Serialization — Where Digital Logic Stops and the Lane Begins

packet bytes
  → framing / encoding        ← what to send
  → scrambling                 ← Module 5
  → serialization              ← in what order, over time
  → the lane

x1   → 1 serializer, 1 differential pair
x4   → 4 serializers, 4 differential pairs, running concurrently
x16  → 16 of each

// SYNTHESIZABLE. Elastic handoff between the digital PCS and a SerDes
// macro interface.
// That a serializer sits behind a fixed-width parallel interface is
// VERIFIED (section 1: the PMA-PCS data path, up to 40 bits wide in the
// quoted device). The two-entry depth and the ready/valid contract are
// ILLUSTRATIVE IMPLEMENTATION POLICY.
module serdes_handoff #(
  parameter int WORD_W = 40          // vendor PMA-PCS width in section 1
) (
  input  logic clk,
  input  logic rst_n,
 
  // ---- From the digital PCS ----------------------------------------------
  input  logic              phy_valid,
  output logic              phy_ready,
  input  logic [WORD_W-1:0] phy_word,
 
  // ---- To the SerDes macro ------------------------------------------------
  output logic              macro_valid,
  input  logic              macro_ready,
  output logic [WORD_W-1:0] macro_word,
 
  output logic              underrun          // macro wanted a word, none held
);
 
  generate
    if (WORD_W < 1) $error("WORD_W must be at least 1");
  endgenerate
 
  // TWO ENTRIES. One is enough to prevent overwrite; the second decouples
  // the producer from a macro that accepts every other cycle, which is the
  // ordinary case when the two sides run at different widths (section 7).
  logic [WORD_W-1:0] w0_q, w1_q;
  logic [1:0]        cnt_q;
  logic              un_q;
 
  assign macro_valid = (cnt_q != 2'd0);
  assign macro_word  = w0_q;
  assign underrun    = un_q;
 
  wire pop  = macro_valid && macro_ready;
  // EFFECTIVE capacity: a slot vacated this cycle is usable this cycle.
  wire can_take = (cnt_q != 2'd2) || pop;
  assign phy_ready = can_take;
 
  wire push = phy_valid && phy_ready;
 
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      w0_q <= '0; w1_q <= '0; cnt_q <= 2'd0; un_q <= 1'b0;
    end else begin
      unique case ({push, pop})
        2'b10 : begin                          // push only
          if (cnt_q == 2'd0) w0_q <= phy_word;
          else               w1_q <= phy_word;
          cnt_q <= cnt_q + 2'd1;
        end
        2'b01 : begin                          // pop only
          w0_q  <= w1_q;
          cnt_q <= cnt_q - 2'd1;
        end
        2'b11 : begin                          // both
          if (cnt_q == 2'd1) w0_q <= phy_word;
          else begin w0_q <= w1_q; w1_q <= phy_word; end
        end
        default : ;
      endcase
 
      // REPORTED, NOT HIDDEN. A macro that asked for a word when none was
      // held is a real condition with real consequences on the wire, and
      // section 11 explains why it cannot simply be back-pressured away.
      if (macro_ready && !macro_valid) un_q <= 1'b1;
    end
  end
 
endmodule

// SYNTHESIZABLE. Low-rate digital parallel-to-serial converter.
// TEACHING MODEL ONLY -- a production PCIe serializer is dedicated
// circuitry (section 2). The BIT ORDER is a declared PARAMETER, not an
// assumption: section 5 explains why the general claim is unsafe even
// though the specific vendor and 8b/10b statements are quotable.
module teach_serializer #(
  parameter int WORD_W    = 8,
  // Declared, not assumed (section 5). Default follows the convention
  // quoted in section 1 at that vendor's PMA interface.
  parameter bit LSB_FIRST = 1'b1
) (
  input  logic clk,
  input  logic rst_n,
 
  // ---- Parallel in --------------------------------------------------------
  input  logic              in_valid,
  output logic              in_ready,
  input  logic [WORD_W-1:0] in_word,
 
  // ---- Serial out ---------------------------------------------------------
  // A DECOUPLED interface, deliberately -- section 11 explains that a real
  // lane has no such thing, and why teaching it this way is still right.
  output logic              serial_valid,
  input  logic              serial_ready,
  output logic              serial_bit,
 
  output logic              busy
);
 
