Extended case study

Signoff review: formal LP property pass rate, unreachable isolation condition count, and retention proof completeness regressed after a low-power intent or sequence update related to UPF Formal Checks.

Background

Previous build passed LP signoff matrix. New failures cluster around one state transition path.

Symptoms observed

• formal LP property pass rate, unreachable isolation condition count, and retention proof completeness regression

• Intermittent failures on transition

• Cross-team disagreement on root cause

Investigation timeline

1. Hour 0: freeze RTL, UPF, and PMU sequence tags

2. Hour 1: isolate failing transition and destination domain

3. Hour 2: verify policy bindings and crossing classification

4. Hour 3: replay waveform with state logs and controls

5. Hour 4: classify root cause and owner

6. Hour 5: apply minimal fix with rollback plan

7. Hour 6: run LP regression matrix and update release memo

Root cause

Root cause traced to UPF Formal Checks: Formal engines validate low-power connectivity and control correctness exhaustively for classes of bugs difficult to hit in simulation.

Fix and validation

• Policy or sequence fix with explicit ownership

• Re-run formal LP app report, property dashboard, and proof-waiver log

• Simulation + formal + implementation regressions

Lessons learned

• Transitions need timeline discipline

• Intent drift is often cross-tool

• Waivers must be bounded and documented

CASE STUDY — UPF Formal Checks
coverage / violation count / post-fix stability

Transition under stress

MODE TRANSITION WAVEFORM — UPF Formal Checks

time ---> 
save_req      ___/---------\____________________
iso_en        ________/----------------\________
switch_en     _____________/--------\___________
domain_vdd    -----------\____OFF____/----------
restore_req   ____________________/---\_________

Ordering errors are the most common LP escapes.

Low-power deep dive

Transition-centric verification closes LP risk better than active-mode-centric regressions.

Concept diagram

VERIFY LOOP

transition matrix -> simulation + formal -> coverage -> closure

Metric graph

COVERAGE CLOSURE

state transitions covered   ███████████
isolation activation        █████████
retention restore paths     ████████

Reports and artifacts

• state coverage

• formal LP properties

• isolation coverage

• LP bug triage dashboard

Mini case study

Coverage looked high, but one untested OFF->RUN transition hid a restore race.

Debug branches

• Rank by transition criticality

• Correlate PMU logs with failures

• Escalate unproven properties

Senior review question

Ask: what transition evidence proves this topic is closed, and which owner signs it?

Key takeaways

• State transition context must accompany every low-power metric claim.

• Intent changes require simulation, formal, and implementation re-validation.

Common pitfalls

• Comparing results from mismatched UPF revisions.

• Assuming static checks replace transition validation.

• Shipping with aged waivers and unclear ownership.

Execution drill pack 1

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/case-study-expanded: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

• State transition explicitly named with legal source/target states.

• Crossing and domain ownership are mapped and agreed.

• Policy controls are traced to always-on source logic.

• Waveform bookmarks align controls with state timestamps.

Review prompts

1. Which policy object is first to deviate from intent?

2. Which owner can apply the smallest reversible fix?

3. What regression matrix proves no collateral damage?

4. Which waiver conditions would still block release?

Evidence capsule

LP EVIDENCE CAPSULE 1

PATH: low-power/low-power-verification/upf-formal-checks/case-study-expanded
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 2

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/case-study-expanded: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

• State transition explicitly named with legal source/target states.

• Crossing and domain ownership are mapped and agreed.

• Policy controls are traced to always-on source logic.

• Waveform bookmarks align controls with state timestamps.

Review prompts

1. Which policy object is first to deviate from intent?

2. Which owner can apply the smallest reversible fix?

3. What regression matrix proves no collateral damage?

4. Which waiver conditions would still block release?

Evidence capsule

LP EVIDENCE CAPSULE 2

PATH: low-power/low-power-verification/upf-formal-checks/case-study-expanded
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 3

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/case-study-expanded: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

• State transition explicitly named with legal source/target states.

• Crossing and domain ownership are mapped and agreed.

• Policy controls are traced to always-on source logic.

• Waveform bookmarks align controls with state timestamps.

Review prompts

1. Which policy object is first to deviate from intent?

2. Which owner can apply the smallest reversible fix?

3. What regression matrix proves no collateral damage?

4. Which waiver conditions would still block release?

Evidence capsule

LP EVIDENCE CAPSULE 3

PATH: low-power/low-power-verification/upf-formal-checks/case-study-expanded
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 4

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/case-study-expanded: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

• State transition explicitly named with legal source/target states.

• Crossing and domain ownership are mapped and agreed.

• Policy controls are traced to always-on source logic.

• Waveform bookmarks align controls with state timestamps.

Review prompts

1. Which policy object is first to deviate from intent?

2. Which owner can apply the smallest reversible fix?

3. What regression matrix proves no collateral damage?

4. Which waiver conditions would still block release?

Evidence capsule

LP EVIDENCE CAPSULE 4

PATH: low-power/low-power-verification/upf-formal-checks/case-study-expanded
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 5

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/case-study-expanded: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

• State transition explicitly named with legal source/target states.

• Crossing and domain ownership are mapped and agreed.

• Policy controls are traced to always-on source logic.

