A novel performance efficient software EDA product for automation of low power silicon product engineering and auto verification of critical power and performance KPIs and associated bug discovery, resolution and low-power coverage closure making use of advanced query APIs of UPF 3.0 and RTL and low power design information extraction through simulation database

1. Leveraging UPF-Extracted Checkers using UPF
Query Functions for Verifying Power Intent of
Memory Controller
Ramesh Kumar Sellamuthu
HSS & SoC DV
Soham Mondal
Samsung Semiconductor India Research
Bangalore, India
ramesh.srk@samsung.com
HSS& SoC DV
Samsung Semiconductor India Research
Bangalore, India
sl.mondal@samsung.com
II. PoWER INTENTSPECIFICATION AND BASIC POWER
Abstract-The increasing demand to make silicon more
energy eff+cient has resulted in the usage of advanced and
complex power management techniques. Usage of low power
assertions which adhere to power control logic sequences leads
to a disadvantage of breakage of assertions or checkers every
time the power intent changes. One automated way of
generating these checkers and assertions through UPF query
functions provides considerable immunity to change in the
power intent of the architecture. In this paper we attempt to
provide a holistic verification flow of low power design through
passing of queried objects to generic checkers and binding them
to design and also through generic custom low level assertions
for verifying micro-architectural power intent.
ELEMENTS
4. UPF
IEEE Std. 1801-2015 Unified Power Format (UPF) allows
designers to specify the power intent of the design. It is based
on TclL language and provides methodology and command
flow to describe power intent of architecture. UPF 3.0+ also
have provision to query power objects from design which can
be leveraged for verification usage. Some of the most
important terminology and power elements are discussed
below.
B. Power Domain
Keywords- Low power verification, Power intent verification,
Assertions, Checkers, UPF Query Functions
A collection of HDL module instances and/or macro cells
that share the same supply requirements are grouped together
and termed as a single power domain. Generally, this
grouping/or aggregation of modules into power domains are
done on the basis of power/or voltage source. The instances of
a power domain typically, but do not always, share a primary
supply set and typically are all in the same power state at a
given time.
I. INTRODUCTION
As electronic systems are getting complex, power and heat
dissipation are becoming ever more important. There is an
increasing demand to reduce the power dissipation and offer
energy-efficient chips. This has resulted in the use of highly
sophisticated power management architectures. It has become
extremely important to verify the high level and low level
power intent of the power management architecture, to verify
functionality of power elements, clock gating, power gating
and dynamic voltage frequency scaling. In this work, we try
to highlight the challenges in custom assertion based low-
power verification and propose a methodology and a holistic
approach to verify all power aspects of design through both
the usage of UPF query functions and binding of generic
checkers to the queried objects as well as custom assertions to
verify micro-architectural power flow. By citing certain
examples, we will demonstrate the usage of UPF 3.0+ to query
the important power objects from the specified architecture
and pass on these objects along with HDL components to
generic synthesizable checker module that can be attached to
the design without affecting actual design. We will also
present some generic custom global assertions to verify power
Sequences ofdesign which can be reused every time the power
intent changes. The suggested flow, verification process
makes low power verification more automated and the closure
of the above can be achieved in less time.
C. Power State
The state of a supply net, which is a HDL representation
of a supply/or power rail, supply port, supply set, or power
domain. It is an abstract representation ofthe operating mode
of the elements of a power domain or of a module instance
(e.g., ON, OFF, RET).
D. Level Shifier
A power element that translates signal values from an
input voltage swing to a different output voltage swing.
E. Repeaters
Ifthe path between source and sink is long, special butfers
may be required to boost the strength ofthe signal and to
ensure that it stabilizes within the required time. These
buffers are typically called repeaters.
F. Retention Cells
Enhanced functionality
sequential elements or a memory such that memory values
can be preserved during power-down state of the primary
supplies. Generally, they are implemented through 2 ways,
namely master slave latch and dual signal retention save and
restore balloon latch. Our Samsung memory Controller
associated with selected
echCon 2023 Samsung Semiconductor India Research

2. 250M 25M M M 25M 250M
subsystem uses the former which provides optimal delay and
performance for memory accesses and consumes least area.
