DenseChip

Low Power / UPF · All levels

UPF Formal Checks: Theory Deep Dive

Theory Deep Dive for UPF Formal Checks.

Foundational theory

UPF Formal Checks is a core part of Low Power Verification. Formal engines validate low-power connectivity and control correctness exhaustively for classes of bugs difficult to hit in simulation. Senior engineers connect observed behavior to explicit state policy, domain boundaries, and sequence ownership before proposing fixes.

Core concepts explained

  • Formal engines validate low-power connectivity and control correctness exhaustively for classes of bugs difficult to hit in simulation.

  • Primary metric: formal LP property pass rate, unreachable isolation condition count, and retention proof completeness

  • Primary artifact: formal LP app report, property dashboard, and proof-waiver log

  • Owners: formal owner, UPF owner, verification lead

  • Legal state transitions must be explicit and testable

  • Every crossing requires policy + evidence

Why this matters in product signoff

At product level, UPF Formal Checks defects become intermittent, expensive silicon escapes. LP verification must prove behavior across legal state transitions, not only active-mode function.

Mental model

diagram
FORMAL LP CHECKS

prove isolation active when source OFF
prove retained regs restore before use
prove forbidden crossings unreachable
prove control signal originates in AON domain

Worked intuition

  1. Name the failing mode transition and power states.

  2. Open formal LP property pass rate, unreachable isolation condition count, and retention proof completeness and identify which crossing or policy failed.

  3. Align waveform timeline with PMU control sequence.

  4. Check UPF object binding and policy ownership.

  5. Collect formal LP app report, property dashboard, and proof-waiver log with database/view tags.

  6. Classify: intent mismatch, sequencing bug, or implementation defect.

  7. Apply minimal fix and rerun LP regression matrix.

Common misconceptions

  • If active mode passes, low-power behavior is safe.

  • Isolation alone can hide all OFF-domain issues.

  • Any UPF syntax conversion preserves semantics.

  • Static reports are enough without transition coverage.

Visual reinforcement

Formal low-power proof scope

diagram
FORMAL LP CHECKS

prove isolation active when source OFF
prove retained regs restore before use
prove forbidden crossings unreachable
prove control signal originates in AON domain

Layer responsibilities

diagram
LP OWNERSHIP LAYERS — UPF Formal Checks

layer                owns                          typical failure
------------------   ---------------------------   --------------------------
architecture         domain strategy               infeasible power states
UPF intent           policy objects + bindings     wrong/missing policy
implementation       LP cell insertion/routing     illegal physical behavior
verification         transition scenarios          uncovered LP bug
signoff governance   waiver + release decisions    late escape to silicon

Low-power deep dive

Transition-centric verification closes LP risk better than active-mode-centric regressions.

Concept diagram

diagram
VERIFY LOOP

transition matrix -> simulation + formal -> coverage -> closure

Metric graph

diagram
COVERAGE CLOSURE

state transitions covered   ███████████
isolation activation        █████████
retention restore paths     ████████

Reports and artifacts

  • state coverage

  • formal LP properties

  • isolation coverage

  • LP bug triage dashboard

Mini case study

Coverage looked high, but one untested OFF->RUN transition hid a restore race.

Debug branches

  • Rank by transition criticality

  • Correlate PMU logs with failures

  • Escalate unproven properties

Senior review question

Ask: what transition evidence proves this topic is closed, and which owner signs it?

Key takeaways

  • State transition context must accompany every low-power metric claim.

  • Intent changes require simulation, formal, and implementation re-validation.

Common pitfalls

  • Comparing results from mismatched UPF revisions.

  • Assuming static checks replace transition validation.

  • Shipping with aged waivers and unclear ownership.

Execution drill pack 1

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/theory-deep-dive: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

  • State transition explicitly named with legal source/target states.

  • Crossing and domain ownership are mapped and agreed.

  • Policy controls are traced to always-on source logic.

  • Waveform bookmarks align controls with state timestamps.

