AMBA AXI · Module 20

AXI Integration Checklist

A sign-off checklist for wiring AXI into an interconnect/SoC — address map (no overlap, decode coverage), ID width and remapping, clock-domain crossings, reset sequencing, interrupts, outstanding/QoS across the fabric, and the system-level deadlock and bring-up checks that integration requires beyond a correct, verified block.

The design (20.1) and verification (20.2) checklists confirm a block is correct and proven. This one confirms the block is correctly wired into the system — the integration sign-off. A block that's perfect in isolation can still break when connected: a wrong address-map entry, a missing clock-domain bridge, a mis-sequenced reset, an ID collision, or an interconnect that deadlocks under mixed traffic. The AXI integration checklist is the sign-off list for wiring AXI into an interconnect/SoC, confirming the system-level concerns the block-level checklists don't cover. It operationalizes Modules 12 (interconnect) and 14 (CDC/reset) plus the integration case study (19.6) into a checklist, organized into address-map, physical-glue, fabric, and bring-up categories.

1. Address Map: Decode, Overlap, and ID Width

The first category is the address map and IDs — how transactions are routed. Confirm: every master can reach every slave it needs to (decode coverage); the address regions don't overlap (no aliasing) and the decode is total (unmapped → DECERR, not silent); each slave's region is sized for its space; and the ID width and remapping are correct — the interconnect appends source bits so multi-master IDs don't collide, and strips them on return (responses go to the right master with the right ID). The check is that the system address map is complete, non-overlapping, and decodes totally, and that ID remapping preserves each master's view — the foundation of correct routing.

Figure 1 — the address-map and ID checklist. Confirm decode coverage (every master reaches the slaves it needs), no overlapping regions (no aliasing), total decode (unmapped → DECERR, not silent), each slave sized for its space, and correct ID width + remapping (append source bits so multi-master IDs don't collide; strip on return so responses reach the right master with the right ID). The system address map must be complete, non-overlapping, and total-decoding, and ID remapping must preserve each master's view — the foundation of correct routing.

2. Physical Glue: Clocks, Resets, Interrupts

The second category is the physical glue — the connections beyond the AXI data path. Confirm: clock-domain crossings — every AXI link that crosses a clock domain uses a proper async-FIFO CDC bridge (14.2), no direct multi-bit crossing; reset sequencing — resets connected and sequenced correctly across the fabric and endpoints (14.3), no block left undefined, clean release; and interrupts — each peripheral's interrupt wired to the controller with the right number/priority, and the driver clears it correctly (W1C). These are the same integration-glue items as the peripheral-integration case study (19.6), confirmed at the system level: a missing CDC bridge causes intermittent corruption, a mis-sequenced reset an undefined startup, a misrouted interrupt a dead handler — all classic integration bugs.

Figure 2 — the physical-glue checklist: clocks, resets, interrupts. Confirm clock-domain crossings (every cross-domain AXI link uses a proper async-FIFO CDC bridge, no direct multi-bit crossing — 14.2); reset sequencing (resets connected and sequenced across fabric and endpoints, no block undefined, clean release — 14.3); and interrupts (each wired to the controller with the right number/priority, cleared correctly by the driver via W1C). These are the integration-glue items (19.6) at system level: a missing CDC bridge → intermittent corruption, a mis-sequenced reset → undefined startup, a misrouted interrupt → dead handler.

3. Fabric: Outstanding, QoS, and Deadlock

The third category is the fabric-level behavior — properties that emerge only from the system, not any single block. Confirm: outstanding depth is provisioned end-to-end (the path's outstanding support meets the bandwidth-delay product, so masters don't starve — 13.3); QoS/arbitration balances mixed traffic (latency-critical CPU vs. throughput DMA, so neither starves — 12.4); deadlock-freedom — no cross-channel/cross-path dependency cycle (response paths sized to worst-case outstanding, channels independent, acyclic routing — 17.7); and width conversion points handle the data correctly. These are composition-level properties the block checklists can't see — a deadlock from undersized buffering or a starved master under contention emerges only when blocks are wired together, so they must be confirmed at integration.

Figure 3 — the fabric-level checklist: outstanding, QoS, deadlock. Confirm outstanding depth provisioned end-to-end (meets the bandwidth-delay product so masters don't starve — 13.3); QoS/arbitration balances mixed traffic (latency-critical CPU vs. throughput DMA, neither starves — 12.4); deadlock-freedom (no cross-channel/cross-path cycle — response paths sized to worst-case outstanding, channels independent, acyclic routing — 17.7); and correct width-conversion points. These composition-level properties emerge only from the wired system, invisible to block checklists, so they must be confirmed at integration.

