DCRouter's error counter saturates at 255. To check that it saturates rather than wraps, a test must first put 255 errors into it, each one a whole packet with a bad CRC sent through the router. A state that one line of RTL describes takes the testbench hundreds of packets to reach. Some states are harder still: sleeping while an output is locked mid-packet needs one source to pause for eight cycles in the middle of a packet while every other port is silent.
How easily can the testbench put the design into the state a check needs?
The obvious view is that the testbench drives every input, so it controls everything. It controls the inputs. The state that matters is often several steps away: a full FIFO needs a stalled output behind it; a credit at zero needs a sink that stops returning credits; a saturated counter needs 255 events. Each step must be caused through the pins, in order, while other activity does not undo it. A random test that never happens to line the steps up never reaches the state, and no check there can fire.
Controllability is the ease of reaching a state from the inputs: how many steps, how specific, and how fragile. A useful habit is to estimate, for each important state, what sequence reaches it.
State | What reaches it | Why it is hard |
|---|---|---|
Input FIFO full (R1) | Fill an input faster than its output drains: stall the sink or contend for the output | Fast sinks and free outputs drain the FIFO first |
Credits at zero (R7) | A sink that stops returning credits while 4 flits are sent | Needs the sink to misbehave on purpose |
Two tails in one cycle (R10) | Packets on two outputs ending in the same cycle | Timing coincidence; depends on lengths and arbitration |
ERR_CNT at 255 (R9) | 255 faulty packets on one input | Long; at 5% faults that is about 5,100 packets |
Asleep with an output locked (R13) | A source pausing 8 cycles mid-packet while all else is idle | Every other port must be silent at the same time |
Woken by port 3 alone (R13) | Sleep, then traffic on input 3 only | Random traffic usually wakes it from another port first |
Every one of these states hides a Bug Zoo bug (1, 10 and 9, 11, 15, 20, 21). A test that cannot reach the state cannot find the bug, however good its checks.
Depth: states that need long sequences (counters, deep FIFOs, timers).
Coincidence: states that need several things in the same cycle (simultaneous tails, a credit return during a send).
Quiet: states that need everything else to stop (sleep, idle timeouts).
Fixed configuration: states only reachable in a mode the test never selects (a disabled port, priority off).
Undriven interfaces: neighbours modelled too politely to ever stall, error or reorder (lesson 1.5).
Technique | How it helps | Where in the course |
|---|---|---|
Directed sequences | Construct the steps on purpose | Lesson 4.1 |
Biased and constrained random | Make the conditions common instead of rare | Lessons 4.4, 4.5 |
Aggressive environment models | Sinks that stall, sources that pause | Lesson 4.8 |
Backdoors and test modes | Set deep state directly, or shorten timers | Lesson 3.5 |
Smaller configurations | Shallower FIFOs and counters make limits close | Lesson 3.6 |
Formal | Considers every reachable state without constructing sequences | Part 7 |
Practice | Purpose |
|---|---|
List hard-to-reach states in the verification plan | Each gets a strategy, not hope |
Coverage points on those states | Shows whether the regression ever reached them (Part 6) |
Ask designers for controllability features | Configurable depths and timers, test modes (lesson 3.6) |
In lesson 4.10, DCRouter's constrained-random hunt runs 274 packets with 5% faults and never reaches ERR_CNT = 255, so it misses BUG_15 (the counter wraps). The error-injection test of lesson 4.7 reaches the state in one directed loop of 300 faulty packets and catches it. The check (compare ERR_CNT with the faults injected) was the same; only controllability differed.
The FIFO drains as fast as it fills (one flit per cycle in and out), so occupancy never builds up; filling it needs the output to stall or be taken by another input.
Quiet plus coincidence: everything must be idle long enough to sleep, and then only input 3 may become active; random traffic usually wakes it from another port.
A check can only fire in a state the test reaches.
Depth, coincidence, quiet and fixed configuration make states hard to reach.
Reach hard states on purpose: directed paths, bias, aggressive models, test modes, smaller configurations or formal.