; an unknown unicast
    // it drops is application data to a station that exists.
    discards_legitimate_traffic = limiter_active && applies_to_unknown;

    // And neither setting changes how many addresses the table refused.
    treats_the_cause = 1'b0;
  end

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      tokens <= '0; c_discarded_bcast <= '0;
      c_discarded_unknown <= '0; c_admitted <= '0;
    end else begin
      if (tick_us) tokens <= admitted_pps_k / 32'd1000;
      if (frame_flooded) begin
        if (tokens != 32'd0) begin
          tokens     <= tokens - 32'd1;
          c_admitted <= c_admitted + 32'd1;
        end else begin
          if ((cause_i == 2'(FLOOD_BCAST)) && applies_to_broadcast)
            c_discarded_bcast <= c_discarded_bcast + 32'd1;
          if ((cause_i == 2'(FLOOD_UNKNOWN)) && applies_to_unknown)
            c_discarded_unknown <= c_discarded_unknown + 32'd1;
        end
      end
    end
  end
endmodule

// ---------------------------------------------------------------------
// bcast_telemetry -- the counters that let an operator tell a switch
// that is forwarding from one that is flooding.
//
// Design rule: a level cannot see this failure, so every counter here
// is an EVENT or a per-set distribution.
// ---------------------------------------------------------------------
module bcast_telemetry
  import bcastmyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,
  input  logic        clear,

  input  logic        frame_valid,
  input  logic        is_flooding_i,
  input  logic  [1:0] cause_i,
  input  logic [15:0] copies_i,
  input  logic        insert_attempted,
  input  logic        insert_refused,
  input  logic [15:0] set_index,
  input  logic  [3:0] set_occupancy,
  input  logic [15:0] ingress_port,

  output logic [47:0] c_frames,
  output logic [47:0] c_flooded,
  output logic [47:0] c_bcast_o,
  output logic [47:0] c_unknown_o,
  output logic [47:0] c_mcast_o,
  output logic [47:0] c_copies_emitted,
  output logic [47:0] c_insert_refused,
  output logic [47:0] c_sets_at_capacity,
  output logic [31:0] flood_share_ppm,
  output logic [31:0] mean_copies_x1000,
  output logic [31:0] refused_rate_ppm,
  output logic        refusals_are_occurring,
  output logic        occupancy_would_have_alarmed,
  output logic [15:0] worst_ingress_port
);
  logic [47:0] per_port_flood [64];

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n || clear) begin
      c_frames <= '0; c_flooded <= '0; c_bcast_o <= '0; c_unknown_o <= '0;
      c_mcast_o <= '0; c_copies_emitted <= '0; c_insert_refused <= '0;
      c_sets_at_capacity <= '0; worst_ingress_port <= '0;
      for (int i = 0; i < 64; i++) per_port_flood[i] <= '0;
    end else begin
      if (frame_valid) begin
        c_frames <= c_frames + 48'd1;
        if (is_flooding_i) begin
          c_flooded        <= c_flooded + 48'd1;
          c_copies_emitted <= c_copies_emitted + 48'(copies_i);
          // Section 3's production note: the counter that names the
          // cause is flooded frames per INGRESS port.
          per_port_flood[ingress_port[5:0]] <=
            per_port_flood[ingress_port[5:0]] + 48'd1;
          if (per_port_flood[ingress_port[5:0]] >
              per_port_flood[worst_ingress_port[5:0]])
            worst_ingress_port <= ingress_port;
          case (cause_i)
            2'(FLOOD_BCAST):   c_bcast_o   <= c_bcast_o + 48'd1;
            2'(FLOOD_MCAST):   c_mcast_o   <= c_mcast_o + 48'd1;
            default:           c_unknown_o <= c_unknown_o + 48'd1;
          endcase
        end
      end
      // The event a level cannot see.
      if (insert_attempted && insert_refused)
        c_insert_refused <= c_insert_refused + 48'd1;
      if (set_occupancy == 4'd4)
        c_sets_at_capacity <= c_sets_at_capacity + 48'd1;
    end
  end

  always_comb begin
    flood_share_ppm = (c_frames == 0) ? 32'd0
                    : 32'((c_flooded * 48'd1_000_000) / c_frames);

    mean_copies_x1000 = (c_frames == 0) ? 32'd0
                      : 32'((c_copies_emitted * 48'd1000) / c_frames);

    refused_rate_ppm = (c_frames == 0) ? 32'd0
                     : 32'((c_insert_refused * 48'd1_000_000) / c_frames);