Clock
Clock sel : CLK SEL
Iso lation : ISO ENL/H
Master Slave Latch having single RETENTION control Clock gating: CG En
Retention: RETn
Basic working principle- Power: PG ALL
1) When clock is 0, signal flows from master to slave latch.
The present value stored in retention slave flip-flop will be
retained which is termed as retention.
PG Reset: PG_RESET
Fig: Retention before power down and restoration after power up
2) When retention goes from I to 0, when clock is 0, signal
does not flow from master to slave latch. The present value
ofslave flip-flop will be shown at the output which is termed
Power Down Sequence- From the waveform, it can be
observed that first isolation 1s enabled, so that master and
slave latch gets isolated. Next, clock is gated, so that clamped
value does not pass irom the master to slave latch.
Subsequently, retention is turned on, so that slave flip-flop
present value is retained. Finally, power or voltage rail is
gated or cut off through power switch enabled by power
controller. Thus, when clock is 0, while retention is 1, value
as restoration.
REINYDDGTVDDVSSpre Mode
I0100-1 0 is retained.
Normal
Operation
010- Power Up Sequence- From the waveform, it is noticed that
firstly, power supply is turned on through power switch.
Next, retention is turned off, while clock is still gated, so that
slave flip flop restores stored value in the output.
Subsequently, clock gating is turned off, to facilitate signalI
propagation. Finally, isolation is turned off, so that it
facilitates next value to come from master to slave flip-flop.
Thus, when clock is 0, and retention goes to low or turned off
stored value is restored.
Retention
QIn] Mode,
output valid
Retention
Mode,
X
output
Invalid
Restore
QInl Mode
0-1
Invalid
Restore
01
Fig: Truth Table of a retention flip-flop/SRAM G. Isolation Cell
When Always-on block receives a signal from a block
that is powered off, it may malfunction due to unknown
propagation. To prevent this, an isolation cell is inserted into
the boundary of a specific block. The isolation cell is fixed to
a value of 0 or 1, when necessary to prevent the always-on
block from malfunctioning. There are 2 types of isolation
cells
VDDIO75AON
-PG ALL
CG En ISO ENL
vDD
Dut
Retention
FF / SRAM
a) <GPA2IsO>: fixed to a clamp valueof0
Clock
Clock In R E I n
ISO ENL Mode
0|
ISO ENH
Normal
Operation
VD
ISOLATION
Non-Retention
FF/ SRAM
Fig: Function Table of 0 clamped isolation cell
b) GPO21sO>:fixed to a clamp value of1
RESETn
G RESETn
Fig: Master-Slave Latch Retention Cell or Macro
ISO
ENHA Y Mode
Nomal
From the above diagram, it is noticed that master latch or non-
retention SRAM is powered by gated power supply. On the
otherhand, slave latch or retention SRAM is powered by both
always-on and gated power supply. They are clocked by same
clock source and connected together through an isolation cell.
0 Operation
IsOLATION|
Fig: Funetion Table of 1 elamped isolation cell
lechCon 2023 Samsung Semiconductor India Research

3. III. MEMORY CONTROLLER POWER STATE MACHINE AND
Test
POWER DOMAINS
Power Domain can exist in various power states that are
dependent on the primary power supplyofthat power domain.
memory Controller has 4 major power domains namely
PD_ALIVE which contains always on modules, PD_HOST
containing the host and other allied components, PD_LOG
comprising ARM cores, system bus and other allied memory
components, PD_NAND consisting ofmemory controller and
associated components.
Generator eEIster Model
Driver
System-on-chip
Fig: Reference Model of TB Controller
Below is the FSM diagram for the power state machine of
the Samsung memory subsystem.
The following is the basic structural code snippet of the
power controller model containing basic tasks-
ACTIVE
import UPF: : *;
task do_pdhost_pwr_up ();
//power up sequence of PD_HOST power
domain
supply_on ("VDD_HOST", 1.2)
endtask
task do_pdhost_pwr_clps();
PG ALL PG SUB
//power down sequence of PD_HOST power
domain
status_reg.READ () ; //From REG Model
supply_off ("VDD_HOST");
endtask
Fig: FSM Diagram of Memory Controller
Above are the power state transition that Memory Controller
subsystem can go through depending on various activities
related to external interrupts or through register programming
The following power controller model controls and
monitor the power elements of the subsystem from outside.
