Skip to content
STIMSMITH

instruction sequence generation

Technique WIKI v1 · 5/26/2026

Instruction sequence generation is a randomized processor-test generation technique in which a generator emits a fixed-length group of instructions designed to perform a specific task, rather than only emitting independent random instructions. In the provided RISC-V verification evidence, sequences are used alongside opcode injection and field mutation to create targeted randomized tests such as large-immediate loads, compute chains, and CSR-access sequences.

Overview

Instruction sequence generation is described as a modification to random instruction generation for RISC-V processor verification. A sequence consists of a fixed number of instructions that are designed to perform a specific task and can be randomized. This lets the generator create multi-instruction behaviors that a single instruction may not express directly. [C1]

Role in the generator

The cited instruction-generation algorithm gives priority to an active sequence: if a sequence is active and not yet completed, the generator returns the next instruction from that sequence. If no active sequence is continuing, the algorithm starts a new randomly selected sequence with 1% probability; starting the sequence randomizes its instructions and returns the first instruction. Otherwise, the generator emits a single independent instruction. [C2]

For independent instructions, the same algorithm starts from a fully randomized 32-bit instruction word, injects a random valid opcode with high probability, and may apply a random field mutation with smaller probability. Specifically, the evidence states that opcode injection is used with 98% probability and random field mutation with 20% probability. [C3]

Sequence examples

The evidence gives three examples of useful randomized instruction sequences:

  • Large-immediate load sequence: two RISC-V instructions can be combined to load a large immediate value into a register, because the immediate field of one instruction is not large enough to load an arbitrary register value. The target register and load value are randomized. [C4]
  • Compute chain: the result of one instruction is fed into the source register of the next instruction, while the operation, such as ADD or SUB, and operand registers are randomized. [C5]
  • CSR access sequence: the sequence performs a randomized CSR access and then writes the CSR value into a normal register so it can be compared with the ISS register. [C6]

Relationship to mutation-based instruction generation

Instruction sequence generation appears in the same generation framework as opcode injection and field mutation. The evidence states that pure randomization tends to generate illegal instructions because illegal instructions occupy a significantly larger state space than legal instructions. To address this, the generator injects valid opcodes and applies field-mutation rules derived from the RISC-V instruction format. [C7]

The field-mutation rules include inserting special immediate values such as MIN, -1, 0, 1, and MAX; mutating RD to zero; making RD equal to RS1 and/or RS2; making RS1 match RS2; and mutating the CSR selector field to a supported CSR. [C8]

Verification context

The technique is reported in an implementation of a cross-level testing approach applied to a pipelined 32-bit industrial RISC-V TGF series core. The evaluation used Verilog RTL obtained from SpinalHDL, Verilator to obtain a C++ core description, a SystemC-based co-simulation testbench, and a 32-bit RISC-V ISS from the open-source RISC-V VP as the reference model. [C9]

Practical significance

Within the cited framework, instruction sequence generation complements single-instruction randomization by deliberately constructing randomized multi-instruction scenarios. This is important for cases where the verification objective depends on interaction across instructions, such as loading values that cannot fit in one immediate field, forwarding one result into the next operation, or making CSR state observable through a normal register comparison. [C10]

LINKED ENTITIES

1 links
opcode injection used_with

CITATIONS

10 sources
10 citations
[1] Instruction sequence generation creates fixed-number instruction sequences designed for a specific task and capable of randomization.
[2] The algorithm continues an active sequence if one is incomplete, otherwise starts a random new sequence with 1% probability, and otherwise generates a single independent instruction.
[3] Independent instruction generation starts from a randomized 32-bit instruction word, injects a valid opcode with 98% probability, and applies a random field mutation with 20% probability.
[4] A large-immediate load sequence can use two RISC-V instructions because one immediate field is not large enough to load an arbitrary register value; the target register and load value are randomized.
[5] A compute-chain sequence feeds one instruction result into the next instruction source register while randomizing the operation and operand registers.
[6] A CSR access sequence performs randomized CSR access and writes the CSR value into a normal register for comparison with the ISS register.
[7] Pure randomization tends to generate illegal instructions because illegal instructions have a significantly larger state space; valid opcode injection is used to address this.
[8] Field-mutation rules include special immediate values, register-field relationships, zero-register handling, and CSR selector mutation to a supported CSR.
[9] The reported implementation applied the approach to a pipelined 32-bit industrial RISC-V TGF series core using SpinalHDL-generated Verilog RTL, Verilator, a SystemC co-simulation testbench, and a 32-bit RISC-V ISS from the open-source RISC-V VP.
[10] Instruction sequences support multi-instruction verification scenarios such as large-immediate loading, compute chains, and CSR-state comparison through a normal register.