The Chiplet Marketplace Vision

Chapter 24.1 mapped the roles and found where the gaps are. This chapter takes the largest gap — the contract itself — and asks what it would have to contain to be checkable by a machine rather than argued in a meeting.

1. The One-Sentence Model

A chiplet marketplace is a marketplace of contracts, not pieces of silicon. The die is one artefact among a dozen, and the ones that decide whether integration succeeds are the ones that can be evaluated before tape-out — which means they must be expressed as data, not as prose in a design document.

So the engineering question is not "will marketplaces exist?" It is: which of 24.1 §6's eleven artefacts can be made machine-checkable, and what does the check actually look like? §6 onward is that question answered in RTL.

2. What This Chapter Owns

Four things are new here, and none of them is a market prediction:

Compatibility as a predicate (§7–§9) — a function of two manifests and a system requirement, not a version comparison. §9 is why max() and even min() on a version number are both wrong.

The four-state configuration lifetime (§10–§12): supported → requested → candidate → active, with an atomic commit between the last two.

Five identity scopes (§13–§14), and the flagship bug where one integer serves all of them.

And two failures where both dies conform (§17–§18) — a progress-reserve mismatch and a reset-semantics mismatch. The link is correct in both. The contract was incomplete.

3. Sourcing

4. What Is Actually Being Traded

And the engineering consequence is the chapter's premise: if the promises are prose, they are evaluated by a person reading a document late in the project. If they are data, they are evaluated by a script before anyone commits — which is the difference between a marketplace and a catalogue of hopes.

5. Contracts Sit Above the Link

Three things to read.

The check consumes manifests plus a system requirement. Compatibility is not a property of two dies alone — a pair that is fine for one product is unusable in another (§8), which is why the requirement is an input.

The result is named, not boolean. 22.1 §22: "incompatible" is not a finding, and a named reason is what makes the result actionable.

And the link is at the bottom, checking none of it. It is necessary and it is evaluated by nothing above it — which is the whole chapter in one node.

6. The Manifest

// ILLUSTRATIVE SYSTEM ARCHITECTURE — derived by this chapter (§3).
// NOT a UCIe structure, NOT a proposed standard, NO field corresponds to any
// specification. This is what a machine-checkable contract would have to hold.
typedef struct packed {
  // WHO — five identity scopes, deliberately separate (§13)
  logic [15:0] supplier_id;
  logic [15:0] model_id;
  logic [7:0]  silicon_rev;
  logic [7:0]  chiplet_role;        // compute / memory-side / io / bridge / accel
 
  // INTERFACE PROFILE — a named bundle, not a version number (§9)
  logic [7:0]  iface_profile;       // the profile this die implements
  logic [7:0]  iface_profile_min;   // the oldest profile it can interoperate with
 
  // PROTOCOL
  logic [PROTO_N-1:0] protocols_supported;
  logic [PROTO_N-1:0] protocols_required;   // what it needs the PEER to accept
  logic               adapter_reliability;  // relies on adapter CRC/retry?
 
  // TRAFFIC CLASSES AND PROGRESS — §17's flagship
  logic [TC_N-1:0]    traffic_classes;
  logic [TC_N-1:0]    tc_progress_critical; // which MUST NOT be starved
  logic               provides_progress_reserve;
  logic [15:0]        max_outstanding_progress;
 
  // LIFETIME CONTRACTS — §18's flagship
  logic [7:0]  reset_model;         // what an interface reset DESTROYS
  logic        retains_across_recovery;
  logic        reset_is_initiator;
 
  // MANAGEMENT / POWER / SECURITY
  logic [7:0]  mgmt_version;
  logic [7:0]  power_states;
  logic [7:0]  security_profile;
  logic        requires_peer_attestation;
 
  // FAULT AND OBSERVABILITY
  logic [7:0]  fault_domain_id;
  logic [7:0]  telemetry_caps;
 
  // COLLATERAL — what the supplier SHIPPED, not what the die does (§16)
  logic        has_reference_model;
  logic        has_protocol_checker;
  logic        has_coverage_plan;
 
  // LIFECYCLE
  logic [15:0] errata_rev;
  logic [15:0] support_horizon_q;
} chiplet_manifest_t;

Architecture. One evaluable record per purchasable die, structured so a missing agreement is a missing field rather than an unasked question.

