AMBA CHI · Module 21 · CHI Design-Review Checklist

RTL Review Checklist

The architecture is signed off; the RTL review now guards the build. A correct CHI architecture becomes a working chip only if its RTL synthesizes and survives silicon — and simulation will not tell you that, since it can pass every functional test while hiding a latch, a CDC bug, or un-closable timing. So the review is structural: it reads what synthesis and silicon do. It walks seven areas — protocol state machines, flow control, hazard and ordering logic, exclusives and CMOs, clocking and CDC, synthesis and timing, and RTL hygiene — each demanding evidence. The pitfall is green-waveform trust: signing off because it simulates cleanly, so a structural bug the waveform never showed rides into tapeout as a respin.

Advanced16 min readAMBA CHIDesign ReviewRTLPre-TapeoutCDC

Module 21 · Chapter 21.2 · CHI Design-Review Checklist

Project thread — 21.1 reviewed the architecture. 21.2 reviews the RTL that implements it; 21.3 reviews the verification.

1. The Review

The RTL review is a structural pass over a CHI block's RTL before tapeout — reading it for what synthesis and silicon will actually do, not just what the testbench exercised. A correct architecture (Chapter 21.1) becomes a working chip only if the RTL faithfully implements it and is clean — synthesizable, timing-closable, CDC-safe. Simulation proves behavior on the vectors you ran; it is blind to structural defects. This review sees what simulation cannot.

2. When To Run It

Run the RTL review at the pre-tapeout gate — after the block is functionally passing but before it is frozen for tapeout.

Trigger: RTL for a CHI block is feature-complete and passing its functional tests.
Precondition: lint, CDC, and synthesis reports exist — the review reads evidence, not just code.
Output: a tapeout-ready block, or a list of blocking issues to fix before freeze.
Cost of skipping: a structural defect missed here returns as a respin — the most expensive failure in the flow.

3. Key Terms

4. Previous Chapter Connection

This review implements what 21.1 signed off. The protocol state machines realize the coherence states and transactions (Chapters 4, 7); the flow-control logic realizes credits (Chapter 14); the hazard logic realizes ordering and hazard resolution (Chapters 9–10); exclusives / CMOs realize Chapter 11. The architecture review decided what; the RTL review checks the how.

Where 21.1 asked "is the design right?", 21.2 asks "does the RTL build it correctly and cleanly?" — a different skill. A block can be architecturally perfect and structurally broken (a latch, a CDC miss), or functionally passing and timing-impossible. This review adds the implementation discipline that turns a signed-off architecture into tapeout-ready silicon, and it hands a verified block to the DV review (Chapter 21.3).

5. How To Use This Checklist

The method — read structure and evidence, not just behavior.

Collect the reports first. Lint, CDC, synthesis/timing, and coverage reports are the evidence. A clean waveform is not sufficient evidence for a structural tick.
Walk the seven areas (sections 7–13). Each - [ ] box is ticked only against a report or a read of the RTL — never against simulation alone.
Treat every warning as guilty until proven benign — a lint/CDC warning is a finding, not noise.
Log gaps as blocking issues — a structural defect must be fixed before freeze.
Re-review after any RTL change near a state machine, a CDC, or a credit loop — these are the fragile areas.

6. The Review Areas

The seven areas of a CHI RTL review, and what each protects.

#	Area	Protects against
7	Protocol State Machines	dead/unreachable states, illegal transitions
8	Flow Control & Credits	credit overflow/underflow, buffer overrun
9	Hazard & Ordering Logic	missed hazards, broken ordering point
10	Exclusives, Atomics & CMOs	broken monitor, wrong atomic/CMO semantics
11	Clocking, Reset & CDC	metastability, reset races, CDC data loss
12	Synthesis, Timing & Structure	latches, combinational loops, timing failure
13	Lint, X-Propagation & RTL Hygiene	X-optimism, multi-driver, uninitialized state

Each area below is a checklist plus the why. A tick means the report or the RTL proves it — not that it simulated fine.

7. Checklist — Protocol State Machines

Every coherence-state and transaction FSM is explicit, with all states and transitions enumerated.
No unreachable states and no dead states (entered but never exited).
Illegal transitions go to a defined state (or a flagged error), never to an undefined one.
The FSM encoding is chosen (binary / one-hot) with timing and safety in mind; a default case exists.
FSM behavior matches the architecture's state tables (Chapter 4) — reviewed against the spec, not memory.

Why. The FSMs are the coherence protocol in silicon (Chapters 4, 7). A dead state or an undefined transition is a latent hang or corruption — and simulation only exercises the states your vectors reached, so unreached states are exactly the unreviewed risk.

