Comparing formal and simulation code coverage

There is a difference in semantics between code coverage generated from a simulator engine and code coverage generated from a formal engine. This paper seeks to raise the awareness of verification engineers on how best to make use of the code coverage data generated by different verification engines. The paper lays out the reasons for using code coverage and describes how simulation code coverage and formal code coverage are generated. It wraps up with comparisons between the two and recommendations on when to use one or the other or both.

The purpose of code coverage

Siemens EDA and the Questa Formal product team are committed to supporting solutions to challenges faced by design and verification engineers. One of those is coverage closure. Code coverage is generated as a by-product by the verification engine used to verify a design.

The purpose of code coverage is to point out areas of the design that haven’t been tested by the verification engine. In other words, the uncovered parts of the design.

If part of your design has not been tested, you will not have found and fixed any bugs in that area of the design. Missed bugs typically equal respins and further pain for you and your customers. When the verification team sees parts of the design that aren’t covered, it is then up to the verification team to improve the testbench, whether formal or simulation, to close the coverage gap. When doing this, the verification team will ideally add meaningful tests or properties that fit and improve on their testbench and test plan.

This paper outlines some of the differences between formal and simulation code coverage with the goal of educating users on how best to make use of this technology and, at the very least, have the information to make informed decisions on how best to use this data. It is up to the verification team to put in place the flow that is most appropriate for their environment and current methodologies.