State. A constant per die; the integrator holds one per candidate. Not synthesised into the datapath — it is design-time data plus a bring-up-time subset.

Event. Consumed by §8's predicate at selection time, and by negotiation at bring-up.

Contract. Three field pairs exist because the pair is the evidence. protocols_supported with protocols_required — what it can do versus what it needs from the peer. traffic_classes with tc_progress_critical — §17 turns on the second. iface_profile with iface_profile_min — §9's reason a single number is insufficient.

Failure. Omitting tc_progress_critical produces §17. Omitting reset_model produces §18. Omitting the three has_* fields means the integrator learns the verification plan after committing (24.1 §11).

DV/debug. The bring-up subset belongs in a silicon snapshot (21.7 §9). In an interoperability matrix the failing pair is usually distinguished by one field, and without both manifests recorded that comparison cannot be made.

7. Compatibility Is Not a Version Comparison

Compatibility is a predicate over three inputs: compatible(A, B, system_requirement). It is not a property of a version, and it is not a property of a pair alone.

8. The Compatibility Predicate

// ILLUSTRATIVE SYSTEM ARCHITECTURE (§3). Verification / design-time model.
// Every failure mode gets a DISTINCT reason — "incompatible" is not a finding.
typedef enum {
  COMPAT_OK,
  X_PROFILE_DISJOINT,        // no common interface profile
  X_PROTOCOL_UNMET,          // one side requires what the other cannot carry
  X_RELIABILITY_OWNER,       // disagree on who provides integrity
  X_PROGRESS_RESERVE,        // §17
  X_RESET_MODEL,             // §18
  X_RESET_BOTH_INITIATOR,
  X_POWER_DISJOINT,
  X_SECURITY_UNMET,
  X_SYSREQ_PROTOCOL,         // pair is fine; the SYSTEM needs something neither has
  X_SYSREQ_CAPACITY,
  RISK_NO_REFERENCE_MODEL,   // not a blocker — changes the plan (§16)
  RISK_SUPPORT_HORIZON
} compat_e;
 
function automatic compat_e compatible(chiplet_manifest_t a,
                                       chiplet_manifest_t b,
                                       sys_requirement_t  req);
  // PROFILE: a common profile must exist, reachable by BOTH. This is the
  // §9 correction — profiles intersect; version numbers do not (§7).
  if ((a.iface_profile     < b.iface_profile_min) ||
      (b.iface_profile     < a.iface_profile_min))
    return X_PROFILE_DISJOINT;
 
  // PROTOCOL: intersection, and each side's REQUIREMENT must be met.
  if ((a.protocols_supported & b.protocols_required) != b.protocols_required)
    return X_PROTOCOL_UNMET;
  if ((b.protocols_supported & a.protocols_required) != a.protocols_required)
    return X_PROTOCOL_UNMET;
 
  // RELIABILITY OWNERSHIP must AGREE. One side relying on the adapter's retry
  // while the other runs raw is a silent unprotected link (22.2 §13).
  if (a.adapter_reliability != b.adapter_reliability) return X_RELIABILITY_OWNER;
 
  // PROGRESS RESERVE — §17. If either side marks a class progress-critical,
  // the PEER must actually reserve for it. Both dies can be individually
  // correct and this can still fail.
  if (|(a.tc_progress_critical) && !b.provides_progress_reserve)
    return X_PROGRESS_RESERVE;
  if (|(b.tc_progress_critical) && !a.provides_progress_reserve)
    return X_PROGRESS_RESERVE;
 
