Power Gating, Isolation, and Retention

Mechanism and evidence

Guided verification lab

Contain the boundary before removing power.

Inspect the relationship between isolation, retained state, supply, and functional checking.

STEP THROUGH

STATE & OBSERVATIONOrdered power cycle / 1 of 6

Checkpoint 1 · Isolate the island.

ISOLATION: 1
POWER GOOD: 1
STATE: clamped
FUNC. SAMPLE: 1

Compare all 6 checkpoints

1 · Isolate the island.
ISOLATION
1
POWER GOOD
1
STATE
clamped
FUNC. SAMPLE
1
2 · Save only the retained state.
ISOLATION
1
POWER GOOD
1
STATE
saved
FUNC. SAMPLE
1
3 · Power is off; boundary checking continues.
ISOLATION
1
POWER GOOD
0
STATE
off
FUNC. SAMPLE
0
4 · Supply returns under isolation.
ISOLATION
1
POWER GOOD
1
STATE
unready
FUNC. SAMPLE
0
5 · Restore and initialize.
ISOLATION
1
POWER GOOD
1
STATE
restored
FUNC. SAMPLE
0
6 · Release the boundary and resume.
ISOLATION
0
POWER GOOD
1
STATE
ready
FUNC. SAMPLE
1

Inspect the contract

Isolate the island.

Isolation: On
Supply: On

Assert the boundary clamp before power changes. Downstream logic must observe the specified safe value.

Evidence to inspect

Observe isolation enable and the output clamp independently.

Checkpoint 1 / 6

Inspect the checker Selected checkpoint pseudocode

Conceptual checker / selected checkpoint

isolation = 1;
assert(boundary_out == 0);

Example contract & limitations

Example contract. Isolation clamps this example’s output to zero. Retained state is saved/restored; volatile state is initialized. Functional sampling pauses while powered off, but always-on boundary checks remain active. Checkpoints show selected state changes, not equally spaced simulation cycles.

Read the complete walkthrough

Ordered power cycle

Isolate the island.. Assert the boundary clamp before power changes. Downstream logic must observe the specified safe value. Evidence: Observe isolation enable and the output clamp independently.
Save only the retained state.. Capture the specified retention set. Do not treat every register as retained. Evidence: Compare the retention image to the retention specification.
Power is off; boundary checking continues.. Stop functional sampling from the island. Always-on monitors still verify clamping. Evidence: A disabled functional monitor must not disable the isolation checker.
Supply returns under isolation.. Wait for power-good while holding the boundary clamp. The internal state is not ready for use. Evidence: Observe power-good without treating it as functional readiness.
Restore and initialize.. Restore retained state and initialize volatile state before declaring the island ready. Evidence: Compare both retained values and volatile reset defaults.
Release the boundary and resume.. After readiness, release isolation and restart functional checking. An earlier violation remains in the test result. Evidence: Check first functional transaction and the complete power-cycle history.

Release isolation early

Isolate the island.. Assert the boundary clamp before power changes. Downstream logic must observe the specified safe value. Evidence: Observe isolation enable and the output clamp independently.
Save only the retained state.. Capture the specified retention set. Do not treat every register as retained. Evidence: Compare the retention image to the retention specification.
Power is off; boundary checking continues.. Stop functional sampling from the island. Always-on monitors still verify clamping. Evidence: A disabled functional monitor must not disable the isolation checker.
Early release exposes unready state.. Isolation releases at power-good before retention restore and initialization have completed. This violates the example sequence; the faulty controller leaves isolation released through restore. Evidence: Check the release edge against restore_done and init_done.
Restore and initialize.. Restore retained state and initialize volatile state before declaring the island ready. Evidence: Compare both retained values and volatile reset defaults.
Release the boundary and resume.. After readiness, release isolation and restart functional checking. An earlier violation remains in the test result. Evidence: Check first functional transaction and the complete power-cycle history.

Related implementation: Gate functional sampling while keeping boundary proof active

task power_aware_monitor::run_phase(uvm_phase phase);
  forever begin
    @(posedge vif.clk);

    if (!vif.pwr_good) begin
      handle_power_down_cleanup();
      wait (vif.pwr_good);
      wait (vif.init_complete);
    end
    else if (vif.valid && vif.ready) begin
      sample_transaction();
    end
  end
endtask

The functional monitor uses the externally visible availability contract to decide when transactions are meaningful. Separate always-on assertions continue checking isolation clamps and power sequencing throughout the off interval.

Ordered power cycle, checkpoint 1: Isolate the island.. Inspect the contract.

Understand the failure

Power-state contractIsolate first, power down second; restore before reconnecting.

The checker correlates the power controller, isolation boundary, retained state, volatile state, and externally visible outputs across every legal transition.

01Isolateclamp outputs02Savecapture retained state03Power offisland may become X04Power onwait for pwr_good05Restorereload retained state06Releaseremove isolation

Always-on domainPower controllerisolate · save · gate · restoreIsolation boundarySAFE_CLAMPblocks X propagationSwitchable islandretained + volatile stateOFF

!pwr_good → isolated outputs equal the specified clamp value · retained state returns only after restore

Isolation-retention boundary

Power status controls what the live system may observe, what state is retained, and when checking may resume.

Power controller: Drives power-gate intent and reports pwr_good.
Power island: Contains volatile logic plus retention registers.
Isolation clamp: Forces each boundary output to a safe 0 or 1 while off.
Power-aware monitor: Gates functional samples during off and blanking windows while boundary assertions remain active.
RAL model: Resets volatile mirrors and preserves retained mirrors.
Live NoC and scoreboard: Remain operational and pause affected flow without consuming X.

