Reconvergence returns through small edits: someone synchronises a second copy “for convenience”, adds a qualifier path, or re-times a pulse. Regression guards make each of those edits fail fast, in simulation or in review, before the next signoff round.
Guard | What it catches |
|---|---|
Held-data stability assertion on every qualified bundle | Any new writer or re-timed window that moves the bus under an armed qualifier |
One-pulse-per-transfer check on load and strobe paths | Merged or doubled pulses after stage changes |
Scoreboard pairing of message with meaning (mode with start, data with valid) | Stale-meaning captures, the exact symptom of the worked example |
Convergence-point inventory as a checked-in list | A new separately synchronised copy of an already-crossed source shows up as an unlisted meeting |
Every new synchroniser instantiation names its source event and lists the signals already crossing from that event; a second crossing of the same event needs a written reason.
Every qualifier or strobe carries its stability argument (protocol, window, assertion) in the same change, not as follow-up work.
Structural CDC analysis runs on every change touching a crossing, not only at milestones; reconvergence findings block the change.
The finding tracker stays linked: fixed findings keep their evidence, so a reintroduced pattern matches a known history.
The review rule (a second crossing of the same source event needs a written reason) and, if the tap fans into destination logic, the convergence-point inventory. If the tap is purely observational to a register the tools can see is a dead end for logic, that evidence closes it.