An AXI slave passes ten thousand random tests with every assertion silent and the scoreboard clean. It goes to silicon and hangs the first time a master issues sixteen outstanding writes, because the tests never issued more than four. Every check was in place; none was ever given the situation that broke the design. Passing tests say nothing about situations the tests never created.
How do you know your tests have exercised everything that matters about an interface?
The obvious measures are the number of tests, the number of cycles, and code coverage (lines and branches executed). Random tests cluster around typical behaviour: short stalls, few outstanding requests, mid-range addresses. And code coverage measures the design's code, not the protocol's situations: a line that handles "buffer full" can execute without the interface ever being at its outstanding limit under back-pressure. Coverage has to be stated in terms of the protocol.
Area | Cover points |
|---|---|
Handshake | Ready before valid, valid before ready, same cycle; stalls of 1, 2 to 7, 8 or more cycles; back-to-back transfers with no gap |
Concurrency | Every outstanding count from 1 to the maximum; reaching the maximum while stalled |
Ordering | Responses in order and reordered across IDs; same-ID sequences; interleaving where allowed |
Sizes and boundaries | Every burst length and size; bursts ending exactly at a boundary (4 KB); narrow and unaligned transfers; all strobe patterns that matter |
Errors | Every error response type, on reads and writes, on first, middle and last beats |
Flow control | Credits at zero; credits returning at maximum rate; credit initialisation |
Reset and power | Reset with transactions in flight; low-power entry denied and accepted; wake with requests waiting |
Crosses | Combinations that interact: maximum outstanding × long stalls; errors × reordering; boundary bursts × back-pressure |
Cover properties on the interface signals for temporal situations (a stall of at least 8 cycles, back-to-back transfers).
Covergroups sampled from the monitor's transactions (lesson 15.4) for values and crosses (burst length × size, outstanding count).
Every assertion gets a cover: the assertion's trigger condition must have been seen, or the assertion proved nothing (lesson 15.3).
Closure: when a point stays unhit, change the stimulus (constrain it towards the corner), do not delete the point.
// snippet: cover properties for two handshake situations
// A stall of at least 8 cycles that then completes.
cover property (@(posedge clk) disable iff (!rst_n)
vld && !rdy [*8] ##1 vld && rdy);
// Back-to-back transfers: three in consecutive cycles.
cover property (@(posedge clk) disable iff (!rst_n)
(vld && rdy) [*3]);Cover properties use the same language as assertions, but report that a situation happened instead of checking a rule.
Evidence | What it shows |
|---|---|
All planned cover points hit | The tests reached every situation in the plan |
Every assertion's trigger covered | Every rule check was actually exercised |
Crosses of interacting features hit | Corners where features combine were reached |
Scoreboard clean and nothing left outstanding | Behaviour in those situations was correct |
The plan reviewed against the specification | The plan itself is not missing situations |
Environment | Coverage |
|---|---|
SystemVerilog | Cover properties and covergroups (fact T30) |
UVM | Coverage subscribers sampling the monitors' transactions |
Verification IP | Ships with a protocol coverage model (lesson 15.8) |
The opening slave (illustrative) had 100% code coverage. A protocol coverage plan added afterwards showed the outstanding-write count had never exceeded four, and the cross of "maximum outstanding" with "response channel stalled" had never been hit. Constraining the stimulus to reach them reproduced the silicon hang in simulation within an hour.
An assertion whose trigger never occurred passes without checking anything; the cover shows it was exercised.
Constrain or direct the stimulus to produce errors on bursts of each length; do not remove the cross unless the specification makes it impossible.
Passing tests prove only what they exercised; measure coverage of protocol situations, not just code.
Plan handshake timing, outstanding counts, ordering, boundaries, errors, flow control, reset and their crosses.
Every assertion needs a cover; an unhit point is a missing test.