8. Checklist — Flow Control & Credits

Every credit counter has defined bounds; it can never overflow or go negative (Chapter 14).
Buffer depths match the credit counts — a credit granted always has a slot.
Backpressure propagates correctly — a full downstream stalls upstream, no data dropped.
Credit return paths cannot be lost or double-counted across reset or error.
No combinational path from a credit grant straight to its own consumption (a timing/loop hazard).

Why. Flow control is where deadlock and data loss live (Chapters 13–14). A credit/buffer mismatch overruns silently in some corner the testbench never hit — a structural bug a counting review catches and a waveform does not.

9. Checklist — Hazard & Ordering Logic

Address-hazard detection (overlapping in-flight transactions to one line) is implemented at the ordering point (Chapter 10).
The ordering point (usually the home) serializes conflicting accesses correctly and completely.
In-flight transaction tracking (the tracker / MSHR structure) cannot overflow or alias entries.
Response ordering guarantees required by the memory model (Chapter 9) are enforced in RTL.
Corner interleavings (snoop vs write, retry vs forward) have explicit handling, not implicit priority.

Why. Hazard/ordering logic is the subtlest RTL in a CHI block (Chapters 9–10). Its bugs are rare interleavings — precisely what random simulation under-hits — so the review must trace the logic, not trust the run.

10. Checklist — Exclusives, Atomics & CMOs

The exclusive monitor correctly sets, clears, and fails across the required events (Chapter 11).
Atomic operations are indivisible in RTL — no window where another agent observes a partial update.
Cache-maintenance operations (CMOs) implement the exact clean/invalidate semantics the spec defines.
Exclusive/atomic corner cases (nested, failing, cross-agent) have defined RTL behavior.
These paths are not left to X-optimistic defaults — unknowns are handled, not ignored.

Why. Exclusives, atomics, and CMOs are low-frequency, high-consequence (Chapter 11). A broken monitor or a non-atomic atomic corrupts synchronization — a bug that appears once in a billion cycles in silicon and never in a short sim.

11. Checklist — Clocking, Reset & CDC

Every clock-domain crossing on a CHI channel uses a correct synchronizer (handshake / async FIFO) — no bare cross.
CDC report is clean — every crossing is acknowledged and verified, none unhandled.
The reset scheme (sync/async assert, sync deassert) is consistent; no reset race on state elements.
All state initializes to a defined value on reset — no X propagating from an uninitialized flop.
Clock gating (if used) is glitch-free and does not drop a credit or handshake.

Why. CDC and reset bugs are classic silicon-only failures (Chapter 14-class flow control across clocks). Metastability and reset races rarely reproduce in sim and routinely kill first silicon — a CDC report, not a waveform, is the evidence.

12. Checklist — Synthesis, Timing & Structure

No inferred latches — every combinational output is fully assigned on all paths (a synth/lint report proves it).
No combinational loops and no multi-driver nets.
Timing closes (or has a credible path to closure) — no logic that is structurally un-closable.
Registered interface outputs where the methodology requires — clean timing boundaries between blocks.
Synthesis warnings are triaged — no silently optimized-away or unintended logic.

Why. These are pure structure — invisible to a functional sim, decisive at tapeout. A latch or an un-closable path does not fail a test; it fails the chip — which is why the review reads the synthesis report, not the run.

13. Checklist — Lint, X-Propagation & RTL Hygiene

Lint is clean (or every waiver is justified and reviewed) — warnings are findings.
X-propagation is safe — no X-optimism masking a real bug (X-prop / X-pessimism sim or formal run).
No uninitialized state reaches a functional decision — reset covers it (area 11).
Case statements are full and parallel where intended; defaults are explicit.
Naming, width, and sign are consistent — no silent truncation or width-mismatch bugs.

Why. Hygiene issues are cheap to fix and expensive to miss. X-optimism in particular lets a sim pass on a value silicon will resolve differently — a false green the review must break with an X-aware run.

14. A Worked Review

Applying the checklist to a home-node (HN-F) RTL block.

State Machines (7). The transaction FSM has a state entered on a rare snoop-vs-writeback race but no exit → a dead state. Evidence: FSM reachability from lint/formal. Blocking issue, then fixed.
Flow Control (8). Credit counter width vs buffer depth matches. Evidence: a counting table. Tick.
Hazard (9). The MSHR handles overlapping lines; the tracker cannot alias. Evidence: a read of the alloc/free logic. Tick.
Exclusives (10). Monitor clears on the required events. Evidence: an event table vs spec. Tick.
CDC (11). One channel crosses to the config clock via a proper async FIFO; CDC report clean. Evidence: the CDC report. Tick.
Synthesis (12), Hygiene (13). No latches, lint clean, X-prop run passes. Evidence: synth + X-prop reports. Tick.

