Cross Coverage

Functional Coverage · Module 19 · Page 19.5

The Engineering Problem

Coverpoints (Module 19.3) measure each feature in isolation — every operation was seen, every size was seen, every mode was seen. But a design's bugs often live not in any single feature but in the combination of features: a WRITE at the maximum size, a read in low-power mode, an error response during a burst. A testbench can reach 100% on every coverpoint — every operation and every size individually exercised — while never once exercising WRITE × max-size together, the exact combination where the bug lives. Per-coverpoint coverage is blind to combinations: it checks that each axis was visited, not that each cell was. The construct that measures combinations is the cross — and it is the most powerful coverage construct and the most dangerous, because the combination space explodes multiplicatively, and crossing the wrong coverpoints yields a cross with millions of bins that can never close — a project-killer. The problem this chapter solves is cross coverage: measuring the combinations that matter, and controlling the explosion so the cross stays meaningful and closable.

A cross measures combinations of coverpoints — the Cartesian product of their bins — answering "was every combination exercised?", not just "was every value of each exercised?". cross cp_op, cp_size creates a cross bin for every pair (op-bin × size-bin); the cross is covered when every meaningful combination is hit. Crosses matter because bugs hide in combinations that per-coverpoint coverage cannot see — each coverpoint at 100% does not imply every combination occurred. But the cross-bin count is the product of the coverpoints' bin counts, so the space explodes: crossing two auto-binned coverpoints (64 bins each) is 4096 bins; a third makes it 262144 — unclosable. The art is control: cross only the coverpoints whose interaction is functionally significant, give them coarse bins (few each), and prune the meaningless and illegal combinations with bin selection (binsof / intersect), ignore_bins, and illegal_bins inside the cross. This chapter is cross coverage: combinations as the Cartesian product, why bugs hide in cells, the explosion, and the pruning that keeps a cross meaningful and closable.

What is cross coverage — how does it measure combinations of coverpoints as a Cartesian product, why do bugs hide in combinations that per-coverpoint coverage is blind to, how does the combination space explode, and how do you control it with coarse bins and pruning so the cross measures the meaningful combinations rather than an unclosable product?

Motivation — why combinations need their own coverage

Per-coverpoint coverage cannot see combinations, and combinations are where interaction bugs live. The reasons crosses are essential — and dangerous:

• Bugs hide in combinations, not isolated features. A design handles each operation correctly and each size correctly, but fails at a specific combination (WRITE at max size) where two features interact. Isolated coverage misses it; only the cross measures whether that combination occurred.
• Per-coverpoint 100% is not combination 100%. Every op seen and every size seen does not mean every op×size seen — you could hit READ-small and WRITE-large and reach 100% on both coverpoints while never hitting WRITE-small or READ-large. The margins can be full while cells are empty.
• The cross is the deepest argument for functional coverage. Interaction coverage is exactly what simpler metrics (code coverage, per-signal toggle) cannot provide — it's intent about how features combine, which only a deliberately-authored cross expresses.
• But the space explodes multiplicatively. Cross bins = product of bin counts. A few coverpoints with many bins → thousands or millions of cross bins — most meaningless, the cross never closing. Crossing carelessly is a project-killer.
• Control is the whole skill. A useful cross is a controlled one — few axes, coarse bins, aggressive pruning of meaningless and illegal combinations. The value of cross coverage is unlocked only by managing the explosion.

The motivation, in one line: bugs hide in combinations of features that per-coverpoint coverage is blind to (every coverpoint at 100% ≠ every combination exercised), so the cross — measuring the Cartesian product — is essential to catch interaction bugs; but the combination space explodes multiplicatively, so the skill is control: cross only the functionally-significant interactions, with coarse bins, pruning the meaningless and illegal combinations, so the cross stays meaningful and closable.

