CSR and Control-Register Access Verification: Expanded Case Study

Extended case study

A formal regression involving CSR and Control-Register Access Verification reopens late in the release cycle after RTL and constraint updates.

Background

Earlier runs were stable, but model assumptions drifted and property intent was not re-audited after implementation changes.

Symptoms observed

• non-vacuous closure rate, counterexample turnaround time, and requirement-level residual risk trend trends worsen while status dashboards look superficially stable.

• counterexample patterns recur across related properties.

• reviewers disagree on whether failures are real bugs or modeling artifacts.

Investigation timeline

1. Hour 0: freeze RTL, assumptions, and tool settings for reproducibility.

2. Hour 1: classify failures into bug, model mismatch, or weak-property buckets.

3. Hour 2: isolate first divergence and map to requirement intent.

4. Hour 3: apply one constrained change and rerun focused property set.

5. Hour 4: confirm reachability and vacuity quality did not regress.

6. Hour 5: replay representative traces in simulation or equivalent flow.

7. Hour 6: publish closure memo with residual risk classification.

Root cause

Root cause traced to CSR and Control-Register Access Verification: Formal register apps target correctness of software-visible control behavior: read/write permissions, privilege filtering, write-one-to-clear semantics, sticky status bits, reset defaults, and side-effect ordering.

Fix and validation

• Correct assumption/property scope to preserve legal behavior.

• Add targeted helper checks that expose key intermediate invariants.

• Update runbook and requirement traceability for future regression stability.

Lessons learned

• Status color is not proof quality; audit supporting evidence.

• First-divergence classification outperforms broad trace inspection.

• Constraint and abstraction governance must be versioned and reviewed.

CASE STUDY - CSR and Control-Register Access Verification
closure slope / vacuity trend / inconclusive aging / replay confidence

Formal deep dive

Formal apps generate high confidence when app-specific assumptions mirror integration and firmware behavior.

Concept diagram

FORMAL APPS MAP

connectivity + csr + progress + reset/x checks -> integrated SoC confidence

Metric graph

APPS CLOSURE QUALITY

functional app closure   ███████
environment realism      █████
waiver pressure          ███

Metrics and artifacts to collect

• connectivity route reachability

• CSR semantic correctness matrix

• progress guarantee closure by interface

• reset/X convergence confidence

Mini case study

Deadlock traces were resolved by tightening fairness assumptions to architecture contracts, not by weakening liveness guarantees.

Debug branches

• Validate mode and configuration constraints for each app.

• Pair safety and liveness checks for progress-sensitive logic.

• Add first-transaction covers for reset-sensitive interfaces.

Senior review question

Ask: which requirement intent is proven, under which assumptions, and what residual risk remains?

Key takeaways

• Tie each proof claim to assumption boundaries and reachability evidence.

• Prefer minimal reversible fixes and preserve legal behavior visibility.

Common pitfalls

• Treating runtime reduction as proof-quality improvement without audits.

• Declaring closure while critical covers remain unreachable.

• Using broad waivers instead of first-divergence root-cause ownership.

Principal formal review addendum

CSR and Control-Register Access Verification should be reviewed as a requirement-evidence workflow, not a single status report.

Use non-vacuous closure rate, counterexample turnaround time, and requirement-level residual risk trend as the monitoring lens and formal closure packet: assumptions audit, proof status matrix, counterexample classification, and requirement traceability as closure proof.

Formal apps deliver high leverage when properties mirror system contracts: connectivity, access control, progress, and reset determinism. Strong teams preserve legal reachability while improving convergence.