    // Section 8: this is nonzero long before any level alarm.
    refusals_are_occurring = (c_insert_refused != 48'd0);

    // And the counterfactual, reported so the gap is visible.
    occupancy_would_have_alarmed = 1'b0;
  end
endmodule

// ---------------------------------------------------------------------
// bcast_conformance -- the checks that hold a switch's flooding
// behaviour to what it can actually claim.
//
// There is no check that the switch does not flood, because Chapter
// 12.1 Section 13's class 49 established that flooding is the
// specified response to an unknown destination.
// ---------------------------------------------------------------------
module bcast_conformance
  import bcastmyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  input  logic [15:0] occupancy_alarm_pct,
  input  logic [15:0] effective_capacity_pct,
  input  logic        counters_merged,
  input  logic        storm_control_on_unknown,
  input  logic [15:0] per_port_setting_pct_x10,
  input  logic [15:0] ports_i,
  input  logic [15:0] aggregate_budget_pct,
  input  logic        refusals_reported,
  input  logic        claims_no_flooding,
  input  logic [47:0] c_flooded_i,

  output logic        v_alarm_unreachable,
  output logic        v_counters_merged,
  output logic        v_limiter_on_unknown,
  output logic        v_aggregate_unbounded,
  output logic        v_refusals_unreported,
  output logic        v_claims_no_flooding,
  output logic  [5:0] violations,
  output logic        conformant
);
  logic [31:0] aggregate_pct_x10;

  always_comb begin
    // 1. Section 8 -- a threshold above the ceiling cannot fire.
    v_alarm_unreachable = (occupancy_alarm_pct > effective_capacity_pct);

    // 2. Prohibition 2 -- two causes, two fixes, one counter.
    v_counters_merged = counters_merged;

    // 3. Section 12 -- the limiter discards legitimate data.
    v_limiter_on_unknown = storm_control_on_unknown;

    // 4. Section 13 -- a per-port setting is not an aggregate bound.
    aggregate_pct_x10     = 32'(per_port_setting_pct_x10) * 32'(ports_i);
    v_aggregate_unbounded = (aggregate_pct_x10
                             > (32'(aggregate_budget_pct) * 32'd10));

    // 5. Section 15 -- the only metric that can see it.
    v_refusals_unreported = !refusals_reported;

    // 6. Chapter 12.1 Section 13's class 49: flooding is specified.
    v_claims_no_flooding = claims_no_flooding && (c_flooded_i != 48'd0);

    violations = { v_claims_no_flooding, v_refusals_unreported,
                   v_aggregate_unbounded, v_limiter_on_unknown,
                   v_counters_merged, v_alarm_unreachable };
    conformant = (violations == 6'b000000);
  end
endmodule

// A1. Copies are the member count less one.
p_rp_copies: assert property (@(posedge clk) disable iff (!rst_n)
  (members != 16'd0) |-> (copies_o == members - 16'd1));

// A2. Emissions are copies times the ingress rate.
p_rp_emissions: assert property (@(posedge clk) disable iff (!rst_n)
  (emissions_pps_k == port_pps_k * 32'(copies_o)));

// A3. One flooding port at 64 members takes almost the whole budget.
p_rp_budget: assert property (@(posedge clk) disable iff (!rst_n)
  ((members == 16'd64) && (port_gbps == 16'd100) &&
   (slot_octets == 16'd84) && (budget_pps_k == 32'd9_524_000))
    |-> (budget_share_ppm >= 32'd980_000));