Mental Model

Hold a cross as a grid of cells — per-coverpoint coverage fills the margins, the cross fills the cells, and bugs hide in the cells the margins can't see:

A cross is a grid: one coverpoint's bins are the rows, another's are the columns, and each cell is a combination. Per-coverpoint coverage only checks that every row was visited and every column was visited — the margins — but a margin can be full while interior cells stay empty. The cross checks every cell, and bugs hide in the cells the margins can't see. The catch is that the grid grows multiplicatively, so you keep it small by crossing few axes with coarse divisions and blanking out the cells that can't or shouldn't occur. Picture a checkerboard grid. The rows are one coverpoint's bins (say op: read, write, RMW); the columns are another's (size: small, large, max). Each cell is a combination — write × max, read × small, and so on. Now, per-coverpoint coverage only looks at the margins: it checks that every row was visited at least once (every op occurred somewhere) and every column was visited (every size occurred somewhere). But here's the trap: the margins can be completely full while interior cells are empty. If you ran read-small and write-large and RMW-max, every row has a tally and every column has a tally — 100% per-coverpoint — yet six of the nine cells are empty: you never ran write-small, read-max, and so on. A bug that only manifests at write × max lives in an empty cell that the full margins completely hide. The cross fills in the grid itself: it checks every cell, so the write × max cell must be visited before the cross closes. That's the power. The danger is that the grid grows multiplicatively: 3 rows × 3 columns = 9 cells is fine, but 64 rows × 64 columns = 4096 cells, and adding a third axis (a cube) makes it 262144 cells — most empty, most meaningless, the grid never filling. So you keep the grid small: cross few axes (2 or 3, not 6), with coarse divisions (3–4 bins per coverpoint, not 64), and blank out the cells that can't occur (an ignore — write × size-only-applies-to-read) or shouldn't occur (an illegal — a forbidden combination). A good cross is a small grid of meaningful cells, all reachable.

So a cross is a grid of cells: per-coverpoint coverage fills the margins (every row, every column visited), but the cross fills the cells (every combination), and bugs hide in the empty cells the full margins hide. The grid grows multiplicatively, so you keep it small — few axes, coarse divisions — and blank out the unreachable (ignore) and forbidden (illegal) cells. Cross the few axes whose interaction matters, keep the grid small, and check every cell that can legally occur.

Visual Explanation — the cross as a grid of combinations

The defining picture is the grid: two coverpoints become rows and columns, and the cross is the cells — every combination.

The figure shows the cross as a grid. Coverpoint cp_op (read, write, RMW) forms the rows; cp_size (small, large, max) forms the columns. The cross (cross cp_op, cp_size, the warning-colored center — warning because it's the explosive construct) creates a bin for every cell — every op×size combination (9 cells for 3×3). The crucial reading is the margins-versus-cells distinction. Per-coverpoint coverage checks only the margins: that every row was visited (cp_op at 100% = read, write, RMW each occurred somewhere) and every column was visited (cp_size at 100% = small, large, max each occurred somewhere). The cross checks every cell: the write × max combination (the default-colored node) is its own cell that must be exercised, even when cp_op and cp_size are already at 100%. This is why the cross adds information no amount of per-coverpoint coverage can: you can have full margins (every op, every size) with empty cells (write-max never co-occurred). The success-colored "9 combination cells" is what the cross requires — and the cross is covered only when all (meaningful) cells are hit. The diagram is the anatomy of interaction coverage: coverpoints (rows, columns) → cross (the grid) → cells (combinations) — and the cross measures what the coverpoints alone cannot: that every combination, not just every value, was exercised. The write × max cell standing alone is the whole point: interaction coverage requires the specific combination, because that's where the interaction bug lives. A cross measures the cells; the coverpoints alone measure only the margins.

