The ACK/NACK Cycle — What the Ninth Clock Proves

   information in the acknowledge slot           = 1 bit
   distinct meanings the specification assigns   = 5 (the NACK conditions)
   identity of the responder                     = not carried
   count of responders                           = not carried
   integrity of the data                         = not carried
   eventual effect of the byte                   = not carried

   An acknowledge is a LIVENESS signal, not a delivery receipt: it says something
   was listening at that instant. Every other property has to come from somewhere
   else -- an identifying register read, a read-back of what was written, a status
   bit, or a device-level protocol layered on top.

   // The ninth clock pulse of a byte. ACK is SDA pulled LOW; NACK is SDA left HIGH.
   // This block drives the slot when this device owns it, and samples the resolved
   // level in every case -- because a transmitter must read the answer it was given.
   module i2c_ack_slot (
       input  logic clk,
       input  logic rst_n,
       input  logic scl_in,             // observed bus level
       input  logic sda_in,             // observed bus level
       input  logic ack_slot,           // from the byte shifter: the ninth clock
       input  logic we_acknowledge,     // 1 = this device owns the slot for this byte
       input  logic send_ack,           // 1 = acknowledge (pull LOW); 0 = NACK (release)
       output logic sda_drive_low,      // DRIVE INTENT for the ninth slot only
       output logic ack_bit,            // the raw level sampled in the ninth slot
       output logic ack_received,       // 1 = ACK, because the bit was LOW
       output logic nack_received,      // 1 = NACK, because the bit was HIGH
       output logic ack_valid           // pulse: the ninth bit has been sampled
   );
       logic scl_q;
       logic scl_rise, scl_fall;
       logic slot_q;

       assign scl_rise = !scl_q &&  scl_in;
       assign scl_fall =  scl_q && !scl_in;

       // ACK is the LOW level. Naming both directions explicitly is not redundancy:
       // "the acknowledge bit was 0" and "the byte was acknowledged" are the same
       // fact stated with opposite polarity, and conflating them is the classic bug.
       //
       // These are LEVELS describing the MOST RECENT acknowledge slot, not pulses.
       // A sequencer asks "was the last byte acknowledged?" several cycles after the
       // slot ended, so a one-cycle pulse would be unusable to it; `ack_valid` is the
       // pulse that says a new answer has landed. Out of reset, before any slot has
       // happened, ack_bit is 1 and so the reported state is NACK -- the safe
       // direction, because assuming an acknowledge nobody gave is how a transmitter
       // walks off the end of a transfer.
       assign ack_received  = !ack_bit;
       assign nack_received =  ack_bit;

       always_ff @(posedge clk) begin
           if (!rst_n) begin
               scl_q         <= 1'b1;   // idle bus: released, therefore high
               slot_q        <= 1'b0;
               sda_drive_low <= 1'b0;   // RELEASE on reset
               ack_bit       <= 1'b1;   // an unanswered slot reads as a NACK
               ack_valid     <= 1'b0;
           end else begin
               ack_valid <= 1'b0;
               scl_q     <= scl_in;
               slot_q    <= ack_slot;

               if (!ack_slot) begin
                   // Outside the ninth clock this block never touches the bus.
                   sda_drive_low <= 1'b0;
               end else begin
                   // Entering the slot, or already in it with SCL low: this is the only
                   // legal moment to establish the level, because SDA may not move
                   // while SCL is high.
                   if ((!slot_q || scl_fall) && !scl_in)
                       sda_drive_low <= we_acknowledge && send_ack;

                   if (scl_rise) begin
                       // The receiver's answer is read in the HIGH period of the ninth
                       // pulse -- the same data-valid window as any other bit.
                       ack_bit   <= sda_in;
                       ack_valid <= 1'b1;
                   end
               end
           end
       end
   endmodule

   module i2c_ack_slot_tb;
       logic clk = 1'b0, rst_n, scl_in;
       logic ack_slot, we_acknowledge, send_ack;
       logic sda_drive_low, ack_bit, ack_received, nack_received, ack_valid;
       int errors = 0;

