Scoreboards

// ── THE QUESTION IT ANSWERS ─────────────────────────────────────────────
// Not "was the bus legal" - the protocol checker owns that. Not "what
// happened" - the monitor owns that. This module asks:
//
//   WAS THE OBSERVED RESULT THE CORRECT RESULT?

      rig               SPEC fails  mon txns  sb data mm  sb all
      correct                    0         9           0       0
      WRONG_READ_DATA            0         9           4       4

      -> ZERO PROTOCOL FAILURES. 4 DATA MISMATCHES.

         The monitor observed the same 9 transactions in
         both rigs, at the same clocks, with the same
         addresses and the same termination classes.
         Everything about HOW the transfer was conducted
         is identical. Only WHAT came back differs.

  // The corruption is applied ONLY while the data is QUALIFIED. The
  // first version corrupted it unconditionally, which meant the bus
  // carried a non-zero value with no termination asserted - and that IS
  // a RULE 3.65 violation, which a protocol checker duly caught. The
  // defect then proved the opposite of its point.

// ── THE INDEPENDENCE RULE ───────────────────────────────────────────────
// This module reads NOTHING from inside the DUT. Not its register array,
// not its decoded index, not its termination decision, not a helper
// signal it kindly exports. Its only inputs are:
//
//   the STIMULUS the testbench issued, and
//   an independently written model of what that stimulus should mean.
//
// A scoreboard whose expected value came from the DUT is asking the
// suspect to write its own alibi. Module 25 made that point about a DMA;
// here it is architecture.

// The address map, the access policies, and the byte-lane semantics are
// re-implemented here from the SPECIFICATION OF INTENT, not copied from
// wb_slave_top. If both were derived from the same source a shared
// misunderstanding would cancel out and the scoreboard would agree with
// a wrong design.

  // The first version of this model assumed ADR_I[5:2] - word-indexed,
  // four bytes per register - and the scoreboard reported two mismatches
  // on a CORRECT design. INDEPENDENT DOES NOT MEAN GUESSED: a reference
  // model must be written from the interface contract, not from an
  // assumption about what the contract probably says.

// ── WHEN STATE UPDATES ──────────────────────────────────────────────────
// At the ARCHITECTURAL COMMIT, which is an accepted write - never when a
// request merely appears. BROKEN_REF_UPDATE moves it to issue time, which
// is a REFERENCE MODEL bug, not a DUT bug, and the module keeps it as a
// named defect precisely because verification code is software too.

  logic apply;
  assign apply = BROKEN_REF_UPDATE ? issue_i : commit_i;

// ── ATTEMPTS, AND WHY RTY DOES NOT CONSUME A PREDICTION ─────────────────
// A RTY attempt moved nothing. B3's [RTY_I] description: "the interface
// is not ready... the bus cycle should be retried at a later time."
//
// So a RTY observation is COUNTED but does not pop the expected entry:
// the intended operation has not happened yet and is still owed. Merging
// a RTY with its later retry would hide an engine that retries forever;
// popping on a RTY would desynchronise the comparison permanently.
//
// THAT IS A LOCAL VERIFICATION POLICY, not a protocol rule, and it is
// the kind of decision a scoreboard has to make explicitly.

      // In this environment the expectation and the observation are
      // produced on the SAME clock: both are derived from the completion
      // event. With a plain queue that made the first observation an
      // orphan and left every later comparison one entry behind, so a
      // perfectly correct rig reported nine mismatches.

      rig                compared  data  term  addr  orphan  total
      correct                   9     0     0     0       0      0
      WRONG_BYTE_MASK           9     1     0     0       0      1
      REF_IGNORES_SEL           9     1     0     0       0      1
      BROKEN_REF_UPDATE         9     0     0     0       0      0

      -> AND NOW READ THE LAST ROW CAREFULLY.

         REF_IGNORES_SEL scores 1 mismatches and the
         DUT IN THAT RIG IS THE CORRECT ONE. Its protocol
         failures are 0 and its monitor is identical to
         the clean rig's.

      A FAILING SCOREBOARD DOES NOT PROVE THE DUT IS
      WRONG. Verification code is software and contains
      bugs like any other. The first question on a
      scoreboard failure is which of the two models is
      mistaken - and the protocol checker's silence here
      is evidence, because a DUT that really moved the
      wrong data would still have kept the bus legal.

         NOTE THE ROW BELOW IT. BROKEN_REF_UPDATE - a model
         that applies writes at ISSUE instead of COMMIT -
         scores 0. IT CANNOT ARM HERE: RULE 3.35 permits
         one outstanding phase, so nothing can observe the
         model between a write being issued and committed.
         A defect that cannot arm is not evidence of a
         correct model; it is evidence of a stimulus that
         never asked.

          // [SEL_O()] names the participating lanes - modelled
          // independently rather than copied from the write path
          for (b = 0; b < SW; b = b + 1) begin
            if (sel_i[b] || REF_IGNORES_SEL) begin

    // ── THE PARTIAL WRITE MUST BE SENSITIVE, NOT MERELY PRESENT ──────
    // Seed the register with a value whose OTHER lanes are non-zero
    // first. A partial write of zero-filled data into an already-zero
    // register produces the same result whether [SEL_I()] is honoured or
    // ignored, so the lane defects would hit the coverage bin and stay
    // invisible. HITTING A BIN IS NOT THE SAME AS BEING SENSITIVE TO
    // THE BUG THE BIN WAS CHOSEN FOR.

      // ── TB INTEGRITY: never compare a value that is not known ────────
      if (exp_valid_i && ((^exp_adr_i === 1'bx) || (^exp_rdat_i === 1'bx)
                          || (^exp_term_i === 1'bx)))
        unk_q <= 1'b1;

      -> EVERY PASS DECISION WAS MADE ON KNOWN VALUES.
         Module 24 lost a gate to an undriven counter: the
         value went X, `if (x == 0)` was neither true nor
         false, and the check was silently skipped.

      for (i = 0; i < 16; i = i + 1)  regs_m[i] <= 32'd0;
      for (i = 0; i < 256; i = i + 1) mem_m[i]  <= 32'd0;

        if (refuse) begin
          nref_q <= nref_q + 16'd1;
        end else begin