RTL / Simulation Perspective — declaring and controlling a cross

In code, a cross is one line (cross a, b) — but the control (selecting, ignoring, forbidding cross bins) is where the skill is. The example shows a cross with coarse coverpoints, pruned with binsof/intersect, ignore_bins, and illegal_bins.

covergroup txn_cg with function sample(bus_txn t);
 
  // cross ONLY coarsely-binned coverpoints — few bins each, so the product stays small
  cp_op:   coverpoint t.op   { bins rd = {READ}; bins wr = {WRITE}; bins rmw = {RMW}; }  // 3 bins
  cp_size: coverpoint t.size { bins small = {[1:4]}; bins large = {[5:63]}; bins max = {64}; } // 3 bins
 
  // the CROSS: 3 × 3 = 9 combination bins — manageable and meaningful
  x_op_size: cross cp_op, cp_size {
    // IGNORE meaningless combinations: suppose RMW is never issued at max size (spec-disallowed by config)
    ignore_bins rmw_max = binsof(cp_op.rmw) && binsof(cp_size.max);
 
    // FORBID combinations that must never occur: a WRITE at size 0 would be a protocol violation
    // (size 0 isn't even a bin here, but illustrate forbidding a combination)
    illegal_bins wr_illegal = binsof(cp_op.wr) && binsof(cp_size) intersect {0};
  }
 
  // ✗ ANTI-PATTERN: crossing AUTO-binned coverpoints → explosion, never closes
  // cp_addr: coverpoint t.addr;   // ~64 auto bins
  // cp_data: coverpoint t.data;   // ~64 auto bins
  // x_bad: cross cp_addr, cp_data;  // 64 × 64 = 4096 mostly-meaningless bins → UNCLOSABLE
 
endgroup
// the cross measures COMBINATIONS; binsof/intersect/ignore/illegal PRUNE it to the meaningful ones

The code shows a controlled cross. The crossed coverpoints (cp_op, cp_size) are coarsely binned — 3 bins each — so the cross is 3 × 3 = 9 combination bins, manageable and meaningful. The cross (x_op_size: cross cp_op, cp_size) creates those 9 bins, then prunes: ignore_bins removes a meaningless combination (rmw_max — binsof(cp_op.rmw) && binsof(cp_size.max) — suppose RMW is never issued at max size, so that cell can't occur and shouldn't block closure); illegal_bins forbids a combination that must never occur (wr_illegal — a WRITE at a forbidden size — sampling it fails the test). The binsof() operator selects cross bins by which coverpoint bin they involve, and intersect {...} filters by value — together they express which cells to ignore or forbid. The anti-pattern (commented) is the project-killer: crossing auto-binned coverpoints (cp_addr, cp_data, ~64 bins each) → 64 × 64 = 4096 mostly-meaningless bins → unclosable. The shape to carry: a cross is trivial to declare (cross a, b) but the skill is control — cross coarsely-binned coverpoints (small product), and prune with binsof/intersect/ignore_bins/illegal_bins to the meaningful combinations. The ignore_bins inside a cross remove the unreachable cells (so the cross can close); the illegal_bins inside a cross forbid the impossible cells (so a forbidden combination fails the test). The coarse binning is the first defense against explosion; the pruning is the second. Declare the cross in one line, but bin coarsely and prune aggressively, or it never closes.

Verification Perspective — the explosion and how pruning tames it

The defining hazard of crosses is the multiplicative explosion — and the defining skill is taming it with coarse bins and pruning. Seeing the numbers makes the danger concrete.

The figure shows the explosion and its taming. The cross-bin count is the product of the coverpoints' bin counts. Coarse × coarse (3 × 3 bins) → 9 cross bins — meaningful, closable. Auto × auto (64 × 64, or × 64 for a third) → 4096 (or 262144) → explosion, unclosable. Taming it has two levers. Coarse binning (fewer bins per coverpoint) shrinks the product — the first and most powerful defense (going from 64 to 4 bins per coverpoint turns 4096 into 16). Pruning (ignore_bins removes unreachable combinations, illegal_bins forbids impossible ones, binsof/intersect selects which cells to keep) removes cells. The verification insight is that both levers attack the explosion but differently: coarse binning attacks the product (the multiplicative growth) at its source — fewer bins per axis means a dramatically smaller grid; pruning attacks the remaining grid by removing the cells that can't (ignore) or shouldn't (illegal) occur. The warning-colored explosion is what careless crossing produces; the brand-colored levers transform it into the success-colored small, reachable set of meaningful combinations. The crucial discipline is that coarse binning comes first: you cannot ignore_bins your way out of a 64 × 64 cross (you'd need to list thousands of cells) — you must re-bin the coverpoints coarsely so the product is small to begin with, then prune the few remaining meaningless cells. So the art is: cross coarsely-binned coverpoints (small product), then prune the unreachable and forbidden cells — turning an unclosable product into a small set of meaningful, reachable combinations. The figure is the taming: explosion (product of bin counts) → coarse bins (shrink the product) + prune (remove cells) → meaningful, closable cross. Coarse-bin first to shrink the product, then prune the cells that can't or shouldn't occur.