4. Bring-Up and the Composition Principle

The final category is the bring-up sequence that verifies the integration end-to-end, simplest-first (19.6): address decode (each endpoint's ID register reads, no DECERR) → register access (CSRs work through the fabric) → reset/clock (clean startup across domains) → data path (transactions traverse the fabric correctly) → interrupts (events reach handlers) → system traffic (mixed masters run without deadlock or starvation). The composition principle behind it: locally-correct blocks can still fail in composition (deadlock, ordering, starvation, glue bugs), so integration sign-off confirms the system-level properties — the block checklists prove each piece, the integration checklist proves they work together.

Figure 4 — the integration bring-up sequence and the composition principle. Bring-up simplest-first (19.6): address decode (ID reads, no DECERR) → register access through the fabric → reset/clock clean startup → data path traverses correctly → interrupts reach handlers → system traffic (mixed masters, no deadlock/starvation). The principle: locally-correct blocks can still fail in composition (deadlock, ordering, starvation, glue), so integration sign-off confirms the system-level properties the block checklists can't — design/verification checklists prove each piece, the integration checklist proves they work together.

5. Common Misconceptions

Myths to unlearn

"If each block is verified, the system works." Locally-correct blocks can still fail in composition — deadlock from undersized buffering, ordering across reconvergent paths, a starved master under contention, glue bugs (CDC, reset, address map). Integration sign-off confirms the system-level properties the block checklists can't see.
"Integration is just connecting AXI ports." It's also the address map (decode, overlap, total decode), ID remapping, clock/reset glue, interrupts, and fabric properties (outstanding, QoS, deadlock) — and most integration bugs are in those, not the port connection. The protocol is the easy part.
"A correct address map just needs no overlaps." It needs no overlap and total decode (unmapped → DECERR, not silent) and decode coverage (every master reaches its slaves) and correct slave sizing. A gap that silently does nothing, or a master that can't reach a slave, are both address-map failures beyond overlap.
"Deadlock can't happen if every block follows the protocol." System-level dependency cycles (a response path in a loop, undersized response buffering, cyclic routing) can deadlock a system of individually-compliant blocks — channel independence at each port doesn't prevent a fabric-level cycle. Deadlock-freedom is a composition property to confirm at integration.
"QoS is an optimization, not a sign-off item." On a shared fabric with mixed traffic (CPU + DMA), without QoS the throughput DMA can starve the latency-critical CPU (or vice versa) — a real failure, not just suboptimal. Balancing mixed traffic is a required integration check.
"CDC and reset are handled by the blocks." Whether an AXI link crosses a clock domain, and how resets are sequenced across the fabric, are system decisions made at integration — a block correct in its own domain still needs a CDC bridge when wired across domains, and reset sequencing is a system-level property. These are integration-checklist items.

6. Debugging Insight

🔍 Debugging insight — a system bug that block-level checks passed is an integration-checklist item

When the system fails but the individual blocks were verified, the bug is in integration — and the symptom maps to a checklist category:

A peripheral is unreachable (DECERR) or aliases another. Address-map category — wrong base, overlap, or incomplete decode. Check the system address map and the decoder configuration.
Intermittent corruption across a link. Physical-glue (CDC) — a clock-domain crossing without a proper async-FIFO bridge. Check which links cross domains and whether they have CDC bridges.
Undefined behavior at startup. Physical-glue (reset) — reset not sequenced correctly across the fabric/endpoints. Check the reset wiring and sequencing.
System deadlocks under load. Fabric category — a dependency cycle (undersized response buffering, cyclic routing). Apply the deadlock method (17.7): build the wait-for graph, find the cycle, break it (size buffers, ensure channel independence/acyclic routing).
A master starves under contention. Fabric (QoS) — mixed traffic without balanced arbitration, the latency-critical master stuck behind a throughput master. Check the interconnect QoS/arbitration.
Throughput far below expected. Fabric (outstanding) — outstanding depth not provisioned end-to-end across the fabric (Little's Law gap at some hop). Check the path's outstanding support.

The diagnostic key: a system failure on individually-verified blocks is always an integration issue — address map, glue (CDC/reset/interrupt), or fabric (outstanding/QoS/deadlock) — so the integration checklist is the debug taxonomy for system bring-up. The block checklists rule out the blocks; the integration checklist localizes the composition failure.

