Power Gating, Isolation, and Retention Verification Case Study

02 · State and power

Power Gating, Isolation, and Retention

Verify that a powered-down island is isolated safely, its retained state survives, volatile state resets, and the surrounding NoC never consumes X-state traffic.

Mechanism · failure · evidence · recovery

Power-state contractIsolate first, power down second; restore before reconnecting.

The checker correlates the power controller, isolation boundary, retained state, volatile state, and externally visible outputs across every legal transition.

01Isolateclamp outputs02Savecapture retained state03Power offisland may become X04Power onwait for pwr_good05Restorereload retained state06Releaseremove isolation

Always-on domainPower controllerisolate · save · gate · restoreIsolation boundarySAFE_CLAMPblocks X propagationSwitchable islandretained + volatile stateOFF

!pwr_good → isolated outputs equal the specified clamp value · retained state returns only after restore

Why it matters

SoCs remove power from idle GPU, NPU, and other islands while the rest of the chip remains active.
Isolation must prevent an unpowered block's floating or unknown outputs from contaminating live logic.
Retention registers must preserve architectural state so the block can resume without a full cold boot.

What is difficult

Powered-down outputs can become X and poison monitors, scoreboards, or neighboring logic.
The testbench must distinguish volatile state that resets from retention state that remains powered.
Power-up includes a recovery interval in which clocks or power may be present but traffic is not yet valid.
A logic-only power model is fast but cannot prove the implementation of physical isolation and level-shifter cells.

Failure signatures

An output is not clamped while its source island is off.
A monitor samples X-state traffic and corrupts checking state.
The RAL model resets retention mirrors even though silicon retained the values.
A scoreboard clears transactions that should pause across a legal sleep interval.
A dirty power-down during a burst hangs the shared NoC.
Traffic resumes before Reset-Done or Initialization-Complete.

Two viable approaches—and their cost

UPF-aware simulation

Inject Unified Power Format intent so the simulator models supply states, isolation, retention, and level shifting.

Strengths

Most realistic representation of implementation power intent.
Can expose physical isolation, retention, and level-shifter integration bugs.

Costs

Adds significant simulation cost.
Requires labor-intensive power-intent setup.
X-propagation failures can be difficult to debug.

Power-aware UVM agent

Use power-status sidebands to pause sampling and apply explicit retention-versus-volatile model policy.

Strengths

Runs quickly in ordinary logic simulation.
Lets each agent and RAL block define its power-state behavior explicitly.
Prevents expected off-state X values from corrupting the scoreboard.

Costs

Depends on the accuracy of the testbench power model and sideband signals.
Cannot detect a missing or incorrectly connected physical isolation cell by itself.

Interview answer, built from the mechanism

Focus on the isolation-retention boundary. A power-aware monitor gates functional transaction decoding as soon as the island turns off, while boundary assertions continue observing clamp values and legal power sequencing.
Use assertions or UPF-aware simulation to prove that outputs are clamped to their required safe values while the island is unavailable.
Split the RAL model into volatile and retention regions. Reset volatile mirrors during a power cycle while leaving retention mirrors untouched.
After power-up, enforce a blanking window until Reset-Done or Initialization-Complete, then compare retained state and resume paused flow.

Component responsibility contract

Component responsibilities and required verification changes for Power Gating, Isolation, and Retention
Component	Responsibility	Required change
Monitor	Isolation awareness	Gate functional transaction publication when pwr_good is low, but keep power-state and clamp observation active.
RAL model	State preservation	Define retention fields and bypass their reset during power cycles.
Scoreboard	Flow control	Pause during power-down without clearing transactions that must survive.
Assertions or UPF	Clamp proof	Check every island output reaches its specified safe value while off.

Implementation patterns

Gate functional sampling while keeping boundary proof activesystemverilog

task power_aware_monitor::run_phase(uvm_phase phase);
  forever begin
    @(posedge vif.clk);

    if (!vif.pwr_good) begin
      handle_power_down_cleanup();
      wait (vif.pwr_good);
      wait (vif.init_complete);
    end
    else if (vif.valid && vif.ready) begin
      sample_transaction();
    end
  end
endtask

The functional monitor uses the externally visible availability contract to decide when transactions are meaningful. Separate always-on assertions continue checking isolation clamps and power sequencing throughout the off interval.

Reset volatile mirrors and preserve retentionsystemverilog

virtual function void update_ral_mirror(bit power_up);
  if (power_up) begin
    reg_model.volatile_block.reset("POWER");
    // reg_model.retention_block remains unchanged.
  end
endfunction

The model applies power-cycle defaults only to state that silicon actually loses.

Prove off-state output clampssystemverilog

property p_outputs_clamped_while_off;
  @(posedge aon_clk) disable iff (!por_n)
    !pwr_good |-> (island_outputs == SAFE_CLAMP_VALUE);
endproperty

assert property (p_outputs_clamped_while_off);

An always-on clock observes the boundary and proves that an unavailable island cannot drive an unsafe value into live logic.

Stress recipe

Start a multi-beat transfer, remove island power before the final beat, and prove that isolation prevents X propagation.
Check every output's required 0 or 1 clamp value throughout the off interval.
Write distinct patterns into volatile and retention registers before sleep, then compare both classes after wake.
Vary the blanking interval and reject all traffic until Reset-Done or Initialization-Complete.
Run the fast power-aware UVM checks in broad regressions and use UPF-aware tests for structural signoff scenarios.

Follow-up questions

How do you verify isolation cells specifically?

Use SVA or UPF-aware checks to require the specified clamp value on every island output whenever the power-gate state says the island is unavailable, independent of its internal logic.

How do you handle X-state on the bus during power-up?

Apply a monitor blanking window for a defined number of cycles and keep sampling disabled until Reset-Done or Initialization-Complete proves that the interface is valid.

What is a dirty power-down test?

Remove power in the middle of a burst. Verify immediate isolation, legal handling of the interrupted transaction, and continued progress on the global NoC.