Protocol Bug or Electrical Bug? Splitting the Search Space

   // -----------------------------------------------------------------------------
   // i2c_rise_classifier.sv
   // Chapter 23.3's instrument: it measures what happens after every RELEASE of a
   // bus line, and turns the electrical-or-protocol question into counts.
   //
   // THE PROBLEM IT SOLVES. A great many I2C symptoms are produced by both a
   // protocol bug and an electrical one, and on the resolved bus they look the same:
   //
   //     a byte with one bit wrong          a shift-register bug, or a slow edge the
   //                                        receiver sampled before it had risen
   //     an acknowledge that comes and goes an address-match bug, or a marginal rise
   //                                        time that only fails at temperature
   //     a transfer that fails at 400 kHz
   //       and works at 100 kHz             a timing-dependent RTL bug, or a bus whose
   //                                        rise time was always too long for Fast-mode
   //
   // Reading the byte values cannot separate those, because the byte values are the
   // same. What separates them is the SHAPE OF THE EDGES, and specifically one
   // number: how long the line takes to read HIGH after the last device lets go.
   //
   // WHAT IT MEASURES. On every transition of `all_released` from 0 to 1 -- the
   // instant the last pull-down is removed -- it starts a counter and stops when
   // `line` reads 1. Each release lands in exactly one bin:
   //
   //   FAST      the line was high within TR_BUDGET clocks. Electrically healthy at
   //             this speed. Any symptom is somewhere else.
   //
   //   SLOW      the line eventually read high, but took longer than TR_BUDGET. The
   //             bus is out of its rise-time budget (Chapter 19.3: tr = 0.8473*Rp*Cb).
   //             Every protocol symptom above this is suspect as a CONSEQUENCE.
   //
   //   ABORTED   a device pulled the line low again before it had risen. Not a
   //             measurement of anything: the pull-up never got to finish. Counted
   //             separately, because folding these into FAST is how an instrument
   //             reports a healthy bus that it never actually measured.
   //
   //   STUCK     everybody stayed released for STUCK_LIMIT clocks and the line never
   //             rose. That is not a slow pull-up, it is something holding the line
   //             that is not visible in `all_released` -- an unmodelled participant,
   //             or a short. Chapter 23.6.
   //
   // THE DISCRIMINATION, stated as a rule:
   //
   //     n_slow = 0 and n_stuck = 0 over a long window
   //       -> the bus is electrically sound at this speed, and a protocol symptom
   //          is a protocol bug. This is a STRONG NEGATIVE and it is the result
   //          worth wanting.
   //
   //     n_slow > 0
   //       -> the bus is out of budget. Fix that BEFORE interpreting any protocol
   //          symptom, because a receiver sampling a line that has not finished
   //          rising reads a zero where a one was sent, and that is indistinguishable
   //          from a data bug at the byte level.
   //
   // WHAT IT CANNOT DO. It cannot tell you WHY a rise is slow -- resistor value, bus
   // capacitance, a leaky device, a level shifter -- and it cannot see anything
   // analogue. It converts "the edges look bad" from an impression into a count, and
   // that is the whole of its contribution.
   //
   // `all_released` is the caller's knowledge that no device it knows about is
   // pulling. In simulation that is the bus model's drive vector. On hardware it is
   // this device's own drive intent, which makes STUCK the bin that catches every
   // participant the caller does not know about.
   // -----------------------------------------------------------------------------

   module i2c_rise_classifier #(
      // Clocks a released line is allowed to take to read HIGH. Derived from the
      // speed mode's tr and the sample clock, NOT chosen for convenience -- the
      // budget is what makes SLOW mean something.
      parameter integer TR_BUDGET   = 4,
      // How long a fully released line may stay low before it is called stuck.
      parameter integer STUCK_LIMIT = 64,
      parameter integer CNT_W       = 16
   ) (
      input  wire clk,
      input  wire rst_n,

      input  wire all_released,   // 1 when no known device is pulling the line low
      input  wire line,           // the resolved bus, read back

      output reg [CNT_W-1:0] n_fast,
      output reg [CNT_W-1:0] n_slow,
      output reg [CNT_W-1:0] n_aborted,
      output reg [CNT_W-1:0] n_stuck,

