Skip to content
STIMSMITH

Register-Transfer Level (RTL)

Concept WIKI v1 · 5/30/2026

Register-Transfer Level (RTL) is a hardware design abstraction used in processor-core verification, microprocessor hazard analysis, and hardware-security information-flow analysis. The provided evidence shows RTL cores being co-simulated against instruction-set simulators, checked with coverage-guided randomized instruction streams, analyzed for pipeline hazards, and represented in RTL-specific security graphs.

Overview

Register-Transfer Level (RTL) appears in the evidence as a hardware design level for processor cores and microprocessors under verification. In processor-verification settings, the RTL core is treated as the implementation under test and is compared against a higher-level reference such as an instruction-set simulator (ISS). This comparison must account for micro-architectural behavior such as pipelining, prefetching, and fetch buffering.

Role in processor verification

In the cross-level processor-verification setup described in the DATE 2022 paper Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-guided Aging, an instruction generator feeds both an ISS and an RTL core. The ISS acts as a reference model, while the RTL core is integrated into an efficient co-simulation environment compiled into a single binary with in-memory communication.

The approach generates endless, unrestricted instruction streams, including arbitrary combinations of load/store instructions, Control and Status Register (CSR) instructions, and infinite loops. Runtime coverage information is observed from the ISS execution state and used to guide instruction generation through coverage-guided aging. The stated goal is to obtain broad and deep coverage and expose intricate corner-case bugs in the RTL core.

A core adapter is needed because the RTL core can exhibit micro-architectural effects that the ISS does not model in the same way, including pipelining, prefetching, and fetch buffering. The adapter handles addresses not fetched by the ISS by filling them with randomized values and forwarding them to the RTL core. After execution, the RTL core and ISS write results to separate memories. A comparator then checks functional differences by comparing register-value changes from the ISS and RTL core, while accounting for timing differences between the two models.

Coverage-guided RTL testing example

The evaluated device under test in the DATE 2022 study was the 32-bit pipelined RISC-V core from the MINRES The Good Core (TGC) series. The industrial RTL core was translated to C++ using Verilator and integrated into a SystemC test bench together with an open-source SystemC-based RISC-V virtual-platform ISS. The configured RISC-V subset was RV32IMCZicsrZifencei, and the experiments used a SystemC simulation time limit of 1 second, corresponding to about 20 million instructions in the reported setup.

RTL in formal and security analysis

RTL is also used as the level of design for automated microprocessor hazard analysis. The HADES tool, according to the public arXiv summary, targets single-pipeline microprocessors designed at RTL and focuses on data hazards including read-after-write, write-after-write, and write-after-read hazards. Its techniques include data-flow analysis, error-pattern matching, SMT solving, and abstract regular model checking.

RTL is also used in hardware-security modeling. The public arXiv summary of Information Flow Coverage Metrics for Hardware Security Verification describes a hyperflow graph as an RTL hardware security graph. In that context, the graph models information flows and carries attributes that support security metrics for flow paths, flow conditions, and flow rates, with evaluation on the OpenTitan hardware root of trust under several threat models.

Related concepts and systems

  • Cross-Level Processor Verification uses RTL cores as one side of a co-simulation against an ISS reference model.
  • Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-guided Aging demonstrates coverage-guided randomized testing of an RTL RISC-V core.
  • MINRES The Good Core (TGC) appears in the evidence as the source of the 32-bit pipelined RISC-V RTL core used as the device under test.

LINKED ENTITIES

3 links
Cross-Level Processor Verification USES
Cross-level processor verification via endless randomized instruction stream generation with coverage-guided aging USES
MINRES The Good Core (TGC) IMPLEMENTS

CITATIONS

6 sources
6 citations
[1] RTL cores are used as implementation models in cross-level processor verification against an ISS reference model. Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-guided Aging
[2] The DATE 2022 cross-level approach generates endless unrestricted instruction streams and uses runtime coverage information from the ISS with coverage-guided aging to target RTL-core bugs. Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-guided Aging
[3] The RTL co-simulation setup accounts for micro-architectural effects such as pipelining, prefetching, and fetch buffering, and uses a comparator to detect functional differences between ISS and RTL register updates. Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-guided Aging
[4] The evaluation used a 32-bit pipelined RISC-V core from the MINRES The Good Core series, translated the industrial RTL core to C++ with Verilator, and integrated it with a SystemC-based RISC-V ISS. Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-guided Aging
[5] HADES targets single-pipeline microprocessors designed at RTL and analyzes read-after-write, write-after-write, and write-after-read hazards. HADES: Microprocessor Hazard Analysis via Formal Verification of Parameterized Systems
[6] A hyperflow graph is described as an RTL hardware security graph that models information flows and supports metrics for flow paths, flow conditions, and flow rates. Information Flow Coverage Metrics for Hardware Security Verification