Power Switching, Corruption & X-Injection

Chapter 10 · Section 10.5 · Low-Power GLS

Project thread — the mini-SoC's power controller sequences isolate/save/switch/restore/de-isolate for each domain. This lesson is that sequence; 10.6 debugs it on the power-gated clock-gated block.

1. Why Should I Learn This?

Isolation (10.3) and retention (10.4) only work if they happen in the right order relative to switching.

• Power-down: isolate → save → switch off (corrupt).
• Power-up: switch on → restore → de-isolate.
• Wrong order → corruption leaks, state lost, or X propagates.

This unifies the chapter: correct sequencing is low-power correctness.

2. Real Silicon Story — the wake that flashed corruption

A domain woke from power-down, and for one cycle an ON domain saw corruption X before settling — occasionally latching a wrong value.

The power-up sequence de-isolated before restore: the clamps were released before the retained state was copied back and the domain's outputs were valid — so for a cycle the ON domain saw the unrestored/corrupt output. Reordering to restore first, then de-isolate removed the flash.

Lesson: power sequencing is directional — on the way up, restore before de-isolate; on the way down, isolate before switch off. A wrong order lets corruption or wrong state escape, even briefly.

3. Concept — the power sequences and what each wrong order breaks

Power-down sequence (order matters):

1. Isolate — clamp the domain's outputs (10.3) so corruption can't leak.
2. Save — copy retained state to the shadow (10.4) while still valid.
3. Switch off — remove power → the domain's logic corrupts to X (10.2).

Power-up sequence (reverse):

1. Switch on — repower the domain (outputs still clamped, still X-ish internally).
2. Restore — copy retained state back (10.4).
3. De-isolate — release the clamps (10.3) once outputs are valid.

What each wrong order breaks:

• Switch off before isolate → corruption leaks into ON domains (10.3).
• Switch off before save → retention saves X (10.4) → state lost.
• De-isolate before restore → ON domain sees a wrong/unrestored value.
• Restore before switch on → restoring into an unpowered flop → fails.

Corruption as X-injection:

• Power-down corruption X is the power-aware X-injection — the sibling of timing-check X (8.5) — and it propagates (Chapter 6); isolation is what contains it.

Who drives it:

• A power/reset controller sequences isolate/save/switch/restore/de-isolate (like reset sequencing, 7.4).

Scope (accuracy):

• Sequencing is the design correctness; corruption X models power-down (10.2). Functional check, not power integrity (10.1). GLS dynamic; STA signs off timing (0.3).

4. Mental Model — closing up a shop for the night

Powering a domain down/up is like closing and reopening a shop.

• Closing (power-down): lock the front door (isolate — nothing gets in/out), put the cash in the safe (save retention), then turn off the lights (switch off — the shop goes dark/corrupt).
• Opening (power-up): turn the lights on (switch on), take the cash out of the safe (restore), then unlock the door (de-isolate — customers can come in).
• Wrong order: turn off the lights before locking → the dark shop is exposed (corruption leaks). Unlock the door before restocking → customers see empty shelves (unrestored value).

Lock before dark, unlock after restock — the order is the correctness.

5. Working Example — the controller sequence and a wrong-order bug

The power-controller sequence (representative):

// Power controller sequencing — REPRESENTATIVE (drives the UPF-inserted cells, like 7.4)
// POWER-DOWN:
iso_en   <= 1;                 // 1. ISOLATE (clamp outputs, 10.3)
save_n   <= 0;                 // 2. SAVE retained state (10.4)  -- BEFORE corruption
pwr_en   <= 0;                 // 3. SWITCH OFF -> domain corrupts to X (10.2)
// POWER-UP:
pwr_en   <= 1;                 // 1. SWITCH ON (repower)
restore_n<= 0;                 // 2. RESTORE retained state (10.4)
iso_en   <= 0;                 // 3. DE-ISOLATE (release clamps, 10.3) -- AFTER restore

# What each WRONG order breaks (tool-neutral):
#   pwr_en=0 BEFORE iso_en=1 .......... corruption LEAKS into ON domains (10.3)
#   pwr_en=0 BEFORE save_n=0 .......... retention saves X -> state LOST (10.4)
#   iso_en=0 BEFORE restore_n=0 ....... ON domain sees UNRESTORED/wrong value
#   restore_n=0 BEFORE pwr_en=1 ....... restore into an unpowered flop -> FAILS

Practical context (representative, tool-neutral):

# Power-sequencing checklist (tool-neutral):
#   power-DOWN order:  ISOLATE -> SAVE -> SWITCH OFF   (clamp & save BEFORE corruption)
#   power-UP order:    SWITCH ON -> RESTORE -> DE-ISOLATE  (restore BEFORE releasing clamps)
#   corruption X = power-aware X-injection (8.5-analog) -> isolation CONTAINS it, propagates if not
#   a power controller drives it (like reset sequencing, 7.4)
#   functional check -- not power integrity (10.1)

Correct vs wrong power-up order, as a real waveform:

6. Debugging Session — a power-sequencing bug

7. Common Mistakes

• Switching off before isolating. Corruption leaks into ON domains (10.3).
• Switching off before saving. Retention captures X — state lost (10.4).
• De-isolating before restoring. ON domain sees an unrestored/wrong value.
• Restoring before switching on. Restore into an unpowered flop fails.
• Treating a sequencing bug as a cell bug. The cells may be fine; the order is wrong.

