Power-Gating Controller and PMU FSM Verification: Theory Deep Dive

Foundational theory

Power-Gating Controller and PMU FSM Verification is core to Dynamic Power & Gating. Treat each power behavior change as a correctness and signoff risk decision.

Core concepts explained

• Power-gating controller verification focuses on PMU FSM correctness through every entry, retention, isolation, shutoff, restore, and re-enable path, including rare abort and fault branches. The sequencing contract is strict: isolate before power-off, retain before context loss, clamp crossings while source is invalid, and de-isolate only after supply/clock/reset readiness criteria are met. Verification should include temporal assertions for handshake ordering with regulators, clock controllers, reset controllers, and software-visible status registers, plus scoreboards that confirm context integrity after repeated sleep-wake cycling. Stress campaigns must inject asynchronous wake requests, overlapping subsystem dependencies, timeout/retry events, and partial-failure cases to prove FSM robustness under realistic platform orchestration. Formal or semi-formal checks are especially effective for invariants such as mutually exclusive illegal states, eventual completion from non-fault commands, and guaranteed safe fallback behavior when an external acknowledgment never arrives.

• Primary metric: illegal transition count, corruption incidence, and reproducibility of low-power regressions across fixed seeds

• Primary artifact: LPV evidence packet: transition timeline, assertion outcomes, and before-after replay summary

• Owners: LPV owner, PMU or firmware owner, verification signoff owner

• Power intent and RTL behavior must stay aligned through transitions

• Proof quality beats broad waive strategies in low-power closure

Why this matters in low-power signoff

Dynamic power controls must preserve correctness first, then deliver meaningful activity and power gains. Teams that enforce this reduce false alarms and real escapes.

Mental model

POWER-AWARE SIM FLOW

UPF + RTL + testbench
        |
        v
Elaboration (PA semantics injected)
        |
        v
Power intent checks (domain, supply, PST)
        |
        v
Dynamic simulation with corruption + clamp behavior
        |
        v
Assertions / scoreboards / waveform triage
        |
        v
Coverage closure + bug replay

Worked intuition

1. Classify symptom first: illegal transition, corruption, isolation break, retention drift, or X-prop ambiguity.

2. Pinpoint first phase boundary where expected low-power behavior diverges.

3. Quantify movement in illegal transition count, corruption incidence, and reproducibility of low-power regressions across fixed seeds before broad refactors.

4. Collect LPV evidence packet: transition timeline, assertion outcomes, and before-after replay summary with fixed run metadata and mode sequencing.

5. Apply one bounded fix and replay both targeted and broader scenarios.

6. Publish owner-signed closure note with rollback trigger.

Common misconceptions

• Passing nominal ON/OFF smoke proves transition correctness.

• UPF compile clean means all intent semantics are correct.

• All X-prop failures indicate real product escapes.

• Retention behavior can be trusted without multi-cycle restore stress.

Low-power verification deep dive

Dynamic power control verification must preserve correctness while validating meaningful efficiency gains.

Concept diagram

DYNAMIC POWER CONTROL

policy intent -> gating/DVFS action -> functional safety checks -> efficiency evidence

Metric graph

DYNAMIC CONTROL SIGNALS

unsafe transitions      ████
power savings gain      ███████
control-loop noise      ███

Metrics and artifacts to collect

• clock-gating safety matrix

• activity and toggle intent correlation

• DVFS transition stability report

• PMU controller state-machine coverage

Mini case study

A DVFS optimization regressed reliability until transition checks included concurrent interrupt and wake conditions.

Debug branches

• Prove functional safety before claiming power benefit.

• Correlate activity reduction with expected policy behavior.

• Stress PMU control loops under asynchronous events.

Senior review question

Ask: what exact low-power transition boundary failed first, and which artifact proves the closure claim reproducibly?

Key takeaways

• Tie each LPV claim to a concrete transition boundary and one proving artifact.

• Prefer minimal reversible fixes with explicit owner and rollback criteria.

Common pitfalls

• Treating power-aware failures as random before boundary classification.

• Waiving X-prop failures before proving impact and root cause.

• Declaring closure without deterministic replay across key modes.

Theory reinforcement

Theory matters when it predicts concrete failure signatures and closure boundaries.

Translate LPV semantics into reproducible verification outcomes.