GLS · Chapter 10 · Low-Power GLS

Isolation & Level-Shifter Cells in Sim

When a power domain switches off, its outputs corrupt to X, and isolation cells are what stop that X from leaking into powered-on domains. An isolation cell clamps a powered-down domain's output to a known value so the receiving domain sees a defined level instead of corruption. The timing is critical: isolation must be enabled before the domain powers down and released after it powers back up, or the corruption escapes. Level-shifter cells handle a different boundary, converting signals between domains at different voltages so the logic levels are interpreted correctly. In simulation level shifters are largely a functional pass-through, but a missing one across a voltage boundary is a real intent bug the power-aware flow flags. This lesson shows how isolation clamps corruption, why the enable timing matters, and how a missing isolation or level shifter appears, while keeping the functional-not-power-integrity boundary.

Foundation12 min readGLSIsolationLevel ShifterPower DomainsCorruption

Chapter 10 · Section 10.3 · Low-Power GLS

Project thread — the mini-SoC's switchable domains feed the always-on domain (bus, control). Isolation is what keeps a powered-down peripheral from corrupting them. 10.6 debugs this on a real block.

1. Why Should I Learn This?

Isolation is the wall between a powered-down domain's corruption and the rest of the chip.

Isolation clamps a powered-down domain's outputs to a known value — no X leak.
Enable timing: assert isolation before power-down, release after power-up.
Level shifters cross voltage boundaries; a missing one is an intent bug.

This is the direct fix for the corruption-leak bug of 10.2, and a mini-SoC essential.

2. Real Silicon Story — the always-on domain corrupted by a powered-down neighbour

An always-on control domain intermittently went X — but its own logic and power were fine.

A neighbouring switchable domain had powered down (corrupting to X, 10.2), and its output fed the control domain without effective isolation — the isolation enable asserted too late, after corruption had already propagated. So the corruption leaked into the always-on domain and hung it. Asserting isolation before power-down (clamping the output first) stopped the leak.

Lesson: a powered-down domain's corruption must be clamped by isolation before it can leak — isolation enable must lead the power-down. Missing or late isolation lets X escape into ON domains.

3. Concept — isolation and level shifters

Isolation cells (clamp corruption):

When a domain powers down, its outputs corrupt to X (10.2).
An isolation cell on each output clamps it to a known value (0 or 1, per UPF set_isolation -clamp_value).
The ON domain then sees a defined level, not corruption.

Isolation enable timing (critical):

Assert isolation before power-down — clamp the output first, so corruption is never seen.
Release isolation after power-up — only once a real value is available.
Late/missing isolation → corruption leaks into the ON domain (a real bug).

Level-shifter cells (cross voltage domains):

A signal from a low-voltage domain to a high-voltage one (or vice versa) needs its levels shifted to be interpreted correctly.
In GLS, level shifters are mostly a functional pass-through (the voltage is not simulated as an analog value), but a missing level shifter across a voltage boundary is an intent bug the UPF/power-aware flow flags.

Scope (accuracy):

Isolation is a functional clamp (models the cell's logic behaviour); level-shift correctness across voltages is a structural/intent check — not analog voltage/power integrity (10.1).
GLS stays dynamic; STA signs off timing (0.3).

Figure 1 — isolation and level-shifter cells (representative). When a switchable domain powers down, its logic corrupts to X (10.2). An ISOLATION cell on each output CLAMPS it to a known value (0/1, per UPF) so the ON domain sees a defined level, not corruption. Isolation ENABLE must assert BEFORE power-down and release AFTER power-up -- late/missing isolation lets X LEAK into the ON domain. A LEVEL-SHIFTER cell crosses a VOLTAGE boundary (low-V to high-V); in GLS mostly a functional pass-through, but a MISSING one across a voltage boundary is an intent bug.

4. Mental Model — a valve you close before shutting off the pump

Isolation is a shutoff valve between a pump (the switchable domain) and the pipes (the ON domain).