       // Wired-AND of the DUT's driver and the testbench's far end, plus a pull-up.
       logic far_drive_low = 1'b0;
       wire  sda_bus = ~(sda_drive_low | far_drive_low);

       i2c_ack_slot dut (.clk(clk), .rst_n(rst_n), .scl_in(scl_in), .sda_in(sda_bus),
           .ack_slot(ack_slot), .we_acknowledge(we_acknowledge), .send_ack(send_ack),
           .sda_drive_low(sda_drive_low), .ack_bit(ack_bit), .ack_received(ack_received),
           .nack_received(nack_received), .ack_valid(ack_valid));

       always #5 clk = ~clk;
       initial begin #40000; $display("FAIL: watchdog expired"); $finish; end

       // Continuous data-valid monitor: the acknowledge is a bit like any other and
       // must not move while SCL is high.
       logic scl_q2, sda_q2;
       int   dv_violations = 0;
       always @(posedge clk) if (rst_n) begin
           if (scl_q2 && scl_in && (sda_bus !== sda_q2)) dv_violations++;
           scl_q2 <= scl_in; sda_q2 <= sda_bus;
       end

       int n_valid = 0;
       always @(posedge clk) if (rst_n && ack_valid) n_valid++;

       logic captured_bit;
       // Run one acknowledge slot. `far_acks` is what the OTHER end does.
       task automatic run_ack_slot(input logic mine, input logic ack, input logic far_acks);
           we_acknowledge = mine; send_ack = ack;
           scl_in = 1'b0;                  repeat (1) @(negedge clk);
           ack_slot = 1'b1;                repeat (2) @(negedge clk);
           far_drive_low = far_acks;       repeat (1) @(negedge clk);
           scl_in = 1'b1;                  repeat (1) @(negedge clk);
           captured_bit = sda_bus;                                   // what a scope sees
                                           repeat (1) @(negedge clk);
           // Release the far end AT THE SAME MOMENT SCL falls. This is legal -- SDA may
           // move once SCL is low -- and it is what distinguishes a design that sampled
           // the answer on the RISING edge from one that sampled it on the falling edge:
           // the two now see different values.
           scl_in = 1'b0; far_drive_low = 1'b0;   repeat (1) @(negedge clk);
           ack_slot = 1'b0;                       repeat (2) @(negedge clk);
       endtask

       initial begin
           rst_n = 1'b0; scl_in = 1'b1; ack_slot = 1'b0;
           we_acknowledge = 1'b0; send_ack = 1'b0;
           scl_q2 = 1'b1; sda_q2 = 1'b1;
           repeat (3) @(negedge clk);
           if (sda_drive_low !== 1'b0) begin $display("FAIL: reset did not release SDA"); errors++; end
           // An unanswered slot must read as a NACK, not as an ACK: the safe default.
           if (ack_bit !== 1'b1) begin $display("FAIL: ack_bit does not default to NACK"); errors++; end
           rst_n = 1'b1; @(negedge clk);

           // 1 -- WE acknowledge. The bus must be LOW in the slot, and the block must
           //      read back the level it is itself producing.
           run_ack_slot(1'b1, 1'b1, 1'b0);
           if (captured_bit !== 1'b0) begin $display("FAIL: our ACK did not pull the bus low"); errors++; end
           if (ack_received !== 1'b1) begin $display("FAIL: ACK not reported as received"); errors++; end
           if (nack_received !== 1'b0) begin $display("FAIL: NACK reported alongside an ACK"); errors++; end

           // 2 -- WE NACK. A NACK is not a signal: it is the ABSENCE of one, so the
           //      block must leave the line alone and the pull-up produces the HIGH.
           run_ack_slot(1'b1, 1'b0, 1'b0);
           if (captured_bit !== 1'b1) begin $display("FAIL: our NACK did not leave the bus high"); errors++; end
           if (nack_received !== 1'b1) begin $display("FAIL: NACK not reported"); errors++; end
           if (ack_received !== 1'b0) begin $display("FAIL: ACK reported alongside a NACK"); errors++; end

           // 3 -- the slot is NOT ours and the far end acknowledges. We must not drive,
           //      and must still read the answer -- a transmitter has to learn it.
           run_ack_slot(1'b0, 1'b1, 1'b1);
           if (ack_received !== 1'b1) begin
               $display("FAIL: did not read the far end's ACK"); errors++; end