  // GUARDED INDEX WIDTH. $clog2(1) is zero and a zero-width counter cannot
  // index anything -- WORD_W = 1 is a legal configuration.
  localparam int IDX_W = (WORD_W <= 1) ? 1 : $clog2(WORD_W);
 
  generate
    if (WORD_W < 1) $error("WORD_W must be at least 1");
  endgenerate
 
  logic [WORD_W-1:0] word_q;
  logic [IDX_W-1:0]  idx_q;
  logic              busy_q;
 
  assign busy         = busy_q;
  assign serial_valid = busy_q;
  // The word is IMMUTABLE while it is being emitted, so the bit selection
  // reads captured state and never the live input.
  assign serial_bit   = LSB_FIRST ? word_q[idx_q]
                                  : word_q[IDX_W'(WORD_W-1) - idx_q];
 
  // A new word is accepted only when nothing is in flight, or on the exact
  // cycle the last bit transfers. Anything looser overwrites a word that
  // is still being sent.
  wire last_bit  = (idx_q == IDX_W'(WORD_W-1));
  wire bit_fire  = serial_valid && serial_ready;
  wire finishing = bit_fire && last_bit;
 
  assign in_ready = !busy_q || finishing;
 
  wire load = in_valid && in_ready;
 
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      word_q <= '0; idx_q <= '0; busy_q <= 1'b0;
    end else begin
      // LOAD HAS PRIORITY over finishing, so a back-to-back word starts
      // immediately rather than costing an idle cycle -- and the index
      // restarts, which is what makes the two cases distinguishable.
      if (load) begin
        word_q <= in_word;
        idx_q  <= '0;
        busy_q <= 1'b1;
      end else if (finishing) begin
        busy_q <= 1'b0;
        idx_q  <= '0;
      end else if (bit_fire) begin
        // ===========================================================
        // THE INDEX ADVANCES ONLY ON A TRANSFER.
        //
        // Advancing on serial_valid alone skips a bit whenever the
        // consumer stalls -- section 12's counterexample, and a one-line
        // mistake that is invisible until something downstream is busy.
        // ===========================================================
        idx_q <= idx_q + IDX_W'(1);
      end
    end
  end
 
endmodule

// SYNTHESIZABLE. Distribute an ordered chunk stream across active lanes.
// THE DISTRIBUTION POLICY IS GENERIC ROUND-ROBIN TEACHING PEDAGOGY
// (section 6). The per-lane independence, the active-lane mask and the
// range safety are the architectural lessons and those DO generalise.
module lane_distributor #(
  parameter int LANES   = 4,
  parameter int CHUNK_W = 8,
  // GUARDED. $clog2(1) is zero; LANES = 1 is a legal configuration.
  parameter int LANE_W  = (LANES <= 1) ? 1 : $clog2(LANES)
) (
  input  logic clk,
  input  logic rst_n,
 
  // ---- Ordered chunk in ---------------------------------------------------
  input  logic                in_valid,
  output logic                in_ready,
  input  logic [CHUNK_W-1:0]  in_chunk,
 
  // ---- Active lane configuration, from Chapter 17.3's committed result ---
  // A NORMALIZED mask: bit p set means logical lane p carries traffic.
  input  logic [LANES-1:0]    lane_active,
 
  // ---- Per-lane output ----------------------------------------------------
  output logic [LANES-1:0]    lane_valid,
  input  logic [LANES-1:0]    lane_ready,
  output logic [CHUNK_W-1:0]  lane_chunk [LANES],
 
  output logic                no_active_lane
);
 
  generate
    if (LANES < 1)  $error("LANES must be at least 1");
    if (LANE_W < 1) $error("LANE_W must be at least 1");
    if ((LANES > 1) && ((1 << LANE_W) < LANES))
      $error("LANE_W too narrow to index LANES");
  endgenerate
 
  logic [LANE_W-1:0] sel_q;
 
  assign no_active_lane = (lane_active == '0);
 