Before you turn off the pump (power-down), close the valve (assert isolation) — so no sludge (corruption X) flows into the clean pipes.
Keep the valve closed while the pump is off; reopen it only after the pump is running clean again (power-up complete).
Close it too late (isolation asserts after power-down) and sludge is already in the pipes (corruption leaked).
A level shifter is a pressure adapter between pipes of different pressure (voltage) — without it, the flow is mis-read at the boundary.

Close the valve first, open it last — and adapt the pressure at voltage boundaries.

5. Working Example — isolation strategy and enable timing

The isolation strategy (UPF) and its enable timing (representative):

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

# UPF isolation + level-shifter strategy — REPRESENTATIVE (10.1)
set_isolation      iso_blk -domain PD_BLK -clamp_value 0 \
  -isolation_signal iso_en -isolation_sense high          ;# clamp PD_BLK outputs to 0 when iso_en=1
set_level_shifter  ls_blk  -domain PD_BLK                 ;# shift across the voltage boundary

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

# Isolation enable timing (tool-neutral) — the ORDER that matters:
#   power-DOWN:  assert iso_en (CLAMP outputs)  ->  THEN switch domain off (corrupt)
#   power-UP:    switch domain on (restore)     ->  THEN release iso_en (real value available)
#   WRONG order (switch off before iso_en, or release iso_en before power-up) -> corruption LEAKS

Practical context (representative, tool-neutral):

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

# Isolation/level-shifter checklist (tool-neutral):
#   [ ] every powered-down domain output that feeds an ON domain has ISOLATION
#   [ ] isolation enable asserts BEFORE power-down, releases AFTER power-up (order!)
#   [ ] clamp_value is the safe/inactive level for the receiving ON logic
#   [ ] level shifters present on every voltage-domain crossing
#   [ ] functional check -- not analog voltage/power integrity (10.1)

Isolation enable timing (correct vs late), as a real waveform:

Isolation timing: enable before power-down clamps the output; enabling late lets corruption leak into the ON domain

9 cycles

Representative. On power-down, iso_en_good asserts BEFORE the domain switches off, so out_good is clamped to 0 — the ON domain stays clean. iso_en_late asserts too late (after corruption), so out_late briefly shows the corruption X, which leaks into on_sig — a real isolation-timing bug. Assert isolation before power-down, release after power-up.

6. Debugging Session — corruption leaking into an ON domain

An always-on domain goes X because a powered-down neighbour's corruption leaked in through missing or late isolation; the isolation enable must assert before power-down and release after power-up to clamp the output before corruption can escape

ISOLATION MUST LEAD POWER-DOWN AND LAG POWER-UP

Symptom

An always-on domain intermittently goes X, though its own logic and power are fine. The X correlates with a neighbouring domain's power-down.

Root Cause

Corruption leaking through missing or late isolation. The neighbouring switchable domain powered down and corrupted to X (10.2, expected). Its output feeds the always-on domain, and the isolation on that output was either missing or enabled too late — asserted after corruption had already propagated. So the corruption X escaped into the ON domain and hung it. The ON domain's own logic is irrelevant — the X came from the powered-down neighbour. The fix is about isolation presence and timing: the isolation must clamp the output before the domain powers down, not after.

Fix

Ensure the powered-down domain's outputs that feed ON domains have isolation, and fix the enable timing: assert isolation before power-down (clamp the output first) and release it after power-up (once a real value exists). Set the clamp value to the safe/inactive level for the receiving logic (e.g. an inactive request). Verify in the power-aware log that no corruption X reaches an ON domain. (Separately, check level shifters exist on any voltage crossing — a missing one is an intent bug.) The lesson: isolation cells clamp a powered-down domain's corruption to a known value so it can't leak into ON domains — and the isolation enable must lead power-down and lag power-up; missing or late isolation lets corruption X escape. Scope: functional clamp behaviour, not analog voltage/power integrity (10.1). (GLS stays dynamic; STA signs off timing, 0.3.)

7. Common Mistakes

Missing isolation on a powered-down output feeding an ON domain — corruption leaks.
Asserting isolation too late (after power-down) — corruption already escaped.
Releasing isolation too early (before power-up) — a 0/1 from an unpowered domain.
Wrong clamp value — clamping to the active level triggers spurious behaviour in the ON domain.
Missing level shifter across a voltage boundary — an intent bug.

