Overview

RTL (Register-Transfer Level) verification is the activity of checking that a hardware design, described at the register-transfer level of abstraction, behaves as intended. Evidence describes it as a primary bottleneck in modern hardware development, reported to consume 60-70% of development time. [C1] Bugs that escape RTL verification are described as lengthening design cycles and producing significant follow-up costs.

The same evidence observes that, although Large Language Models (LLMs) have shown promise for RTL automation, their performance and research focus have overwhelmingly centered on RTL generation rather than verification. [C1]

Simulation-based RTL verification

Simulation is described as a prevalent verification approach because of its ease of use and scalability. In processor RTL verification, this makes stimulus generation and comparison against a reference behavior central parts of the workflow.

Cross-level testing with an ISS reference

A documented RISC-V processor-verification approach uses cross-level testing: the RTL core under test is run in a tightly coupled co-simulation setting together with an Instruction Set Simulator (ISS) acting as the reference model. The testbench generates an endless instruction stream on the fly during simulation, with no restrictions on the generated stream. The same stream is fed to both the ISS and the RTL core, and the results are compared after each executed instruction, so RTL-core errors are detected immediately when they occur.

Test-generation considerations

The same RISC-V cross-level work contrasts generated testing with official hand-written RISC-V test suites. Those suites are described as targeting basic sanity checks and a few corner-case scenarios across instruction-set extensions, but their overall coverage is described as very limited and unsuitable for continuous testing.

Sequence-based stimulus generation with SGen

Evidence documents SGen, a sequence-based assembly generator written in C++11 that aims to bridge the gap between directed and fully random stimulus methods. [C10] SGen uses a random interface class together with C++11 lambda functions to describe complex relationships between random variables without relying on a constraint engine. [C10]

Reported runtime characteristics include generating tests of 25k–50k instructions per run, with an average SGen execution time of 709 ms across 500 runs and an average throughput of 31k instructions per second. [C10] SGen is described as being used to verify the Cavium ThunderX2 core, where it is reported to be better at uncovering certain types of errors than existing tools, generating far more failures than PPIGen for the same number of runs while having similar bucket counts; the tool is also described as adding no significant compute or license overhead to simulation times. [C10]

Automated test-program generation

A separate line of evidence reviews approaches toward automating simulation-based design verification, including Inductive Logic Programming (ILP) methods. [C2] That work situates RTL verification within a longer history of automated test-program generation research, citing techniques such as:

• Genesys-Pro (Adir et al.), which is described as innovations in test program generation for functional processor verification. [C2][C10]
• Evolutionary test program induction for microprocessor design verification (Corno et al.), including a graph-based functional test program generation approach for pipelined processors (Mishra and Dutt). [C10]
• Genetic approaches to automatic bias generation for biased random instruction generation (Bose et al.). [C2]
• Coverage-directed test generation using Bayesian networks (Fine and Ziv; Braun, Fine, and Ziv) and the related IBM patent on coverage directed test. [C2]
• Constraint-based random stimuli generation for hardware verification (Naveh et al.). [C10]
• Functional vector generation for HDL models using linear programming and 3-SAT (Fallah, Devadas, and Keutzer), as well as automatic functional vector generation using the extended finite state machine model (Cheng and Krishnakumar). [C10]

These methods are described in the evidence as components of the broader test-generation ecosystem that complements simulation-based and formal RTL verification flows. [C2][C10]

RISC-V random program generation with riscv-dv

Evidence identifies riscv-dv as an open-source random instruction generator developed by CHIPS Alliance for RISC-V processor verification. Its SystemVerilog UVM-based class structure is described as helpful for verifying RISC-V IP, and the generated random tests can be run directly with the design IP.

Within that ecosystem, the class riscv_asm_program_gen.sv (described in the gen_program() function and its helpers) generates the complete RISC-V assembly program used to verify RISC-V IP, with support for customization of RISC-V GPR usage and instruction selection.

Sections generated by this class include the initialization routine, instruction section, data section, stack section, page tables, and interrupt and exception handling.

Configuration randomization

The class riscv_instr_gen_config is randomized from the test riscv_instr_base_test.sv. This randomization decides the RISC-V extension used, the supported privilege mode, the instruction counts for the main program and subprograms, and whether the program must generate break instructions via variables such as no_ebreak, no_dret, no_fence, and no_wfi. Many other configuration variables can be set true or false based on DUT features and testbench stimulus-generation requirements.

Program generation pipeline

The gen_program() function is the main entry point for generating all sections of the program. After being called from the upper layer, it invokes other functions in riscv_asm_program_gen one by one.

The pipeline includes:

• get_directed_instr_stream() and add_directed_instr_stream(), which select the ratio of instruction generation (e.g., riscv_jal_instr ratio: 30/1000).
• gen_program_header(), which fills the instr_stream string array with header instructions such as .include "user_init.s" and calls gen_section("_start", str) to insert them.
• init_gpr(), which initializes general-purpose registers with random values.
• generate_directed_instr_stream(), which decides the ratio and inserts directed instruction streams, randomizing instructions and selecting rs1, rs2, and rd based on instruction type. The post_random() function of riscv_instr is used to produce instructions that use GPRs x0 to x31 across all instructions.
• A check that controls the ratio of any illegal or HINT instructions; if that ratio is zero, no illegal or HINT instructions are generated.
• riscv_instr_sequence::generate_instr_stream, which uses convert2asm() to convert the instruction stream to assembly strings.
• main_program[hart].generate_instr_stream(), which converts the instruction stream to string format.
• insert_sub_program(sub_program[hart], instr_stream) when sub-program instructions need to be generated.
• Host-interface instructions added by gen_section, such as str=write_tohost:, str=sw gp, tohost, t1, instr[0]=sw gp, tohost, t1, and str=_exit:.
• push_gpr_to_kernel_stack(), which pushes general-purpose registers to the stack for trap handling, and gen_section() selecting str=mtvec_handler, which defines exception_handler and interrupt_handler.

