correlation
The One-Bit Problem
2026 · 6 min read
A model that matches the RTL on every directed test can still be wrong in the one place nobody tested. 99% correlation is not almost done — it's where the real work starts.
Every modeling engagement eventually produces the same comfortable chart: a correlation report showing hundreds of matched transactions, a pass rate in the high nineties. It feels like proof. It isn't. It's a measurement of the tests you ran, not of the design.
The failures we've been asked to find — after someone else's model passed a regression suite — almost never live in the transactions anyone directed a test at. They live one layer down:
- The beat that arrives in the same cycle something else completes. Whether the observer sees the old value or the new one is a semantics question. Get it wrong and the model agrees with every test that wasn't built around the collision.
- The error path nobody wanted to write. Error responses are tedious to test and easy to defer. So every model agrees on the happy path, and disagrees precisely when firmware hits the condition in the field.
- The field that reads back differently than it was written. Write-only bits, read-to-clear side effects, status that changes on the way out the door. The manual describes the intent. The RTL implements a detail.
The manager who wouldn't take 99%
Early in my career I designed the lead-lag filter for a digital control loop. The filter itself was seventh order; sitting inside the system's equalizer, the whole thing was closer to fifteenth order, driving an actuator that had to position to a micron. A closed loop running 60 to 70 dB of gain does not forgive sloppy arithmetic.
The flow was the honest one. Model it in floating point first. Verify it behaves. Then, with the system's margins in hand, quantize it into a digital filter — pick the zero-order-hold characteristics, and design the fixed-point arithmetic down to the exact bit width of the ALU that would run it. That was an era when memory was expensive and silicon was priced by the gate, so PPA wasn't a slogan — it was survival. Fixed point, then RTL.
I assumed, naturally, that the C fixed-point model would be the golden trace and the RTL would match it 100%. Same arithmetic, same word lengths, same operations. It's a digital world — deterministic, bit for bit. Why would it disagree?
It disagreed. What followed was the most grueling stretch of debugging I had done to that point. My manager's position was absolute: it matches 100%, or we keep going. I wanted to argue for a tolerance — surely some mismatches are acceptable? — but I couldn't refute him, and the reason I couldn't is the reason this story matters. It's a digital world. Either the bits agree or they don't. There is no "close enough" in a bit stream.
Here is what his stubbornness bought. Because not one mismatch was allowed to stand unexplained, every one of them had to be understood — and understanding them found real problems. Bugs in the model. Bugs in the RTL. Overflow paths nobody had bounded. Underflow quietly eating significant digits in exactly the operating region where the loop needed them most. None of it would have surfaced if we had agreed that 99% passes. The mismatches weren't noise. Each one was a finding wearing a disguise.
What the last 1% is hiding
The uncomfortable truth about that final percent of mismatches: they are not all model bugs. Some of them are the RTL being wrong — and a model built by copying the RTL would have copied the bug too. This is the entire reason a model should be built from the spec and correlated against the implementation, instead of extracted from it. The mismatch list is not noise to be ground down. It's the deliverable. Every unresolved mismatch is a question the team gets to answer before silicon.
That changes what correlation means. It's not a gate that says "close enough." It's a triage list, and the discipline is in the classification:
- Model bug — fix the model, rerun.
- RTL bug — write it up, prove it, report it. This is the finding clients remember.
- Ambiguous spec — the hardest and most valuable category. Two defensible readings, and the choice changes what firmware must do. That's a conversation, not a diff.
The stance that follows
If a one-bit difference can hide inside a 99% pass rate, then "the model matches" is never the claim we make. The claim is: here is everything we ran, here is what agreed, here is the classified list of what didn't, and here is our judgment on each entry.
Correlation isn't the end of a modeling project. It's the review that the design never had.