  // NEXT ACTIVE LANE, with an explicit wrap at LANES-1. Never rely on a
  // counter wrapping naturally -- it only does at a power-of-two LANES,
  // and LANES is a free parameter.
  function automatic logic [LANE_W-1:0] next_active(input logic [LANE_W-1:0] cur);
    logic [LANE_W-1:0] c;
    c = cur;
    for (int i = 0; i < LANES; i++) begin
      c = (c == LANE_W'(LANES-1)) ? '0 : (c + LANE_W'(1));
      if (lane_active[c]) return c;
    end
    return cur;                       // no active lane: hold
  endfunction
 
  // RANGE SAFETY. sel_q is internally generated here, but the pattern is
  // written out because an externally-supplied lane id must ALWAYS be
  // checked before an array access -- never rely on "the protocol will not
  // send that".
  localparam int CHK = LANE_W + 1;
  wire sel_legal = (CHK'(sel_q) < CHK'(LANES));
 
  wire selected_ok = sel_legal && lane_active[sel_q] && lane_ready[sel_q];
  assign in_ready = selected_ok;
  wire fire = in_valid && in_ready;
 
  always_comb begin
    for (int p = 0; p < LANES; p++) begin
      // AN INACTIVE LANE NEVER RECEIVES NORMAL TRAFFIC.
      lane_valid[p] = in_valid && sel_legal && lane_active[p]
                                            && (LANE_W'(p) == sel_q);
      lane_chunk[p] = in_chunk;
    end
  end
 
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      sel_q <= '0;
    end else if (fire) begin
      sel_q <= next_active(sel_q);
    end else if (!no_active_lane && !lane_active[sel_q]) begin
      // The committed lane set changed under us and the current selection
      // is no longer active. Move to one that is, rather than stalling on
      // a lane that will never be ready.
      sel_q <= next_active(sel_q);
    end
  end
 
endmodule

step             1     2     3     4     5     6     7
in_valid         1     0     0     0     0     0     0
in_word         A5     -     -     -     -     -     -
 
busy             0     1     1     1     1     1     1
idx              -     0     1     1     1     2     3
serial_valid     0     1     1     1     1     1     1
serial_ready     -     1     1     0     0     1     1
serial_bit       -     1     0     1     1     0     1

// SVA over teach_serializer, serdes_handoff and lane_distributor. These
// assert LOCAL digital contracts. They assert nothing about the analog
// serializer, PLL, driver, equalization, or the channel -- none of which
// is modelled (section 2).
 
// ---- ENVIRONMENT ------------------------------------------------------
// A1: the input word is stable while offered and not accepted.
assume property (@(posedge clk) disable iff (!rst_n)
  (in_valid && !in_ready) |=> ($stable(in_word) && in_valid));
// A2: lane_active is Chapter 17.3's committed, normalized mask and does
// not change mid-word.
assume property (@(posedge clk) disable iff (!rst_n)
  busy |-> $stable(lane_active));
 
// ---- SERIALIZER -------------------------------------------------------
 
// P1: an accepted word is emitted EXACTLY WORD_W times. (bits_sent is a
// testbench counter reset on load.)
property p_exact_bit_count;
  @(posedge clk) disable iff (!rst_n)
  $fell(busy) |-> (bits_sent == WORD_W);
endproperty
a_count : assert property (p_exact_bit_count);
 
// P2: THE WORD IS IMMUTABLE while it is being emitted. Catches an output
// wired to the live input rather than to captured state.
property p_word_immutable;
  @(posedge clk) disable iff (!rst_n)
  (busy && !load) |=> $stable(word_q);
endproperty
a_immutable : assert property (p_word_immutable);
 
// P3: no new word is accepted while one is in flight, except on the exact
// cycle the last bit transfers.
property p_no_overwrite;
  @(posedge clk) disable iff (!rst_n)
  (busy && !finishing) |-> !in_ready;
endproperty
a_no_overwrite : assert property (p_no_overwrite);
 
// P4: THE INDEX ADVANCES ONLY ON A TRANSFER. Section 12's counterexample.
property p_index_only_on_fire;
  @(posedge clk) disable iff (!rst_n)
  (busy && !bit_fire && !load) |=> $stable(idx_q);
endproperty
a_index : assert property (p_index_only_on_fire);
 