      // The worst rise seen, in clocks. A single slow edge among thousands of fast
      // ones is a different finding from a bus that is uniformly slow, and a count
      // alone cannot tell them apart.
      output reg [CNT_W-1:0] max_latency,
      // Which release first exceeded the budget. Releases are numbered from ONE, so
      // zero unambiguously means "no slow release has occurred" and no second flag
      // is needed to say so -- two pieces of state that can disagree about the same
      // fact are worse than one that cannot.
      output reg [CNT_W-1:0] first_slow_release,
      output reg [CNT_W-1:0] n_releases,

      output reg measuring
   );

      localparam [CNT_W-1:0] CNT_MAX = {CNT_W{1'b1}};

      reg all_released_q;
      wire release_edge = ~all_released_q & all_released;

      reg [CNT_W-1:0] timer;

      // Every counter increment below is guarded against its maximum. Saturating,
      // not wrapping: a wrapped diagnostic counter reports 0 for a great many events,
      // and 0 is also what a clean bus reports. Written out rather than hidden in a
      // macro, because a compiler directive is global to the compilation and a
      // diagnostic block is the last place to introduce one.

      always @(posedge clk) begin
         if (!rst_n) begin
            all_released_q     <= 1'b1;
            n_fast             <= {CNT_W{1'b0}};
            n_slow             <= {CNT_W{1'b0}};
            n_aborted          <= {CNT_W{1'b0}};
            n_stuck            <= {CNT_W{1'b0}};
            max_latency        <= {CNT_W{1'b0}};
            first_slow_release <= {CNT_W{1'b0}};
            n_releases         <= {CNT_W{1'b0}};
            timer              <= {CNT_W{1'b0}};
            measuring          <= 1'b0;
         end else begin
            all_released_q <= all_released;

            if (measuring) begin
               if (!all_released) begin
                  // Somebody pulled again before the line rose. The pull-up never
                  // finished, so this is not a rise-time measurement.
                  measuring <= 1'b0;
                  if (n_aborted != CNT_MAX) n_aborted <= n_aborted + 1'b1;
               end else if (line) begin
                  measuring <= 1'b0;
                  if (timer > max_latency) max_latency <= timer;
                  if (timer > TR_BUDGET[CNT_W-1:0]) begin
                     if (n_slow != CNT_MAX) n_slow <= n_slow + 1'b1;
                     // Latched on the FIRST slow release only. Guarded on n_slow
                     // being zero rather than on a separate flag, so the two can
                     // never disagree about whether a slow release has happened.
                     if (n_slow == {CNT_W{1'b0}}) first_slow_release <= n_releases;
                  end else begin
                     if (n_fast != CNT_MAX) n_fast <= n_fast + 1'b1;
                  end
               end else if (timer >= STUCK_LIMIT[CNT_W-1:0]) begin
                  measuring <= 1'b0;
                  if (timer > max_latency) max_latency <= timer;
                  if (n_stuck != CNT_MAX) n_stuck <= n_stuck + 1'b1;
               end else begin
                  timer <= timer + 1'b1;
               end

            end else if (release_edge) begin
               // A release only starts a measurement if the line is actually still
               // low. A release onto an already-high line is a zero-length rise and
               // is counted FAST immediately -- it is a real, and common, release.
               if (n_releases != CNT_MAX) n_releases <= n_releases + 1'b1;
               if (line) begin
                  if (n_fast != CNT_MAX) n_fast <= n_fast + 1'b1;
               end else begin
                  measuring <= 1'b1;
                  timer     <= {CNT_W{1'b0}};
               end
            end
         end
      end

   endmodule

   // -----------------------------------------------------------------------------
   // i2c_rise_classifier_tb.sv
   // The oracle, plus the experiment that is the point of Chapter 23.3: the SAME
   // protocol symptom produced twice, once by a protocol bug and once by a slow
   // edge, with the classifier separating them.
   //
   // The bench contains a one-line RC bus model. It is a restatement of Chapter
   // 19.7's `i2c_bus_rc` reduced to a single line and a single parameter, included
   // here so this file runs on its own -- an artifact a reader cannot execute is a
   // listing, not evidence.
   //
   // Bounded: every wait is a fixed number of clock edges, and a watchdog terminates
   // the run independently of anything the DUT does.
   // -----------------------------------------------------------------------------