  // RESET LIFETIME — §18. Both must agree what an interface reset destroys.
  if (a.reset_model != b.reset_model)                 return X_RESET_MODEL;
  if (a.retains_across_recovery != b.retains_across_recovery)
    return X_RESET_MODEL;
  if (a.reset_is_initiator && b.reset_is_initiator)   return X_RESET_BOTH_INITIATOR;
  if (!a.reset_is_initiator && !b.reset_is_initiator) return X_RESET_BOTH_INITIATOR;
 
  if ((a.power_states & b.power_states) == '0)        return X_POWER_DISJOINT;
  if (a.requires_peer_attestation && (b.security_profile == '0))
    return X_SECURITY_UNMET;
 
  // THE SYSTEM REQUIREMENT — the third input (§5). A pair can be mutually
  // compatible and still unusable for THIS product.
  if ((a.protocols_supported & b.protocols_supported & req.protocols_needed)
        != req.protocols_needed)                      return X_SYSREQ_PROTOCOL;
  if (min16(a.max_outstanding_progress, b.max_outstanding_progress)
        < req.min_outstanding_progress)               return X_SYSREQ_CAPACITY;
 
  // RISKS: they do not block the pairing. They change the plan and the terms.
  if (!a.has_reference_model || !b.has_reference_model)
    return RISK_NO_REFERENCE_MODEL;
  if (min16(a.support_horizon_q, b.support_horizon_q) < req.min_horizon_q)
    return RISK_SUPPORT_HORIZON;
 
  return COMPAT_OK;
endfunction

Architecture. A pure predicate over two manifests and a system requirement, returning one of thirteen named outcomes.

State. None — deliberately, so it can be run offline over a catalogue of candidates.

Event. Evaluated at selection, long before silicon; re-evaluated whenever a manifest revision changes.

Contract. Profiles intersect; requirements are checked in both directions; reliability ownership must agree rather than merely be present. And the reset check is a strict exclusive-or — both-initiator deadlocks and neither-initiator also deadlocks, so testing only the both-case leaves half the failure uncovered (22.5 §4).

Failure. Returning a boolean collapses thirteen findings into one symptom, so the integrator learns a pairing does not work and not why — which directly worsens 24.1 §16's attribution problem. Omitting the req input produces pairs that are mutually compatible and useless for the product.

DV/debug. The two RISK_* results are the useful ones commercially: they do not block, they change the verification plan and the contract terms. A pairing with no reference model on either side is buildable and is a different project (§16).

9. Wrong RTL — Highest Version Wins

// WRONG — negotiate on a version number. Two variants, both defective.
assign active_version = (local_max > remote_max) ? local_max : remote_max;  // max
assign active_version = (local_max < remote_max) ? local_max : remote_max;  // min

Why min is also wrong, which is the part usually missed.

And the correction is a profile — a named bundle of mandatory features — plus an explicit iface_profile_min stating the oldest profile a die can interoperate with (§6, §8). A profile is checkable; a number is a proxy for a bundle nobody wrote down.

10. Four Configuration States

19.5 and 21.1 §29 established requested-versus-active. A marketplace needs four, because negotiation itself is a state.

Two properties.

candidate exists so a proposal can be validated before it takes effect — and so both dies can acknowledge it before either changes behaviour.

And only active may be read by the datapath. 21.5 §40: a measurement or a transfer decision made against requested is computed against a configuration that may not exist.

11. Atomic Contract Commit

// ILLUSTRATIVE SYSTEM ARCHITECTURE (§3). Two-phase commit across two dies,
// with a single epoch that ties every event to the configuration it ran under.
typedef struct packed {
  logic [7:0]  iface_profile;
  logic [PROTO_N-1:0] protocols;
  logic [TC_N-1:0]    traffic_classes;
  logic [TC_N-1:0]    tc_progress_critical;
  logic [7:0]  mgmt_version;
  logic [7:0]  security_profile;
} contract_t;
 
contract_t          supported_c;      // constant, from the manifest
contract_t          requested_q;      // written by management
contract_t          candidate_q;      // proposed by negotiation
contract_t          active_q;         // ONLY the datapath reads this
logic [EPOCH_W-1:0] cfg_epoch_q;
 
logic prepare_ack_local, prepare_ack_peer;
logic commit_fire;
 
