Four methods — structural, formal, dynamic simulation with injection, and gate-level re-checks — each prove something the others cannot, and each is wasted if it runs at the wrong cadence or without an owner. The regression strategy assigns every method a place, a frequency, and a person, so coverage is continuous instead of heroic.
Method | Cadence | Owner | Guards against |
|---|---|---|---|
Structural analysis (block) | Every block change | Block designer | New or altered crossings |
Structural analysis (flat) | Integration milestones | Signoff owner | Boundary assumption failures |
Formal protocol checks | Nightly, plus on protocol RTL change | Verification owner | Protocol deadlock, loss, duplication |
Injection simulation | Nightly regression with varied seeds | Verification owner | Race-intolerant protocols |
Gate-level structural re-run | Post-synthesis, per ECO, pre-tapeout | Signoff owner with PD | Implementation damage to synchronisers |
Every method has exactly one owner who reads its results on schedule — shared ownership means unread results.
The designer owns block structural cleanliness because they own the fastest fix loop.
Verification owns formal and injection because they own stimulus, assertions, and seeds.
Signoff owns flat runs, gate-level re-runs, and the dashboard because they own the cross-block, cross-revision truth.
Methods overlap deliberately at the seams: formal assumptions are reviewed where waivers are reviewed, injection hit counts are trended where findings are trended, and gate-level results join the same dashboard as RTL results with their revision marked. Overlap at the seams is how one method's blind spot gets caught by another's field of view — the strategy works when the seams are shared, not when each method files its own private report.
Probably yes, but verify: structural finding real defects means the design is churning; formal staying green means protocols hold. Check formal is still running on current RTL with current assumptions — silence from a stale run is not evidence.
Because zero hits means the injection proved nothing, exactly as zero structural findings on a multi-clock design means blindness. Both need their canary; sharing the dashboard puts both under the same honest-metrics rules.