// P5: the presented bit is stable while stalled.
property p_bit_stable_under_stall;
  @(posedge clk) disable iff (!rst_n)
  (serial_valid && !serial_ready) |=> (serial_valid && $stable(serial_bit));
endproperty
a_bit_stable : assert property (p_bit_stable_under_stall);
 
// P6: THE ORDER PROPERTY. The emitted bit matches an INDEPENDENT
// restatement of the declared convention -- not the module's own
// expression, which would agree with a wrong one (section 5).
property p_bit_order_matches_declared;
  @(posedge clk) disable iff (!rst_n)
  serial_valid |-> (serial_bit == (LSB_FIRST ? word_q[idx_q]
                                             : word_q[WORD_W-1-idx_q]));
endproperty
a_order : assert property (p_bit_order_matches_declared);
 
// P7: busy clears only after the FINAL bit transfers.
property p_busy_clears_on_last;
  @(posedge clk) disable iff (!rst_n)
  $fell(busy) |-> $past(finishing);
endproperty
a_busy : assert property (p_busy_clears_on_last);
 
// P8: the index is never out of range -- the WORD_W = 1 corner included.
property p_index_in_range;
  @(posedge clk) disable iff (!rst_n)
  busy |-> (idx_q <= IDX_W'(WORD_W-1));
endproperty
a_range : assert property (p_index_in_range);
 
// ---- HANDOFF ----------------------------------------------------------
 
// P9: no word is dropped -- a refused word is back-pressured, not lost.
property p_no_word_dropped;
  @(posedge clk) disable iff (!rst_n)
  (phy_valid && !phy_ready) |=> (phy_valid && $stable(phy_word));
endproperty
a_no_drop : assert property (p_no_word_dropped);
 
// P10: the held word is not overwritten before the macro takes it.
property p_no_macro_overwrite;
  @(posedge clk) disable iff (!rst_n)
  (macro_valid && !macro_ready) |=> (macro_valid && $stable(macro_word));
endproperty
a_hold : assert property (p_no_macro_overwrite);
 
// P11: simultaneous push and pop leave occupancy unchanged.
property p_simul;
  @(posedge clk) disable iff (!rst_n)
  (push && pop) |=> (cnt_q == $past(cnt_q));
endproperty
a_simul : assert property (p_simul);
 
// P12: an underrun is REPORTED. The wire cannot be stalled (section 11),
// so this condition must never be silent.
property p_underrun_reported;
  @(posedge clk) disable iff (!rst_n)
  (macro_ready && !macro_valid) |=> underrun;
endproperty
a_underrun : assert property (p_underrun_reported);
 
// ---- DISTRIBUTOR ------------------------------------------------------
 
// P13: a chunk goes to EXACTLY ONE lane.
property p_one_lane_only;
  @(posedge clk) disable iff (!rst_n)
  in_valid |-> ($countones(lane_valid) <= 1);
endproperty
a_one_lane : assert property (p_one_lane_only);
 
// P14: AN INACTIVE LANE NEVER RECEIVES NORMAL TRAFFIC. A lane the Link did
// not negotiate must carry nothing (Chapter 17.3).
generate for (genvar p = 0; p < LANES; p++) begin : g_inactive
  property p_inactive_silent;
    @(posedge clk) disable iff (!rst_n)
    !lane_active[p] |-> !lane_valid[p];
  endproperty
  a_inactive : assert property (p_inactive_silent);
end endgenerate
 
// P15: the selector index is always in range, at every LANES value.
property p_sel_in_range;
  @(posedge clk) disable iff (!rst_n)
  (LANES == 1) || (sel_q < LANE_W'(LANES));
endproperty
a_sel : assert property (p_sel_in_range);
 
// P16: THE LAYER PROPERTY. Nothing in this chapter interprets packet
// meaning -- the serializer has no notion of TLP type (section 4).
property p_no_packet_semantics;
  @(posedge clk) disable iff (!rst_n)
  serial_valid |-> !(dut_tl.cpl_valid || dut_tl.mem_valid);
endproperty
a_layer : assert property (p_no_packet_semantics);
 
// P17: reset discards a partial word and clears output validity.
property p_reset;
  @(posedge clk)
  !rst_n |=> (!busy && !serial_valid && !macro_valid);
endproperty
a_reset : assert property (p_reset);