           // 4 -- the slot is not ours and NOBODY acknowledges. The pull-up makes it a
           //      NACK, which is exactly specification condition 1: no receiver present.
           run_ack_slot(1'b0, 1'b1, 1'b0);
           if (nack_received !== 1'b1) begin
               $display("FAIL: an unanswered slot must read as a NACK"); errors++; end

           // 5 -- send_ack must be ignored when the slot is not ours. A device that
           //      acknowledged a byte it did not receive would corrupt the handshake.
           run_ack_slot(1'b0, 1'b1, 1'b0);
           if (captured_bit !== 1'b1) begin
               $display("FAIL: drove an acknowledge slot it does not own"); errors++; end

           // 6 -- exactly one ack_valid per slot: five slots, five pulses.
           if (n_valid != 5) begin
               $display("FAIL: expected 5 ack_valid pulses, saw %0d", n_valid); errors++; end

           // 7 -- outside the slot the block never drives, whatever the inputs say.
           we_acknowledge = 1'b1; send_ack = 1'b1; ack_slot = 1'b0;
           repeat (4) @(negedge clk);
           if (sda_drive_low !== 1'b0) begin
               $display("FAIL: drove SDA outside the acknowledge slot"); errors++; end

           if (dv_violations != 0) begin
               $display("FAIL: %0d data-valid violations in the acknowledge slot", dv_violations); errors++; end

           if (errors == 0)
               $display("PASS: ACK is a pulled-low slot, NACK is an absent one, %0d slots, zero data-valid violations",
                        n_valid);
           else $display("FAIL: %0d error(s)", errors);
           $finish;
       end
   endmodule

   // The ninth clock pulse of a byte. ACK is SDA pulled LOW; NACK is SDA left HIGH.
   // This block drives the slot when this device owns it, and samples the resolved
   // level in every case -- because a transmitter must read the answer it was given.
   module i2c_ack_slot (
       input  wire clk,
       input  wire rst_n,
       input  wire scl_in,             // observed bus level
       input  wire sda_in,             // observed bus level
       input  wire ack_slot,           // from the byte shifter: the ninth clock
       input  wire we_acknowledge,     // 1 = this device owns the slot for this byte
       input  wire send_ack,           // 1 = acknowledge (pull LOW); 0 = NACK (release)
       output reg  sda_drive_low,      // DRIVE INTENT for the ninth slot only
       output reg  ack_bit,            // the raw level sampled in the ninth slot
       output wire ack_received,       // 1 = ACK, because the bit was LOW
       output wire nack_received,      // 1 = NACK, because the bit was HIGH
       output reg  ack_valid           // pulse: the ninth bit has been sampled
   );
       reg  scl_q, slot_q;
       wire scl_rise = ~scl_q &  scl_in;
       wire scl_fall =  scl_q & ~scl_in;

       // LEVELS describing the MOST RECENT slot, not pulses: a sequencer asks whether
       // the last byte was acknowledged several cycles later. Out of reset the state is
       // NACK, which is the safe direction.
       assign ack_received  = ~ack_bit;
       assign nack_received =  ack_bit;

       always @(posedge clk) begin
           if (!rst_n) begin
               scl_q         <= 1'b1;   // idle bus: released, therefore high
               slot_q        <= 1'b0;
               sda_drive_low <= 1'b0;   // RELEASE on reset
               ack_bit       <= 1'b1;   // an unanswered slot reads as a NACK
               ack_valid     <= 1'b0;
           end else begin
               ack_valid <= 1'b0;
               scl_q     <= scl_in;
               slot_q    <= ack_slot;

               if (!ack_slot) begin
                   sda_drive_low <= 1'b0;
               end else begin
                   // Establish the level only while SCL is low: SDA may not move
                   // while SCL is high.
                   if ((!slot_q || scl_fall) && !scl_in)
                       sda_drive_low <= we_acknowledge & send_ack;

                   if (scl_rise) begin
                       // The answer is read in the HIGH period of the ninth pulse.
                       ack_bit   <= sda_in;
                       ack_valid <= 1'b1;
                   end
               end
           end
       end
   endmodule

   module i2c_ack_slot_tb;
       reg clk, rst_n, scl_in;
       reg ack_slot, we_acknowledge, send_ack;
       wire sda_drive_low, ack_bit, ack_received, nack_received, ack_valid;
       integer errors;

