Manufacturing test learned decades ago that a chip must be designed to be testable: scan chains make every flip-flop controllable and observable, at a small area cost, because testing without them is hopeless. Functional verification has the same problem and a weaker habit. Designs arrive with hidden credit counters, hard-coded depths and 16-bit timers, and the verification team spends months working around choices that would have cost the designer an afternoon to change.
What can designers build in to make verification cheaper, and what would you ask for?
The obvious division of labour is that designers design and verifiers verify whatever arrives. That makes every controllability and observability problem the verifier's, solved with workarounds: backdoors into private signals, long tests to reach deep states, fragile white-box checks. Many of these problems are far cheaper to remove in the design than to work around in every test, for every derivative, for the life of the block.
Feature | What it buys | Typical cost |
|---|---|---|
Status registers for important hidden state (credits, occupancy, state machines) | Observability at a documented point; grey-box checks that survive redesign | A few register bits and read muxing |
Parameterised depths, widths and counts | Small test configurations where limits are close (a 2-entry FIFO fills at once) | Careful parameterisation; the shipped values must still be verified |
Programmable or shortened timers | Timeouts, idle detection and watchdogs reachable in simulation | A register or parameter; the full value still needs one test or a proof |
Designer-written assertions on internal intent | Bugs caught at the source by the person who knows the intent | Designer time; assertions move with the RTL |
Clean, standard interfaces between blocks | Reusable monitors, bind points and protocol checkers | Discipline more than area |
Deterministic reset of all state | No X-dependent behaviour; reset bugs visible | Reset wiring for every flop that matters |
Debug counters and event traces | Observability in simulation, emulation and silicon (Part 11) | Area and power, often gated off in production |
Ask | Why | Lesson that needed it |
|---|---|---|
Credit counts in STATUS | BUG_9 and BUG_22 lose credits invisibly; today only a credit audit sees them | Observability (3.2) |
Parameter for FIFO depth | A depth-2 configuration fills in two flits, making R1's boundary easy to reach | Controllability (3.1) |
Idle-cycle threshold as a parameter | Sleep entry (8 cycles) is reachable already; a larger threshold in a derivative would not be | Controllability (3.1) |
Assertions on the FIFO, lock and credit logic, written by the designer | Internal state is checked at its source and kept current by its owner | Black, white, grey box (3.4) |
Round-robin pointers readable for debug | Starvation (BUG_5) is otherwise visible only through fairness statistics | Observability (3.2) |
Prefer features that also help debug and silicon bring-up: status visibility pays three times (simulation, emulation, lab).
Parameterise, then verify the shipped values: small configurations find logic bugs; the real configuration must still be run.
Avoid verification-only modes that change behaviour: every mode is more logic to verify and a mode that could be left on by mistake.
Ask early: features requested at specification review cost an afternoon; requested after RTL freeze they cost a change request.
Practice | Purpose |
|---|---|
Design-for-verification review alongside the specification review | Asks are made while they are cheap (lesson 2.5) |
Designers own block-level assertions | Intent is checked by the people who hold it |
Parameterised IP with verification configurations | Small configurations for bugs, shipped configurations for sign-off |
A team (illustrative) inherited a block with a hard-coded 1,024-entry buffer and no status visibility. Reaching full took 1,024 transactions under stalled downstream traffic in every test that needed it, and wrong occupancy was visible only as data corruption much later. A depth parameter and an occupancy register, added in the next derivative at negligible cost, cut those tests from minutes to milliseconds and made the occupancy bug class directly checkable.
A small depth makes full and wrap-around easy to reach, finding logic bugs quickly; the shipped depth must still be verified, since bugs can depend on the real size.
BUG_9, BUG_10 and BUG_22: each leaves the wrong number of credits, visible as a wrong STATUS value instead of only through a credit audit.
Many verification problems are cheaper to remove in the design than to work around in every test.
Ask for status visibility, parameterised limits, designer assertions, clean interfaces and deterministic reset.
Ask at specification review, and still verify the shipped configuration.