Integration Checklist

A master can be correct. A slave can be correct. The system can still be wrong, and the specification tells you in advance that it can.

INTEGRATION = COMPATIBILITY + OWNERSHIP + ROUTING + POLICY

Integration review is the only place those four are examined together, which is why it is the review most often skipped and most expensive to skip.

1. Two Conformant Endpoints, One Deadlock

INT-06. Does every endpoint observe every termination its counterpart can assert?

ERR_O and RTY_O are optional on both sides. PERMISSION 3.20 and PERMISSION 3.25 make them so. A master may omit ERR_I; a slave may implement ERR_O; neither is non-conformant.

Connect them:

=== SIM H - INTEGRATION CAPABILITY MISMATCH ===

  the SAME slave, two masters, one reserved-offset write

  master            operations issued  operations RETIRED
  observes ERR                      2                   2
  no ERR input                      2                   1

  at the pins              ERR-aware rig   ERR-blind rig
  phases opened                        2               2
  ACK terminations                     1               1
  ERR terminations                     1              39

  The ERR-blind rig's slave asserted ERR on 39 clocks. Its
  master retired 1 of 2 operations and is still waiting
  for an acknowledgement that will never come, because the
  only answer available is one it has no wire to receive.

Thirty-nine error terminations, asserted correctly, into a master with no input to receive them. The specification anticipates this exactly:

OBSERVATION 3.35 — If the SLAVE supports ERR_O or RTY_O, but the MASTER does not support these signals, deadlock may occur.

Note what that does not say. It does not say either component is wrong. Two conformant components can deadlock when integrated, and an observation in Chapter 3 of the bus specification is where that is written down.

PASS: every termination class an endpoint can assert is either observed by its counterpart or converted by something between them. FAIL: any asserted class with no receiver. The disposition for an unexamined pairing is NOT VERIFIED, and this is the item where that matters most, because the failure is invisible until the one access that triggers it.

2. Profile Compatibility

INT-01. What exact interface profile does each endpoint implement?

Module 29 inspected a crossbar whose header declares it conforms to the WB-B4 pipeline specification and whose ports carry STALL — a signal B3 Classic does not have. Classic and pipelined are not the same timing contract, and an adapter is not optional between them.

The artifact a review produces:

Two rows there are the whole review. The ERR column disagrees between the first two — that is SIM H. And the last row is what an honest table looks like when nobody has read the datasheet yet. Do not invent compatibility to fill a cell.

3. Response Provenance

INT-09. Which request does this response belong to, and what guarantees it?

The unacceptable answer is "the mux sends the ACK back." That describes the wiring, not the invariant.

Four mechanisms are legitimate, and a review checks the assumption, not the mechanism:

Row two is the one that keeps appearing in real code. Module 29 found a live-selector arbiter whose safety rests on a CPU property stated in a comment beside it — and a framework arbiter with the same structure and a parameter that fixes it.

Measured, with the owner and the recipient recorded as separate fields:

=== SIM I - RESPONSE PROVENANCE ===

  rig         phases  owner moved  response misdelivered  first bad cycle
  correct           8            0                      0                0
  defective       133            0                    133                6

  M0 operations retired   correct 4   defective 0
  M1 operations retired   correct 4   defective 4
  protocol violations     correct 0   defective 0
  SPEC assertions         correct 0   defective 0
  LOCAL assertions        correct 0   defective 133

Zero protocol violations. Zero specification assertion failures. M1 retired four operations; M0 retired none, having issued four. M1 completed work using acknowledgements earned by M0's transfers.

  The defective rig breaks no Wishbone rule and no
  specification assertion. It breaks a LOCAL invariant 133
  times, first at cycle 6. That invariant only exists
  because somebody recorded the owner and the recipient as
  two separate fields. A review that accepts the sentence
  'the mux returns the ACK' never asks the question.

PASS: misdeliveries 0, with the mechanism's assumption identified and checked. FAIL: any misdelivery, or an assumption nobody can state.

4. Timeout Is A Requirements Document

INT-12. Who owns the timer, what does expiry mean, and what is the residual risk?

B3 bounds no latency. The nearest it comes is:

RECOMMENDATION 3.10 — Design INTERCON modules to prevent deadlock. One solution is a watchdog timer function that monitors the MASTER's STB_O signal.

A recommendation, about an interconnect, offering one solution. Everything else is yours:

=== SIM J - TIMEOUT IS LOCAL POLICY ===

  one watchdog, threshold 20 clocks, two targets

  target                    wait clocks  watchdog fired  data returned
  slow but finite (9)                 9              no  0x600d0004
  never answers               unbounded             yes  0xffffffff

  operations retired        2 of 2
  watchdog expiries         1

  The first target waited nine clocks and nothing fired.
  The second was cut off at twenty. NOTHING IN WISHBONE
  DISTINGUISHES THEM - B3 bounds no latency. The number 20
  came from a requirements document, and a different number
  would have reclassified the first target as a failure.

Seven questions a timeout review must answer, and "we added a timeout" answers none of them:

The third and fourth are where Module 10's drain problem lives, and a review that stops at "expiry returns ERR" has not reached it.

5. False Confidence

"The endpoint works alone." Proves: it satisfies its own datasheet against its own testbench. Does not prove: anything about the pairing. Both endpoints in SIM H pass standalone. Missing evidence: a compatibility table with no NOT VERIFIED rows on the pairings that ship.

"We added a timeout." Proves: the bus will reopen. Does not prove: that the failure is reported, that the late response is absorbed, or that the threshold came from anywhere. Missing evidence: the seven answers above.

6. The Integration Checklist

7. What To Carry Forward

• Two conformant endpoints can deadlock, and OBSERVATION 3.35 says so before you build it.
• Fill the compatibility table honestly. NOT VERIFIED in a cell is information; a guess is not.
• Profiles are timing contracts. Classic and pipelined need an adapter, not optimism.
• Check the assumption, not the mechanism. Live-grant steering is fine when something prevents the grant from moving — and that something must be writable down.
• A timeout threshold is a requirement, not a protocol constant, and expiry is the beginning of the policy rather than the end.

Chapter 30.5 is what you do when one of these items turns out to have been NOT VERIFIED.