Lesson 6.9's DCRouter coverage model has 78 bins. Merged across twelve seeds of its final testbench, 74 are hit. Four are not: "CTRL lp_en 0", and "ERR_CNT0 saturated", "ERR_CNT1 saturated", "ERR_CNT3 saturated". Sign-off is next week. Someone suggests marking all four as excluded so the report says 100%. Each hole deserves a different answer, and one of them is not "exclude".
What should be done with a coverage hole?
Two obvious answers are both wrong. "Hit every bin" ignores bins that cannot be hit, or that cost far more to hit than they are worth. "Exclude whatever is left" turns the coverage report into a document that agrees with itself. A hole is a question: did we not test this because it cannot happen, because it does not matter, or because we have not got to it yet? The answer must be recorded, with evidence.
Ending | When | Evidence required |
|---|---|---|
Hit | The situation can occur and matters | A test (directed, biased or coverage-driven) that hits it, in the regression, with its check active |
Exclude as unreachable | No legal input can produce it | A proof (formal, Part 7) or a design argument reviewed by the designer; the bin removed or marked illegal |
Waive | It can occur but is judged not to need simulation | A written reason, an owner, a reviewer, and where possible other evidence (formal, a related test, reuse) |
Unreachable is a claim about the design, so it needs the design's authority: a proof or the designer's sign-off.
A waiver is a risk accepted by someone named: it appears in the sign-off review (Part 14).
An illegal bin is better than an excluded one when the situation must never occur: it becomes a check.
Hole | Can it occur? | Decision |
|---|---|---|
CTRL lp_en 0 | Yes: software may disable low power | Hit. A real mode never configured: add a phase with lp_en clear and check that DCRouter never sleeps (R13 says it sleeps only with lp_en) |
ERR_CNT0 saturated | Yes | Hit or waive. The four counters come from one loop in the RTL and ERR_CNT2's saturation is tested; a waiver citing that is defensible, but hitting the other three costs one loop of faulty packets per input |
ERR_CNT1 saturated | Yes | Same as ERR_CNT0 |
ERR_CNT3 saturated | Yes | Same as ERR_CNT0 |
None is unreachable, so none may be excluded. The cheap, honest choice is to hit all four; the waiver for the three counters is acceptable only with its reason written down, because "generated from the same loop" is an argument about the RTL that must stay true as the RTL changes.
Constraints are right and it still never occurs: check whether the environment's legal inputs can produce it at all.
The design logic prevents it: for example, a state reachable only from a state that is itself unreachable.
A formal tool proves the cover property unreachable: the strongest evidence (Part 7).
Never because "we have never seen it": rarity is not impossibility (lesson 6.5).
Practice | Purpose |
|---|---|
A hole list with owner, cause and decision for every empty bin | No hole is silently ignored |
Formal unreachability checks on cover properties | Proof instead of opinion for exclusions |
Waivers reviewed at sign-off, with their reasons | Accepted risk visible to the people accountable (Part 14) |
A team (illustrative) excluded a coverage bin for a FIFO-overflow recovery path as "unreachable, the FIFO cannot overflow". A later change reduced the FIFO depth, and the path became reachable. The exclusion was still in place, the bin no longer counted, and the recovery logic, which had a bug, was never exercised. An exclusion backed by a formal proof would have been re-checked automatically after the change and failed.
It is a legal configuration software can choose; it can occur in the field, so it must be tested or explicitly waived, not declared unreachable.
The proof is re-run when the design changes, so an exclusion that becomes wrong fails automatically; a comment stays wrong silently.
Every hole is hit, excluded as unreachable with proof, or waived with a reason and an owner.
Unreachable is a claim about the design; rarity is not impossibility.
Report the hole list with decisions, not just the percentage.