Power controller -> Power island
Power controller -> Power-aware monitor
Power island -> Isolation clamp -> Live NoC and scoreboard
Power-aware monitor -> Live NoC and scoreboard
Power controller -> RAL model

Why it matters

SoCs remove power from idle GPU, NPU, and other islands while the rest of the chip remains active.
Isolation must prevent an unpowered block's floating or unknown outputs from contaminating live logic.
Retention registers must preserve architectural state so the block can resume without a full cold boot.

What is difficult

Powered-down outputs can become X and poison monitors, scoreboards, or neighboring logic.
The testbench must distinguish volatile state that resets from retention state that remains powered.
Power-up includes a recovery interval in which clocks or power may be present but traffic is not yet valid.
A logic-only power model is fast but cannot prove the implementation of physical isolation and level-shifter cells.

Failure signatures

An output is not clamped while its source island is off.
A monitor samples X-state traffic and corrupts checking state.
The RAL model resets retention mirrors even though silicon retained the values.
A scoreboard clears transactions that should pause across a legal sleep interval.
A dirty power-down during a burst hangs the shared NoC.
Traffic resumes before Reset-Done or Initialization-Complete.

Compare approaches

Two viable approaches—and their cost

UPF-aware simulation

Inject Unified Power Format intent so the simulator models supply states, isolation, retention, and level shifting.

Strengths

Most realistic representation of implementation power intent.
Can expose physical isolation, retention, and level-shifter integration bugs.

Costs

Adds significant simulation cost.
Requires labor-intensive power-intent setup.
X-propagation failures can be difficult to debug.

Power-aware UVM agent

Use power-status sidebands to pause sampling and apply explicit retention-versus-volatile model policy.

Strengths

Runs quickly in ordinary logic simulation.
Lets each agent and RAL block define its power-state behavior explicitly.
Prevents expected off-state X values from corrupting the scoreboard.

Costs

Depends on the accuracy of the testbench power model and sideband signals.
Cannot detect a missing or incorrectly connected physical isolation cell by itself.

Explain it in an interview

Interview answer, built from the mechanism

Focus on the isolation-retention boundary. A power-aware monitor gates functional transaction decoding as soon as the island turns off, while boundary assertions continue observing clamp values and legal power sequencing.
Use assertions or UPF-aware simulation to prove that outputs are clamped to their required safe values while the island is unavailable.
Split the RAL model into volatile and retention regions. Reset volatile mirrors during a power cycle while leaving retention mirrors untouched.
After power-up, enforce a blanking window until Reset-Done or Initialization-Complete, then compare retained state and resume paused flow.

Assign responsibilities

Component responsibility contract

Component responsibilities and required verification changes for Power Gating, Isolation, and Retention
Component	Responsibility	Required change
Monitor	Isolation awareness	Gate functional transaction publication when pwr_good is low, but keep power-state and clamp observation active.
RAL model	State preservation	Define retention fields and bypass their reset during power cycles.
Scoreboard	Flow control	Pause during power-down without clearing transactions that must survive.
Assertions or UPF	Clamp proof	Check every island output reaches its specified safe value while off.

Build the checker

Implementation patterns

Gate functional sampling while keeping boundary proof activesystemverilog

task power_aware_monitor::run_phase(uvm_phase phase);
  forever begin
    @(posedge vif.clk);

    if (!vif.pwr_good) begin
      handle_power_down_cleanup();
      wait (vif.pwr_good);
      wait (vif.init_complete);
    end
    else if (vif.valid && vif.ready) begin
      sample_transaction();
    end
  end
endtask

Reset volatile mirrors and preserve retentionsystemverilog

virtual function void update_ral_mirror(bit power_up);
  if (power_up) begin
    reg_model.volatile_block.reset("POWER");
    // reg_model.retention_block remains unchanged.
  end
endfunction

The model applies power-cycle defaults only to state that silicon actually loses.

Prove off-state output clampssystemverilog

property p_outputs_clamped_while_off;
  @(posedge aon_clk) disable iff (!por_n)
    !pwr_good |-> (island_outputs == SAFE_CLAMP_VALUE);
endproperty

assert property (p_outputs_clamped_while_off);

An always-on clock observes the boundary and proves that an unavailable island cannot drive an unsafe value into live logic.

Stress the design

Stress recipe

Start a multi-beat transfer, remove island power before the final beat, and prove that isolation prevents X propagation.
Check every output's required 0 or 1 clamp value throughout the off interval.
Write distinct patterns into volatile and retention registers before sleep, then compare both classes after wake.
Vary the blanking interval and reject all traffic until Reset-Done or Initialization-Complete.
Run the fast power-aware UVM checks in broad regressions and use UPF-aware tests for structural signoff scenarios.

Follow-up questions

How do you verify isolation cells specifically?

Use SVA or UPF-aware checks to require the specified clamp value on every island output whenever the power-gate state says the island is unavailable, independent of its internal logic.

How do you handle X-state on the bus during power-up?

Apply a monitor blanking window for a defined number of cycles and keep sampling disabled until Reset-Done or Initialization-Complete proves that the interface is valid.

What is a dirty power-down test?

Remove power in the middle of a burst. Verify immediate isolation, legal handling of the interrupted transaction, and continued progress on the global NoC.

Engineering qualifications