Coverage Closure — From Holes to Sign-Off

What Is Coverage Closure?

Coverage closure is the systematic process of driving every coverage metric — code, functional, and structural — to project-agreed sign-off thresholds before tape-out. It is the final gate of the verification sign-off flow and arguably the most labour-intensive phase: random simulation alone rarely pushes functional coverage above 80–85%, leaving a residual long tail of corner cases that require deliberate engineering effort.

The process is iterative. You run regression, merge coverage databases, generate a coverage report, examine uncovered bins, determine the root cause of each hole, apply a fix (constraint tweak, directed test, or formal waiver), re-run, and repeat — until every metric either hits its goal or has an approved exclusion. A single coverage closure cycle on a mid-complexity IP block typically takes one to three weeks of focused verification effort.

Identifying Coverage Holes

Coverage holes — bins that were never hit across all simulation runs — appear in the merged coverage database. Every major simulation tool (Synopsys VCS, Cadence Xcelium, Mentor Questa) can merge per-seed UCDB/VDBCOV files and produce a unified report. Typical report commands:

# Merge all seed databases
vcover merge -out merged.ucdb seeds/*.ucdb

# Generate HTML + text report
vcover report -html -details -output cov_report merged.ucdb

# Text report: show only unhit bins
vcover report -details -below 100 merged.ucdb | tee holes.txt

The text report lists each covergroup, coverpoint, and bin with its hit count. A bin with hit count = 0 is a hole. Bins with very low counts (1–2 hits) are also suspicious — they may represent marginal scenarios that passed only by luck and deserve closer inspection.

Categories of Holes

The Coverage Closure Analysis Workflow

Every uncovered bin must be triaged through a structured root-cause analysis before any action is taken. Skipping the analysis and jumping straight to waivers is a dangerous shortcut — it can hide real RTL bugs.

Constraint Refinement for Corner Cases

The most common cause of coverage holes is an overly broad constraint space where the solver explores the easy paths millions of times while rarely visiting the corners. Constraint refinement narrows the solver's focus.

Constraint Weighting

SystemVerilog's dist keyword lets you bias the solver toward specific values without excluding everything else:

class axi_seq_item extends uvm_sequence_item;
  rand logic [7:0]  burst_len;
  rand logic [2:0]  burst_size;
  rand axi_burst_t  burst_type;

  // Standard constraint — all burst lengths equally likely
  constraint c_len_default {
    burst_len dist {
      8'h00     := 30,  // single beat — common path
      [8'h01:8'h0F] := 50,  // short bursts
      [8'h10:8'hFE] := 15,  // medium bursts
      8'hFF     := 5   // max burst — corner case
    };
  }

  // Closure constraint: force max burst to close hole
  constraint c_len_closure {
    burst_len == 8'hFF;
  }

  // Enable closure mode from test
  function void set_closure_mode();
    c_len_default.constraint_mode(0);
    c_len_closure.constraint_mode(1);
  endfunction
endclass

Adding Corner-Case Bins

Sometimes the covergroup does not have a bin for the exact corner you need. Adding explicit named bins lets the tool track the scenario and confirms when it is closed:

covergroup cg_burst;
  cp_len: coverpoint burst_len {
    bins single    = {8'h00};
    bins short[]   = {[8'h01:8'h0F]};
    bins medium[]  = {[8'h10:8'hFE]};
    bins max_burst = {8'hFF};   // explicit corner bin
  }
  cp_type: coverpoint burst_type {
    bins fixed  = {AXI_FIXED};
    bins incr   = {AXI_INCR};
    bins wrap   = {AXI_WRAP};
  }
  // Cross: catch WRAP with max burst — hard corner case
  cx_type_len: cross cp_type, cp_len {
    // Exclude impossible: FIXED type cannot use max length
    ignore_bins fixed_max =
      binsof(cp_type.fixed) && binsof(cp_len.max_burst);
  }
endgroup

Directed Sequences for Hard Bins

Some coverage bins are statistically improbable regardless of constraint tuning — for example, a specific protocol error recovery sequence that requires a precise multi-cycle handshake. These "hard bins" require directed tests: tests that procedurally force the exact stimulus needed without relying on the random solver at all.