Review prompts

  1. Which policy object is first to deviate from intent?

  2. Which owner can apply the smallest reversible fix?

  3. What regression matrix proves no collateral damage?

  4. Which waiver conditions would still block release?

Evidence capsule

diagram
LP EVIDENCE CAPSULE 1

PATH: low-power/low-power-verification/upf-formal-checks/theory-deep-dive
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 2

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/theory-deep-dive: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

  • State transition explicitly named with legal source/target states.

  • Crossing and domain ownership are mapped and agreed.

  • Policy controls are traced to always-on source logic.

  • Waveform bookmarks align controls with state timestamps.

Review prompts

  1. Which policy object is first to deviate from intent?

  2. Which owner can apply the smallest reversible fix?

  3. What regression matrix proves no collateral damage?

  4. Which waiver conditions would still block release?

Evidence capsule

diagram
LP EVIDENCE CAPSULE 2

PATH: low-power/low-power-verification/upf-formal-checks/theory-deep-dive
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 3

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/theory-deep-dive: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

  • State transition explicitly named with legal source/target states.

  • Crossing and domain ownership are mapped and agreed.

  • Policy controls are traced to always-on source logic.

  • Waveform bookmarks align controls with state timestamps.

Review prompts

  1. Which policy object is first to deviate from intent?

  2. Which owner can apply the smallest reversible fix?

  3. What regression matrix proves no collateral damage?

  4. Which waiver conditions would still block release?

Evidence capsule

diagram
LP EVIDENCE CAPSULE 3

PATH: low-power/low-power-verification/upf-formal-checks/theory-deep-dive
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 4

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/theory-deep-dive: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

  • State transition explicitly named with legal source/target states.

  • Crossing and domain ownership are mapped and agreed.

  • Policy controls are traced to always-on source logic.

  • Waveform bookmarks align controls with state timestamps.

Review prompts

  1. Which policy object is first to deviate from intent?

  2. Which owner can apply the smallest reversible fix?

  3. What regression matrix proves no collateral damage?

  4. Which waiver conditions would still block release?

Evidence capsule

diagram
LP EVIDENCE CAPSULE 4

PATH: low-power/low-power-verification/upf-formal-checks/theory-deep-dive
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 5

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/theory-deep-dive: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

  • State transition explicitly named with legal source/target states.

  • Crossing and domain ownership are mapped and agreed.

  • Policy controls are traced to always-on source logic.

  • Waveform bookmarks align controls with state timestamps.

Review prompts

  1. Which policy object is first to deviate from intent?

  2. Which owner can apply the smallest reversible fix?

  3. What regression matrix proves no collateral damage?

  4. Which waiver conditions would still block release?

Evidence capsule

diagram
LP EVIDENCE CAPSULE 5

PATH: low-power/low-power-verification/upf-formal-checks/theory-deep-dive
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 6

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/theory-deep-dive: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

  • State transition explicitly named with legal source/target states.

  • Crossing and domain ownership are mapped and agreed.

  • Policy controls are traced to always-on source logic.

  • Waveform bookmarks align controls with state timestamps.

Review prompts

  1. Which policy object is first to deviate from intent?

  2. Which owner can apply the smallest reversible fix?

  3. What regression matrix proves no collateral damage?

  4. Which waiver conditions would still block release?

Evidence capsule

diagram
LP EVIDENCE CAPSULE 6

PATH: low-power/low-power-verification/upf-formal-checks/theory-deep-dive
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 7

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/theory-deep-dive: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

  • State transition explicitly named with legal source/target states.

  • Crossing and domain ownership are mapped and agreed.

  • Policy controls are traced to always-on source logic.

  • Waveform bookmarks align controls with state timestamps.

Review prompts

  1. Which policy object is first to deviate from intent?

  2. Which owner can apply the smallest reversible fix?

  3. What regression matrix proves no collateral damage?

  4. Which waiver conditions would still block release?

Evidence capsule

diagram
LP EVIDENCE CAPSULE 7

PATH: low-power/low-power-verification/upf-formal-checks/theory-deep-dive
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 8

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/theory-deep-dive: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

  • State transition explicitly named with legal source/target states.

  • Crossing and domain ownership are mapped and agreed.