8. Industry Best Practices

• Power-down: isolate → save → switch off (clamp/save before corruption).
• Power-up: switch on → restore → de-isolate (restore before releasing clamps).
• Drive the sequence from a power controller (like reset sequencing, 7.4).
• Verify the order in the power-aware waveform/log across every transition.
• Contain corruption with isolation active at the right time.

Senior Engineer Thinking

• Beginner: "The isolation and retention cells are there, so power-down is fine."
• Senior: "In what order does the controller drive them? Isolate before switch-off, restore before de-isolate — a wrong order leaks corruption or loses state even with correct cells. Let me check the sequence in the power-aware log."

The senior treats power correctness as sequencing and verifies the order, not just cell presence.

Silicon Impact

Power sequencing is the conductor of low-power correctness: isolation (10.3) and retention (10.4) are the instruments, but only the right order makes them work together. A sequencing bug — switch off before isolate, de-isolate before restore — is a real, power-transition-triggered silicon failure: corruption flashing into an always-on domain or state lost on wake, causing hangs or wrong behaviour after every power event (0.3), often for just a cycle and thus brutal to reproduce. Because the cells may be perfectly correct, these bugs hide from cell-level checks and surface only in power-aware GLS running the full sequence. Mastering the two orderings — isolate→save→off and on→restore→de-isolate — and verifying them in simulation is what makes a power-managed chip switch domains reliably.

Engineering Checklist

• Power-down: isolate → save → switch off (clamp/save before corruption).
• Power-up: switch on → restore → de-isolate (restore before de-isolate).
• Drove the sequence from a power controller (7.4-style).
• Verified the order and no leak/lost state in the power-aware log.
• Confirmed isolation contains the corruption X (active at the right time).

Try Yourself

1. Sequence a power-down as isolate → save → switch off and a power-up as switch on → restore → de-isolate — clean across the transition.
2. Observe: no corruption leaks, state survives.
3. Change: move de-isolate before restore on power-up.
4. Expect: the ON domain flashes corruption X for a cycle before settling. Then move switch-off before isolate on power-down and watch corruption leak. Restore the correct orders to fix both.

Power-aware simulation with a power-control sequence is an EDA-tool feature; the ordering behaviour is standardized and illustrated tool-neutrally here.

Interview Perspective

• Weak: "Power-down just turns the domain off."
• Good: "Power-down is isolate → save → switch off; power-up is switch on → restore → de-isolate."
• Senior: "Low-power correctness is the sequence: isolate and save before corruption, restore before releasing clamps, restore after repowering. A wrong order leaks corruption or loses state even with correct cells. The corruption X is power-aware X-injection that propagates unless isolation contains it — so I verify the controller's order in the power-aware log. Functional, not power integrity."

9. Interview / Review Questions

10. Key Takeaways

• Low-power correctness is sequencing: powering a domain down/up is an ordered sequence, not one event.
• Power-down: isolate → save → switch off — clamp the outputs (10.3) and save retained state (10.4) before the domain corrupts to X (10.2).
• Power-up: switch on → restore → de-isolate — repower, restore retained state (10.4), then release the clamps (10.3).
• Wrong order breaks it: switch off before isolate → corruption leaks; before save → state lost; de-isolate before restore → wrong value; restore before switch on → fails.
• Corruption X is power-aware X-injection (8.5-analog) that propagates (Chapter 6) unless isolation contains it; a power controller drives the sequence (7.4-style). Functional, not power integrity (10.1); GLS dynamic, STA signs off timing (0.3). Next: 10.6 — a power-gated clock-gated block.

Quick Revision

Low-power correctness = SEQUENCING. Power-down: isolate → save → switch off (clamp + save BEFORE corruption-to-X, 10.2/10.3/10.4). Power-up: switch on → restore → de-isolate (restore BEFORE releasing clamps). Wrong order: off-before-isolate → leak; off-before-save → state lost; de-iso-before-restore → wrong value. Corruption X = power-aware X-injection (propagates unless isolation contains it). Controller-driven (7.4-style). Functional check. Next: 10.6 — power-gated clock-gated block.