Coverage Directed Test Generation
ConceptCoverage Directed Test Generation (CDG) is a dynamic verification method in which coverage metrics obtained from a current simulation are used to drive the generation of inputs for subsequent simulations. CDG has been deployed in both hardware functional verification (notably for processor and RTL designs) and software testing (e.g., human–robot interaction). The evidence traces CDG from early academic mechanisms such as MicroGP, Bayesian-network-based and Markov-chain-based approaches, through model-based test-program generation tools such as IBM Genesys-Pro, to recent coverage-guided hardware fuzzing frameworks and reinforcement-learning-driven software test generation, and characterizes CDG mechanisms as a research response to the limits of unguided random generation and to the engineering cost of manually tuning generator constraints.
First seen 5/26/2026
Last seen 8/2/2026
Evidence 7 chunks
Wiki v4
WIKI
Overview
Coverage Directed Test Generation (CDG) is a dynamic verification method in which coverage metrics obtained from a current simulation are used to drive the generation of inputs for subsequent simulations. The FuzzWiz evidence describes CDG as "another renowned dynamic method which is deployed in both software testing and hardware verification," and defines the core mechanism explicitly: "coverage metrics from the present simulation are used to drive the generation of inputs for subsequent simulations." The BU thesis material gives a complementary description: "the constraints of a test generator are automatically driven by the coverage feedback so that the test input generated in the next round can increase the overall coverage."
The concept appears in the evidence in two main application domains:
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
5 connectionsCDG mechanisms can use Bayesian networks for test generation
Avi Ziv's research interests include coverage-directed test generation
MicroGP uses genetic programming for CDG
CDG frameworks can use Markov chain models for test generation
The paper mentions Coverage Directed Test Generation as a relevant methodology.
LINKED ENTITIES
12 linksConstrained Random Verification related_to FuzzWiz evidence situates CDG alongside CRV as a dynamic verification method, characterizing CRV as failing to explore the state space due to time-space explosion.
simulation-based verification context_for FuzzWiz evidence frames simulation-based verification as the strongest method in verification and the parent context within which CDG operates.
Coverage-guided Fuzzing modern_instantiation_of Both FuzzWiz and the BU thesis frame coverage-guided fuzzing as a recent approach used to address the CDG problem in hardware.
FuzzWiz example_of FuzzWiz evidence presents FuzzWiz as an automated fuzzing framework plus MetaFuzz metamodeling code generator aimed at the CDG problem in hardware.
ProcessorFuzz example_of BU thesis presents ProcessorFuzz as a coverage-guided hardware fuzzer with a register-state-based coverage metric tailored for processors; ProcessorFuzz paper discusses it in the context of hardware fuzzing and CDG motivation.
DirectFuzz example_of BU thesis introduces DirectFuzz as a directed hardware fuzzing mechanism that adapts software directed fuzzing to hardware; relevant to CDG as it uses coverage feedback to focus verification effort.
TargetFuzz example_of BU thesis introduces TargetFuzz as a mechanism that guides fuzzing towards recently modified code regions using a target-specific corpus.
Genetic Programming uses BU thesis and Ioannides–Eder describe MicroGP as a CDG mechanism using genetic programming to evolve instruction sequences.
Differential Testing related_to BU thesis describes differential testing as the bug-detection approach used by processor fuzzers that sits alongside coverage feedback.
TheHuzz related_to ProcessorFuzz evidence describes TheHuzz as a hardware fuzzer relying on software-testing-style coverage metrics such as statement, branch, line, and expression coverage, which prior work considers insufficient for processor verification.
RFUZZ related_to ProcessorFuzz evidence notes Li et al.'s enhancement of RFUZZ with symbolic simulation, which is highly coupled to Chisel HDL and limits applicability.
DiFuzzRTL related_to ProcessorFuzz evidence references DIFUZZRTL in its processor-fuzzing comparisons and configurations.
