The symptoms

The equivalence check fails between the RTL and the handed-off netlist. Simulation passed, so the divergence hides where the tests never looked.

The failing cone is small: a 3-input function of a, b, and c. The program below exhausts all 8 input patterns against the golden function.

The investigation

Confirm the two sides come from the same revision first. Most failures are version skew, not real logic bugs.

Then localize with the counterexample: one failing pattern names the cone, and the cone names the gate. Rank the causes before editing.

Proving the single wrong gate

Golden is (a and b) or c. The netlist built (a and b) or (not c), a single inversion. Six of eight patterns disagree, which is 75 percent.

The program below counts the disagreements for the buggy and the fixed netlist. Zero disagreements is the bar for handoff.

golden y = (a and b) or c; buggy y = (a and b) or (not c)
when a and b are both 1, both give 1: 2 of 8 patterns agree
otherwise c and not c always differ: 6 of 8 patterns disagree
disagreement = 6 / 8 = 0.75 = 75%
fixed y = (a and b) or c: 0 of 8 patterns disagree

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

import sys

def golden(a, b, c):
    return (a and b) or c

def buggy(a, b, c):
    return (a and b) or (not c)

def fixed(a, b, c):
    return (a and b) or c

miss_buggy = 0
miss_fixed = 0
total = 0
for n in range(8):
    a = (n >> 2) & 1
    b = (n >> 1) & 1
    c = n & 1
    total = total + 1
    if buggy(a, b, c) != golden(a, b, c):
        miss_buggy = miss_buggy + 1
    if fixed(a, b, c) != golden(a, b, c):
        miss_fixed = miss_fixed + 1

bad = 0
if total != 8:
    bad = bad + 1
if miss_buggy != 6:
    bad = bad + 1
if miss_fixed != 0:
    bad = bad + 1
if bad != 0:
    print("FAIL: agreement count broke on " + str(bad) + " checks")
    sys.exit(1)
print("PASS: buggy netlist differs on 6 of 8 patterns, fixed on 0")

Fix and trade-off

Fix the source side and re-run the full check, not just the failing cone. A local fix can move the divergence elsewhere.

Full re-verification costs machine time on every fix. Incremental checks on the cone guide the debug, and the full run closes it.

Related topics

• Next: Power too high at the same timing

• Equivalence checking

• Simulation-synthesis mismatch