Finite state machine state transition identification
Finite state machine state transition identification is a technique used in RTL fuzzing to determine when an RTL design's finite state machine has moved from one state to another. In the DIFUZZRTL work, this capability is part of a register-coverage guided fuzzing approach that is described as efficiently and correctly identifying state transitions in RTL finite state machines.[1]
Context in DIFUZZRTL
DIFUZZRTL is an RTL fuzzer for discovering bugs in CPU RTL designs. Its abstract states that the system "develops a register-coverage guided fuzzing technique" and that this technique "efficiently yet correctly identifies a state transition in the finite state machine of RTL designs."[1] This places finite state machine state transition identification as a supporting technique within coverage-guided RTL fuzzing rather than as a standalone end-user tool.
Role
Based on the available evidence, the main documented role of this technique is:
- to support register-coverage guided fuzzing for RTL designs; and
- to do so in a way intended to be both efficient and correct when identifying finite state machine state transitions.[1]
Evidence scope
The provided source does not describe the internal algorithm for how the state transition identification is performed. It only establishes that DIFUZZRTL uses this capability as part of its RTL fuzzing methodology.[1]
[1]: DIFUZZRTL abstract, provided evidence.