The model switches OFF or switches ON power supply to
supply ports based on power domains entering different power
at run time.
PD_ALIVE PD HOST PDLOG PD_NAND
Power
State
|Active
Idle
PG SUB ON
PG ALL ON
ON
OFF
OFF
OFF
ON
ON
ON
ON
ON
|OFF
ON
ON
| OFF
|OFF
states.
B. Motivationfor using UPF Queryfunctions
Fig: Power state table of memory Controller
Tool-generated assertions are widely used for low-
power verification. However, they may not be useful or
exhaustive in all the designs, as highlighted by the
Based on external activities like peripheral interrupts or
through external register programming and firmware initiated
commands, the different partitioned power domains enter
different power statees.
reasons below.
A design can have a very specific requirement which
is not being provided by the tool-generated assertion.
A. General testbench model ofpower controller
Apart from the actual RTL controller, a reference model
ofthe controller has been created which executes all tasks
related to power collapse and power up of diferent power
domains, coupled with checkers associated with individual
The low-power technology is still evolving andhence
a new set of protocol appears every now and then.
which may require a different set of assertions that isS
not yet provided by the tool vendor.
task.
Due to the above reasons the user may want to write
his custom assertions and coverage items. These items
can be grouped in a checker module, and this checker
module can be instantiated into the design using UPF
command "bind_checker". However, the method of
instantiation of such a checker module is not trivial.
These low-power assertions/coverage items require
access to power objects. However, at the early stages
of verification these power objects are only present in
IechCon 2023 Samsung Semiconductor India Research

4. UPF
the UPF file and do not exist in the design. It is
therefore not straightforward to pass these UPF objects
to a checker instance.
Design
quoun nsano
Extrect power and deskgn handles
Some of the property-checking requires access to
design/power signals spanning across multiple
domains. Such a task is highly error prone and time
consuming.
Usng UP commands)
LLJLLLL
Checker Module
(SVA9 and vogrougs)
As the scope and the inputs of these checkers instances
are defined in UPF, any change in the UPF or design
might break these checkers and they need to be re-
written.
inchecker
netaats chockor
Simulation Tool
Simulaton
Data
Coverago Data
Assertion
Me3angea
Sample code snippet ofa bind of a checker-
Fig: Methodology Flow Chart
bind_checker checker_instance_name
-module checker_module_name
-bind_to target_instance
-ports ({formal_portl_name
p o w e r _ o b j e c t _ h a n d l e }
Iv. PoWER STATE TRANSITION CHECKER
Memory Controller subsystem contain a large number of
power domains and each powerdomain can operate in various
power states. It must be ensured that all power domains cover
all power states. The design uses complex power saving
schemes like dynamic voltage frequency scaling which
essentially means that a single power domain can exist in
different power states based on different voltage level of
power supply. Below table depicts the power states of
PDHOST domain on basis of various voltage levels of
supply voltage.
(formal_portz_namee
p o w e r _ c o n t r o l _ s i g n a l } }
The UPF 3.0+ standard provides the bind_checker
command that helps to instantiate the checker module
"checker_module_name into the design hierarchy
with the instance name
*target_instance"
"checker_instance_name" without actually modifying the
design code or introducing any functional changes. The
low-power assertions are created in this checker module,
which can then monitor the power aware design. Supply Name Power States
Power
Domain
The UPF 3.0+ standard provides a great toolset of
ActiveIdle PG SUB PG ALL
(for
query_isolation,
including example
commands,
query power_domain,
query_retention), which can be used to search and
get the handle of power management objects,
including strategies (isolation/retention/power switch),
power domains, supply nets, supply ports etc. These
commands follow a hierarchical approach and return
the handle of objects which reside in or below the
scope where these commands are called.
query
PD_HOST|VDD 1.8V 1.2V 1.OV 0.75V
(Retention/'Always-
on)
VDD(Non-
Retention/Gated)
1.8V 1.2V1.0V OFF
. UPF 3.0+ standard provides this command to query the
design (HDL) elements through find_objects
command. It provides a good deal of filtering support
to extract relevant elements.
