Verification is not testing until nothing breaks; it is proving coverage of a space defined by the specification. The distinction matters because a testbench that exercises what its author thought of correlates strongly with what the design already handles, which is precisely the wrong correlation.
A coverage model derived from the specification rather than from the design, so that a function the RTL forgot is a coverage hole rather than an invisible omission.
UVM agents per interface, a layered sequence library, scoreboards and a reference model. Built for reuse across the block, subsystem and full-chip levels, because rebuilding at each level is how schedules disappear.
The state space explored rather than enumerated, with constraints tightened as coverage closes and directed tests reserved for the corners random will not reach economically.
SystemVerilog assertions embedded at interfaces and internal protocol boundaries, so a violation is caught where it happens rather than three modules downstream.
Applied to control logic, arbiters, protocol compliance, connectivity and register maps — problems where exhaustive proof is cheaper than simulation coverage.
Functional, code and assertion coverage tracked from week one. Every waived hole documented with a reason, because an undocumented waiver is indistinguishable from an oversight.
Timing-annotated simulation for reset sequencing, X-propagation and initialisation behaviour, which static timing analysis structurally cannot see.
| Technique | Best for | Poor fit for |
|---|---|---|
| Constrained-random simulation | Datapaths, wide state spaces, system-level scenarios | Deep sequential control corners |
| Directed tests | Known corner cases, specification examples, regression anchors | Exploring anything unforeseen |
| Assertions | Interface protocol violations, internal invariants | End-to-end functional intent |
| Formal property proof | Arbiters, FSM deadlock, protocol compliance, register maps | Large datapaths and arithmetic |
| Formal equivalence | Netlist against RTL after synthesis or ECO | Anything about timing or function |
| Emulation or prototyping | Software bring-up, long real-world scenarios, boot | Fine-grained internal observability |
| Gate-level simulation | Reset release, X-propagation, initialisation | Functional coverage |
A hundred per cent functional coverage means every item in the coverage model was hit. It says nothing about whether the model described the specification faithfully, and a model written by reading the RTL will happily reach full coverage while missing a requirement the design never implemented.
Which is why the plan is written from the specification, by someone who is not the designer, and reviewed as a document in its own right. It is the cheapest defence available against the failure mode that verification exists to prevent.
The Universal Verification Methodology, a standard framework for building reusable constrained-random verification environments — agents per interface, sequence libraries, scoreboards and coverage collectors — so that environments scale from block to full chip.
On control logic, arbiters, protocol compliance, connectivity and register maps, where exhaustive proof is achievable and cheaper than reaching equivalent confidence through simulation coverage. It is a poor fit for wide arithmetic datapaths.
No. It means every item in the coverage model was exercised. If the model was written from the RTL rather than the specification, a requirement the design never implemented will not appear as a hole. This is why the plan is written independently and reviewed as a document.
Tell us the specification, the constraint and the deadline. Programmes that cross silicon, radio, embedded and AI are where Faststream is strongest.