Waveform Debugging at the Gate Level

Chapter 12 · Section 12.3 · GLS Debug Methodology

Project thread — every backward-trace in this book (FSM X→state→unreset flop, 6.6) used this. This lesson makes the waveform-navigation technique explicit; 12.4 adds force/deposit to test the hypothesis.

1. Why Should I Learn This?

A gate-level waveform is where the trace-to-source step actually happens — and it's easy to get lost.

• Thousands of signals, cryptic names, cells — not RTL.
• The technique: backward-trace the first X → driving cell → cone → source.
• Controlling values (6.3) show which input brought the X in.

This is the how of 12.1's trace step and 12.2's backward-trace.

2. Real Silicon Story — lost in ten thousand signals

An engineer opened a gate-level waveform to debug an X, saw ten thousand cryptically-named signals, and — overwhelmed — started randomly expanding nets, getting nowhere for hours.

A systematic backward-trace took minutes: start at the first X (12.2), find the cell driving that net, look at its inputs — one was X, the rest non-controlling — follow that input's net to its driving cell, and repeat until reaching an unreset flop (the X source). The ten thousand signals were irrelevant; one directed path led to the source.

Lesson: don't browse a gate-level waveform — backward-trace it. From the first X, follow net → driving cell → offending input → net, hop by hop, to the source.

3. Concept — the gate-level backward-trace

Why gate-level waveforms are hard:

• Volume — every cell net, thousands of signals.
• Names — tool-generated (q_reg[3], n123) after synthesis (5.2).
• Cells — AND2X1/DFFRX1/MUX2, not RTL constructs.

The backward-trace technique (the core skill):

1. Start at the first X (12.2) — the earliest wrong net.
2. Find its driving cell — the cell whose output is that net (follow the net to its driver).
3. Look at that cell's inputs — which input is X? Use controlling values (6.3): an AND with a 0 would absorb X (so the X came via a non-controlling input); identify which input brought the X in.
4. Follow that input's net to its driving cell — repeat (hop by hop).
5. Stop at the X source — an unreset flop (Ch7), a timing-check firing (Ch8), contention, an unknown input (Ch6). That's the root.

Navigation aids:

• Netlist hierarchy — use instance paths to stay oriented (5.2).
• Group by clock domain — separate domains (esp. CDC, Ch9).
• X source vs X propagation — a cell outputting X with all defined inputs is a source; a cell passing an X from an input is propagation (keep tracing).
• Preserved signals (5.2) — keep key internal names visible for the trace.

Scope (accuracy):

• Waveform backward-trace is a localization technique; controlling values (6.3) show where X stops/passes. GLS stays dynamic (0.3).

4. Mental Model — follow the smoke to the fire

A gate-level X in a waveform is smoke filling a huge building (thousands of signals).

• Don't wander room to room opening doors (randomly expanding signals) — you'll never find it.
• Follow the smoke backward toward where it's thickest and earliest (the first X).
• At each room, check which doorway the smoke came through (which cell input is X — controlling values tell you which door it couldn't have come through).
• Walk through that doorway to the next room and repeat — until you reach the fire (the X source).

Follow the smoke backward through the doorways to the fire — don't wander.

5. Working Example — a backward-trace

Tracing an X back through cells (tool-neutral):

# Gate-level backward-trace — REPRESENTATIVE (tool-neutral)
# first X: net 'busy' = X  (from first-divergence, 12.2)
#   busy driven by: assign busy = (state == RUN)   -> cell u_cmp
#     u_cmp inputs: state[1:0]  -> state[1] = X, state[0] = 0
#       state[1] driven by: DFF u_q1 (.Q(state[1]))   -> cell u_q1
#         u_q1: D captured X? or RN=X? -> RN not asserted -> X SOURCE (unreset flop, Ch7)
# path: busy(X) <- u_cmp <- state[1](X) <- u_q1 (unreset) = SOURCE
# fix the source (reset u_q1); busy clears.  [same trace as 6.6, now as a waveform technique]

# Controlling-value check at each hop (6.3):
#   at an AND cell: if another input is 0, the X is ABSORBED there (X came elsewhere) -> don't trace that leg
#   if all other inputs non-controlling (AND=1, OR=0, XOR): the X PASSED through -> trace the X input

Practical context (representative, tool-neutral):

# Gate-level waveform navigation (tool-neutral):
#   1) start at the FIRST X (12.2)
#   2) follow the net to its DRIVING cell (the cell whose output is that net)
#   3) inspect inputs; controlling values (6.3) show which input brought the X in
#   4) follow that input's net to ITS driving cell -> REPEAT
#   5) stop at the X SOURCE (unreset flop / timing check / contention / unknown, Ch6/7/8)
#   aids: netlist hierarchy (5.2), group by clock domain (Ch9), preserved signals (5.2)

A backward-trace through the cone, as a real waveform:

6. Debugging Session — lost in a gate-level waveform

7. Common Mistakes

• Randomly browsing the waveform instead of backward-tracing.
• Not starting at the first X (12.2) — trace from the earliest.
• Ignoring controlling values (6.3) — they tell you which input brought the X in.
• Confusing X propagation with an X source — keep tracing until a cell outputs X with defined inputs.
• Not using hierarchy/preserved signals (5.2) to stay oriented.

