In short: UPF (IEEE 1801) is a Tcl-based sidecar file that captures a chip's power intent — which blocks switch off, at what voltage, and the isolation, level-shifter, and retention cells that keep signals safe across power boundaries — so that one golden description drives simulation, synthesis, and place-and-route consistently.
Why power intent cannot live in the RTL
A modern SoC rarely runs every block at the same voltage all the time. A smartwatch application processor might keep its always-on domain at 0.6 V while the GPU island sits at 0.9 V and the radio is completely powered down for 95% of its life. None of this appears in the Verilog: RTL describes logic, not the power grid, the switch fabric, or the sequencing that brings a domain back to life. If you tried to encode power-down behaviour directly in HDL, you would pollute the design with `ifdef` clutter that no synthesis tool could interpret as real low-power structure.
The Unified Power Format solves this by keeping power intent in a separate, machine-readable file. Standardised as IEEE 1801 (and historically known from the Accellera UPF 1.0 donation in 2007), UPF is written in a Tcl dialect so it is both scriptable and tool-agnostic. The same `.upf` flows through Synopsys VCS and Fusion Compiler, Cadence Xcelium and Innovus, and Siemens Questa — each tool reading the identical intent rather than guessing.
One golden UPF drives the whole flow. Verification sees the power-off behaviour in RTL simulation, synthesis inserts the special cells, and the PnR tool physically implements the switches — all from the same source, which is what prevents the classic "it worked in sim but corrupts in silicon" low-power bug.
Power domains: the organising unit
Everything in UPF hangs off the power domain — a group of instances that share a primary supply and are powered up or down together. You create one with create_power_domain PD_GPU -elements {u_gpu}. Each domain is driven by supply nets and ports (create_supply_net, create_supply_port), and you declare the legal combinations of supply states as power states using add_power_state. A domain that can be at nominal voltage, a retention voltage, or fully off needs those three states enumerated explicitly so the tools know what is reachable.
UPF 2.x and later replaced the older state-table style with supply sets — abstract handles for a power/ground pair you can bind to real nets late in the flow. This lets a verification engineer write intent against PD_GPU.primary long before anyone has decided the exact rail name, which matters on a 200-engineer program where RTL and physical teams work in parallel.
The three special cells
When one domain switches off and a neighbour stays on, three categories of inserted logic keep the design correct.
| Cell | Problem it solves | UPF command |
|---|---|---|
| Isolation | A powered-off output floats to an unknown value and corrupts the live receiver | set_isolation |
| Level shifter | A 0.6 V signal cannot reliably drive a 0.9 V gate (and vice-versa) | set_level_shifter |
| Retention | State would be lost on power-down; a few key flops must survive | set_retention |
Isolation cells clamp an outgoing signal to a known constant (0, 1, or latched) while the source domain is dark. You specify the clamp value and the control signal: set_isolation iso_gpu -domain PD_GPU -isolation_power_net VDD_AON -clamp_value 0 -isolation_signal iso_en. Get the clamp wrong and a powered-down bus can assert a spurious request into the always-on controller — a bug that often only shows up in gate-level power-aware simulation. We cover the mechanics of the clamp and enable timing in depth in our companion piece on isolation cells in VLSI.
Rule of thumb: isolation goes on the output of the domain that powers down, on the receiving (always-on) rail — because the isolation cell itself must stay alive to hold the clamp when everything around it is off.
Level shifters translate logic levels between domains at different voltages. A high-to-low shifter is relatively cheap; low-to-high shifters need the higher rail and are larger. When a crossing is both multi-voltage and switchable you often need an enable-level-shifter (ELS) that does isolation and translation in one cell to save area. Retention registers use a shadow latch on an always-on "retention supply" so a handful of critical state bits — a mode register, a program counter — survive a power cycle. Retention is expensive in area and leakage, so good designs retain tens of flops, not thousands, and reload the rest from memory on wake.
A minimal UPF, end to end
A compact but complete intent for the diagram above reads roughly like this: declare the top supply, create the two domains, define their power states, then attach isolation and level-shifting to the crossing.
create_power_domain PD_AONandcreate_power_domain PD_GPU -elements {u_gpu}create_supply_net VDD_AON/create_supply_net VDD_GPUand a switched version viacreate_power_switchadd_power_state PD_GPU -state {ON ...},{OFF ...}set_isolationwith a clamp value and enable, thenset_level_shifterfor the 0.6 V ↔ 0.9 V crossing
The physical implementation tool then reads this and inserts real cells from the library's low-power kit. If your design-services team needs help writing production-grade UPF for a tapeout, specialists like Avecas design services do this daily across foundry nodes.
Verification: where UPF earns its keep
Power-aware simulation is the payoff. With UPF loaded, the simulator drives powered-off nets to X and checks that isolation is enabled before shutdown and retention is restored before use. A frequent failure is an isolation enable that arrives one cycle too late, letting an X propagate into live logic — invisible in a normal functional run, obvious the moment UPF is active. Teams typically run static UPF checks (consistency, missing isolation, illegal crossings) first, then dynamic power-aware sim, before trusting the intent downstream. See our walkthrough of power-aware simulation basics for the X-propagation debugging patterns.
Common pitfalls
- Missing level shifters on diagonal crossings — a signal that is both isolated and voltage-shifted needs an ELS, not a plain isolation cell.
- Retention supply left out of the always-on set — retained flops lose state if their shadow latch shares the switched rail.
- Over-retention — retaining thousands of flops kills your leakage budget; retain the minimum and reload the rest.
- Intent drift — editing UPF for PnR but not re-running power-aware sim. Keep one golden file.
Want to write UPF that passes a real tapeout review? Our CourseTron Low-Power VLSI course walks you through domains, isolation, retention, and power-aware simulation on an industry-style SoC — with hands-on labs in Synopsys and Cadence tools.
Frequently Asked Questions
Is UPF the same as CPF?
No. CPF (Common Power Format) was Cadence's competing format. UPF, standardised as IEEE 1801, won broad adoption and is now supported across all major vendors, so new designs almost always use UPF.
Where are isolation cells physically placed?
On the always-on side of a boundary, powered by the receiver's rail, so the clamp holds even when the source domain is fully dark.
Do I need retention for every register?
No — retention costs area and leakage. Retain only the few state bits needed to resume (mode, status, program counter) and reload everything else from memory on wake.
Which tools read UPF?
Synopsys (VCS, Fusion Compiler), Cadence (Xcelium, Genus, Innovus), and Siemens EDA (Questa) all consume the same IEEE 1801 file across simulation, synthesis, and place-and-route.