CITATIONS
21 sources21 citations — click to expand
[1] CDG is a dynamic verification method deployed in both software testing and hardware verification, in which coverage metrics from the present simulation are used to drive the generation of inputs for subsequent simulations. FuzzWiz - Fuzzing Framework for Efficient Hardware Coverage
[2] Simulation-based verification is the strongest method in verification and entails simulating a Design Under Verification with valid input sequences and evaluating its behavior to discover bugs. FuzzWiz - Fuzzing Framework for Efficient Hardware Coverage
[3] Constrained Random Verification (CRV) is one of the most widely used methodologies and falls short in thoroughly exploring the state space of the design due to the phenomenon of time-space explosion. FuzzWiz - Fuzzing Framework for Efficient Hardware Coverage
[4] Effectiveness of CDG test generation depends on the structure of the DUV, the coverage criterion, and input space; the generated tests still miss a large number of potentially severe bugs and regression of these test simulations often requires longer turnaround time. FuzzWiz - Fuzzing Framework for Efficient Hardware Coverage
[5] Coverage-guided fuzzing has been studied in hardware verification to address the CDG problem; FuzzWiz and MetaFuzz are introduced as automated frameworks targeting HDL-, coverage-feedback-, and fuzzer-engine-specific limitations of prior work. FuzzWiz - Fuzzing Framework for Efficient Hardware Coverage
[6] In CDG, the constraints of a test generator are automatically driven by coverage feedback so that the test input generated in the next round can increase the overall coverage. BU thesis on fuzzing (ProcessorFuzz/DirectFuzz/TargetFuzz)
[7] MicroGP [Squillero, 2005] is a CDG mechanism that generates test inputs using an instruction template based on genetic programming, with statement coverage as the fitness value for searching an instruction sequence. BU thesis on fuzzing (ProcessorFuzz/DirectFuzz/TargetFuzz)
[8] Fine and Ziv (2003) propose a CDG mechanism based on Bayesian networks; setting up the network requires in-depth expertise in the design specifications of the RTL design. BU thesis on fuzzing (ProcessorFuzz/DirectFuzz/TargetFuzz)
[9] Wagner et al. (2005) present a CDG framework using a Markov chain model whose weights are fine-tuned based on collected coverage; the framework relies on a custom template that requires deep domain knowledge. BU thesis on fuzzing (ProcessorFuzz/DirectFuzz/TargetFuzz)
[10] CDG mechanisms aim to find a balance between the amount of domain knowledge applied to the framework and the general applicability of the mechanism [Ioannides and Eder, 2012]. BU thesis on fuzzing (ProcessorFuzz/DirectFuzz/TargetFuzz)
[11] Formal verification methods (e.g., symbolic execution, model checking) use mathematical reasoning to prove hardware conformance but suffer from the state explosion problem and do not scale well for complex RTL designs such as a processor. BU thesis on fuzzing (ProcessorFuzz/DirectFuzz/TargetFuzz)
[12] Coverage-guided fuzzing has been adapted as a dynamic verification method for hardware, including processors, when differences between software and hardware execution and bug detection are addressed. BU thesis on fuzzing (ProcessorFuzz/DirectFuzz/TargetFuzz)
[13] Random instruction generators are commonly used in processor verification because they require limited human expertise and scale to large RTL designs, but lack of coverage guidance leads to repetitive inputs that test the same processor functionalities and decrease the chances of finding bugs. ProcessorFuzz: Processor Fuzzing with Control and ...
[14] Adjusting constraints of a random test generator to target uncovered RTL regions significantly increases engineering effort and slows down the verification process; CDG mechanisms were proposed to overcome this. ProcessorFuzz: Processor Fuzzing with Control and ...
[15] Trippel et al. translate hardware designs to software models and fuzz those models to reuse software-fuzzer coverage metrics (basic block, edge); this introduces challenges such as proving the equivalency between hardware design and software model. ProcessorFuzz: Processor Fuzzing with Control and ...
[16] TheHuzz relies on coverage metrics such as statement, branch, line, and expression extracted via industrial tools (e.g., Cadence, ModelSim); prior work considers these metrics insufficient for processor verification. ProcessorFuzz: Processor Fuzzing with Control and ...
[17] Li et al.'s enhancement of RFUZZ with symbolic simulation is highly coupled to Chisel HDL, which limits applicability, and monitoring multiplexers in complex designs introduces excessive performance overhead. ProcessorFuzz: Processor Fuzzing with Control and ...
[18] Ioannides and Eder evaluate MicroGP on a fully fledged industrial design, reporting good code coverage with reasonably compact tests compared to traditional test generation, with scope for improvement in test diversity. Feedback-based Coverage Directed Test Generation: An industrial evaluation
[19] MicroGP uses an evolutionary algorithm, based on a customized instruction library corresponding to the instruction set architecture of a particular processor, to evolve a set of test programs whose best aims to achieve high coverage. Feedback-based Coverage Directed Test Generation: An industrial evaluation
[20] Verification is described as reaching 'crisis proportions' because it is unpredictable in nature and, given exhaustive simulation is commercially unacceptable, depends on engineers selecting scenarios, making the process and quality criteria subjective. Feedback-based Coverage Directed Test Generation: An industrial evaluation
[21] ProcessorFuzz is presented as a coverage-guided hardware fuzzer for processors using a register-state-based coverage metric and is HDL-agnostic. ProcessorFuzz: Processor Fuzzing with Control and ...