The combined result is a full RISC-V assembly language program with random instructions and random GPR selections across different instruction patterns, suitable as verification stimuli for RISC-V IP.

LLM-based agentic RTL verification

Recent evidence describes RTL verification approaches that combine LLMs with programmatic tool use.

Pro-V multi-agent system and Sampling&Filtering

The Pro-V system is described as an efficient program-generation multi-agent system for automatic RTL verification. Compared to direct RTL-based sampling in CorrectBench, it proposes a more efficient and robust Sampling&Filtering mechanism that is fully decoupled from RTL generation.

In this mechanism, the agent samples N Program Emulator candidates M1, …, MN (with N = 5 in the reported study). Each candidate produces a corresponding signal reference result candidate R1, …, RN. The results are categorized into three cases:

1. Consistent Outputs – all results are identical and merged into a single representative output.
2. Outlier Detection – if a unique result Rj differs from all the others in {R1, R2, …, Rn} (for example, j = 4), the outlier is filtered out.
3. Partial Consistent – the remaining partial-consistency cases are merged while abstaining from diversity.

This filtering mechanism is described as efficiently providing the most informative inputs to a downstream LLM-as-a-Judge module for further evaluation.

PRO-V-R1 open-source agentic framework

PRO-V-R1 is described as the first trainable open-source agentic framework for autonomous RTL verification, with three reported contributions: [C1]

1. PRO-V sys – a modular agentic system that couples LLM-based reasoning with programmatic tool use for RTL verification.
2. A data-construction pipeline that leverages existing RTL datasets to build simulation-validated, expert-level trajectories tailored for supervised fine-tuning (SFT) of RTL verification agents.
3. An efficient reinforcement learning (RL) algorithm that uses verification-specific rewards derived from program-tool feedback to optimize the end-to-end verification workflow.

The system is positioned against existing methods that rely on large-scale proprietary models (such as GPT-4o) to generate Python-based functional references, which are described as incurring high cost and data-privacy risks. PRO-V-R1 is described as filling the previously absent role of an end-to-end open-source solution for autonomous verification. [C1]

Empirically, PRO-V-R1 is reported to achieve a 57.7% functional correctness rate and 34.0% robust fault detection, compared with the base model's 25.7% and 21.8% respectively, and is described as outperforming large-scale proprietary LLMs in functional correctness and showing comparable robustness for fault detection. [C1]

Formal verification for security: Contract Shadow Logic

Evidence also documents a formal approach to RTL verification in the security domain. Modern out-of-order processors face speculative execution attacks, and although software and hardware mitigations have been proposed, new attacks continue to arise from unknown vulnerabilities. [C3]

Contract Shadow Logic is described as a formal verification technique that can considerably improve RTL verification scalability while being applicable to different defense mechanisms against speculative execution attacks. The technique leverages computer-architecture design insights to improve verification performance when checking security properties formulated as software-hardware contracts for secure speculation. [C3]

The verification scheme is described as accessible to computer architects and as requiring minimal formal-method expertise. It is reported to have been evaluated on multiple RTL designs, including three out-of-order processors, and to exhibit a significant advantage in finding attacks on insecure designs and deriving complete proofs on secure designs compared with the baseline and two state-of-the-art verification schemes, LEAVE and UPEC. [C3]

ISA-specification and instruction-set modeling context

Evidence also situates RTL verification alongside a body of work on ISA specification and instruction-set modeling, including efforts to synthesize formal models of hardware from RTL for efficient verification of memory-model implementations (Hsiao et al., MICRO 2021), reverse-engineering instruction encodings (Hsieh et al., USENIX 2001), and the Instruction-Level Abstraction (ILA) as a uniform specification for SoC verification (Huang et al., TODAES 2019). [C4] The same body of related work references early microprocessor design verification (Hunt Jr.), the use of axiomatic hardware-software contracts for security (Mosier et al., ISCA 2022), and the automated formal verification of processors based on architectural models (Kuhne et al., FMCAD 2010). [C4] These efforts are presented in the evidence as forming the broader architectural and ISA-modeling context within which RTL verification techniques operate. [C4]

RISC-V case study

The cross-level testing approach described above was evaluated on the 32-bit pipelined RISC-V core of the MINRES The Good Folk (TGF) Series. The authors report that the approach found several serious bugs in the industrial core and processed more than 200 million instructions per hour on a standard laptop.

Role in processor development

Across the cited evidence, RTL verification is positioned as a practical check of an RTL implementation against expected behavior. In simulation-based flows, generated instruction streams exercise the design while an ISS or generated assembly-test workflow provides a way to expose mismatches and detect design errors before they become more costly later in development. Automated test-generation methods using ILP, genetic algorithms, Bayesian networks, or coverage-directed techniques supply additional stimuli, while LLM-based agentic systems extend the approach by generating program emulators and signal references that the verification pipeline can compare against. Formal techniques such as Contract Shadow Logic push the same goal into the security-property domain for processors vulnerable to speculative execution attacks. [C1][C2][C3][C4][C10]