In short: A retention flop is a special flip-flop with a shadow (balloon) storage element on an always-on supply that preserves a handful of critical state bits while the main logic is power-gated off, so the block wakes up in its exact pre-sleep state instead of being reset.
When a design team power-gates a block to kill leakage, they face an awkward truth: cutting the supply erases every flip-flop. For a block that must resume exactly where it left off — a USB controller mid-transaction, a CPU pipeline holding a program counter, a configuration register bank — losing that state is unacceptable. Re-initializing from scratch costs time, energy, and sometimes correctness. The retention flop (also called a state-retention register, SRPG cell, or retention flip-flop) is the cell-level answer to this problem, and it is one of the most frequently probed topics in low-power VLSI interviews.
Why power gating erases state
In a power-gated design, a header or footer switch (a PMOS "header" between VDD and the block's virtual VDD, or an NMOS "footer" to ground) disconnects the logic from the real rail. Once the virtual rail collapses, the cross-coupled inverters inside an ordinary flip-flop lose their feedback loop and the stored value evaporates. Leakage in a modern FinFET node at 5 nm or 7 nm can dominate total power during long idle windows, so turning the block fully off is attractive — but only if state can survive.
A single sleep/wake cycle that saves even a few hundred state bits can avoid a full re-boot sequence costing thousands of cycles. For always-connected SoCs that sleep and wake millions of times a day, retention is what makes aggressive power gating practical.
The balloon latch: a shadow cell on an always-on supply
The core idea is deceptively simple. Alongside the master-slave structure of a normal flip-flop, the retention flop adds a small low-leakage "balloon" latch powered from a separate always-on supply (often written VDDG or VDD_RET). This shadow latch is typically built from high-Vt, long-channel transistors so that it leaks almost nothing while holding data. Two dedicated control signals orchestrate the transfer:
- SAVE (sometimes called RESTORE's partner, or driven by a single NRETAIN/RET pin) — asserted just before the power switch opens, it copies the flop's current value into the balloon latch.
- RESTORE — asserted after the supply returns and has settled, it copies the balloon value back into the main flop before the clock resumes.
Between those two events the main flop can go completely dark; only the tiny balloon cell stays alive. Because the balloon is small and high-Vt, the always-on retention supply draws a fraction of the block's active leakage.
Save/restore timing — where candidates slip
The retention sequence is a strict handshake with the power-management controller, and getting the ordering wrong corrupts state. A correct cycle looks like this:
- Stop the clock to the block (clamp it low) and quiesce inputs with isolation cells.
- Assert SAVE — the balloon captures Q. SAVE must be stable for the balloon's setup/hold window before the supply drops.
- Open the power switch; the switchable domain collapses. The balloon holds on VDDG.
- Wake: close the power switch, wait for the virtual rail to settle (inrush/ramp time, often tens to hundreds of nanoseconds).
- Assert RESTORE — the main flop reloads from the balloon.
- De-assert isolation, then release the clock.
The classic bug: releasing RESTORE or the clock before the virtual rail is fully settled. The flop then latches a partially-restored or metastable value. Always-on retention control pins (SAVE/RESTORE/clock) must themselves be routed on the always-on supply and buffered so they arrive glitch-free.
In a UPF (IEEE 1801) flow, you describe all of this declaratively: set_retention names the retention strategy and supply, set_retention_control binds the SAVE/RESTORE signals and their polarity, and the power switch, isolation, and level-shifter strategies complete the intent. Synopsys Design Compiler / Fusion Compiler and Cadence Genus/Innovus read the UPF and swap ordinary flops for library retention flops during synthesis, then verify the sequence with tools like Synopsys VC LP or Siemens Questa power-aware simulation. Mentor/Siemens Calibre and the formal low-power checkers confirm the isolation and retention topology before signoff.
Retention vs. the alternatives
| Technique | Leakage in sleep | Wake latency | State kept? | Area cost |
|---|---|---|---|---|
| Clock gating only | High (logic still powered) | ~0 | Yes | Minimal |
| Power gating, no retention | Very low | Long (re-init) | No | Switches only |
| Power gating + retention flops | Very low + tiny always-on leak | Short (restore) | Yes | ~1.2–2× flop area |
| Save to on-chip SRAM | Low | Medium (DMA out/in) | Yes (bulk) | Controller + memory |
A retention flop typically costs 20–100% more area and a little more active power than a plain flop because of the extra balloon latch and routing, so teams retain only the essential state — control FSMs, configuration, the few architectural registers needed to resume — and let the rest re-initialize. Choosing that minimal retention set is a real engineering decision and a frequent interview discussion. For large bulk state, dumping to always-on SRAM before sleep is cheaper per bit than giving every flop a balloon.
A worked micro-example
Imagine a sensor-hub FSM holding a 24-bit configuration register plus an 8-bit state counter that must survive deep sleep. Mark those 32 flops retention in UPF; the tool maps them to the library's retention variant on VDDG. Leave the 4,000 datapath flops as standard cells on the switchable supply. During a 50 ms idle window, the switchable domain leaks essentially zero, while the 32 balloon latches on VDDG sip perhaps a few nanowatts. On wake, RESTORE reloads the 32 bits in one or two clock edges and the hub resumes mid-stream — no I2C re-enumeration, no lost count. That is the entire value proposition of retention in one picture.
Signoff and verification pitfalls
Low-power verification catches the failures functional sim never will. Power-aware (UPF) simulation in Questa or VCS corrupts non-retained flops to X at power-down so you see missing retention. Formal low-power checks (Synopsys VC LP, Cadence Conformal Low Power) confirm every retention register has a legal control signal, that control nets live on an always-on domain, and that isolation guards every crossing from the off domain. If any of those fail, the chip may wake with garbage — a bug that is expensive to find in silicon and nearly impossible to debug after tape-out.
For a deeper treatment of the switch fabric and isolation cells that surround these flops, see our companion piece on power gating in VLSI, and for the intent language that drives the whole flow read UPF and low-power design intent. If you want hands-on labs with real Synopsys and Cadence low-power flows, our partner ChipXpert VLSI training runs guided power-aware RTL-to-GDS projects. Browse the full catalog on our courses page.
Want to design, map, and verify retention flops in a real UPF flow? The CourseTron Low-Power VLSI Design track walks you from power intent through power-aware signoff with industry tools. Enroll today.
Frequently asked questions
What is the difference between a retention flop and a normal flip-flop?
A normal flip-flop loses its value the instant its supply is removed. A retention flop adds a small balloon latch on an always-on supply plus SAVE/RESTORE control, so its value survives power gating and is reloaded on wake.
Why is the balloon latch built from high-Vt transistors?
The balloon must stay powered throughout sleep, so its own leakage directly adds to always-on power. High-Vt, long-channel devices leak orders of magnitude less than the standard-Vt cells used in the fast datapath, keeping the retention supply current tiny.
When should SAVE and RESTORE be asserted relative to the power switch?
SAVE is asserted and allowed to settle before the power switch opens; RESTORE is asserted only after the switch closes and the virtual rail has fully settled. Violating this ordering latches corrupt or metastable state.
Do I have to make every flop a retention flop?
No, and you should not. Retention flops cost extra area, routing, and always-on leakage, so teams retain only essential control, configuration, and architectural state, letting bulk datapath flops re-initialize or dumping large state to always-on SRAM instead.