Cover groups are being modelled in the following checker
module. In this example, the cover bin is being updated, every
time PG_ALL power state is reached by the power domain
PD_HOST. The below checker for detection of power state
of power domain PD_HOST is implemented according to
power state transition table and also adhering to power state
change with dynamic voltage supply.
C. Steps umdertaken to adopt this methodology
The steps that were undertaken to verify power intent
through UPF query functions are as follows-
Checkers to check the power intent by SVAs or
tasks are created and they are clubbed together
in a single module.
The required number of power objects and
design signals are determined which are required
by these checkers. The power/control signals
(power elements) are extracted from the power
architecture using UPF query_* commands.
The HDL objects are extracted from design
using UPF command find_objects .
The above handles are passed to the checker
module and instantiated in the design with the
help of UPFcommand bind_checker .
lechCon 2023 Samsung Semiconductor India Research

5. Checker Module Code
The specified checker module requires the handle of the
primary power net of a power domain. This can be extracted
from power architecture using the UPF command
query power_domain. We then attached this power net to the
formal port names in the checker module. The checker module
V. IsOLATION PROTOCOL CHECKER
module power_state_checker (input supply_net_type
PSN)
The checker to verify isolation cell can be expressed in the
form of SVA which is written inside a checker module as
Parameter string PD_NAME =";
parameter string pri_power_net_name "";
initial begin : COV_GRP_SAMPLE_BLOCK
cov_grp = new
forever begin
e (seq_state)
if (seqstate
=
PG_ALL) begin
cov_grp.sample ()
follows:
Checker Module Code
module checker_isolation (input op,
iso_en, clk)
parameter n t clamp_value = 1
parame ter 1Solated_signal_name =
parameter 1So_STrategy_name=";
alwayse (posedge clk)
if (iso_en)
assert (op =Clamp_value) elsee
$error "isolated signal us" foor
end
end
end
initial begin : PD_STATE_TRACKING_BLOCK
seq_state = IDLE;
forever beginn
case (seq_state)
isolation strategy nS 1s not
clamped(8b) correctiy",
1solated_signal_nane,
iso_strategy_name, clamp_value).
endmodule
ACTIVE
if (get_supply_voltage (PSN) = =
1.2) seq_state
=
IDLE;
The above checker module required the handle of isolated
signals, isolation_enable, clk and parameter values. UPF
query functions were used to extract these handles from
power architecture. These power handles are then passed as
actual to the formal port names in the checker module. Then
the checker module was attached to the design using the
IDLE: begin
if(get_supply_voltage(PSN) = 1.0) seq_state =
PG_SUB;
else if (get_s upply_voltage (PSN) == 1.3) seq_state
= ACTIVE;
end
bind_checker command.
TeL code to extract isolation cels
PG_SUB: if (get_supply_voltage (PSN) = =
OFF)
seq_state = PG_ALL;
PG_ALL: if (get_supply_voltage (PSN) = =
1.0)
seq_state = PG_SUB;
proc chk_isollation_properties (
foreach domain [query_power_domain *] (
foreach isolation [query_isolation
$domain]
-domain
default: seq_state = IDLE;
endcase
array set Iso_Strat [query_isolation
* -domain
Sdomain]
e (PSN.voltage)
display ("Power domain 'ss' changed its voltage
to 'd", PD_NAME, get_supply_voltage(PSN))
foreach iso_sig $Iso_Strat (elements) {
bind_checker
chk_$Iso_Strat (isolation_name)_$ domain (domain_nam
e)
module checker_isolation
-ports [list
[list op $iso_sigl
list iso_en $ Iso_Strat (isolation_signal) ]
list clk clk]IN
end //foreveI
end
is instantiated into the design using the bind_checker
command. parameters [list
TeL code to extract power domains [list clamp_value $Iso_Strat(clamp_value)] . .
