Answer each question out loud before opening it. If you miss more than three in the checkpoint, revisit the lessons linked at the end.
It adds the question of whether hardware faults in the field are detected: safety mechanisms become features, and fault injection measures diagnostic coverage against metrics per ASIL, with traceability and process evidence audited.
From a threat model, write it as something that must not happen (access, flow, timing, fault bypass), prove it where possible, track information flow, and attack the design with faults and fuzzing.
RTL simulation does not model metastability or synchroniser delay, so missing or wrong synchronisation passes; crossings are verified structurally first, then with protocol assertions.
Random programs run on the RTL and an ISS in lock-step, compared at every retired instruction; compliance suites as a gate; formal on the pipeline; OS boots on emulation; separate plans for interrupts, microarchitecture and multi-core ordering.
Layered oracles: bit-exact arithmetic units, kernels within a derived, scaled tolerance or bit-exact against a model of the hardware's order, networks by accuracy; tolerances validated with planted bugs.
Task. DCRouter is to be sold as automotive IP: 2 to 8 ports, FIFO depth 2 to 64, CRC optional, ASIL B. List what you would add to its verification plan, beyond what the course has already done.
Configuration: legal ranges checked in the RTL; a parameterised testbench; regress the extremes (2 and 8 ports, depth 2 and 64, CRC on and off) and every customer configuration; a pairwise covering array over representative values (including odd depths), random configurations nightly; formal on small instances. Safety: identify safety mechanisms (CRC on packets, parity on configuration registers, a watchdog on stuck grants), verify them functionally, and run fault-injection campaigns, including faults inside the mechanisms, to measure diagnostic coverage against ASIL B targets (SPFM at least 90%, LFM at least 60%); traceability from safety requirements to evidence; tool confidence. Sign-off: state which configurations the evidence covers and the measured safety metrics, with residual risk.
Safe, detected and dangerous.
50%: the 16 faults on the unprotected byte were dangerous, out of 32 data-bit faults.
Both deliberately introduce faults; mutation asks whether the testbench notices a design bug, fault injection whether the design notices a hardware failure.
Every architectural result was correct, yet data leaked through cache timing; correct results are not evidence of no leaks.
Its last values, as if it were still on, hiding isolation and retention bugs.
Simulation delivers all bits in the same cycle; in silicon they can resolve in different cycles.
Intermediate errors can be overwritten, and lock-step reports the first wrong instruction.
Floating-point addition is not associative; summing in a different order gives slightly different, equally correct results.
16, against 256 for every combination.
Otherwise it only exercises and checks one configuration.