A risk register is a table of things that could stop the chip from working or from shipping on time, each with a person who acts on it. For coherence the risks cluster around change: whatever is new in this program is where the protocol has not been proven before. A register entry is useful only if it says how you will know early that the risk is turning into a problem.
Field | Meaning | Example (R1 below) |
|---|---|---|
Risk | The specific failure, in protocol terms | Late PutM accepted after a three-hop Fwd-GetM |
Likelihood (1 to 5) | Chance the bug exists in this RTL | 2: the handler was reviewed, but the route is new |
Impact (1 to 5) | Worst consequence if it ships | 5: a stale value is silent data corruption |
Detectability (1 to 5) | How hard it is to find before tape-out; 5 = only a targeted race test or a proof finds it | 5: needs a PutM delayed past a completed forward |
Early indicator | A measured number that moves before the failure | Hits of the cross (MI^A, Fwd-GetM) x route x PutM order |
Mitigation | What reduces likelihood or detectability | Directed race test, small-model proof, chicken bit for four-hop |
Owner and review date | One person, one date | Home-controller lead, weekly |
Id | Area | Risk | L | I | D | Early indicator | Mitigation |
|---|---|---|---|---|---|---|---|
R1 | New protocol feature | Direct cache-to-cache transfer: a late PutM from a non-holder is accepted | 2 | 5 | 5 | Race cross bins hit in both orders | Directed stress, formal on a small model, chicken bit |
R2 | New interconnect | A response can wait behind a request in a shared buffer | 3 | 5 | 3 | Watchdog timeouts per 10^4 seeds under buffer-starved profiles | Class-to-buffer review, reserved response slots |
R3 | New memory-model target | A load is not replayed when an Inv hits a speculatively read line | 3 | 4 | 4 | Litmus MP and CoRR forbidden-outcome counts | Litmus suite in simulation and emulation |
R4 | Power states | Power-down flush races a Fwd-GetM | 2 | 5 | 4 | Cross of flush state x incoming forward | Quiesce protocol review, directed test |
R5 | Chiplet boundary | Link-level retry duplicates an Inv-Ack | 2 | 5 | 3 | Duplicate-ack assertion antecedent count | Sequence numbers, link error injection |
R6 | Integration | Directory not initialised to U after reset | 4 | 3 | 1 | First boot test | Reset checklist |
R7 | Verification gap | Reference model lacks the O state used by the RTL | 4 | 3 | 2 | Scoreboard mismatches on O-state traffic | Extend the model before random regression |
L, I and D are illustrative 1 to 5 scores. R1 is the race of An Illustrative Escape on the course model (C0 evicts X in MI^A while C1's GetM is served three-hop); the register records it before silicon instead of after. The mechanisms behind the other rows are taught in A Protocol Deadlock, Load Replay on Snoop, A Power-Down Race and Coherence Across Dies.
Rank by the product likelihood x impact x detectability, the same shape as the risk priority number of failure mode and effects analysis (FMEA). Likelihood x impact alone ranks R6 above R1: a reset bug is likely and fairly bad, the race is unlikely. But R6 will be found on the first boot test whatever you do, while R1 will be found only if someone builds the exact timing. Detectability measures how much the risk depends on deliberate effort, and effort is what the register allocates. Ties break on impact, so a safety risk wins over a performance one.
RISKS = [ # id, likelihood, impact, detectability (5 = needs a targeted race or a proof)
("R1", 2, 5, 5), ("R2", 3, 5, 3), ("R3", 3, 4, 4), ("R4", 2, 5, 4),
("R5", 2, 5, 3), ("R6", 4, 3, 1), ("R7", 4, 3, 2),
]
def score(r, with_d=True):
_, l, i, d = r
return l * i * (d if with_d else 1)
def rank(risks, with_d=True):
return [r[0] for r in sorted(risks, key=lambda r: (-score(r, with_d), -r[2], r[0]))]
full = rank(RISKS)
assert full == ["R1", "R3", "R2", "R4", "R5", "R7", "R6"], full
# general claim: a risk at least as bad on every factor never ranks below another
for a in RISKS:
for b in RISKS:
if all(x >= y for x, y in zip(a[1:], b[1:])) and a != b:
assert full.index(a[0]) < full.index(b[0]), (a, b)
# in this register, every hard-to-detect safety risk (I = 5, D >= 4) ranks above every easy one (D <= 2)
hard = [r[0] for r in RISKS if r[2] == 5 and r[3] >= 4]
easy = [r[0] for r in RISKS if r[3] <= 2]
assert all(full.index(h) < full.index(e) for h in hard for e in easy)
# not a general law of L x I x D: a rare hidden safety race (L1, I5, D4) = 20 ranks below
# a likely, easily found safety bug (L5, I5, D2) = 50, which is why the impact-5 rule sits above the score
pair = [("Rx", 1, 5, 4), ("Ry", 5, 5, 2)]
assert [score(r) for r in pair] == [20, 50] and rank(pair) == ["Ry", "Rx"]
# failing case: likelihood x impact only buries the race below the obvious reset bug
li = rank(RISKS, with_d=False)
assert li.index("R6") < li.index("R1"), li
assert not all(li.index(h) < li.index(e) for h in hard for e in easy)
# mitigation moves the rank: a small-model proof of R1 lowers its detectability to 2
mitigated = [("R1", 2, 5, 2) if r[0] == "R1" else r for r in RISKS]
assert rank(mitigated).index("R1") > rank(mitigated).index("R7")
print("PASS: L x I x D ranks the hidden race first, L x I alone ranks the reset bug above it")The check asserts three things: the ranking itself, a dominance rule that any sound score must keep, and that, in this register, every hard-to-detect safety risk outranks every easily detected one. The broken ranking without detectability violates the last claim. The last claim is a property of these seven rows, not of the formula: a counterexample in the check shows a hidden race at (L1, I5, D4) = 20 ranking below an easy safety bug at (L5, I5, D2) = 50, which is why the impact-5 rule below sits above the score. The final step shows the register is live: once a proof exists, R1's detectability falls and the next risk gets the attention.
The score orders the work; it does not decide it. Two rules sit above it. Any risk with impact 5 needs a named mitigation whatever its rank, because silent data corruption is never an acceptable residual. And a risk leaves the register only when its indicator shows the evidence, for example R1's cross bins hit in both orders on runs the value checker passed, as defined in Closure Evidence.
The race. The tie breaks on impact: a race with impact 5 can corrupt data silently, while a performance shortfall can be measured and traded. The impact-5 rule also requires a named mitigation for the race regardless of score.