• Waveform bookmarks align controls with state timestamps.

Review prompts

1. Which policy object is first to deviate from intent?

2. Which owner can apply the smallest reversible fix?

3. What regression matrix proves no collateral damage?

4. Which waiver conditions would still block release?

Evidence capsule

LP EVIDENCE CAPSULE 5

PATH: low-power/low-power-verification/upf-formal-checks/case-study-expanded
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 6

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/case-study-expanded: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

• State transition explicitly named with legal source/target states.

• Crossing and domain ownership are mapped and agreed.

• Policy controls are traced to always-on source logic.

• Waveform bookmarks align controls with state timestamps.

Review prompts

1. Which policy object is first to deviate from intent?

2. Which owner can apply the smallest reversible fix?

3. What regression matrix proves no collateral damage?

4. Which waiver conditions would still block release?

Evidence capsule

LP EVIDENCE CAPSULE 6

PATH: low-power/low-power-verification/upf-formal-checks/case-study-expanded
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 7

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/case-study-expanded: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

• State transition explicitly named with legal source/target states.

• Crossing and domain ownership are mapped and agreed.

• Policy controls are traced to always-on source logic.

• Waveform bookmarks align controls with state timestamps.

Review prompts

1. Which policy object is first to deviate from intent?

2. Which owner can apply the smallest reversible fix?

3. What regression matrix proves no collateral damage?

4. Which waiver conditions would still block release?

Evidence capsule

LP EVIDENCE CAPSULE 7

PATH: low-power/low-power-verification/upf-formal-checks/case-study-expanded
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 8

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/case-study-expanded: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

• State transition explicitly named with legal source/target states.

• Crossing and domain ownership are mapped and agreed.

• Policy controls are traced to always-on source logic.

• Waveform bookmarks align controls with state timestamps.

Review prompts

1. Which policy object is first to deviate from intent?

2. Which owner can apply the smallest reversible fix?

3. What regression matrix proves no collateral damage?

4. Which waiver conditions would still block release?

Evidence capsule

LP EVIDENCE CAPSULE 8

PATH: low-power/low-power-verification/upf-formal-checks/case-study-expanded
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 9

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/case-study-expanded: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

• State transition explicitly named with legal source/target states.

• Crossing and domain ownership are mapped and agreed.

• Policy controls are traced to always-on source logic.

• Waveform bookmarks align controls with state timestamps.

Review prompts

1. Which policy object is first to deviate from intent?

2. Which owner can apply the smallest reversible fix?

3. What regression matrix proves no collateral damage?

4. Which waiver conditions would still block release?

Evidence capsule

LP EVIDENCE CAPSULE 9

PATH: low-power/low-power-verification/upf-formal-checks/case-study-expanded
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 10

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/case-study-expanded: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

• State transition explicitly named with legal source/target states.

• Crossing and domain ownership are mapped and agreed.

• Policy controls are traced to always-on source logic.

• Waveform bookmarks align controls with state timestamps.

Review prompts

1. Which policy object is first to deviate from intent?

2. Which owner can apply the smallest reversible fix?

3. What regression matrix proves no collateral damage?

4. Which waiver conditions would still block release?

Evidence capsule

LP EVIDENCE CAPSULE 10

PATH: low-power/low-power-verification/upf-formal-checks/case-study-expanded
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 11

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/case-study-expanded: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

• State transition explicitly named with legal source/target states.

• Crossing and domain ownership are mapped and agreed.

• Policy controls are traced to always-on source logic.

• Waveform bookmarks align controls with state timestamps.

Review prompts

1. Which policy object is first to deviate from intent?

2. Which owner can apply the smallest reversible fix?

3. What regression matrix proves no collateral damage?

4. Which waiver conditions would still block release?

Evidence capsule

LP EVIDENCE CAPSULE 11

PATH: low-power/low-power-verification/upf-formal-checks/case-study-expanded
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 12

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/case-study-expanded: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

• State transition explicitly named with legal source/target states.

• Crossing and domain ownership are mapped and agreed.

• Policy controls are traced to always-on source logic.

• Waveform bookmarks align controls with state timestamps.

Review prompts

1. Which policy object is first to deviate from intent?

2. Which owner can apply the smallest reversible fix?

3. What regression matrix proves no collateral damage?

4. Which waiver conditions would still block release?

Evidence capsule

LP EVIDENCE CAPSULE 12

PATH: low-power/low-power-verification/upf-formal-checks/case-study-expanded
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 13

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/case-study-expanded: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

• State transition explicitly named with legal source/target states.

• Crossing and domain ownership are mapped and agreed.

• Policy controls are traced to always-on source logic.

• Waveform bookmarks align controls with state timestamps.

Review prompts

1. Which policy object is first to deviate from intent?

2. Which owner can apply the smallest reversible fix?

3. What regression matrix proves no collateral damage?

4. Which waiver conditions would still block release?

Evidence capsule

LP EVIDENCE CAPSULE 13

PATH: low-power/low-power-verification/upf-formal-checks/case-study-expanded
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Principal LP review addendum

Formal engines validate low-power connectivity and control correctness exhaustively for classes of bugs difficult to hit in simulation.

Metric: formal LP property pass rate, unreachable isolation condition count, and retention proof completeness