7. Verification Insight

✅ Sign-off insight — integration sign-off confirms the system-level properties blocks can't, where composition bugs live

The AXI integration checklist is the sign-off for composition — confirming that correct, verified blocks are correctly wired together, which is a distinct concern from the blocks themselves and where a major class of bugs lives. It operationalizes the interconnect (12), CDC/reset (14), and integration (19.6) material into categories: address map + IDs (decode coverage, no overlap, total decode → DECERR, slave sizing, ID width/remapping), physical glue (CDC bridges on cross-domain links, reset sequencing, interrupt wiring/clearing), fabric (outstanding provisioned end-to-end, QoS balancing mixed traffic, deadlock-freedom, width conversion), and bring-up (the simplest-first sequence: decode → register access → reset/clock → data path → interrupts → system traffic). The governing principle is that locally-correct blocks can fail in composition — deadlock from undersized buffering, ordering across reconvergent paths, starvation under contention, and the glue bugs (address map, CDC, reset, interrupt) — so integration sign-off exists to confirm the system-level, emergent properties that no block checklist can see: a single port being deadlock-free doesn't make the fabric deadlock-free; a block correct in its domain still needs a CDC bridge across domains; a correct slave is unreachable with a wrong address map. Three disciplines: (1) Confirm decode coverage, not just no-overlap — the address map must be complete (every master reaches its slaves), non-overlapping (no aliasing), and total (unmapped → DECERR), since gaps and unreachability are as broken as overlaps. (2) Treat CDC, reset, and deadlock as system properties — whether a link crosses domains, how resets sequence across the fabric, and whether the composed dependency graph is acyclic are integration decisions, not block properties, and are the highest-impact glue/fabric items. (3) Bring up simplest-first — the decode → register → reset → data → interrupt → system-traffic sequence localizes any integration failure to its category, and the integration checklist doubles as the bring-up debug taxonomy (a system bug on verified blocks is always address-map, glue, or fabric). The meta-lesson, completing the checklist trilogy (design, verification, integration): a working system requires three separate sign-offs — each block designed right (20.1), each block proven right (20.2), and the blocks wired right (20.3) — because correctness composes only if the composition itself is correct, and the integration checklist is how the composition is systematically confirmed. A system that passes all three is one where the pieces are correct, proven, and demonstrably work together — which is what real system sign-off requires, and which is why integration is its own checklist rather than an assumed consequence of correct blocks. Next, the checklists turn from building systems to the engineer's own readiness: the last-mile interview revision list.

8. Interview Questions

9. Summary

The AXI integration checklist is the sign-off for composition — confirming verified blocks are correctly wired together, a concern distinct from the blocks themselves and where a major bug class lives. It operationalizes the interconnect (12), CDC/reset (14), and integration (19.6) material into four categories. Address map + IDs: decode coverage (every master reaches its slaves), no overlap (no aliasing), total decode (unmapped → DECERR), slave sizing, and ID width/remapping (append/strip so multi-master IDs don't collide). Physical glue: CDC bridges on every cross-domain link, reset sequencing across the fabric, interrupt wiring/clearing. Fabric: outstanding provisioned end-to-end (no starvation), QoS balancing mixed traffic (CPU vs. DMA), deadlock-freedom (sized buffers, independent channels, acyclic routing), width conversion. Bring-up: simplest-first (decode → register access → reset/clock → data path → interrupts → system traffic), which doubles as the integration debug taxonomy.

The governing principle: locally-correct blocks can fail in composition — deadlock, ordering across reconvergent paths, starvation, and glue bugs (address map, CDC, reset, interrupt) are emergent, composition-level properties no block checklist can see (a single deadlock-free port doesn't make a deadlock-free fabric; a block correct in its domain still needs a CDC bridge across domains). The disciplines: confirm decode coverage (not just no-overlap), treat CDC/reset/deadlock/QoS as system properties, and bring up simplest-first to localize failures. The meta-lesson completes the checklist trilogy: a working system requires three separate sign-offs — designed right (20.1), proven right (20.2), wired right (20.3) — because correctness is hierarchical (components correct and composition correct and emergent properties correct), and you cannot verify a system by verifying its components alone. Composition bugs only exist at the system level and only manifest under the interactions integration testing creates, so integration is its own discipline. Next, the checklists turn to the engineer's own readiness: the last-mile interview revision list.

10. What Comes Next

You can now sign off integration; next, your own interview readiness:

20.4 — AXI Interview Checklist (coming next) — a last-mile revision list before an AXI interview, distilling the must-know points into a final pre-interview pass.

Previous: 20.2 — AXI Verification Checklist. Related: 12.3 — Decode & Address Map for the address-map items, 14.2 — Asynchronous Bridges for CDC, and 17.7 — Debugging Deadlock for the fabric deadlock-freedom check.