Skip to content
STIMSMITH

Coverage-guided aging

Technique WIKI v2 · 9/22/2026

Coverage-guided aging is a processor-verification technique that feeds runtime functional-coverage information from an ISS back to an endless randomized RISC-V instruction stream generator, with the goal of making generated instruction coverage more uniform over time.

Overview

Coverage-guided aging is a runtime guidance technique for cross-level processor verification. It is used with an endless randomized instruction stream generator in a co-simulation setup where an RTL processor is checked against an Instruction Set Simulator (ISS). The technique tracks and updates coverage information in the ISS and dynamically feeds that information back to the instruction stream generator so that the generated instructions have a more uniform coverage distribution over time [1].

The approach was presented as part of work on RISC-V processor verification, where the authors describe it as a novel concept used to smooth out the coverage distribution of randomized instruction streams over time [2].

Verification setting

Coverage-guided aging is applied in a cross-level verification setting: an RTL processor core is verified using an ISS as a reference model [1]. The instruction stream is generated at runtime as one endless stream rather than as separate short tests, and coverage information is continuously updated from the ISS execution state [1][2].

This addresses a limitation of simple endless randomized instruction streams: without runtime coverage collection and feedback, a generator based only on random test strategy may have difficulty continuously achieving broad and deep coverage [2].

Main flow

The flow described in the DATE 2022 paper includes the following major elements:

  • Coverage-Observer. The Coverage-Observer monitors the internal state of the ISS to measure functional coverage. It samples executed instructions and maps them to coverage points; in the reported implementation, the coverage points are defined as the cross-product of instruction groups [3]. It also performs the coverage aging step and provides hints when functionality must be covered again [3].
  • Instruction-Injector. The Instruction-Injector evaluates hints from the Coverage-Observer and injects instructions intended to cover the requested functionality. It must account for different fetch behavior and execution timing between the ISS and RTL core, which can lead to different random instruction generator states [3].
  • Comparator. The Comparator detects functional differences between the RTL core and the ISS by comparing register values. Because the two models do not have the same timing behavior, it logs value changes and compares changes at the same logical position; if a difference is found, the simulation is stopped [3].
  • Core adapter. For RTL microarchitectural effects such as pipelining, prefetching, and fetch buffering, a core adapter checks for addresses not fetched by the ISS, fills them with randomized values not generated by the instruction generator, and forwards them to the RTL core [3].

Aging concept

In this technique, coverage is not only measured once; it is continuously updated and used to guide test generation over time [1][3]. The Coverage-Observer performs coverage aging and tells the Instruction-Injector when functionality must be covered again, allowing already exercised functionality to be re-targeted during a long-running randomized stream [3]. The reported purpose is to smooth or regularize the coverage distribution of the generated randomized instruction stream [1][2].

Evaluation context

The reported case study used a 32-bit pipelined RISC-V core from the MINRES The Good Core (TGC) series as the device under test and the ISS of the open-source SystemC-based RISC-V VP2 as reference [3]. The RTL core was translated to C++ with Verilator and integrated into a SystemC test bench together with the ISS [3]. The core and ISS were configured for the RISC-V subset RV32IMCZicsrZifencei, and experiments were run on Ubuntu 20.04 LTS with an AMD Ryzen 7 PRO 4750U CPU, 36 GB RAM, and a SystemC simulation time limit of one second, corresponding to about 20 million instructions [3].

Significance

Coverage-guided aging connects runtime coverage observation with endless randomized instruction stream generation. In the cited RISC-V verification work, it is the mechanism used to dynamically feed ISS-observed coverage information back into generation and to obtain a more regular or uniform distribution of generated instructions over time [1][2].

References

[1] Niklas Bruns, Vladimir Herdt, Eyck Jentzsch, and Rolf Drechsler, “RISC-V Processor Verification with Coverage-guided Aging.”

[2] Niklas Bruns, Vladimir Herdt, Eyck Jentzsch, and Rolf Drechsler, “Cross-level processor verification via endless randomized instruction stream generation with coverage-guided aging,” DATE 2022.

[3] Niklas Bruns, Vladimir Herdt, Eyck Jentzsch, and Rolf Drechsler, “Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-Guided Aging,” DATE 2022.

LINKED ENTITIES

3 links
RISC-V Processor Verification with Coverage-guided Aging USES
Cross-level processor verification via endless randomized instruction stream generation with coverage-guided aging INTRODUCES
RISC-V instruction stream generator USES

CITATIONS

11 sources
11 citations
[1] Coverage-guided aging tracks and updates ISS coverage information and feeds it back to an instruction stream generator to make generated instructions more uniformly distributed. [PDF] RISC-V Processor Verification with Coverage-guided Aging*
[2] The technique was presented as a novel concept for smoothing the coverage distribution of randomized instruction streams over time. [PDF] RISC-V Processor Verification with Coverage-guided Aging*
[3] The approach is used in a cross-level verification setting with an RTL processor and an ISS reference model, producing one endless instruction stream at runtime. [PDF] RISC-V Processor Verification with Coverage-guided Aging*
[4] Simple endless randomized instruction streams without runtime coverage feedback are limited in their ability to continuously achieve broad and deep coverage. [PDF] RISC-V Processor Verification with Coverage-guided Aging*
[5] The Coverage-Observer monitors ISS state, samples executed instructions, maps them to coverage points, performs coverage aging, and provides hints when functionality must be covered again. Cross-Level Processor Verification via
[6] In the reported implementation, coverage points are defined as the cross-product of instruction groups. Cross-Level Processor Verification via
[7] The Instruction-Injector evaluates Coverage-Observer hints and injects instructions while considering different fetch behavior and execution timing between cores. Cross-Level Processor Verification via
[8] The Comparator compares ISS and RTL register values by logging value changes and comparing changes at the same position, stopping the simulation on a difference. Cross-Level Processor Verification via
[9] A core adapter handles RTL microarchitectural effects by filling addresses not fetched by the ISS with randomized values and forwarding them to the RTL core. Cross-Level Processor Verification via
[10] The case study used a 32-bit pipelined MINRES The Good Core RISC-V core, the SystemC-based RISC-V VP2 ISS, Verilator, RV32IMCZicsrZifencei configuration, and an Ubuntu 20.04 LTS/Ryzen 7 PRO 4750U/36 GB RAM setup with a one-second SystemC simulation limit. Cross-Level Processor Verification via
[11] The DATE 2022 paper is bibliographically identified as 'Cross-level processor verification via endless randomized instruction stream generation with coverage-guided aging' by Bruns, Herdt, Jentzsch, and Drechsler. A RISC-V Test Sequences Generation Method Based on Instruction ...

VERSION HISTORY

v2 · 9/22/2026 · gpt-5.5 (current)
v1 · 6/25/2026 · minimax/minimax-m3