// Targeted sequence: close the WRAP + max_burst cross bin
class axi_wrap_maxlen_seq extends uvm_sequence #(axi_seq_item);
  `uvm_object_utils(axi_wrap_maxlen_seq)

  function new(string name = "axi_wrap_maxlen_seq");
    super.new(name);
  endfunction

  task body();
    axi_seq_item item;
    10.times do begin             // repeat for robustness
      item = axi_seq_item::type_id::create("item");
      start_item(item);
      // No randomisation — force exact values
      item.burst_type = AXI_WRAP;
      item.burst_len  = 8'hFF;    // 256-beat WRAP burst
      item.burst_size = 3'b011;   // 8-byte data width
      item.addr       = 32'hDEAD_0000;
      finish_item(item);
    end
  endtask
endclass

// Closure test that runs the targeted sequence
class test_closure_wrap_max extends base_test;
  `uvm_component_utils(test_closure_wrap_max)

  task run_phase(uvm_phase phase);
    axi_wrap_maxlen_seq seq;
    phase.raise_objection(this);
    seq = axi_wrap_maxlen_seq::type_id::create("seq");
    seq.start(env.agent.sequencer);
    phase.drop_objection(this);
  endtask
endclass

The closure test is run once to confirm the bin closes, then added permanently to the regression suite so it cannot re-open in future runs after RTL changes.

Exclusion Waivers

Not every uncovered bin represents a missing test — some scenarios are structurally impossible given the design's architecture. These bins must be formally excluded with documented justification rather than left as open holes that inflate the coverage deficit.

Inline Pragma Exclusion

Most EDA tools support source-level annotations to exclude specific lines or blocks from code coverage. These pragmas are inserted directly into the RTL or testbench:

// Questa / Xcelium inline exclusion syntax

// Exclude a block from line and branch coverage
// coverage off
always_ff @(posedge clk) begin
  // This code path is architecturally dead —
  // design spec v2.3 §4.7: WRAP bursts use fixed
  // internal wrap length; external length field ignored
  if (wrap_override) wrap_len_reg <= ext_wrap_len;
end
// coverage on

// Exclude a single bin inside a covergroup
covergroup cg_op;
  cp_op: coverpoint op {
    bins read  = {OP_READ};
    bins write = {OP_WRITE};
    // Atomic op excluded: not implemented in this rev
    ignore_bins atomic = {OP_ATOMIC};
  }
endgroup

Tool Exclusion File

For code coverage (line, branch, toggle), exclusions are typically managed in a separate exclusion file rather than modifying the RTL source. This keeps the RTL clean and makes the exclusion set auditable:

# coverage_exclusions.do
# Reviewed and approved: lead verification engineer 2026-06-20

# Exclude dead code: wrap_override never asserted by design
# Justification: Spec §4.7 — wrap length is hardwired, ext field unused
coverage exclude -srcfile rtl/axi_burst_ctrl.sv \
  -linerange 142 148 -comment "dead: wrap_override unreachable"

# Exclude OP_ATOMIC toggle: feature not in scope for Rev A
coverage exclude -inst /tb/dut -toggle {op_atomic} \
  -comment "OP_ATOMIC: feature deferred to Rev B — TKT-4492"

Cross-Coverage Holes and binsof

Cross coverage is the most complex form of functional coverage because the number of bins grows multiplicatively. A cross of two 8-bin coverpoints produces 64 cross bins, most of which may be legal but hard to hit. Some may be impossible (invalid combinations of orthogonal dimensions).

covergroup cg_cmd_cross;

  cp_cmd: coverpoint cmd_type {
    bins read  = {CMD_READ};
    bins write = {CMD_WRITE};
    bins flush = {CMD_FLUSH};
  }

  cp_size: coverpoint data_size {
    bins b1  = {3'b000};   // 1 byte
    bins b2  = {3'b001};   // 2 bytes
    bins b4  = {3'b010};   // 4 bytes
    bins b8  = {3'b011};   // 8 bytes
  }

  // Cross: all command × all size combinations
  cx_cmd_size: cross cp_cmd, cp_size {