       // Wired-AND of the DUT's driver and the testbench's far end, plus a pull-up.
       reg  far_drive_low;
       wire sda_bus = ~(sda_drive_low | far_drive_low);

       i2c_ack_slot dut (.clk(clk), .rst_n(rst_n), .scl_in(scl_in), .sda_in(sda_bus),
           .ack_slot(ack_slot), .we_acknowledge(we_acknowledge), .send_ack(send_ack),
           .sda_drive_low(sda_drive_low), .ack_bit(ack_bit), .ack_received(ack_received),
           .nack_received(nack_received), .ack_valid(ack_valid));

       initial clk = 1'b0;
       always #5 clk = ~clk;
       initial begin #40000; $display("FAIL: watchdog expired"); $finish; end

       // Continuous data-valid monitor: the acknowledge is a bit like any other and
       // must not move while SCL is high.
       reg scl_q2, sda_q2;
       integer dv_violations;
       always @(posedge clk) if (rst_n) begin
           if (scl_q2 && scl_in && (sda_bus !== sda_q2)) dv_violations = dv_violations + 1;
           scl_q2 <= scl_in; sda_q2 <= sda_bus;
       end

       integer n_valid;
       always @(posedge clk) if (rst_n && ack_valid) n_valid = n_valid + 1;

       reg captured_bit;
       // Run one acknowledge slot. far_acks is what the OTHER end does.
       task run_ack_slot; input mine; input ack; input far_acks; begin
           we_acknowledge = mine; send_ack = ack;
           scl_in = 1'b0;                  repeat (1) @(negedge clk);
           ack_slot = 1'b1;                repeat (2) @(negedge clk);
           far_drive_low = far_acks;       repeat (1) @(negedge clk);
           scl_in = 1'b1;                  repeat (1) @(negedge clk);
           captured_bit = sda_bus;                                   // what a scope sees
                                           repeat (1) @(negedge clk);
           // Release the far end AT THE SAME MOMENT SCL falls -- legal, and it is what
           // distinguishes a rising-edge sampler from a falling-edge one.
           scl_in = 1'b0; far_drive_low = 1'b0;   repeat (1) @(negedge clk);
           ack_slot = 1'b0;                       repeat (2) @(negedge clk);
       end endtask

       initial begin
           errors = 0; dv_violations = 0; n_valid = 0; far_drive_low = 1'b0;
           rst_n = 1'b0; scl_in = 1'b1; ack_slot = 1'b0;
           we_acknowledge = 1'b0; send_ack = 1'b0;
           scl_q2 = 1'b1; sda_q2 = 1'b1;
           repeat (3) @(negedge clk);
           if (sda_drive_low !== 1'b0) begin $display("FAIL: reset did not release SDA"); errors = errors + 1; end
           // An unanswered slot must read as a NACK, not as an ACK: the safe default.
           if (ack_bit !== 1'b1) begin $display("FAIL: ack_bit does not default to NACK"); errors = errors + 1; end
           rst_n = 1'b1; @(negedge clk);

           // 1 -- WE acknowledge. The bus must be LOW in the slot, and the block must
           //      read back the level it is itself producing.
           run_ack_slot(1'b1, 1'b1, 1'b0);
           if (captured_bit !== 1'b0) begin $display("FAIL: our ACK did not pull the bus low"); errors = errors + 1; end
           if (ack_received !== 1'b1) begin $display("FAIL: ACK not reported as received"); errors = errors + 1; end
           if (nack_received !== 1'b0) begin $display("FAIL: NACK reported alongside an ACK"); errors = errors + 1; end

           // 2 -- WE NACK. A NACK is not a signal: it is the ABSENCE of one, so the
           //      block must leave the line alone and the pull-up produces the HIGH.
           run_ack_slot(1'b1, 1'b0, 1'b0);
           if (captured_bit !== 1'b1) begin $display("FAIL: our NACK did not leave the bus high"); errors = errors + 1; end
           if (nack_received !== 1'b1) begin $display("FAIL: NACK not reported"); errors = errors + 1; end
           if (ack_received !== 1'b0) begin $display("FAIL: ACK reported alongside a NACK"); errors = errors + 1; end

