Every quasi-static signal carries the same proof obligation: stable before use. Whoever claims the signal is static must show what enforces the stability and what would catch it if the enforcement broke. An obligation nobody writes down is an obligation nobody meets.

The obligation, stated plainly

For each quasi-static signal, name the stability window (reset, a named mode, a stopped clock), the enforcer (gated write, mode machine, stopped clock), and the observer (the assertion or check that fires if the signal moves inside the window). A row missing any of the three is incomplete.

Asserting it

The stability property is a one-line assertion: while the consumer is active, the value must not change. It costs almost nothing and catches exactly the failure that matters, a write path that fires when it should not.

1
2
3
4
5
6

// snippet
// the live configuration must hold still whenever the datapath uses it
property p_cfg_stable;
  @(posedge clk_d) use_enable |-> $stable(cfg_live);
endproperty
a_cfg_stable : assert property (p_cfg_stable);

The matching simulation check scrambles the writable (shadow) copy while use_enable is high and confirms the live copy and the outputs do not move. Together the assertion and the test cover both directions: the live value never changes in use, and writes outside the window cannot leak through.

What the review looks for

The reviewer reads the obligation table, not the intent comment. “Static configuration” in a comment proves nothing; a named window with an enforcer and an observer proves the claim was taken seriously. Signals without all three get synchronisers, not trust.

Related topics

• Static by Construction

• Constraints and Waiver Hygiene