// A4. And it exceeds the budget.
p_rp_exceeds: assert property (@(posedge clk) disable iff (!rst_n)
  (emissions_pps_k > budget_pps_k) |-> exceeds_budget);

// A5. A bigger switch does not help.
p_rp_bigger_no: assert property (@(posedge clk) disable iff (!rst_n)
  (bigger_switch_helps == 1'b0));

// A6. The egress share converges on unity, not on a half.
p_rp_converges: assert property (@(posedge clk) disable iff (!rst_n)
  (members >= 16'd8) |-> (egress_share_ppm >= 32'd875_000));

// A7. Egress bandwidth is the port rate times the copies.
p_rp_bandwidth: assert property (@(posedge clk) disable iff (!rst_n)
  (egress_bw_gbps == 32'(port_gbps) * 32'(copies_o)));

// A8. A single-member VLAN floods nowhere.
p_rp_single: assert property (@(posedge clk) disable iff (!rst_n)
  (members == 16'd1) |-> (copies_o == 16'd0));

// A9. Over-budget states are counted.
p_rp_counted: assert property (@(posedge clk) disable iff (!rst_n)
  exceeds_budget |=> (c_over_budget == $past(c_over_budget) + 32'd1));

// B1. A broadcast destination always floods.
p_fc_bcast: assert property (@(posedge clk) disable iff (!rst_n)
  (frame_valid && dest_is_broadcast) |-> (cause == 2'(FLOOD_BCAST)));

// B2. A unicast miss floods too.
p_fc_unknown: assert property (@(posedge clk) disable iff (!rst_n)
  (frame_valid && !lookup_hit && !dest_is_multicast && !dest_is_broadcast)
    |-> (cause == 2'(FLOOD_UNKNOWN)));

// B3. A hit does not flood.
p_fc_hit: assert property (@(posedge clk) disable iff (!rst_n)
  (frame_valid && lookup_hit && !dest_is_broadcast) |-> !is_flooding);

// B4. Only a refused insert is permanent.
p_fc_permanent: assert property (@(posedge clk) disable iff (!rst_n)
  reason_is_permanent |-> ((cause == 2'(FLOOD_UNKNOWN)) && insert_was_refused));

// B5. An unknown unicast costs the host nothing.
p_fc_host_zero: assert property (@(posedge clk) disable iff (!rst_n)
  (cause == 2'(FLOOD_UNKNOWN)) |-> host_cost_is_zero);

// B6. And only a broadcast will be noticed.
p_fc_notice: assert property (@(posedge clk) disable iff (!rst_n)
  anybody_will_notice |-> (cause == 2'(FLOOD_BCAST)));

// B7. Copies are emitted only when flooding.
p_fc_copies_gated: assert property (@(posedge clk) disable iff (!rst_n)
  !is_flooding |-> (copies_now == 16'd1));

// B8. The permanent counter is a subset of the unknown counter.
p_fc_subset: assert property (@(posedge clk) disable iff (!rst_n)
  (c_unknown_permanent <= c_unknown));

// B9. Causes are mutually exclusive.
p_fc_exclusive: assert property (@(posedge clk) disable iff (!rst_n)
  frame_valid |-> !(dest_is_broadcast && dest_is_multicast));

// C1. The nominal entry count is sets times ways.
p_tc_nominal: assert property (@(posedge clk) disable iff (!rst_n)
  (nominal_entries == sets * 32'(ways)));

// C2. Refusals rise with the load.
p_tc_monotone: assert property (@(posedge clk) disable iff (!rst_n)
  (load_x100_o > $past(load_x100_o)) |-> (refused_ppm_o >= $past(refused_ppm_o)));

// C3. At a load of 4.00 the refused share is about 19.5%.
p_tc_at_nominal: assert property (@(posedge clk) disable iff (!rst_n)
  (load_x100_o == 32'd400) |-> ((refused_ppm_o > 32'd190_000) &&
                                (refused_ppm_o < 32'd201_000)));