// COMMIT requires: both sides prepared, AND nothing outstanding. Committing
// with work in flight leaves those objects running under the OLD contract
// while the new one is active (22.5 §11).
assign commit_fire = prepare_ack_local && prepare_ack_peer
                  && (outstanding_q == '0) && commit_request;
 
always_ff @(posedge clk or negedge rst_n) begin
  if (!rst_n) begin
    active_q    <= CONTRACT_SAFE_DEFAULT;
    cfg_epoch_q <= '0;
  end else if (commit_fire) begin
    // THE WHOLE CONTRACT MOVES IN ONE CYCLE. Committing fields separately is
    // §12 — one cycle of mixed interpretation.
    active_q    <= candidate_q;
    cfg_epoch_q <= cfg_epoch_q + 1'b1;
  end
end
 
// MANDATORY. English: the active contract changes only on a commit, and only
// with nothing outstanding. Fires at the cycle of a partial or unquiesced
// commit — before any traffic is misinterpreted.
a_contract_atomic: assert property (
  @(posedge clk) disable iff (!rst_n)
    $changed(active_q) |-> ($past(commit_fire) && ($past(outstanding_q) == '0))
);
 
// MANDATORY. English: a candidate is never a subset violation of what this die
// supports. Fires if negotiation proposes something the manifest never offered
// — §9's `max` bug arriving at runtime.
a_candidate_within_supported: assert property (
  @(posedge clk) disable iff (!rst_n)
    prepare_ack_local
      |-> ((candidate_q.protocols & supported_c.protocols) == candidate_q.protocols)
       && ((candidate_q.traffic_classes & supported_c.traffic_classes)
             == candidate_q.traffic_classes)
);

Architecture. Four contract registers, a two-sided prepare, and one commit that moves the entire contract in a single cycle with a monotonic epoch.

State. Four contract_t registers plus the epoch and two prepare acknowledgements.

Event. commit_fire requires both prepares and quiescence. The epoch increments exactly once per commit, which is what lets any later event be attributed to the contract it ran under (21.6 §11).

Contract. outstanding_q must count every outstanding obligation across every class, not one queue's (22.2 §14). A quiesce that drains one class and not another commits with work still in flight under the old contract.

Failure. §12. Also: committing without the peer's prepare_ack produces a one-sided commit, which is the same failure with a longer window.

DV/debug. cfg_epoch in every trace event (21.7 §16) is what makes a cross-reconfiguration trace interpretable. Without it, a straggler from the previous contract is judged under the new one and reported as a peer violation.

12. Wrong RTL — Partial Commit

// WRONG — fields commit as they are validated. Each write is correct; the
// SEQUENCE is the defect.
always_ff @(posedge clk) begin
  if (tc_map_valid)   active_q.traffic_classes     <= candidate_q.traffic_classes;
  if (tc_prog_valid)  active_q.tc_progress_critical<= candidate_q.tc_progress_critical;
  if (proto_valid)    active_q.protocols           <= candidate_q.protocols;  // one cycle later
end

The window, cycle by cycle:

Four properties.

For two to three cycles the two dies mean different things by the same bytes. Not a dropped transfer — a misinterpreted one, which may be silently accepted and corrupt downstream state.

A misclassified transfer is worse here than elsewhere, because the traffic-class map decides which queue and which reserve a transfer uses (§17). A progress-critical transfer classified as bulk loses its reserve and can deadlock the pair.

The window is short, load-dependent and reproduces poorly — the hardest class (19.5 §39).

And §11's a_contract_atomic fires at cycle 100, in simulation, at the first partial write — before any traffic is misinterpreted at all.

13. Five Identity Scopes

One integer cannot serve five scopes. They change at different rates, for different reasons, and software depends on the third while hardware routes on the first.