8. Industry Best Practices

Isolate every powered-down output that feeds an ON domain.
Assert isolation before power-down, release after power-up (lead/lag).
Clamp to the safe/inactive value for the receiving logic.
Place level shifters on every voltage crossing.
Verify no corruption reaches ON domains in the power-aware log.

Senior Engineer Thinking

Beginner: "The always-on domain went X — its logic must be buggy."
Senior: "Did a neighbour just power down? Its corruption may have leaked — is the isolation present, and does its enable lead the power-down? I clamp the output before the domain switches off."

The senior traces an ON-domain X to a neighbour's power-down and checks isolation presence and enable timing.

Silicon Impact

Isolation is the containment wall for power-down corruption, and a breach is a serious, system-level silicon bug: a powered-down domain's corruption leaking into an always-on domain (missing/late isolation) can hang the bus, corrupt control state, or brick the chip on a power transition — an intermittent, power-sequence-triggered failure that's brutal to debug (0.3). The enable timing (isolation must lead power-down, lag power-up) is a classic, easy-to-get-wrong detail. Power-aware GLS is exactly the tool that reveals a leak (corruption X reaching an ON domain) and lets you verify the enable ordering before tape-out. Level shifters add the voltage-boundary correctness on top. Getting isolation right — presence, clamp value, and timing — is foundational to a chip that survives every power cycle.

Engineering Checklist

Isolation on every powered-down output feeding an ON domain.
Isolation enable asserts before power-down, releases after power-up.
Clamp value = safe/inactive level for the receiving logic.
Level shifters on every voltage crossing.
Verified no corruption X reaches an ON domain (power-aware log).

Try Yourself

Route a switchable domain's output into an ON domain with isolation, asserting isolation before power-down — the output is clamped, ON domain clean.
Observe: the corruption is contained.
Change: delay the isolation enable to after power-down.
Expect: the corruption X leaks into the ON domain before the clamp engages — the timing bug. Then remove isolation entirely and watch the leak persist. Restore correct lead/lag timing to fix.

Power-aware simulation with isolation/level-shifter cells is an EDA-tool feature; behaviour is standardized and illustrated tool-neutrally here.

Interview Perspective

Weak: "Isolation just separates the domains."
Good: "Isolation clamps a powered-down domain's outputs to a known value so corruption doesn't leak; the enable asserts before power-down."
Senior: "Isolation clamps a powered-down domain's corruption X to a safe value for the ON domain, and its enable must lead power-down and lag power-up — late or missing isolation leaks corruption. Level shifters handle voltage crossings (mostly functional in GLS; a missing one is an intent bug). Power-aware GLS reveals a leak; it's a functional check, not power integrity."

9. Interview / Review Questions

10. Key Takeaways

When a domain powers down, its logic corrupts to X (10.2); isolation cells clamp its outputs to a known value (0/1, per UPF) so the corruption doesn't leak into ON domains.
Isolation enable timing is critical: assert isolation before power-down (clamp first) and release it after power-up — late or missing isolation lets corruption X escape into an ON domain (a real bug).
Set the clamp value to the safe/inactive level for the receiving logic.
Level-shifter cells cross voltage boundaries (low-V ↔ high-V); in GLS they're largely a functional pass-through, but a missing one is a real intent bug.
Isolation/level-shifter behaviour is a functional/structural power-intent check — not analog voltage/power integrity (10.1); GLS stays dynamic, STA signs off timing (0.3). Next: 10.4 — retention flops & state across power-down.

Quick Revision

Isolation clamps a powered-down domain's outputs to a known value (0/1, per UPF) so corruption X doesn't leak into ON domains. Enable must LEAD power-down, LAG power-up — late/missing isolation → corruption escapes (bug). Clamp to the safe/inactive level. Level shifters cross voltage boundaries (functional pass-through in GLS; a missing one is an intent bug). Functional check, not power integrity. Next: 10.4 — retention flops.