// C4. Refusals begin well below full occupancy.
p_tc_early: assert property (@(posedge clk) disable iff (!rst_n)
  (load_x100_o >= 32'd100) |-> (refused_ppm_o != 32'd0));

// C5. Stored plus refused is what was offered.
p_tc_partition: assert property (@(posedge clk) disable iff (!rst_n)
  (stored_estimate + refused_estimate == offered_addresses));

// C6. Occupancy never exceeds the nominal entry count.
p_tc_occupancy_bounded: assert property (@(posedge clk) disable iff (!rst_n)
  (stored_estimate <= nominal_entries));

// C7. A refused insert is permanent.
p_tc_permanent: assert property (@(posedge clk) disable iff (!rst_n)
  (refused_ppm_o != 32'd0) |-> flood_share_is_permanent);

// C8. The contradiction state is reachable.
p_tc_contradiction: assert property (@(posedge clk) disable iff (!rst_n)
  ((occupancy_pct_x100 < 32'd9000) && (refused_ppm_o > 32'd100_000))
    |-> occupancy_reads_healthy);

// C9. Mean copies rise with refusals.
p_tc_copies: assert property (@(posedge clk) disable iff (!rst_n)
  (refused_ppm_o > $past(refused_ppm_o)) |->
    (mean_copies_x1000 >= $past(mean_copies_x1000)));

// D1. Stale entries scale with churn against the ageing interval.
p_se_count: assert property (@(posedge clk) disable iff (!rst_n)
  (churn_per_hour != 32'd0) |->
    (stale_entries == (32'(ageing_seconds) * 32'd1000) / teardown_interval_ms));

// D2. They add to the keys competing for sets.
p_se_competing: assert property (@(posedge clk) disable iff (!rst_n)
  (keys_competing == live_addresses + stale_entries));

// D3. And cause additional refusals.
p_se_causes: assert property (@(posedge clk) disable iff (!rst_n)
  (stale_entries != 32'd0) |-> (refused_with_stale >= refused_without_stale));

// D4. The refusal outlives its cause.
p_se_outlives: assert property (@(posedge clk) disable iff (!rst_n)
  refusal_outlives_the_cause);

// D5. Eviction would convert a permanent refusal into a transient one.
p_se_eviction: assert property (@(posedge clk) disable iff (!rst_n)
  !eviction_permitted |-> eviction_would_fix_it);

// D6. Zero churn means no stale entries.
p_se_zero: assert property (@(posedge clk) disable iff (!rst_n)
  (churn_per_hour == 32'd0) |-> (stale_entries == 32'd0));

// D7. The alarm cannot fire above the ceiling.
p_ma_unreachable: assert property (@(posedge clk) disable iff (!rst_n)
  (occupancy_alarm_pct > effective_ceiling_pct) |-> !alarm_can_fire);

// D8. And at a real failure it is silent.
p_ma_silent: assert property (@(posedge clk) disable iff (!rst_n)
  (!alarm_can_fire && (refused_ppm_i > 32'd100_000)) |-> alarm_is_silent_at_failure);

// E1. The admitted rate is the setting times the port rate.
p_sc_admitted: assert property (@(posedge clk) disable iff (!rst_n)
  (admitted_pps_k == (port_pps_k * 32'(setting_pct_x10)) / 32'd1000));

// E2. A setting below 100% makes the limiter active.
p_sc_active: assert property (@(posedge clk) disable iff (!rst_n)
  (setting_pct_x10 < 16'd1000) |-> limiter_active);

// E3. Applying it to unknown unicast discards legitimate traffic.
p_sc_legitimate: assert property (@(posedge clk) disable iff (!rst_n)
  (limiter_active && applies_to_unknown) |-> discards_legitimate_traffic);

// E4. It never treats the cause.
p_sc_not_cause: assert property (@(posedge clk) disable iff (!rst_n)
  (treats_the_cause == 1'b0));