14. Wrong RTL — Chiplet ID Is Link ID

// WRONG — the routing table is keyed by physical link, and software is told
// the link number is the chiplet's identity.
assign target_link  = route_tbl[dst_chiplet_id];   // dst_chiplet_id IS a link id
assign sw_visible_id = link_id;                    // published to software

The failure:

Four readings.

The failover worked perfectly. Every mechanism did its job — and the system broke because identity was defined as a route.

Step 6 is the serious one. 22.4 §11's correlation problem: outstanding obligations tagged with a stale identity scope cannot be matched, and unmatched responses are either dropped or mis-attributed.

The fix is separation (§15): a stable logical identity that survives routing, a route that may change, and a route epoch so a live transaction can still be correlated across a change.

And software must be published the logical identity, never the link — which is 22.4 §21's point that a physical boundary is not a software boundary.

15. Corrected RTL — Separated Identity

// CORRECTED. Identity, route and epoch are three different things.
typedef struct packed {
  logic [15:0] logical_id;      // STABLE — what software sees; survives failover
  logic [15:0] supplier_id;
  logic [15:0] model_id;
  logic [7:0]  package_site;    // where it physically sits
  logic [31:0] security_id;     // per-INSTANCE, not per-model (§13)
} chiplet_identity_t;
 
chiplet_identity_t  ident_q [NUM_CHIPLETS];   // stable
logic [LINK_W-1:0]  route_q [NUM_CHIPLETS];   // may change
logic [EPOCH_W-1:0] route_epoch_q;            // increments when a route changes
 
// A transaction carries the LOGICAL destination and the route epoch it was
// issued under, so a response is correlatable even across a failover.
typedef struct packed {
  logic [SEM_W-1:0]   sem_id;
  logic [GEN_W-1:0]   generation;
  logic [15:0]        dst_logical_id;   // NOT a link
  logic [EPOCH_W-1:0] route_epoch;
} mkt_txn_t;
 
always_ff @(posedge clk or negedge rst_n) begin
  if (!rst_n) route_epoch_q <= '0;
  else if (route_commit_fire) begin
    route_q[route_commit_id] <= route_commit_link;
    route_epoch_q            <= route_epoch_q + 1'b1;
  end
  // NOTE: no branch here writes ident_q. That absence IS the fix.
end
 
// MANDATORY. English: a chiplet's logical identity never changes while it is
// present. Fires on §14 directly.
a_logical_identity_stable: assert property (
  @(posedge clk) disable iff (!rst_n)
    chiplet_present[0] |-> $stable(ident_q[0].logical_id)
);
 
// MANDATORY. English: a route change does not alter any live transaction's
// destination identity. Fires if failover re-tags outstanding work.
a_live_txn_identity_stable: assert property (
  @(posedge clk) disable iff (!rst_n)
    (txn_live && $changed(route_epoch_q)) |-> $stable(txn_dst_logical_id)
);

Architecture. Stable identity, mutable route, monotonic route epoch — three registers where the wrong design had one.

State. An identity record and a route entry per chiplet, plus one epoch.

Event. route_commit_fire writes the route and bumps the epoch. No branch writes ident_q, and that absence is the correctness argument.

Contract. Software is published logical_id. The route is an internal detail and may change without any software-visible event (22.4 §21).

Failure. Bumping the epoch without carrying it on the transaction leaves a response un-attributable to the route it was issued under — the same orphan, one layer up.

DV/debug. Both the identity and the route epoch belong in the trace (21.7 §16). A response whose route_epoch predates the current one is a straggler, not a violation — and telling those apart requires the field.

16. Verification Collateral Is Part of the Product

A marketplace without verification collateral does not remove integration cost. It moves it to the buyer — and prices it at zero in the transaction, which is why the has_* fields in §6 exist as manifest data rather than as documentation.

17. Flagship — Two Conforming Chiplets Deadlock

Both support the same interface profile. The link is correct. The package deadlocks under load.

The failure chain (22.3 §12's deadlock, across an organisational boundary):

Five readings.

Both dies are individually correct. A reserves for progress traffic; B does not, and B's design is a legitimate choice for a die that was never asked to guarantee one.

The link is faultless. Every flit crossed correctly; 23.3 §14's lesson — transport correctness is not system correctness.

Link conformance testing cannot find it (20.7). Conformance validates the boundary; progress guarantees are one of the ten unstandardised rows (24.1 §6).

The contract was incomplete, and the missing field is nameable: provides_progress_reserve against the peer's tc_progress_critical. §8's X_PROGRESS_RESERVE returns before anyone commits silicon.

And the verification test that would have found it is 22.3 §21's: does progress traffic advance under maximum bulk load? A directed test each supplier could have run — against a peer model neither had.

18. Flagship — Reset Semantics Disagree

A subtler version of the same shape, and it survives every unit test.

Four readings.

Neither supplier violated anything. Both documented their behaviour; nobody compared the two documents, which is the entire failure.

Step 5 is a silent hang — the hardest thing to debug in a two-supplier package, because 24.1 §16's attribution question has no framework and each side's evidence shows its own behaviour as correct.

The check is one field comparison — a.retains_across_recovery != b.retains_across_recovery → X_RESET_MODEL (§8) — evaluated before selection.

And this is why reset lifetime belongs in a manifest rather than a datasheet paragraph. 23.1 §17 showed the same failure between two transports inside one design; across suppliers there is no design review that would catch it.

19. What Is Observed and What Is Derived

And the last row is this chapter's honest frame. The manifest, the predicate, the four-state lifetime, the identity scopes and the two flagship failures are derived from what composition structurally requires — legitimate engineering analysis, and not a report of anything that exists. 22.1 §5's rule is what keeps "here is what would be needed" from becoming "here is what is happening."

20. Common Misconceptions

"A chiplet marketplace is like buying IP blocks." §4: an IP block is integrated into your RTL and re-verified in context; a chiplet is a separately-taped-out die whose behaviour you cannot change.

"If both dies support UCIe they are compatible." §17, §18: both conformed, and the package deadlocked. The link is one of eleven rows.

"Version negotiation means choose the highest common number." §9: max agrees on something one side cannot do, and even min cannot express mandatory features, dependencies or deprecations. Use a profile.

"A standard physical link defines reset semantics." §18: two suppliers documented opposite interpretations and neither violated anything.

"One chiplet ID can identify everything." §13, §14: five scopes change at different rates, and keying software identity on a route makes a failover look like a device swap.

"Performance is implied by link capability." §6: sustained throughput, tail latency, outstanding capacity and progress guarantees are separate declarations (21.5).

"Verification collateral is optional documentation." §16: without a reference model the integrator can only check that a die agrees with itself.

"A marketplace eliminates integration engineering." §16: it relocates it to the buyer and prices it at zero.

"Standard compliance proves product-level interoperability." §17, 20.7: conformance validates a boundary against a reference, not a composition against a requirement.

21. Understanding Check

22. Summary

Five things.

What is traded is a contract, and only an evaluable contract is tradeable (§1, §4). Prose promises are checked by a person late; data promises are checked by a script early.

Compatibility is a predicate over two manifests and a system requirement (§8) — thirteen named outcomes, not a boolean, because "incompatible" is not a finding.

A version number cannot carry a bundle (§9). max is broken and min is insufficient; profiles are the checkable unit.

Configuration has four states and one atomic commit (§10–§12). A partial commit gives two dies two or three cycles of different meanings for the same bytes.

And one integer cannot serve five identity scopes (§13–§15) — keying software identity on a route makes a correct failover look like a device swap and orphans every outstanding request.

On evidence: an ecosystem is forming — a maintained specification, a broad consortium, demonstrated interoperability, announced components. Everything this chapter builds is derived Level-E system architecture (§19), not a standard and not a report.