    // Spec §3.2: FLUSH ignores data_size — always treats as full cache line
    // Exclude all FLUSH × size combinations except the default b8
    ignore_bins flush_b1 =
      binsof(cp_cmd.flush) && binsof(cp_size.b1);
    ignore_bins flush_b2 =
      binsof(cp_cmd.flush) && binsof(cp_size.b2);
    ignore_bins flush_b4 =
      binsof(cp_cmd.flush) && binsof(cp_size.b4);

    // Explicitly track the hard corner: WRITE + 1-byte (rare in practice)
    bins write_byte = binsof(cp_cmd.write) && binsof(cp_size.b1);
  }
endgroup

After narrowing the cross to only legal combinations, close the remaining hard cross bins with a directed sequence that simultaneously drives the correct command and size, as shown in the targeted sequence pattern above.

Regression Strategy and Seed Management

Coverage closure does not happen in a single simulation run. It requires a carefully managed regression campaign where results from many seeds accumulate into a single merged database.

Seed Management

Each constrained-random run uses a different random seed. Good seed management means:

• Record every seed that produced useful coverage. Store seed → UCDB file mappings in a spreadsheet or CI artifact registry.
• Re-run failing seeds to distinguish intermittent failures from deterministic RTL bugs.
• Tag closure seeds — seeds that specifically closed previously-open bins — and lock them into the permanent regression so they re-run on every RTL change.
• Retire low-value seeds — after closure, seeds that add zero new coverage can be dropped to reduce regression runtime without losing coverage.

Parallel Regression

Coverage closure regressions are embarrassingly parallel. Each seed runs independently and its UCDB is merged at the end. Use your grid engine (LSF, SGE, or a CI parallel matrix) to fan out hundreds of seeds simultaneously:

#!/bin/bash
# Launch 200 parallel seeds; merge when all done

SEEDS=(1001 1002 1003 ... 1200)
UCDB_DIR=./ucdb

for seed in "${SEEDS[@]}"; do
  bsub -J "cov_${seed}" -o logs/cov_${seed}.log \
    vsim -c -do "run -all; coverage save ${UCDB_DIR}/seed_${seed}.ucdb; quit" \
         -sv_seed ${seed} tb_top
done

# Wait for all jobs, then merge
bwait -w "ended(cov_*)"
vcover merge -out merged_final.ucdb ${UCDB_DIR}/*.ucdb
vcover report -html -details -output final_report merged_final.ucdb

Accumulation Across Runs

Coverage databases are cumulative. Each new batch of seeds is merged into the master database, and the coverage percentage monotonically increases (never decreases, unless the covergroup definition changes). Track progress by graphing total functional coverage percentage against number of unique seeds run — the curve flattens as you approach the hard-bin regime and directed tests become necessary.

Sign-Off Criteria

Sign-off criteria define the numerical thresholds that must be met for the verification team to declare a block "ready for tapeout." These thresholds are defined in the project's Verification Plan (VPlan) at the start of the project, not negotiated at the end.

EDA Tool Support

Common Pitfalls in Coverage Closure

• Waiver inflation — Teams under schedule pressure waive too many bins without proper justification. Establish a waiver budget (e.g., max 3% waivers) and require management sign-off for overages.
• Coverage without assertions — High functional coverage means all scenarios were exercised, but not necessarily checked correctly. Coverage without a rich SVA or scoreboard can miss bugs even at 100%.
• Covergroup mismatch after RTL change — An RTL change can invalidate existing covergroups if signal widths or enum values change. Always re-validate your covergroup definitions after any RTL modification.
• Ignoring low-hit bins — Bins with hit count 1 or 2 passed by luck. These are statistical accidents that should be investigated and reinforced with additional directed or weighted-random runs.
• Not tracking closure seeds — If a seed that closed a hard bin is not recorded and re-run, an RTL bug fix could re-open the bin without being noticed until the next report cycle.
• Late VPlan definition — Sign-off criteria negotiated under schedule pressure at the end of a project are always lower than they should be. Define thresholds in the VPlan before any RTL is written.

Frequently Asked Questions