Overview

Broken conditionals are hardware design bugs that arise from improper handling of exceptional cases or of operations permitted only in a specific state, such as a particular privilege mode. In an RTL design, they manifest as conditional logic that is too loose (forgotten guards), or as cases that are missing entirely (forgotten edge cases such as resets, default cases, or overflow checks).

In the ENCARSIA bug taxonomy, broken conditionals form one of two top-level categories that together account for all architecturally observable bugs found in the authors' survey of CPU designs. The complementary category is signal mix-ups. Bugs that modify only the value assigned inside a conditional — but leave the conditions themselves intact — are counted as signal mix-ups rather than broken conditionals.

Examples from Real Designs

• A missing nested conditional inside a state transition (akin to CVA6 PR #138) makes the resulting assignment's guard too loose and can produce access-control weaknesses.
• A missing case arm in a state machine (akin to BOOM PR #173), such as forgetting a reset, default, or overflow check.
• An access-control check that fails to verify that the CPU is in debug mode before permitting access to debug CSRs, enabling unintended access.

Representation in the Yosys IR

Yosys represents conditional assignments as multiplexer trees: a hierarchical arrangement of multiplexers in which each level progressively narrows the set of possible expressions that may be assigned to the signal at the root of the tree. At each level, select signals derived from the assignment's conditions choose which branch to follow, ultimately selecting the expression to assign.

A broken conditional corresponds in this representation to:

1. A branch that is missing from the multiplexer tree, or
2. An incorrectly derived select signal that does not match the condition of the assignment.

The multiplexer-tree abstraction allows ENCARSIA to handle complex conditional assignments with a unified injection approach.

Injection Approach (Table Representation)

ENCARSIA abstracts the multiplexer tree into a table representation. Each row maps a specific combination of select-signal values to the expression that the multiplexer tree root should assign in that case.

The tool injects realistic, complex transformations by performing simple operations on the table, such as removing or adding cases. This avoids the need to modify the circuit after each transformation. The transformations were derived from a survey of real bugs and are intended to model the subtle mistakes that designers actually make:

• Removing a single row — models a designer forgetting to consider a special case.
• Turning a select signal into X (don't-care) — models cases where designers place insufficient constraints on a case.
• Turning a don't-care select signal into a specific value — models bugs where constraints are placed on cases mistakenly.

According to the authors, these transformations cover the entirety of the bugs in conditional logic that they revealed in their survey.

Reconstructing the Circuit

Once the table has been manipulated, it must be translated back into standard circuitry so the design can be simulated, instrumented, or otherwise analyzed by fuzzers. ENCARSIA achieves this by translating the table into a Yosys internal pmux cell — a many-input multiplexer that uses one-hot encoding (exactly one bit high per possible select value). Each row in the table becomes a possible case in the conditional assignment: the entry's assignment expression propagates exactly when the select-signal combination matches that row.

The construction proceeds as follows:

1. Connect the row's expression to one of the inputs of the pmux.
2. Generate the corresponding one-hot select bit by adding an eq cell that compares the table's select-signal combination against the actual select-signal value at runtime.
3. Connect the pmux output back to the root wire that was originally driven by the multiplexer tree.

The Yosys backend that translates RTLIL back into Verilog then renders the pmux cell into a process that resembles the original conditional statement.

Survey Statistics

The ENCARSIA survey classified 177 relevant bug fixes across multiple open-source CPU designs. Broken conditionals accounted for 66 (37%) of these, distributed as follows:

Relationship to Other Concepts

• ENCARSIA — the CPU fuzzing evaluation framework that formally defines broken conditionals as one of two bug categories it models via automatic bug injection.
• Signal mix-ups — the sibling bug category; bugs that change only the value assigned inside an existing conditional without altering any conditions are classified as signal mix-ups, not broken conditionals.
• Yosys / RTLIL — the open synthesis suite whose intermediate representation (multiplexer trees, pmux cells, eq cells) ENCARSIA manipulates to inject broken-conditional bugs.