8. Industry Best Practices

• Backward-trace from the first X — net → driving cell → offending input → repeat.
• Use controlling values (6.3) to pick the offending input at each hop.
• Distinguish X source from propagation — stop at the source.
• Use the netlist hierarchy and preserved signals (5.2) for orientation.
• Group signals by clock domain (esp. CDC, Ch9).

Senior Engineer Thinking

• Beginner: "There are ten thousand signals — I'll expand nets until I find it."
• Senior: "Start at the first X, find its driving cell, see which input brought the X in (controlling values), follow that net, repeat. It's a directed path to the source — I don't browse."

The senior backward-traces the first X through driving cells, using controlling values, instead of browsing.

Silicon Impact

Gate-level waveform navigation is where root causes are actually found — and doing it systematically is the difference between minutes and days. A gate-level waveform's volume and cryptic names make random browsing a black hole that stalls bring-up and tempts engineers to guess (or waive) instead of finding the source (0.3). A disciplined backward-trace — first X → driving cell → offending input (controlling values) → repeat → source — turns the sea of signals into a directed path to the root, reliably. Because every trace-to-source step (in every prior debug) is a gate-level waveform trace, mastering this technique is what operationalizes the whole methodology: first-divergence (12.2) finds where to start, and backward-trace (here) is how you get from there to the fix.

Engineering Checklist

• Started at the first X (12.2).
• Followed the net to its driving cell; inspected inputs.
• Used controlling values (6.3) to find the offending input.
• Repeated hop-by-hop to the X source (distinguished source from propagation).
• Used hierarchy/preserved signals/clock-domain grouping (5.2/Ch9) to stay oriented.

Try Yourself

1. Open a gate-level waveform with an X and resist browsing — start at the first X (12.2).
2. Observe: find its driving cell; identify which input is X (use controlling values, 6.3).
3. Change: follow that input's net to its driving cell, and repeat.
4. Expect: a short directed path leads to the X source (e.g. an unreset flop) — far faster than browsing. Note where controlling values told you an X was absorbed (don't trace that leg).

Gate-level waveform backward-tracing is a discipline in any waveform viewer. No paid tool required.

Interview Perspective

• Weak: "I look through the waveform for the X."
• Good: "I trace the X backward — follow the net to its driving cell and see which input is X."
• Senior: "Gate-level waveforms are huge and cryptically named, so I backward-trace: from the first X, follow net → driving cell → offending input (controlling values tell me which input brought it in) → repeat, until the X source. I distinguish a source from propagation, use hierarchy and preserved signals to stay oriented, and group by clock domain. It's a directed path, not browsing."

9. Interview / Review Questions

10. Key Takeaways

• Gate-level waveforms are hard: thousands of signals, tool-generated names (q_reg[*], n123, 5.2), and cells instead of RTL constructs — don't browse them.
• Navigate by a systematic backward-trace: start at the first X (12.2) → follow the net to its driving cell → find the offending input (via controlling values, 6.3) → follow that input's net → repeat to the X source.
• Controlling values (6.3) tell you which input brought the X in at each hop (an absorbed leg isn't the path).
• Distinguish an X source (cell outputs X with defined inputs — the root) from X propagation (keep tracing); use the netlist hierarchy, preserved signals (5.2), and clock-domain grouping (Ch9) to stay oriented.
• This is the how of the funnel's trace-to-source step (12.1/12.2) — a directed path, not browsing; GLS stays dynamic (0.3). Next: 12.4 — force, deposit & bisecting a failure.

Quick Revision

Gate-level waveforms = huge + cryptic names (5.2) + cells — don't browse, BACKWARD-TRACE. From the first X (12.2): net → driving cell → offending input (controlling values 6.3 tell you which) → follow that net → repeat → X source (unreset flop Ch7 / timing check Ch8 / contention / unknown Ch6). Source = outputs X with defined inputs; else propagation (keep tracing). Use hierarchy/preserved signals (5.2). Next: 12.4 — force, deposit & bisection.