Skip to content
STIMSMITH

Coverage-guided aging

Technique WIKI v1 · 6/25/2026

Coverage-guided aging is a verification technique used in cross-level processor verification to drive randomized instruction stream generation toward uncovered functional coverage points by progressively aging (forgetting) recently hit coverage targets.

Overview

Coverage-guided aging is a randomized test-generation guidance strategy for cross-level processor verification. It directs an endless randomized instruction stream generator to repeatedly revisit functional coverage targets that have not been exercised recently, rather than allowing the generator to settle on a fixed distribution of stimuli [1]. The technique was introduced for comparing an instruction-set simulator (ISS) and a register-transfer level (RTL) processor core running side by side, where the goal is to expose functional divergences between the two models.

Context: Cross-Level Processor Verification

Cross-level verification compares a high-level reference model against an RTL implementation while the same program is executed on both. Because the two models do not share timing, the comparison must be performed on logged register-value changes rather than cycle-accurate signals. Coverage-guided aging operates inside this framework as the mechanism that decides which instructions to inject next [1].

Components

A coverage-guided aging flow is built from three cooperating components [1]:

  • Coverage-Observer. Samples the internal state of the ISS (specifically the executed instructions) and maps each sampled instruction to a functional coverage point. Coverage points are defined as the cross-product of instruction groups, and the coverage model can in principle be arbitrarily complex. The observer is also responsible for performing the actual aging of already-hit coverage points.
  • Instruction-Injector. Consumes hints from the Coverage-Observer describing which functionality still needs to be covered (or must be covered again) and injects instructions into the instruction stream so that those targets are exercised. The injector must reconcile the differing fetch behaviors and execution timings of the ISS and the RTL core, which place the two random instruction generators in different states.
  • Comparator. Logs register-value changes from both the RTL core and the ISS and continuously matches them at the same logical position. Any difference terminates the simulation, surfacing a potential bug.

A separate core adapter handles addresses not fetched by the ISS by inserting randomized values and forwarding them to the RTL core, so the RTL execution remains synchronized with the ISS-driven stream.

How Aging Works

The key idea is that simply maximizing new coverage (as in classical coverage-directed generation) is insufficient when the generator state can drift between the two models. Instead, the Coverage-Observer periodically ages — i.e., reduces the freshness of — coverage points that have been hit, so that previously covered functionality is treated as uncovered again after some interval. The Instruction-Injector is then repeatedly steered toward targets whose age has expired, ensuring continuous re-exercise of corner-case combinations of instructions over the duration of the run [1].

Evaluation Setup

In the original evaluation [1], coverage-guided aging was instantiated for the 32-bit pipelined MINRES "The Good Core" (TGC) RISC-V core against the open-source SystemC-based RISC-V VP2 instruction-set simulator. The RTL core was translated to C++ with Verilator and integrated into a SystemC test bench together with the ISS, configured for the RISC-V subset RV32IMCZicsrZifencei. Experiments were run on an Ubuntu 20.04 LTS machine (AMD Ryzen 7 PRO 4750U, 4.1 GHz, 36 GB RAM) with a SystemC simulation time limit of one second (≈20 million instructions per run).

Significance

Coverage-guided aging adapts randomized instruction-stream generation to the realities of cross-level verification, where the RTL and ISS models can desynchronize and where coverage must be continually re-asserted rather than simply expanded. It is the central contribution of the paper Cross-level processor verification via endless randomized instruction stream generation with coverage-guided aging [1].

Related Approaches (as cited in the source paper)

  • Constraint-based specification-driven stimuli generation [1]
  • Coverage-guided fuzzing of instruction-set simulators [1]
  • Directed test suites covering RISC-V instruction sets [1]
  • Formal model-checking-based approaches (which can face scalability issues) [1]

References

[1] N. Bruns, V. Herdt, E. Jentzsch, et al., "Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-Guided Aging," 2022 Design, Automation & Test in Europe Conference & Exhibition (DATE), Antwerp, Belgium, 2022, pp. 1123–1126.

LINKED ENTITIES

1 links
Cross-level processor verification via endless randomized instruction stream generation with coverage-guided aging USES

CITATIONS

6 sources
6 citations
[1] Coverage-guided aging is a guidance mechanism used in cross-level processor verification to drive endless randomized instruction stream generation toward uncovered or aged functional coverage points. Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-Guided Aging (DATE 2022)
[2] The Coverage-Observer measures functional coverage from the ISS execution state, performs coverage-aging, and hints the Instruction-Injector when functionality must be covered again; coverage points are defined as the cross-product of instruction groups. Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-Guided Aging (DATE 2022)
[3] The Instruction-Injector evaluates hints from the Coverage-Observer and injects instructions to cover the requested functionality, accounting for differing fetch behaviors and execution timings between the ISS and the RTL core. Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-Guided Aging (DATE 2022)
[4] The Comparator logs register-value changes from the ISS and the RTL core and continuously matches them at the same position; on any difference, the simulation is terminated. Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-Guided Aging (DATE 2022)
[5] The evaluation used the 32-bit pipelined MINRES The Good Core (TGC) RISC-V core against the RISC-V VP2 ISS via a Verilator-generated C++ model in a SystemC test bench, configured for RV32IMCZicsrZifencei on Ubuntu 20.04 LTS with a one-second SystemC simulation time limit (~20 million instructions). Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-Guided Aging (DATE 2022)
[6] The paper situates coverage-guided aging among related approaches including constraint-based specification generation, coverage-guided fuzzing of ISSes, directed RISC-V test suites, and formal model-checking methods, noting scalability concerns for the latter. Cross-Level Processor Verification via Endless Randomized Instruction Stream Generation with Coverage-Guided Aging (DATE 2022)