   `timescale 1ns/1ps

   // A single line with a rise time. Falling is immediate (a transistor discharges
   // the net); rising takes RISE_CLKS after the last device releases (a resistor
   // charges it). That asymmetry is the whole model, and it is the digital
   // consequence of tr = 0.8473 * Rp * Cb rather than an analogue ramp.
   module tb_rc_line #(
      parameter integer RISE_CLKS = 0
   ) (
      input  wire clk,
      input  wire drive_low,      // 1 = a device is pulling this line down
      output wire line
   );
      reg [15:0] rise_cnt = RISE_CLKS[15:0];
      always @(posedge clk) begin
         if (drive_low)                           rise_cnt <= 16'd0;
         else if (rise_cnt < RISE_CLKS[15:0])     rise_cnt <= rise_cnt + 16'd1;
      end
      // Low while anyone pulls, and for RISE_CLKS clocks after the last one lets go.
      assign line = ~drive_low && (rise_cnt >= RISE_CLKS[15:0]);
   endmodule


   module i2c_rise_classifier_tb;

      localparam integer CNT_W = 16;
      localparam integer TR_BUDGET   = 4;
      localparam integer STUCK_LIMIT = 64;

      reg clk = 1'b0;
      reg rst_n = 1'b0;
      always #5 clk = ~clk;

      integer errors = 0, checks = 0, neg_detected = 0, negative_mode = 0;

      // ---------------------------------------------------------------- DUT A
      // Driven directly, so every bin including the unreachable-on-a-real-bus ones
      // can be entered deliberately.
      reg  a_all_released = 1'b1;
      reg  a_line         = 1'b1;
      wire [CNT_W-1:0] a_fast, a_slow, a_abort, a_stuck, a_max, a_first_slow, a_rel;
      wire a_measuring;

      i2c_rise_classifier #(.TR_BUDGET(TR_BUDGET), .STUCK_LIMIT(STUCK_LIMIT), .CNT_W(CNT_W))
      dut_a (
         .clk(clk), .rst_n(rst_n),
         .all_released(a_all_released), .line(a_line),
         .n_fast(a_fast), .n_slow(a_slow), .n_aborted(a_abort), .n_stuck(a_stuck),
         .max_latency(a_max), .first_slow_release(a_first_slow), .n_releases(a_rel),
         .measuring(a_measuring)
      );

      // ---------------------------------------------------------------- DUT B
      // Behind a real RC line, so the classifier is exercised against a bus rather
      // than against a hand-drawn waveform. Two of them, at two rise times, which is
      // the experiment in section 6.
      reg  b_drive = 1'b0;
      wire b_line_fast, b_line_slow;
      wire [CNT_W-1:0] bf_fast, bf_slow, bf_abort, bf_stuck, bf_max, bf_first, bf_rel;
      wire [CNT_W-1:0] bs_fast, bs_slow, bs_abort, bs_stuck, bs_max, bs_first, bs_rel;

      tb_rc_line #(.RISE_CLKS(2)) line_fast (.clk(clk), .drive_low(b_drive), .line(b_line_fast));
      tb_rc_line #(.RISE_CLKS(9)) line_slow (.clk(clk), .drive_low(b_drive), .line(b_line_slow));

      i2c_rise_classifier #(.TR_BUDGET(TR_BUDGET), .STUCK_LIMIT(STUCK_LIMIT), .CNT_W(CNT_W))
      dut_bf (
         .clk(clk), .rst_n(rst_n), .all_released(~b_drive), .line(b_line_fast),
         .n_fast(bf_fast), .n_slow(bf_slow), .n_aborted(bf_abort), .n_stuck(bf_stuck),
         .max_latency(bf_max), .first_slow_release(bf_first), .n_releases(bf_rel),
         .measuring()
      );
      i2c_rise_classifier #(.TR_BUDGET(TR_BUDGET), .STUCK_LIMIT(STUCK_LIMIT), .CNT_W(CNT_W))
      dut_bs (
         .clk(clk), .rst_n(rst_n), .all_released(~b_drive), .line(b_line_slow),
         .n_fast(bs_fast), .n_slow(bs_slow), .n_aborted(bs_abort), .n_stuck(bs_stuck),
         .max_latency(bs_max), .first_slow_release(bs_first), .n_releases(bs_rel),
         .measuring()
      );

      // ---------------------------------------------------------------- DUT C
      // A NARROW instance. At CNT_W = 16 the counters saturate at 65535, which no
      // reasonable run reaches, so the saturation the header claims would be an
      // untested claim and a mutation replacing it with wrapping would survive
      // every check. At CNT_W = 4 the bound is 15 and forty releases reach it.
      // Moving the bound is cheaper than lengthening the run, and the configuration
      // that makes it reachable is a legal one somebody will eventually instantiate.
      reg  c_all_released = 1'b1;
      reg  c_line         = 1'b1;
      wire [3:0] c_fast, c_slow, c_abort, c_stuck, c_max, c_first, c_rel;

      i2c_rise_classifier #(.TR_BUDGET(TR_BUDGET), .STUCK_LIMIT(STUCK_LIMIT), .CNT_W(4))
      dut_c (
         .clk(clk), .rst_n(rst_n),
         .all_released(c_all_released), .line(c_line),
         .n_fast(c_fast), .n_slow(c_slow), .n_aborted(c_abort), .n_stuck(c_stuck),
         .max_latency(c_max), .first_slow_release(c_first), .n_releases(c_rel),
         .measuring()
      );

      // ------------------------------------------------------------------ helpers
      // ── STIMULUS TIMING DISCIPLINE ──────────────────────────────────────────
      // Every wait ends 1 ns AFTER the clock edge, so every stimulus assignment
      // that follows it lands strictly between edges.
      //
      // The first version of this bench did not do that: it drove DUT inputs with
      // blocking assignments at the same simulation instant as the posedge. Whether
      // the DUT's always block saw the old value or the new one then depended on
      // which process the scheduler happened to run first, and the symptom was a
      // measured latency short by one -- for SOME values of the latency and not
      // others. A release programmed for 11 clocks measured 11; one programmed for
      // 14 measured 13; one for 2 measured 1.
      //
      // That pattern is worth recognising because of how it presents. An off-by-one
      // that appears at some values and not others looks exactly like a design bug
      // with an obscure trigger, and invites a search of the design's arithmetic.
      // The tell is that the values with the error have no arithmetic relationship
      // to each other -- they differ by how many edges the preceding stimulus
      // consumed, which is a property of the BENCH.
      task tick (input integer n); integer k;
         begin for (k = 0; k < n; k = k + 1) @(posedge clk); #1; end
      endtask

      // One clock edge, leaving the simulation 1 ns past it.
      task step; begin @(posedge clk); #1; end endtask

      task chk (input [255:0] name, input integer got, input integer exp);
         begin
            checks = checks + 1;
            if (got !== exp) begin
               if (negative_mode) neg_detected = neg_detected + 1;
               else begin
                  errors = errors + 1;
                  $display("  FAIL %0s: got %0d expected %0d", name, got, exp);
               end
            end else if (negative_mode) begin
               errors = errors + 1;
               $display("  FAIL negative proof did not fire: %0s", name);
            end
         end
      endtask

      task do_reset;
         begin
            rst_n = 1'b0; a_all_released = 1'b1; a_line = 1'b1; b_drive = 1'b0;
            tick(3); rst_n = 1'b1; tick(2);
         end
      endtask

      // One release on DUT A, arranged so that `lat` is EXACTLY the latency the
      // classifier will measure.
      //
      // Getting this right needs care, and the first version of it did not. Writing
      // "hold the line low for lat clocks after releasing" produced a measured
      // latency of lat-1, because the edge at which the classifier SEES the release
      // is itself one of the clocks the loop counted. The symptom was three failures
      // -- a max-latency check, and both halves of the budget-boundary test -- none
      // of which was a defect in the classifier. A measurement helper whose argument
      // does not mean what its name says produces failures that all look like
      // off-by-one bugs in the design.
      task a_release_after (input integer lat); integer k;
         begin
            a_all_released = 1'b0; a_line = 1'b0; tick(2);
            a_all_released = 1'b1;
            step;                                    // the release edge itself
            for (k = 0; k < lat; k = k + 1) step;    // lat edges with the line still low
            a_line = 1'b1;                           // read high on the next edge
            tick(2);
         end
      endtask

      // One bus transaction on DUT B: pull the line low for `low_clks`, then release
      // and wait long enough for the slowest model to finish rising.
      task b_pulse (input integer low_clks);
         begin b_drive = 1'b1; tick(low_clks); b_drive = 1'b0; tick(20); end
      endtask

      integer i;
      initial begin
         $display("i2c_rise_classifier_tb");

         // ---------------------------------------------------------------------
         // T1 -- the four bins, each entered deliberately. Two of them cannot occur
         // on a healthy bus, which is exactly why the bench drives the classifier's
         // inputs directly rather than only through a bus model.
         // ---------------------------------------------------------------------
         $display("T1 each bin entered deliberately");
         do_reset;
         a_release_after(2);                         // within the 4-clock budget
         chk("T1 a fast release is FAST", a_fast, 1);
         chk("T1 nothing else counted", a_slow + a_abort + a_stuck, 0);

         a_release_after(9);                         // over budget, but it does rise
         chk("T1 a slow release is SLOW", a_slow, 1);
         chk("T1 fast count unchanged", a_fast, 1);
         chk("T1 max latency is exactly 9", a_max, 9);
         // Releases are numbered from 1, so 0 unambiguously means "no slow release
         // has occurred" without needing a second flag to say so.
         chk("T1 first slow release is the 2nd", a_first_slow, 2);

         // Aborted: release, then pull again before the line has risen.
         a_all_released = 1'b0; a_line = 1'b0; tick(2);
         a_all_released = 1'b1; tick(2);
         a_all_released = 1'b0; tick(2);             // pulled again, still low
         a_line = 1'b0; a_all_released = 1'b1; tick(1); a_line = 1'b1; tick(2);

         chk("T1 an interrupted rise is ABORTED", a_abort, 1);

         // Stuck: everybody released and the line stays low past STUCK_LIMIT.
         a_all_released = 1'b0; a_line = 1'b0; tick(2);
         a_all_released = 1'b1;
         tick(STUCK_LIMIT + 4);
         chk("T1 a line that never rises is STUCK", a_stuck, 1);
         a_line = 1'b1; tick(2);

         // The bins must account for every release. A classifier whose bins do not
         // sum to the release count is dropping or double-counting events, and
         // neither shows up as a wrong individual bin.
         chk("T1 bins sum to releases",
             a_fast + a_slow + a_abort + a_stuck, a_rel);
         $display("      fast=%0d slow=%0d aborted=%0d stuck=%0d releases=%0d max=%0d",
                  a_fast, a_slow, a_abort, a_stuck, a_rel, a_max);

         // ---------------------------------------------------------------------
         // T2 -- the boundary. TR_BUDGET is 4, so exactly 4 clocks must be FAST and
         // exactly 5 must be SLOW. A budget whose boundary is never tested is a
         // number the instrument has never actually applied.
         // ---------------------------------------------------------------------
         $display("T2 the budget boundary, at exactly TR_BUDGET and one beyond");
         do_reset;
         a_release_after(TR_BUDGET);
         chk("T2 exactly at budget is FAST", a_fast, 1);
         chk("T2 exactly at budget is not SLOW", a_slow, 0);
         a_release_after(TR_BUDGET + 1);
         chk("T2 one clock over budget is SLOW", a_slow, 1);
         chk("T2 fast count unchanged", a_fast, 1);

         // ---------------------------------------------------------------------
         // T3 -- a release onto a line that is already high. Zero-length rise, which
         // is what an IDEAL bus model produces on every release, and it must be
         // counted rather than silently ignored.
         // ---------------------------------------------------------------------
         $display("T3 a zero-length rise");
         do_reset;
         a_all_released = 1'b0; a_line = 1'b1; tick(2);   // an ideal bus: never low
         a_all_released = 1'b1;
         step;
         // Sampled ON the release edge, not after it. A classifier that enters
         // measurement and leaves again on the next clock produces the same counts
         // and a one-cycle `measuring` pulse that nothing downstream expects -- and
         // a check taken three cycles later cannot see the difference.
         chk("T3 measurement never started", a_measuring, 0);
         tick(3);
         chk("T3 counted as a release", a_rel, 1);
         chk("T3 counted FAST", a_fast, 1);
         chk("T3 max latency is zero", a_max, 0);
         chk("T3 no measurement left in flight", a_measuring, 0);

         // ---------------------------------------------------------------------
         // T4 -- THE EXPERIMENT. One drive pattern, two buses. The pattern is
         // identical, the classifier is identical, the budget is identical; the only
         // difference is the rise time of the line. A verdict that changes under
         // that single variable is a verdict about the bus.
         // ---------------------------------------------------------------------
         $display("T4 one drive pattern, two rise times");
         do_reset;
         for (i = 0; i < 20; i = i + 1) b_pulse(3 + (i % 4));
         $display("      RISE_CLKS=2:  fast=%0d slow=%0d stuck=%0d max=%0d releases=%0d",
                  bf_fast, bf_slow, bf_stuck, bf_max, bf_rel);
         $display("      RISE_CLKS=9:  fast=%0d slow=%0d stuck=%0d max=%0d releases=%0d",
                  bs_fast, bs_slow, bs_stuck, bs_max, bs_rel);
         chk("T4 both buses saw the same releases", bf_rel, bs_rel);
         chk("T4 the 2-clock bus is entirely FAST", bf_slow, 0);
         chk("T4 the 2-clock bus counted 20", bf_fast, 20);
         chk("T4 the 9-clock bus is entirely SLOW", bs_fast, 0);
         chk("T4 the 9-clock bus counted 20", bs_slow, 20);
         chk("T4 neither bus is stuck", bf_stuck + bs_stuck, 0);
         chk("T4 max latency separates them", (bs_max > bf_max) ? 1 : 0, 1);
         chk("T4 the slow bus was out of budget from release 1", bs_first, 1);
         chk("T4 the fast bus never recorded a slow release", bf_first, 0);

         // ---------------------------------------------------------------------
         // T5 -- the strong negative. The whole value of the fast result is that
         // `n_slow` is zero over a long window, so the window has to be long and it
         // has to be reported. A zero over three releases is not evidence.
         // ---------------------------------------------------------------------
         $display("T5 the strong negative needs a long window");
         do_reset;
         for (i = 0; i < 200; i = i + 1) b_pulse(2 + (i % 5));
         $display("      RISE_CLKS=2 over 200 releases: fast=%0d slow=%0d", bf_fast, bf_slow);
         chk("T5 200 releases observed", bf_rel, 200);
         chk("T5 not one of them was slow", bf_slow, 0);
         chk("T5 bins account for all of them", bf_fast + bf_slow + bf_abort + bf_stuck, bf_rel);

         // ---------------------------------------------------------------------
         // T7 -- max_latency is the GREATEST, not the most recent. Every earlier
         // test released at a constant latency, where "last" and "greatest" are the
         // same number, so the distinction was never under test. A slow release
         // followed by a fast one separates them.
         // ---------------------------------------------------------------------
         $display("T7 max latency is the greatest, not the last");
         do_reset;
         a_release_after(11);
         chk("T7 the slow release set max to 11", a_max, 11);
         a_release_after(1);
         chk("T7 a later FAST release does not lower max", a_max, 11);
         a_release_after(2);
         chk("T7 nor does another", a_max, 11);
         a_release_after(14);
         chk("T7 a larger one does raise it", a_max, 14);