The review caught the dead FSM state (area 7) — a rare-race hang that the functional suite never entered — from a reachability report, not a waveform. That is a respin avoided.

15. Sign-off Criteria

What "the RTL passed for tapeout" actually means.

All seven areas walked, each ticked against a report or an RTL read — not simulation alone.
Lint and CDC reports are clean (or every waiver justified) — no unexplained warnings.
No inferred latches, no multi-driver, no combinational loops — a structural clean bill.
X-propagation verified — no X-optimism hiding a bug.
Every blocking issue closed before freeze, and the reports archived with the sign-off.

16. The Pitfall

Pitfall: green-waveform trust — signing off RTL because it simulates cleanly

The defining RTL-review mistake is green-waveform trust — concluding a block is tapeout-ready because it simulates correctly, and skipping the structural pass. Simulation proves behavior on the vectors you ran; it is structurally blind. An inferred latch simulates like a flop until the one path that exposes it; a CDC bug simulates fine because the sim's clocks happen to align; an X-optimistic mux resolves an unknown favorably in sim while silicon resolves it the other way; a timing-hostile path simulates at any frequency because sim has no timing; a multi-driver net may look right on the values you drove. Every one of these passes a functional test and fails the chip. The trap is that a green waveform feels like proof — it is vivid, behavioral, convincing — so the reviewer stops before reading the synthesis, CDC, and X-prop reports where the real risks live. The result is a block that is functionally correct and structurally broken, signed off with full confidence, returning months later as a respin — the single most expensive failure in the flow.

The fix: make the RTL review a structural review. Read the reports — lint, CDC, synthesis/timing, X-prop — not just the waveform. Treat every warning as a finding. A clean simulation is a necessary but wildly insufficient condition for tapeout sign-off.

17. Common Mistakes & Red Flags

Trusting the waveform. Assumption: it sims, it ships. Bug: structural defects (the Pitfall). Fix: read the reports.
Waiving lint/CDC warnings blindly. Assumption: noise. Bug: a real bug waived. Fix: justify every waiver.
Unreached FSM states. Assumption: if sim never hit it, ignore it. Bug: latent hang. Fix: prove reachability formally.
Ignoring X-optimism. Assumption: X is harmless. Bug: false green. Fix: X-prop / X-pess run.
Latches "that work in sim." Assumption: functionally fine. Bug: fails timing/silicon. Fix: eliminate inferred latches.
Red flag — no CDC report. Any async crossing without a clean CDC report is an automatic block.
Red flag — credit width ≠ buffer depth. A silent overrun; fix before freeze.
Red flag — "timing will close later." Structurally un-closable logic will not; fix the structure now.

18. Quick Revision

RTL Review Checklist. A pre-tapeout, structural pass over a CHI block's RTL — reading it for what synthesis and silicon do, not what the testbench ran, because simulation proves behavior but is blind to structure. Run it after the block is functionally passing but before freeze, with lint, CDC, and synthesis reports as evidence. Walk seven areas, each ticked against a report or an RTL read (never simulation alone): Protocol State Machines (no dead/unreachable states, legal transitions, Chapters 4/7); Flow Control & Credits (bounded counters, buffer=credit, no overrun, Chapter 14); Hazard & Ordering Logic (hazard detection, ordering point, MSHR safety, Chapters 9–10); Exclusives, Atomics & CMOs (monitor correct, atomics indivisible, exact CMO semantics, Chapter 11); Clocking, Reset & CDC (synchronized crossings, clean CDC report, defined reset, no X); Synthesis, Timing & Structure (no latches, no loops/multi-driver, closable timing); and Lint, X-Propagation & RTL Hygiene (clean lint, no X-optimism, full cases). Sign-off means all areas green against reports, a structural clean bill (no latches/CDC/X issues), every blocking issue closed before freeze, and the reports archived. The pitfall is green-waveform trust — signing off because the block simulates cleanly, skipping the structural pass, so a latch, a CDC bug, an X-optimistic path, or timing-hostile logic that the waveform never revealed rides into the tapeout and returns as a respin. A clean sim is necessary but wildly insufficient. Next, 21.3 reviews the verification that should have caught the rest.

Coming Next

Chapter 21.3 — Verification Review Checklist. The RTL is structurally clean; the next review asks whether the verification actually proves it correct. Chapter 21.3 covers the DV-completeness review for CHI testbenches — the coverage model, protocol checkers and scoreboard, assertion set, stimulus and randomization, corner-case and DVM/RAS coverage, and coverage-closure questions that separate a testbench that looks thorough from one that actually is.