  • Policy controls are traced to always-on source logic.

  • Waveform bookmarks align controls with state timestamps.

Review prompts

  1. Which policy object is first to deviate from intent?

  2. Which owner can apply the smallest reversible fix?

  3. What regression matrix proves no collateral damage?

  4. Which waiver conditions would still block release?

Evidence capsule

diagram
LP EVIDENCE CAPSULE 8

PATH: low-power/low-power-verification/upf-formal-checks/theory-deep-dive
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 9

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/theory-deep-dive: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

  • State transition explicitly named with legal source/target states.

  • Crossing and domain ownership are mapped and agreed.

  • Policy controls are traced to always-on source logic.

  • Waveform bookmarks align controls with state timestamps.

Review prompts

  1. Which policy object is first to deviate from intent?

  2. Which owner can apply the smallest reversible fix?

  3. What regression matrix proves no collateral damage?

  4. Which waiver conditions would still block release?

Evidence capsule

diagram
LP EVIDENCE CAPSULE 9

PATH: low-power/low-power-verification/upf-formal-checks/theory-deep-dive
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 10

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/theory-deep-dive: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

  • State transition explicitly named with legal source/target states.

  • Crossing and domain ownership are mapped and agreed.

  • Policy controls are traced to always-on source logic.

  • Waveform bookmarks align controls with state timestamps.

Review prompts

  1. Which policy object is first to deviate from intent?

  2. Which owner can apply the smallest reversible fix?

  3. What regression matrix proves no collateral damage?

  4. Which waiver conditions would still block release?

Evidence capsule

diagram
LP EVIDENCE CAPSULE 10

PATH: low-power/low-power-verification/upf-formal-checks/theory-deep-dive
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 11

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/theory-deep-dive: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

  • State transition explicitly named with legal source/target states.

  • Crossing and domain ownership are mapped and agreed.

  • Policy controls are traced to always-on source logic.

  • Waveform bookmarks align controls with state timestamps.

Review prompts

  1. Which policy object is first to deviate from intent?

  2. Which owner can apply the smallest reversible fix?

  3. What regression matrix proves no collateral damage?

  4. Which waiver conditions would still block release?

Evidence capsule

diagram
LP EVIDENCE CAPSULE 11

PATH: low-power/low-power-verification/upf-formal-checks/theory-deep-dive
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 12

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/theory-deep-dive: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

  • State transition explicitly named with legal source/target states.

  • Crossing and domain ownership are mapped and agreed.

  • Policy controls are traced to always-on source logic.

  • Waveform bookmarks align controls with state timestamps.

Review prompts

  1. Which policy object is first to deviate from intent?

  2. Which owner can apply the smallest reversible fix?

  3. What regression matrix proves no collateral damage?

  4. Which waiver conditions would still block release?

Evidence capsule

diagram
LP EVIDENCE CAPSULE 12

PATH: low-power/low-power-verification/upf-formal-checks/theory-deep-dive
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Execution drill pack 13

Use this pack to rehearse low-power closure on low-power/low-power-verification/upf-formal-checks/theory-deep-dive: transition framing, policy ownership, implementation evidence, and release confidence.

Transition checklist

  • State transition explicitly named with legal source/target states.

  • Crossing and domain ownership are mapped and agreed.

  • Policy controls are traced to always-on source logic.

  • Waveform bookmarks align controls with state timestamps.

Review prompts

  1. Which policy object is first to deviate from intent?

  2. Which owner can apply the smallest reversible fix?

  3. What regression matrix proves no collateral damage?

  4. Which waiver conditions would still block release?

Evidence capsule

diagram
LP EVIDENCE CAPSULE 13

PATH: low-power/low-power-verification/upf-formal-checks/theory-deep-dive
STATE WINDOW: <from -> to>
POLICY OBJECT: <isolation / retention / shifter / switch>
OWNER: <name>
PRIMARY ARTIFACT: <report/waveform/formal result>
RELEASE DECISION: <close / bounded waiver / escalate>

Theory reinforcement

LP verification must prove behavior across legal state transitions, not only active-mode function.

Practice this lesson