Skip to content
STIMSMITH

Broken Conditionals

Concept

Broken conditionals are a category of hardware design bugs in which conditional logic is implemented incorrectly — for example, by omitting a required case or by misderiving a select signal that guards an assignment. They are one of two high-level bug categories used by ENCARSIA to classify architecturally observable RTL defects, alongside signal mix-ups, and are modelled in the Yosys intermediate representation by corrupting multiplexer trees that encode conditional assignments.

First seen 7/15/2026
Last seen 7/15/2026
Evidence 7 chunks
Wiki v1

WIKI

Overview

Broken conditionals are hardware design bugs that arise from improper handling of exceptional cases or of operations permitted only in a specific state, such as a particular privilege mode. In an RTL design, they manifest as conditional logic that is too loose (forgotten guards), or as cases that are missing entirely (forgotten edge cases such as resets, default cases, or overflow checks).

In the ENCARSIA bug taxonomy, broken conditionals form one of two top-level categories that together account for all architecturally observable bugs found in the authors' survey of CPU designs. The complementary category is signal mix-ups. Bugs that modify only the value assigned inside a conditional — but leave the conditions themselves intact — are counted as signal mix-ups rather than broken conditionals.

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

1 connections
Encarsia ← implements 100% 2e
ENCARSIA implements broken conditional transformations to inject bugs.

CITATIONS

12 sources
12 citations — click to expand
[1] Broken conditionals refer to issues arising from improper handling of exceptional cases or, e.g., operations allowed only in a specific privilege mode. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection
[2] Yosys represents conditionals as multiplexer trees, a hierarchical arrangement of multiplexers where each level progressively narrows down the set of possible expressions assigned to the signal at the root of the tree. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection
[3] In this representation, broken conditionals correspond to a potential branch missing from the multiplexer tree, or an incorrectly derived select signal that does not match the condition of the assignment. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection
[4] ENCARSIA abstracts multiplexer trees into a table representation where the table maps specific select signal combinations to the corresponding expression chosen in that case. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection
[5] Removing a single row from the table can model a designer forgetting to consider a special case. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection
[6] Turning a select signal into an X (don't-care) can model cases where designers place insufficient constraints on a case; conversely turning a don't-care into a specific value models bugs where constraints are placed mistakenly. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection
[7] These transformations cover the entirety of the bugs in conditional logic revealed in the survey. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection
[8] ENCARSIA translates the manipulated table into a Yosys internal pmux cell (a many-input multiplexer using one-hot encoding) and uses eq cells to compare the table's select-signal combinations to runtime values. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection
[9] Of 177 relevant bugs found in the survey, 111 (63%) were signal mix-ups and 66 (37%) were broken conditionals. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection
[10] The survey reports broken-conditional counts per design: Ibex 17, CVA6 22, Rocket 8, BOOM 13, HACK@DAC19 2, HACK@DAC21 4. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection
[11] Bugs affecting conditional assignments are classified as broken conditionals when they involve missing cases or incorrect conditions, exemplified by a forgotten nested conditional (like CVA6 PR #138) and a missing case in a switch statement (like BOOM PR #173). Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection
[12] Bugs that concern solely the conditionally assigned values but do not modify any conditions are classified as signal mix-ups rather than broken conditionals. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection