Interview Review Checklist

    WEAK QUESTION            WHAT IT MEASURES
    -----------------------  ------------------------------------------
    "What is a NAK?"         whether you read the glossary

    STRONG QUESTION          WHAT IT MEASURES
    -----------------------  ------------------------------------------
    "A device enumerates     whether you can classify a symptom, choose
    and then permanently     a discriminating observation, name what
    NAKs an OUT endpoint.    each instrument cannot prove, and say
    Plan?"                   which RTL decision made it diagnosable

    1  WHAT PROBLEM DOES THIS SOLVE?
       Not what it does -- what goes wrong without it. If you cannot
       state the failure it prevents, you have memorised a mechanism.

    2  WHAT STATE MUST PERSIST?
       And which of it is authoritative versus derived. Two things that
       "always agree" is the interview's favourite trap.

    3  WHAT HAPPENS ON RESET?
       Which reset. USB has at least four and they have different
       scopes, and the second half of the question -- what must NOT be
       cleared -- is the half that distinguishes answers.

    4  WHAT CAN HAPPEN SIMULTANEOUSLY?
       Name the pairs. For each: what wins, and is that a decision or an
       accident of coding order?

    5  WHICH BOUNDARY FAILS FIRST?
       Zero, one, maximum, one past. On USB the answer is very often the
       zero-length packet.

    6  WHAT WOULD YOU ASSERT?
       And is it safety or progress? If everything you name is safety,
       you have missed half the obligations.

    7  HOW WOULD YOU VERIFY IT?
       Including: what would make the test PASS while the design is
       wrong?

    8  WHAT MUTATION WOULD CHALLENGE YOUR CHECKER?
       And if it survived, what are the four things that could mean?

    9  HOW WOULD YOU DEBUG IT?
       What is the first discriminating observation, and what can that
       instrument not prove?

  // An OUT endpoint accepting a packet into one of two buffers.
  always @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      full   <= 2'b00;
      wptr   <= 1'b0;
      maxpkt <= 7'd64;
    end else if (usb_reset) begin
      full   <= 2'b00;
      wptr   <= 1'b0;
      maxpkt <= 7'd64;
    end else begin
      if (pkt_valid && (pkt_len != 0) && !full[wptr]) begin
        len[wptr] <= pkt_len;
        full[wptr] <= 1'b1;
        wptr <= ~wptr;
      end
      if (fw_release) full[rptr] <= 1'b0;
    end
  end

    WHAT TO SAY, in this order

    RESET SCOPE       maxpkt is firmware configuration and a USB bus
                      reset must not clear it. The device silently
                      reverts to a 64-byte maximum on every host
                      suspend/resume. BLOCKER.

    BOUNDARY          `pkt_len != 0` drops the zero-length packet, which
                      is how a transfer that is an exact multiple of
                      maxpkt is terminated. Such transfers hang. BLOCKER.

    COLLISION         if pkt_valid and fw_release land in the same cycle
                      AND wptr == rptr, the set and the clear touch the
                      same bit. Written as two separate statements the
                      later one wins, which here is the clear -- so the
                      packet is lost. It should be ONE expression:
                      full <= (full | set) & ~clr, with the order chosen
                      deliberately.

    WHAT YOU WOULD    can wptr and rptr be equal while full[wptr] is 0?
    ASK NEXT          If the invariant says no, where is it enforced?

  // Reporting a completed transfer to firmware.
  always_ff @(posedge clk) begin
    if (complete) begin
      xfer_bytes <= total;
      xfer_done  <= 1'b1;
    end
    if (fw_ack) xfer_done <= 1'b0;
  end
  assign ep_busy = (xfer_bytes != 0);

    AUTHORITATIVE     ep_busy means "a completion is pending" and the
    STATE             register holding that is xfer_done. Deriving it
                      from xfer_bytes gives the wrong answer for a
                      transfer that completed with zero bytes -- which
                      is legal, and is exactly what a terminating
                      zero-length packet produces.

    LIVENESS          nothing stops `complete` from firing while
                      xfer_done is still set. The previous completion is
                      overwritten, firmware reads a length that belongs
                      to a different transfer, and nothing records it.
                      Needs backpressure AND a counter.

    NO RESET          there is no reset branch at all. Ask whether that
                      is deliberate -- on an FPGA it sometimes is -- and
                      if so, what initialises it.

    THE TRAP          "always_ff means it is safe" is not an argument.
                      Every defect above is expressible in always_ff.

  process (clk, rst_n)
  begin
    if rst_n = '0' then
      sts <= (others => '0');
    elsif rising_edge(clk) then
      if fw_we = '1' and fw_addr = A_MASK then
        msk <= fw_wdata(NEV - 1 downto 0);
        sts <= (others => '0');
      end if;
      sts <= (sts or ev) and (not fw_clr);
    end if;
  end process;

    SIDE EFFECT       a write to MASK also clears STATUS. Masking must
                      HIDE an event, not discard one -- a driver that
                      masks during a critical section loses everything
                      that happened inside it.

    ORDERING          (sts or ev) and (not fw_clr) applies the clear
                      LAST, so a firmware clear beats a hardware event
                      arriving in the same cycle. The event is newer
                      than firmware's decision to clear it, so the set
                      should win: (sts and not fw_clr) or ev.

    VHDL SPECIFIC     the two assignments to sts in the same process --
                      one inside the mask branch, one after it -- mean
                      the LAST wins, so the mask branch's clear is dead
                      code. Two bugs that partly cancel. Say so; an
                      interviewer is watching for whether you notice
                      that signal assignment is last-writer-wins rather
                      than sequential.

    WHAT YOU WOULD    is there a counter for events that arrive on a bit
    ASK NEXT          already set? A sticky bit cannot count.

    Q  A device works perfectly on every machine in the lab and fails
       certification. Give three possible reasons, in different
       categories.

    A  ELECTRICAL      eye diagram, inrush, droop -- invisible to every
                       functional test and the commonest certification
                       failure
       CONFORMANCE     a Chapter 9 requirement no host in the lab
                       exercises. Enumeration is one path; conformance
                       is a property of the whole state machine.
       DESCRIPTORS     internally inconsistent in a way that every host
                       tolerates and the compliance tool does not

    Q  Firmware clears an interrupt status bit in the same cycle the
       hardware sets it. What should happen, and what usually does?

    A  The set must win: firmware's write reflects a read from several
       cycles earlier, and the event is newer than the decision to clear
       it. What usually happens is the clear wins, because
       (sts | ev) & ~clr is the natural way to write it and applies the
       clear last. The event is lost with no record -- so the answer has
       three parts: the ordering, one expression rather than two
       branches, and a counter for the multiplicity a sticky bit cannot
       represent.

    Q  Which state in a USB device must survive a bus reset, and why is
       that the interesting half of the question?

    A  The endpoint configuration -- maximum packet size, which endpoints
       exist -- because firmware wrote it in response to
       SET_CONFIGURATION and the host's reset does not revoke it. Data
       state and every data toggle must clear.
       It is the interesting half because a reset list is wrong in two
       directions: too long loses the configuration on every suspend,
       too short leaves a stale toggle so the device acknowledges
       everything and accepts nothing. Both ship.

    Q  How would you verify that a bidirectional bus arbiter is fair?

    A  Not with data checks -- a starved direction corrupts nothing.
       With a BOUNDED progress property whose bound is derived from the
       machine rather than measured from a run, and whose antecedent
       excludes the environment legitimately refusing. Then a scenario
       that loads both directions simultaneously, because an arbiter is
       only exercised when there is something to arbitrate. Then measure
       the worst observed wait and compare it to the derived bound.

    Q  A mutation survives your regression. What does it mean?

    A  One of four things and only one blames the testbench: the mutant
       is equivalent (often because the code it changed is dead), the
       line is unreachable under this stimulus, the condition is
       reachable and nothing constructs it, or it occurs and nothing
       checks the result. The procedure is to instrument the changed
       expression and count the cycles in which it is DECISIVE. Zero
       means the finding is in the RTL, not the bench.

    Q  Your coverage is 96%. What is your first question?

    A  Of what? Derive the denominator and name the exclusions. Two
       failure modes: impossible bins inflating the total, or an honest
       total over incomplete AXES. An exhaustive sweep over state and
       stimulus does not contain simultaneity, so a set/clear collision
       can be missed by a sweep that is genuinely exhaustive over
       everything it covers.

    BAD    guess confidently
    BAD    "I do not know" and stop
    GOOD   say what class of thing it is, what you would need to settle
           it, and what you would guess and how much you would trust it

    "I do not remember the exact timeout value. What I would do is find
     it in Chapter 9 rather than recall it, because the number matters
     and getting it approximately right is worse than looking it up.
     What I can tell you is the SHAPE: it is a timeout on the device's
     response to a control transfer, it exists so a host is not held by
     a device that has stopped, and the review question is whether the
     device's slowest path can exceed it -- which is a question about
     firmware latency, not about the timer."

    MECHANISM                     CAN YOU STATE...
    ----------------------------  ---------------------------------------
    enumeration                   which request is legal in which device
                                  state, and what "undefined" means there
    descriptors                   what makes a descriptor set internally
                                  inconsistent, and who catches it
    endpoints                     why they are buffers rather than ports,
                                  and what a maximum packet size costs
    the four transfer types       which one you would choose, and the
                                  argument against your choice
    the data toggle               how it distinguishes a lost handshake
                                  from a lost packet, using one bit and
                                  no timers
    the zero-length packet        why it is a packet, and the exact
                                  transfer sizes that hang without it
    NAK                           why it is not an error
    bus reset                     the four resets, and what each must NOT
                                  clear
    suspend and resume            why resume detection cannot be in the
                                  domain suspend stops
    double buffering              why it can only be tested in the region
                                  where firmware is late
    the bridge on a dev board     why "USB is slow" is usually a latency
                                  timer
    buffer ownership              what "owned by nobody" looks like, and
                                  why it is a hang and not a corruption

    METHOD                        CAN YOU STATE...
    ----------------------------  ---------------------------------------
    safety vs progress            why one does not imply the other, and
                                  an example of a bug with no wrong value
    reference-model independence  why a model by the design's author from
                                  the design's sentence is one artefact
    coverage denominators         how to derive one, and what "axes"
                                  means
    temporal reachability         three ways a generator can fail to
                                  reach a condition
    negative controls             why a checker never shown to fail is
                                  unvalidated
    surviving mutations           the four meanings, and the probe that
                                  distinguishes them
    first divergence              why the expected model must be simpler
                                  than the design
    evidence limits               what a protocol analyser cannot prove

    1  COLD APPLICATION
       Pick a mechanism from another protocol entirely -- AXI write
       response ordering, DDR refresh scheduling, an SPI status poll --
       and answer all nine questions from section 2 about it.

    2  SNIPPET
       Write your own twenty-line snippet containing exactly three
       findings: one reset, one collision, one boundary. Hand it to
       somebody else.

    3  THE FOURTH LAYER
       Take the "works in the lab, fails certification" question and add
       a fourth category with a concrete example.

    4  THE HONEST NON-ANSWER
       Write the "I do not know" answer for: the maximum current a
       bus-powered device may draw before configuration.

    5  SEVERITY UNDER PRESSURE
       You have found six findings and the tape-out is in four days.
       Which do you insist on, which do you document, and what is the
       sentence you use to defend the boundary?

    6  THE REVERSE INTERVIEW
       Write the three questions YOU would ask about a team's
       verification process to find out whether it is any good. None of
       them may contain the word "coverage".

    THE POSTURE
    o  a USB interview is rarely a test of USB facts; it is a test of
       whether you can reason from a protocol requirement to a register
       and back to a customer symptom
    o  the nine questions work on a mechanism you have never seen, which
       is exactly when they are being tested
    o  say what you would ASK, not only what you found -- twenty lines
       out of context cannot settle everything, and knowing which half
       needs the contract is the skill

    READING CODE COLD
    o  state, reset, collisions, boundaries, liveness -- in that order
    o  "always_ff" and "we use strong typing" are not arguments; every
       defect in section 3 is expressible with both
    o  in VHDL, two assignments to one signal in one process means the
       last wins, which turns one of the two into dead code

    THE ANSWERS THAT SEPARATE
    o  a reset list is wrong in TWO directions and both ship
    o  a set/clear collision is resolved by operand order, and the event
       is newer than the decision to clear it
    o  fairness is verified by a bounded progress property, not by data
    o  a surviving mutation has four meanings; measure, do not argue
    o  "96% coverage" invites "of what", and the second failure mode is
       an honest denominator over incomplete axes

    NOT KNOWING
    o  name the class, name what would settle it, and say how much you
       would trust your guess -- an answer with no fact in it can
       demonstrate more than the fact would have

    30.1  a design review is an ORDERED set of questions, each with an
          invariant, evidence, a failure signature and the false
          confidence that hides it
    30.2  the evidence is itself engineered software, and its failures
          are silent by construction -- a verification bug produces a
          PASS
    30.3  four different things are called compliance, and a device can
          be functionally perfect and out of conformance
    30.4  a correct block still has to live in somebody else's chip,
          where every assumption has two owners
    30.5  when it fails anyway: classify, choose the discriminating
          observation, know what each instrument cannot prove, and find
          the first divergence
    30.6  and whether you can do any of it