           // 3 -- the slot is NOT ours and the far end acknowledges. We must not drive,
           //      and must still read the answer -- a transmitter has to learn it.
           run_ack_slot(1'b0, 1'b1, 1'b1);
           if (ack_received !== 1'b1) begin
               $display("FAIL: did not read the far end's ACK"); errors = errors + 1; end

           // 4 -- the slot is not ours and NOBODY acknowledges. The pull-up makes it a
           //      NACK, which is exactly specification condition 1: no receiver present.
           run_ack_slot(1'b0, 1'b1, 1'b0);
           if (nack_received !== 1'b1) begin
               $display("FAIL: an unanswered slot must read as a NACK"); errors = errors + 1; end

           // 5 -- send_ack must be ignored when the slot is not ours. A device that
           //      acknowledged a byte it did not receive would corrupt the handshake.
           run_ack_slot(1'b0, 1'b1, 1'b0);
           if (captured_bit !== 1'b1) begin
               $display("FAIL: drove an acknowledge slot it does not own"); errors = errors + 1; end

           // 6 -- exactly one ack_valid per slot: five slots, five pulses.
           if (n_valid != 5) begin
               $display("FAIL: expected 5 ack_valid pulses, saw %0d", n_valid); errors = errors + 1; end

           // 7 -- outside the slot the block never drives, whatever the inputs say.
           we_acknowledge = 1'b1; send_ack = 1'b1; ack_slot = 1'b0;
           repeat (4) @(negedge clk);
           if (sda_drive_low !== 1'b0) begin
               $display("FAIL: drove SDA outside the acknowledge slot"); errors = errors + 1; end

           if (dv_violations != 0) begin
               $display("FAIL: %0d data-valid violations in the acknowledge slot", dv_violations); errors = errors + 1; end

           if (errors == 0)
               $display("PASS: ACK is a pulled-low slot, NACK is an absent one, %0d slots, zero data-valid violations",
                        n_valid);
           else $display("FAIL: %0d error(s)", errors);
           $finish;
       end
   endmodule

   library ieee;
   use ieee.std_logic_1164.all;

   -- The ninth clock pulse of a byte. ACK is SDA pulled LOW; NACK is SDA left HIGH.
   -- This block drives the slot when this device owns it, and samples the resolved
   -- level in every case -- because a transmitter must read the answer it was given.
   entity i2c_ack_slot is
       port (
           clk            : in  std_logic;
           rst_n          : in  std_logic;
           scl_in         : in  std_logic;   -- observed bus level
           sda_in         : in  std_logic;   -- observed bus level
           ack_slot       : in  std_logic;   -- from the byte shifter: the ninth clock
           we_acknowledge : in  std_logic;   -- 1 = this device owns the slot
           send_ack       : in  std_logic;   -- 1 = ACK (pull LOW); 0 = NACK (release)
           sda_drive_low  : out std_logic;   -- DRIVE INTENT, ninth slot only
           ack_bit        : out std_logic;   -- the raw level sampled in the slot
           ack_received   : out std_logic;   -- 1 = ACK, because the bit was LOW
           nack_received  : out std_logic;   -- 1 = NACK, because the bit was HIGH
           ack_valid      : out std_logic    -- pulse: the ninth bit was sampled
       );
   end entity;

   architecture rtl of i2c_ack_slot is
       signal scl_q  : std_logic := '1';    -- idle bus: released, therefore high
       signal slot_q : std_logic := '0';
       signal abit   : std_logic := '1';    -- an unanswered slot reads as a NACK
       signal scl_rise, scl_fall : std_logic;
   begin
       scl_rise <= (not scl_q) and scl_in;
       scl_fall <= scl_q and (not scl_in);

       ack_bit <= abit;