Runtime / Execution Flow — how a cross bin gets hit

At run time, a cross bin is hit only when all its coverpoints' bins are hit on the same sample — the combination must co-occur. The flow shows it.

The flow shows how a cross bin gets hit. Sample (step 1): one transaction carries values for all the crossed fields at once (op and size and mode together). Map (step 2): each coverpoint maps its value to a bin — cp_op maps op to its bin, cp_size maps size to its bin — the row and the column for this transaction. Cell (step 3): the cross bin at that (op-bin, size-bin) cell is marked hit — the combination that co-occurred. Covered (step 4): the cross closes only when every meaningful combination has co-occurred on some transaction. The runtime insight is the co-occurrence requirement: a cross bin is hit only when its component bins are hit together, on the same transaction — not when they're hit separately on different transactions. This is exactly why per-coverpoint coverage can't substitute: exercising every op (on some transactions) and every size (on some transactions) fills the coverpoints but not the cross cells — the cross cell requires a single transaction where the specific op and the specific size occur together. So to close a cross, the stimulus must produce the combinations — which is harder than producing each value, and is why crosses drive the most targeted constrained-random work (Module 19.1's feedback loop). The flow is the cross-hit mechanic: sample (all fields together) → map (each to a bin, the row and column) → cell (the intersection bin hit) → covered (when every meaningful cell co-occurred). The co-occurrence is the essence: the cross measures whether the combinations actually happened together, which is what isolated coverage cannot tell you. A cross cell needs its values to co-occur on one transaction — separate exercise of each value never fills it.

Waveform Perspective — combinations co-occurring over time

A cross is visible as combinations co-occurring on individual transactions: a cross cell is hit when its values appear together on one transaction — and a combination that never co-occurs is a cross gap. The waveform shows it.

The waveform shows combinations co-occurring. Each transaction carries an op and a size together. Transaction 1 is read-small (cell read×small hit, x_rd_sm). Transaction 2 is write-large (cell write×large hit, x_wr_lg). Transaction 3 is read-large (cell read×large hit). The crucial reading is the co-occurrence and the gap. Across the run, op covers read and write, and size covers small and large — both coverpoints look well-exercised (the margins are full). But the cell write×small never occurs: no transaction is both write and small, so that cross bin stays empty (x_wr_sm flat) — a combination gap, invisible to the per-coverpoint margins. This is the visual proof of the chapter's thesis: the op coverpoint and the size coverpoint can both read 100% (read and write both occurred; small and large both occurred) while a specific combination (write-small) never co-occurred — an empty cell the full margins completely hide. The cross is what exposes it: x_wr_sm staying empty is a visible gap that demands a transaction where write and small occur together. The picture to carry is that a cross cell is hit only when its values appear on the same transaction (x_rd_sm fires because txn1 is read AND small), and a never-co-occurring combination is a gap that per-coverpoint coverage cannot see. Reading the waveform this way — which combinations co-occurred? which cell is still empty despite full margins? — is reading the cross. The write×small cell staying empty while op and size are both fully covered is the signature of an interaction gap — the exact blind spot that makes cross coverage necessary. A cross cell needs co-occurrence; full margins can hide an empty cell, and that empty cell is where the interaction bug hides.