// E5. Broadcast and unknown discards are counted apart.
p_sc_apart: assert property (@(posedge clk) disable iff (!rst_n)
  (frame_flooded && (cause_i == 2'(FLOOD_BCAST)) && (tokens == 32'd0)
   && applies_to_broadcast)
    |=> (c_discarded_unknown == $past(c_discarded_unknown)));

// E6. An admitted frame consumes a token.
p_sc_token: assert property (@(posedge clk) disable iff (!rst_n)
  (frame_flooded && (tokens != 32'd0)) |=> (c_admitted == $past(c_admitted) + 32'd1));

// E7. The demand is the admitted rate times the copies.
p_sc_demand: assert property (@(posedge clk) disable iff (!rst_n)
  (demand_pps_k == admitted_pps_k * 32'(copies(int'(members)))));

// E8. A per-port setting is not an aggregate bound.
p_sc_aggregate: assert property (@(posedge clk) disable iff (!rst_n)
  ((per_port_setting_pct_x10 * ports_i) > (aggregate_budget_pct * 16'd10))
    |-> v_aggregate_unbounded);

// F1. Flooded frames are a subset of frames.
p_tl_subset: assert property (@(posedge clk) disable iff (!rst_n)
  (c_flooded <= c_frames));

// F2. Causes partition the floods.
p_tl_partition: assert property (@(posedge clk) disable iff (!rst_n)
  (c_flooded == c_bcast_o + c_unknown_o + c_mcast_o));

// F3. A refusal is an event and a nonzero count is the signal.
p_tl_event: assert property (@(posedge clk) disable iff (!rst_n)
  (c_insert_refused != 48'd0) |-> refusals_are_occurring);

// F4. Mean copies is at least one.
p_tl_mean: assert property (@(posedge clk) disable iff (!rst_n)
  (c_frames != 48'd0) |-> (mean_copies_x1000 >= 32'd1000));

// F5. An alarm above the effective capacity is a violation.
p_cf_alarm: assert property (@(posedge clk) disable iff (!rst_n)
  (occupancy_alarm_pct > effective_capacity_pct) |-> v_alarm_unreachable);

// F6. Merged counters are a violation.
p_cf_merged: assert property (@(posedge clk) disable iff (!rst_n)
  counters_merged |-> v_counters_merged);

// F7. A no-flooding claim with floods counted is a violation.
p_cf_claim: assert property (@(posedge clk) disable iff (!rst_n)
  (claims_no_flooding && (c_flooded_i != 48'd0)) |-> v_claims_no_flooding);

// F8. Conformance is the disjunction of its six checks.
p_cf_vector: assert property (@(posedge clk) disable iff (!rst_n)
  conformant |-> (violations == 6'b000000));

c_tc_load1:      cover property (@(posedge clk) load_x100_o == 32'd100);
c_tc_load4:      cover property (@(posedge clk) load_x100_o == 32'd400);
c_tc_load8:      cover property (@(posedge clk) load_x100_o == 32'd800);
c_tc_silent:     cover property (@(posedge clk) occupancy_reads_healthy);
c_fc_permanent:  cover property (@(posedge clk) reason_is_permanent);
c_fc_unknown:    cover property (@(posedge clk) cause == 2'(FLOOD_UNKNOWN));
c_rp_saturated:  cover property (@(posedge clk) exceeds_budget);
c_se_stale:      cover property (@(posedge clk) stale_entries >= 32'd800);
c_se_displaced:  cover property (@(posedge clk) live_refusals_caused != 32'd0);
c_ma_unreachable:cover property (@(posedge clk) !alarm_can_fire);
c_sc_unknown_lim:cover property (@(posedge clk) discards_legitimate_traffic);
c_sc_aggregate:  cover property (@(posedge clk) v_aggregate_unbounded);
c_tl_refusals:   cover property (@(posedge clk) refusals_are_occurring);
c_cf_alarm:      cover property (@(posedge clk) v_alarm_unreachable);