Definition

Toggle coverage is a hardware verification coverage metric in which a signal is considered toggled if its value switches from 0 → 1 and from 1 → 0 at least once while executing a test. The cited Logic Fuzzer paper describes it as a proxy metric used in both industry and academia to gain confidence about the correctness of a design-under-test.

Use in processor verification

In the Logic Fuzzer evaluation, toggle coverage is used to observe whether inserted fuzzing logic causes new activity in RTL. The paper explains that after adding congestor logic and rerunning the same tests, the design can show different behavior, and this activity can be observed by measuring toggle coverage.

One example from the BOOM processor inserted a congestor at the ready signal of the Reorder Buffer and randomly pulled the ready signal low when the ROB was actually ready. This caused additional signals to toggle: 12 in the frontend module, 40 in the core module, and 32 in the load-store unit. The authors used this example to demonstrate that a single congestor could activate logic not touched by more than 200 tests.

Across verification binaries, the paper reports that Logic Fuzzer increased toggle coverage by about 1% on average. The authors characterize this increase as a beneficial side effect rather than the main purpose of the technique.

Limitations

Toggle coverage is not a complete measure of whether a hardware system has been verified. The Logic Fuzzer paper explicitly cautions that increasing coverage is not the purpose of Logic Fuzzer; instead, its purpose is to create irregular execution flow that is often not captured by coverage metrics. Toggle coverage and similar code-coverage metrics are described as proxy metrics rather than full indicators of verification completeness.

The paper gives a concrete limitation: among the bugs found by Logic Fuzzer, only one bug, identified as B12, directly correlated with toggle coverage. The other three bugs did not correlate with toggle coverage and were detected because of randomized events created by Logic Fuzzer. The authors note that combinations of signals and states may expose bugs even when 100% toggle coverage would not necessarily detect them.

Relationship to Logic Fuzzer

Logic Fuzzer uses toggle coverage as an observational metric to show that fuzzing can activate additional RTL behavior. However, Logic Fuzzer is not primarily a coverage-increase tool: its intended role is to create irregular execution flows and randomized events that may expose bugs beyond what toggle coverage alone can indicate.