DebugLab — the cross that could never close

✗ CROSS of two AUTO-binned coverpoints → multiplicative explosion:
  cp_addr: coverpoint t.addr;        // ~128 auto bins (meaningless raw partition)
  cp_data: coverpoint t.data;        // ~128 auto bins
  x_addr_data: cross cp_addr, cp_data;  // 128 × 128 ≈ 16384 bins — MOSTLY impossible combos
  // most cells are raw-value combinations no stimulus targets → cross stuck at ~3%, never closes
  // adding stimulus can't help: the problem is the BINNING, not the stimulus
 
✓ COARSE-BIN first, then CROSS only the meaningful interaction, then PRUNE:
  cp_addr_region: coverpoint t.addr { bins low={[0:'h3FF]}; bins io={['hF000:'hFFFF]}; bins other=default; }
  cp_data_kind:   coverpoint t.data { bins zero={0}; bins ones={'hFFFFFFFF}; bins normal=default; }
  x_region_kind: cross cp_addr_region, cp_data_kind {  // 3 × 3 = 9 MEANINGFUL bins
    ignore_bins io_ones = binsof(cp_addr_region.io) && binsof(cp_data_kind.ones); // can't occur
  }
  // now 9 (minus ignored) reachable, meaningful combinations → closable in a normal regression

Common Mistakes

• Crossing auto-binned or wide coverpoints. The product explodes into thousands of meaningless bins that never close; coarse-bin first.
• Adding stimulus to close an unclosable cross. The problem is the binning, not the stimulus; re-bin the coverpoints coarsely instead of burning compute.
• Crossing everything with everything. Cross only the few interactions that are functionally significant; most pairs don't need a cross.
• Not pruning meaningless combinations. Unreachable cells block closure; remove them with ignore_bins (and forbid impossible ones with illegal_bins).
• Assuming per-coverpoint 100% covers combinations. Full margins can hide empty cells; a cross is needed to require the combinations.
• Going N-way when targeted 2-way crosses suffice. Each axis multiplies the space; prefer several targeted 2-way or 3-way crosses over one giant N-way.

Senior Design Review Notes

Interview Insights

Exercises

1. Margins versus cells. Give a concrete example where both coverpoints read 100% but a cross cell is empty, and name the bug that could hide there.
2. Estimate the explosion. For a cross of three coverpoints with 8, 16, and 4 bins, compute the cross-bin count and decide whether it's acceptable.
3. Prune a cross. For a cross of op and size, write the ignore_bins for a combination that can't occur and the illegal_bins for one that must never occur.
4. Coarse-bin to close. A cross of two 32-bit fields won't close. Describe how to re-bin them into a small, meaningful, closable cross.

Summary

• A cross measures combinations of coverpoints — the Cartesian product of their bins — answering "was every combination exercised?", because bugs hide in combinations (write × max size) that per-coverpoint coverage is blind to: every coverpoint at 100% does not imply every combination occurred.
• A cross is a grid of cells: per-coverpoint coverage fills the margins (every row, every column visited), but the cross fills the cells (every combination); a cross bin is hit only when its component bins co-occur on the same transaction.
• The cross-bin count is the product of the coverpoints' bin counts, so the space explodes multiplicatively — crossing auto-binned coverpoints (64 × 64 = 4096, × 64 = 262144) is unclosable, a project-killer, and no stimulus can close a binning problem.
• Control is the skill: coarse-bin the coverpoints first (shrink the product at its source), cross only the functionally-significant interactions, and prune the unreachable (ignore_bins) and forbidden (illegal_bins) cells, selecting with binsof / intersect.
• The durable rule of thumb: a cross is a multiplication — its bin count is the product of the crossed coverpoints' bin counts — so before you cross, count the product, and if it isn't a small, meaningful number, coarse-bin the coverpoints first; cross only the interactions where features genuinely interact, prune the cells that can't or shouldn't occur, and prefer several targeted 2-way crosses to one giant N-way, so the cross measures the meaningful combinations rather than an unclosable product.

Next — Coverage Analysis: with covergroups, coverpoints, bins, and crosses in place, the question becomes how to read the result — the coverage report. How to interpret coverage numbers, find the meaningful gaps, distinguish a stimulus gap from an unreachable bin, merge coverage across many regression runs, and turn the report into the next actions that drive toward closure.