       -- LEVELS describing the MOST RECENT slot, not pulses: a sequencer asks whether
       -- the last byte was acknowledged several cycles later. Out of reset the reported
       -- state is NACK, which is the safe direction.
       ack_received  <= not abit;
       nack_received <= abit;

       process (clk)
       begin
           if rising_edge(clk) then
               if rst_n = '0' then
                   scl_q         <= '1';
                   slot_q        <= '0';
                   sda_drive_low <= '0';    -- RELEASE on reset
                   abit          <= '1';
                   ack_valid     <= '0';
               else
                   ack_valid <= '0';
                   scl_q     <= scl_in;
                   slot_q    <= ack_slot;

                   if ack_slot = '0' then
                       sda_drive_low <= '0';
                   else
                       -- Establish the level only while SCL is low.
                       if (slot_q = '0' or scl_fall = '1') and scl_in = '0' then
                           sda_drive_low <= we_acknowledge and send_ack;
                       end if;

                       if scl_rise = '1' then
                           -- The answer is read in the HIGH period of the ninth pulse.
                           abit      <= sda_in;
                           ack_valid <= '1';
                       end if;
                   end if;
               end if;
           end if;
       end process;
   end architecture;

   library ieee;
   use ieee.std_logic_1164.all;

   entity i2c_ack_slot_tb is
   end entity;

   architecture sim of i2c_ack_slot_tb is
       signal clk            : std_logic := '0';
       signal rst_n          : std_logic := '0';
       signal scl_in         : std_logic := '1';
       signal ack_slot       : std_logic := '0';
       signal we_acknowledge : std_logic := '0';
       signal send_ack       : std_logic := '0';
       signal sda_drive_low, ack_bit, ack_received, nack_received, ack_valid : std_logic;

       signal far_drive_low : std_logic := '0';
       signal sda_bus       : std_logic;

       signal n_valid, dv_violations : natural := 0;
       signal test_done : std_logic := '0';
   begin
       sda_bus <= not (sda_drive_low or far_drive_low);

       dut : entity work.i2c_ack_slot
           port map (clk => clk, rst_n => rst_n, scl_in => scl_in, sda_in => sda_bus,
                     ack_slot => ack_slot, we_acknowledge => we_acknowledge, send_ack => send_ack,
                     sda_drive_low => sda_drive_low, ack_bit => ack_bit,
                     ack_received => ack_received, nack_received => nack_received,
                     ack_valid => ack_valid);

       clk <= not clk after 5 ns;

       watchdog : process
       begin
           wait for 40 us;
           if test_done = '0' then
               report "watchdog expired -- the design never reached the expected state"
                   severity failure;
           end if;
           wait;
       end process;

       monitor : process (clk)
           variable scl_q2 : std_logic := '1';
           variable sda_q2 : std_logic := '1';
       begin
           if rising_edge(clk) then
               if rst_n = '1' then
                   if scl_q2 = '1' and scl_in = '1' and sda_bus /= sda_q2 then
                       dv_violations <= dv_violations + 1;
                   end if;
                   scl_q2 := scl_in; sda_q2 := sda_bus;
                   if ack_valid = '1' then n_valid <= n_valid + 1; end if;
               end if;
           end if;
       end process;

       stim : process
           variable errs         : natural := 0;
           variable captured_bit : std_logic;

           procedure waitn (n : in positive) is
           begin
               for i in 1 to n loop wait until falling_edge(clk); end loop;
           end procedure;

           -- Run one acknowledge slot. far_acks is what the OTHER end does.
           procedure run_ack_slot (mine, ack, far_acks : in std_logic) is
           begin
               we_acknowledge <= mine; send_ack <= ack;
               scl_in <= '0';                 waitn(1);
               ack_slot <= '1';               waitn(2);
               far_drive_low <= far_acks;     waitn(1);
               scl_in <= '1';                 waitn(1);
               captured_bit := sda_bus;                       -- what a scope sees
                                              waitn(1);
               -- Release the far end AT THE SAME MOMENT SCL falls -- legal, and it is
               -- what distinguishes a rising-edge sampler from a falling-edge one.
               scl_in <= '0'; far_drive_low <= '0';  waitn(1);
               ack_slot <= '0';                      waitn(2);
           end procedure;
       begin
           waitn(3);
           if sda_drive_low /= '0' then
               report "reset did not release SDA" severity error; errs := errs + 1; end if;
           if ack_bit /= '1' then
               report "ack_bit does not default to NACK" severity error; errs := errs + 1; end if;
           rst_n <= '1'; waitn(1);