         // ---------------------------------------------------------------------
         // T8 -- the saturation bound, on the narrow instance. A diagnostic counter
         // that wraps reports a small number for a great many events, and a small
         // number is what a nearly-clean bus reports.
         // ---------------------------------------------------------------------
         $display("T8 counter saturation at CNT_W=4 (max 15)");
         do_reset;
         for (i = 0; i < 40; i = i + 1) begin
            c_all_released = 1'b0; c_line = 1'b0; tick(2);
            c_all_released = 1'b1; step;
            c_line = 1'b1; tick(2);
         end
         $display("      narrow instance: releases=%0d fast=%0d", c_rel, c_fast);
         chk("T8 release counter saturated at 15", c_rel, 15);
         chk("T8 fast counter saturated at 15", c_fast, 15);
         chk("T8 neither wrapped to a small value", (c_rel >= 15 && c_fast >= 15) ? 1 : 0, 1);
         chk("T8 the other bins stayed empty", c_slow + c_abort + c_stuck, 0);

         // ---------------------------------------------------------------------
         // T6 -- negative proof. Six deliberately wrong expectations, one per check
         // shape used above.
         // ---------------------------------------------------------------------
         $display("T6 negative proof -- eight deliberately wrong expectations");
         // The negative proof establishes its OWN state rather than borrowing
         // whatever the previous test left behind. An earlier arrangement read
         // counters that a later test's reset had cleared, so two of the eight
         // "deliberately wrong" expectations of zero were accidentally correct and
         // silently stopped proving anything -- while the block's own count still
         // looked healthy. A negative proof built on state it does not control is
         // one refactor away from being decorative.
         do_reset;
         a_release_after(2);    // FAST
         a_release_after(7);    // SLOW
         chk("T6 setup: one fast", a_fast, 1);
         chk("T6 setup: one slow", a_slow, 1);
         chk("T6 setup: max is 7", a_max, 7);
         chk("T6 setup: narrow instance was reset", c_rel, 0);

         negative_mode = 1;
         chk("T6a wrong bin count",        a_fast, 7);
         chk("T6b wrong zero claim",       a_slow, 3);
         chk("T6c wrong release total",    a_rel, 199);
         chk("T6d wrong bin sum",          a_fast + a_slow, 0);
         chk("T6e wrong max latency",      a_max, 0);
         chk("T6f wrong first-slow index", a_first_slow, 19);
         chk("T6g wrong boundary claim",   a_max, 3);
         chk("T6h wrong saturation bound", c_rel, 40);
         negative_mode = 0;
         chk("T6 all eight negatives detected", neg_detected, 8);

         $display("");
         $display("checks=%0d errors=%0d negatives_detected=%0d/8", checks, errors, neg_detected);
         if (errors == 0) $display("RESULT: PASS"); else $display("RESULT: FAIL");
         $finish;
      end

      initial begin
         #2000000;
         $display("RESULT: FAIL -- watchdog expired, the run did not terminate");
         $finish;
      end

   endmodule

   The same twenty pulses, the same classifier, the same TR_BUDGET of 4 clocks.
   The ONLY difference between the two rows is the rise time of the line.

      RISE_CLKS = 2:   fast=20  slow=0   stuck=0  max=1   releases=20
      RISE_CLKS = 9:   fast=0   slow=20  stuck=0  max=8   releases=20

   Both buses saw exactly the same twenty releases. One is entirely inside its
   budget and one is entirely outside it, and nothing about the traffic changed.

   RISE_CLKS = 2 over 200 releases:   fast=200   slow=0

   programmed 11 clocks  ->  measured 11      correct
   programmed  1 clock   ->  measured  1      correct
   programmed  2 clocks  ->  measured  1      one short
   programmed 14 clocks  ->  measured 13      one short

   FIRST CAMPAIGN     15 valid   9 KILLED   4 SURVIVED   (1 anchor did not match)
   AFTER T3, T7, T8   15 valid  15 KILLED   0 SURVIVED