How to specify and verify power-cycled SoCs for checking and coverage

Today's power-cycled SoC designs have power architectures that can be distressingly complex with multiple power domains that contain many power modes that require a thorough verification process.

By Thomas L. Anderson, John Decker, J. Marc Edwards, and Robert Juliano, Cadence Design Systems -- Electronic Business, 3/18/2008

The demand for more sophisticated power-management techniques is increasing rapidly as designers move to processes of 45 nm and smaller. The increasing effect of leakage current, the desire for lower package costs, the demand for longer battery life, and “green” legislation are all driving power lower. In today’s power-cycled systems-on-chip (PC-SoC), power is lowered by reducing or shutting off power to regions of the devices, known as power domains (PDs). First-generation PC-SoC designs have only a few PDs, but newer designs now under development will feature as many as twenty, producing numerous power modes.

The growth in the number of PDs leads to even more growth in the number of power-up and power-down transitions that must be verified before the chip is fabricated. Power-related bugs can be extremely serious, often with no software workarounds, so that the chip must be turned. Fortunately, five key technologies are available for effective power verification with automation that requires only half the time of traditional methods:

1. Power-definition markup languages (PDMLs)
2. Power-aware simulation
3. Structural power checks
4. Power-related assertions
5. Formal analysis of the power-control logic

Power-definition markup languages

PDMLs provide a way to specify the power architecture of a design independently of the RTL. The PDML specification includes power/ground connectivity and control, power shut-off behavior, and interactions between different PDs. The PDML file can be leveraged by many tools in the development flow, so that the intended power architecture can be implemented correctly and verified both before and after the implementation.

For example, consider a chip with three power domains:

• PD1 is the default domain for most of the chip, running at VDD1
• PD2 is a region running at VDD2 that can be powered down when not needed
• PD3 is a region that can be switched between VDD1 or VDD2

This power-down and power-up of PD2 is controlled by the POWER_OFF signal. When PD2 is turned off, all signals in the domain are logically floating, including the outputs. Since the floating signals cause unpredictable behavior in the system, inputs of modules connected to PD2 need to be protected. The solution is to isolate PD2’s outputs so that they present known good values to the connected inputs. This isolation is triggered by the ISOLATE signal.

This example chip has four possible power modes, corresponding to PD2 being on or off and PD3 at its two different voltages. As shown in Figure 1 (below), only three of these power modes are allowed. Also shown are the four (of the possible six) transitions allowed between these states.

Figure 1: Example chip showing allowed states and transitions
 

All of the power characteristics for the chip can be succinctly captured with PDML. Figure 2 (below) shows an example specification using the Si2 Common Power Format (CPF) standard. The specification first defines the four power domains as well as the signal (POWER_OFF) that powers down PD2 and then defines the isolation rules for the PD2 outputs that drive into the other power domains. By describing the isolation behavior in the PDML rather than in the RTL, the same RTL block can be used in different power domains and with different interface requirements. Finally, the CPF specification defines the different power modes and allowed transitions.

Figure 2: Example chip specification using the Si2 Common Power Format

Power-aware simulation

The PDML specification in Figure 2 is very valuable for chip verification. The second key technology is power-aware simulation, in which the RTL simulator reads and interprets the PDML so that it can model power-up and power-down behavior. In the example, when PD2 is powered down, the simulator can set all of the signals in the region to unknown and properly isolate PD2’s outputs. If the design contains bugs causing power-down at incorrect times, simulation tests will fail due to the modeling of the powered-down logic. The simulator can also create and track power-related functional coverage points, for example, that all allowed states and transitions are exercised.

A power-aware simulator can also perform checks to ensure proper response to power events, such as whether a PD is powered down only after its outputs have been isolated. In fact, there are a number of checks that should be performed:

• Detect illegal modes and transitions
• Ensure proper sequencing of power control signals
• Model the power shut-off behavior
• Ensure proper level shifter insertion between power domains of different voltages
• Ensure proper isolation of signals coming from power shutoff regions

Structural power checks and power-related assertions

Some of the checks in this list are static structural checks, the third key technology for power verification. Structural checks can be performed as the power architecture is being modeled. Other checks must be performed dynamically during simulation, and these are best implemented using assertions, the fourth key technology. Many control functions and timing relationships specified in the PDML can be automatically transformed into assertions using a standard format such as SystemVerilog Assertions (SVA) or Property Specification Language (PSL).

The PDML shown in Figure 2 can be used to generate many assertions, such as the following SVA assertion that isolation must occur before power shut-down of PD2:

iso_before_pso : assert property @(POWER_OFF) (ISOLATE = 1’b1));

Formal analysis of the power-control logic

Monitoring these power-related assertions in simulation is critical to detect errors in the power implementation, but it is possible that the set of tests will not exercise all important power behavior. It is very beneficial to supplement simulation with formal analysis, the final key technology for power verification. Formal analysis is exhaustive in nature, so it can find every bug related to the power assertions and, after the bugs are fixed, verify completely that none of the assertions can ever be violated.

In summary, today’s PC-SoC designs have power architectures that can be distressingly complex. Multiple power domains with many power modes require a thorough verification process. The five technologies described in this article – PDML specification, power-aware simulation, structural power checks, power-related assertions, and formal analysis of the power-control logic – provide excellent checking and coverage while saving half of the power verification time. These technologies are at the core of an effective power-verification methodology, ensuring that low-power design produces high-confidence chips.

Tom Anderson is a product marketing director, John Decker is an architect, J. Marc Edwards is a technical leader, and Robert Juliano is a senior technical lead at Cadence Design Systems.