proc cov_power_states_of_power_domain
set pd_Iist [query_power_domain *]
foreach PD $pd_list {(
array set pd_details Iquery_power_domain $PD
detailed]
VI. CuSTOM GLOBAL ASSERTIONS TO CHECK POWER
CONTROL SEQUENCEs
set pri_net $pd_details (primary_power_net)
set paName $pd_details (domain_name)
bind_checker check_inst_$pdName
module power_state_checker
Ports [list [list PSN $pri_net]]
parameters [list [list PD_NAME SpdName
A. Macros used for SVA sequences
The following SVA macros are used to verity the micro-
architectural level power control sequences which are
temporal in nature and hard to catch or modify through
checkers made from UPF Query commands because for every
echCon 2023 - Samsung Semiconductor India esearch

6. B. Conclusion
power intent change or change in macro cells the
functionality or temporal order of sequence of events can
change. So, here we have used custom global assertions,
which can be reused in different subsequent projects with
minor changes. One such macro definition is given below-
The verification community has been working on
automatic extraction of per-domain assertions from UPF
specifications through several ways in recent times. We
adopted one such methodology tor holistic power intent
functionality verification of memory controller subsystem.
which is hybrid in nature making use of automated checkers
taking in UPF power elements and HDL objects through UPF
query functions in addition to custom global assertion macros
which showcase the general microarchitectural power
sequence flow of the controller. This methodology can be
reused in multiple subsystem projects of any nature and is
immune to changes in design and UPF file. Our methodologv
will help engineers not only to find deep low-power
functional bugs in the design but also shorten the time of
overall bug hunting and verification productivity.
define pwr_dn(POWER_DOMAIN, CLK, RAND_VAR)
seguence pwr_dn_ POWER_DOMAIN:
Srose (iso POWER_DOMAIN
##[L:S]$rose
(clock_gate POWER_DOMAIN)
##[l:$] (! pwr_on* * POWER_DOMA IN
pwr_off_*POWER_DOMAIN ):
endsequence
POWER_DOMAIN ';
propertty chk_pwr_dn_
pwr_dn_ *POWER_DOMAIN ;
endproperty
ACKNOWLEDGMENT
always e (posedge
CLK* *)
if * RAND_VAR )
ap_ 'POWER_DOMAIN
property (chk_pWr_dn_
The authors would like to thank the reviewers for their
valuable suggestions which have enriched this paper
significantly and my manager and co-author Ramesh for
having mentored me, providing valuable guidance and giving
me chance to work on low power verification of a crucial
memory subsystem.
assert
POWER_DOMAIN )
In the above code, properties are declared as macros so that
they can be reused multiple times in checker based on the
random variable set by power up and down sequences.
Below is the example of a checker which uses this SV
assertion. For example, if "do_pdhost_pwr_clps " task from
the power controller is invoked, the random variable
"m_dopdhost_pwr_dn" gets set and the given SV assertion
gets triggered. Below is the example code of a power control
sequence checker.
REFERENCES
[1] IEEE Std 1801-2015forDesign and Verification of Low Power
Integrated Circuits. IEEE Computer Society, 5 December 2015.
[21 RudraMukherjee, Amit Srivastava, StephenBailey:"Staticand Formal
Verificationof Low Power Designs at RTL using UPF", DVCon 2008.
(3] A. Hazra, S. Mitra, P. Dasgupta, A. Pal, D. Bagchi and K Guha
"Leveraging UPF-extracted assertions for modeling and formal
verification of architectural power intent," Design Automation
Conference, Anaheim, CA, USA, 2010, pp. 773-776, doi
10.1145/1837274.1837469.
4] A. Hazra, S. Goyal, P. Dasgupta and A. Pal, "FormalVerification of
Architectural Power Intent," in IEEE Transactionson Very LargeScale
Integration (VLSI) Systems, vol. 21, no. 1, pp. 78-91, Jan. 2013, doi:
10.1109/TVLSL.2011.2180548.
module power_control_sequence_checker():
pwr_dn (PD_HOST, host_clk,
m_do_pdhost_pw_dn)
S] "Amit Srivastava, Awashesh Kumar", PA-APIs:Looking beyond
power intent specification formats, DVCon USA 2015.
[6] R. Sharafinejad, B. Alizadeh and M. Fujita, "UPF-based formal
verification of low power techniques in modern processors," 2015
IEEE 33rd VLSI Test Symposium (VTS), Napa, CA, USA, 2015, pp.
1-6, doi: 10.1109/VTS.2015.7116288.
endmodule
chCon 2023-Samsung Semiconductor India Research