           -- 1: WE acknowledge -- the bus must be LOW and we read back our own level.
           run_ack_slot('1', '1', '0');
           if captured_bit /= '0' then
               report "our ACK did not pull the bus low" severity error; errs := errs + 1; end if;
           if ack_received /= '1' then
               report "ACK not reported as received" severity error; errs := errs + 1; end if;
           if nack_received /= '0' then
               report "NACK reported alongside an ACK" severity error; errs := errs + 1; end if;

           -- 2: WE NACK -- a NACK is the ABSENCE of a signal; the pull-up makes the HIGH.
           run_ack_slot('1', '0', '0');
           if captured_bit /= '1' then
               report "our NACK did not leave the bus high" severity error; errs := errs + 1; end if;
           if nack_received /= '1' then
               report "NACK not reported" severity error; errs := errs + 1; end if;
           if ack_received /= '0' then
               report "ACK reported alongside a NACK" severity error; errs := errs + 1; end if;

           -- 3: not our slot, far end acknowledges -- we must not drive, and must read it.
           run_ack_slot('0', '1', '1');
           if ack_received /= '1' then
               report "did not read the far end's ACK" severity error; errs := errs + 1; end if;

           -- 4: not our slot and NOBODY acknowledges -- specification condition 1.
           run_ack_slot('0', '1', '0');
           if nack_received /= '1' then
               report "an unanswered slot must read as a NACK" severity error; errs := errs + 1; end if;

           -- 5: send_ack must be ignored when the slot is not ours.
           run_ack_slot('0', '1', '0');
           if captured_bit /= '1' then
               report "drove an acknowledge slot it does not own" severity error; errs := errs + 1; end if;

           -- 6: exactly one ack_valid per slot.
           if n_valid /= 5 then
               report "expected 5 ack_valid pulses" severity error; errs := errs + 1; end if;

           -- 7: outside the slot the block never drives, whatever the inputs say.
           we_acknowledge <= '1'; send_ack <= '1'; ack_slot <= '0';
           waitn(4);
           if sda_drive_low /= '0' then
               report "drove SDA outside the acknowledge slot" severity error; errs := errs + 1; end if;

           if dv_violations /= 0 then
               report "data-valid violations in the acknowledge slot" severity error;
               errs := errs + 1; end if;

           if errs = 0 then
               report "i2c_ack_slot self-check complete: ACK is a pulled-low slot, NACK is an "
                    & "absent one, " & integer'image(n_valid)
                    & " slots, zero data-valid violations" severity note;
           else
               report "i2c_ack_slot self-check FAILED" severity error;
           end if;
           test_done <= '1';
           wait;
       end process;
   end architecture;

   // PROPERTY 1 -- protocol legality. The transmitter must have released. This is a
   // statement about the DUT's obligation and holds for every byte, forever.
   property transmitter_released_for_the_answer;
       @(posedge clk) disable iff (!rst_n)
       (ack_slot && we_are_transmitting) |-> !sda_drive_low;
   endproperty

   // PROPERTY 2 -- the acknowledge is a data bit and obeys the data-valid rule. A
   // receiver that decides late emits FRAMING, not a late acknowledge.
   property ack_stable_through_scl_high;
       @(posedge clk) disable iff (!rst_n)
       (ack_slot && $past(scl_in) && scl_in) |-> $stable(sda_in);
   endproperty

   // COVERAGE -- the five NACK conditions are five DIFFERENT situations, and a suite
   // that only ever produces condition 1 has not tested acknowledgement at all.
   covergroup ack_reason_cg @(posedge clk);
       option.per_instance = 1;
       cp : coverpoint nack_reason iff (ack_valid && nack_seen) {
           bins absent      = { NACK_NO_DEVICE };      // condition 1
           bins busy        = { NACK_BUSY };           // condition 2
           bins not_understood = { NACK_BAD_CONTENT }; // condition 3
           bins full        = { NACK_FULL };           // condition 4
           bins end_of_read = { NACK_MASTER_DONE };    // condition 5 -- NOT an error
       }
       // And the one that matters most in practice: an ACK on every byte of a long
       // transfer is the common case, so cover the LENGTH at which a NACK appeared.
       cp_pos : coverpoint byte_index_of_nack iff (nack_seen) {
           bins on_address = { 0 };
           bins first_data = { 1 };
           bins later_data = { [2:255] };
       }
   endgroup