Part 6 answers: How does the method change from simulation to silicon?
The loop never changes; the instruments do. Simulation sees everything, formal proves or gives a trace, gate-level adds real cells, emulation and FPGA trade visibility for speed, and silicon shows almost nothing. This part applies the method at each stage and teaches how to move a failure to the cheapest stage that still shows it.
Use a formal counterexample as a debug trace.
Decide what gate-level simulation and equivalence add.
Move a silicon failure back into simulation.
9 lessons, about 106 min
The part on one page, taken from each lesson's Remember box.
RTL Simulation
RTL simulation shows everything the model does. It cannot show what the model leaves out: wire and gate delays, real start-up values, the real world around the design.
Zero delay means no glitches. Logic that is only safe without glitches, like a decoded asynchronous reset, passes every RTL test.
When the chip disagrees with a clean RTL run, ask first which of the three gaps the bug could live in.
Rule of thumb: debug in RTL simulation whenever it can show the bug, and know the three things it cannot show.
Formal Counterexamples as Traces
A bounded check stops at the first failing step, so its trace is already the shortest. Read it from reset, one step per clock.
Inputs in steps where they cannot matter are filled in at random by the solver. Pin them with assumptions and check the trace still fails.
A property that watches the cause fails earlier than one that watches the symptom. Replay the trace in simulation to make a test.
Rule of thumb: treat a counterexample as a failing test: read it, shrink it, replay it, then fix and run the same check again.
Gate-Level Simulation
An unknown start value is a free choice for synthesis. It may pick a constant, so the netlist can do something no RTL run showed.
Gate-level X depends on the cell models: a mux cell can be as optimistic as RTL, and AND-OR gates more pessimistic than the chip.
Real or pessimism: start the X source at 0 and at 1. If the outputs differ, the X is real; if they never do, it is pessimism.
Rule of thumb: never clear gate-level X by initialising every flop; find each X's source and prove it harmless or fix it.
Equivalence Failures
Each point is proved with its inputs assumed equal, so the unproven point nearest the inputs is the difference; points after it often prove.
A real difference has a counterexample from reset. Get it with a miter and read it like a short trace.
No counterexample from reset, and a register with no partner in the cone: suspect the setup. Add the mapping; it must prove too.
Rule of thumb: an unproven point is a question: answer it with a counterexample from reset or a proven mapping, never with a waiver alone.
Emulation and FPGA Prototyping
Fast platforms trade visibility for speed: on an FPGA you see only the signals you chose before the build, in a window of a few thousand samples.
Trigger on the symptom first to learn when; then trigger on what the hypothesis says happened earlier. Each replay moves the window back.
Replay is only useful if the run is deterministic. Record or control every input that is not, then bring the cycle back to simulation.
Rule of thumb: a trigger is a hypothesis: write down what you expect to see in the window before you arm it.
The First Failing Test on Silicon
Do not reset a failing chip until the state is saved. Read what does not disturb it first; a scan dump is the last, one-shot step.
Two dumps taken apart in time tell a deadlock (nothing moves) from a livelock or a slow chip (something counts).
A dump is a state, not a history. Loaded into simulation it reproduces what happens next; it cannot show how the chip got there.
Rule of thumb: save the state before you touch the chip, and test every theory in simulation from that state before trying it on the bench.
Silicon vs Simulation Correlation
A disagreement has three possible homes: different inputs, a model that cannot show the effect, or this die. Rule out inputs first; they are the commonest.
Compare at the finest grain both sides can give: per-window signatures or counters, not one pass or fail at the end.
One die differing is a die. Every die differing is the design or the model. Change the die before you change the design.
Rule of thumb: never compare outputs until the inputs are shown to be the same, and never call silicon wrong from one die.
Marginal and Environmental Failures
A wall that moves with the clock period is setup-type. A band at high voltage or cold that ignores the period is hold-type. Neither is a logic bug.
A shmoo belongs to one test at one temperature. Switching-heavy tests and temperature both move the wall, so map the worst test at the worst corner.
Ask how far the operating point is from the wall, not whether it passes. One step of margin at 25 C can be none when hot.
Rule of thumb: a failure that moves with voltage, frequency or temperature is a margin question until a shmoo says otherwise.
Moving the Failure to the Cheapest Stage
The cheapest stage is the cheapest one that contains every ingredient of the failure, not the cheapest one there is. Name the ingredients first.
A failure that moved must keep its signature. If the symptom changes, check you still have the same bug, or a new one.
A cheap stage pays twice: faster experiments now, and a test that sweeps the space the expensive stage only sampled.
Rule of thumb: debug where the failure is cheapest to see, prove the fix there and where it was found.
Practice question: D flip-flop with asynchronous reset: glitch-free reset
Practice question: FSM reset synchronisation and glitch prevention
Code lab: DFF with asynchronous reset
Code lab: Reset synchroniser
Practice question: Formal-assisted coverage: witness traces
Interview: run a mock interview on this topic