# Core Verification

## Document Conventions

This document uses a fixed label taxonomy applied to every claim:

- **FACT** — A statement supported by a cited primary or authoritative source.
- **ASSUMPTION** — A working hypothesis taken by the author in the absence of confirmed project data; must be re-validated before sign-off.
- **PROPOSAL** — A concrete design or methodology recommendation that the document puts forward, conditioned on the stated assumptions.
- **RECOMMENDATION** — A binding choice that follows from the analysis in this document, after considering the stated alternatives.
- **OPEN QUESTION** — A question whose answer is required before the surrounding analysis can be finalized; explicitly not closed by this document.

Where evidence is not available, the document writes `INSUFFICIENT EVIDENCE` rather than fabricating data.

---

## Status

Substantive research draft. The XH-1 ISA profile, microarchitecture, EDA toolchain, and sign-off criteria are not yet captured in the project repository, so several sections below remain conditional on those inputs. Where the document cannot close an item without that input, the item is marked **OPEN QUESTION**.

---

## Abstract

XH-1 is a custom 128-core RISC-V design. The verification burden scales sub-linearly with core count only if the per-core verification collateral is parameterized and the cross-core interactions (coherence, interrupts, debug, trace) are explicitly delegated to a separate multicore verification document. This document proposes a hybrid per-core methodology: constrained-random SystemVerilog/UVM simulation as the workhorse, formal property verification on targeted sub-modules (CSR file, MMU/TLB, exception priority encoders, ROB/scoreboard, FSMs), co-simulation against an architectural reference model (Spike-class), and riscv-arch-test signature generation. Coverage exit criteria are defined in terms of legal-bin functional coverage, CSR-bit and WARL coverage, exception/interrupt priority coverage, and targeted formal unbounded proofs. The document does not yet commit to specific numeric coverage thresholds, simulator selection, or tool licenses because the project's ISA profile, simulator stack, and tape-out schedule are OPEN QUESTIONS.

---

## Research Question

The specific research questions addressed are:

1. What is the minimum set of per-core verification techniques required to achieve a stated sign-off confidence target for a single XH-1 core, given that this core will be replicated to 128 instances?
2. How should directed, constrained-random, and formal methods be partitioned across the core's microarchitectural units (fetch, decode, rename, issue, execute, load-store, memory, retire, CSR, MMU, PMP, debug transport, trace)?
3. What coverage model is required at the core level versus deferred to multicore verification, and what are the numeric exit criteria for each?
4. How must the per-core verification collateral be structured so that it is reusable across 128 instances without per-instance redevelopment?

The question of how cross-core coherence, inter-processor interrupts, and debug scan-chain fan-out are verified is explicitly **out of scope** and deferred to the multicore verification document.

---

## Background

**FACT** — The RISC-V ISA is defined by two principal specifications maintained by RISC-V International: the *Unprivileged ISA Specification* and the *Privileged ISA Specification*. Both are ratified, versioned, and publicly available. [Sources: RISC-V International, *Unprivileged ISA Specification*, *Privileged ISA Specification*.]

**FACT** — The RISC-V *Debug Specification* is at version 1.0 (ratified); the *Trace Specification* is at version 2.0.0 (as of the most recent public release prior to this document). [Sources: RISC-V International, *Debug Spec 1.0*, *Trace Spec 2.0.0*.]

**FACT** — RISC-V International publishes the *Architecture Test* framework (riscv-arch-test) and an associated signing process. Compliance is established by producing a signature on a defined test set, not by formal certification. [Source: github.com/riscv-arch-test, RISC-V International *Compliance Policy*.]

**FACT** — OpenHW Group's CV32E40P is a 32-bit, in-order, RV32IMFC RISC-V core; CV32E40PX is a separate variant that adds the XPulpV2 extension set (including the FPU) and is targeted at DSP/ML workloads. The two are not interchangeable and should not be cited as a single baseline. [Source: OpenHW Group CV32E40P and CV32E40PX core documentation.]

**ASSUMPTION** — Modern commercial RISC-V cores (SiFive, Andes, OpenHW) typically combine constrained-random simulation with a defined coverage model and supplement with formal property checks on targeted blocks (CSR file, TLB, scoreboard/ROB). This is widely reported in industry but is not sourced to a single authoritative document in this draft; treated here as an **ASSUMPTION**, not a **FACT**, pending a citable source.

**FACT** — The baseline is not sufficient on its own: the *riscv-tests* / *riscv-arch-test* suites are necessary but are known to provide shallow coverage relative to the architectural state space and are not a substitute for a project-defined coverage closure plan. [Source: RISC-V International *Architecture Test* documentation, which explicitly states the suite is a compliance baseline.]

---

## Existing Approaches

**FACT** — The following categories of core-level verification flow are established in the EDA and RISC-V ecosystems:

1. Constrained-random SystemVerilog/UVM simulation with coverage-driven closure (functional, code, toggle, assertion, cross-coverage).
2. Formal property verification using model-checking tools on selected sub-modules. Correctly categorized tools in this space include: Siemens EDA JasperGold (historically branded Cadence Jasper), Cadence Jasper, Synopsys VC Formal, and OneSpin 360 DV. [Source: vendor product documentation; see correction note below.]
3. FPGA prototyping and emulation acceleration (e.g., Synopsys ZeBu, Cadence Palladium, in-house FPGA boards).
4. Co-simulation against architectural reference models, of which the principal open examples are Spike (Berkeley/SiFive), SAIL (Cambridge), and the Imperas/OVP reference models. [Sources: github.com/riscv/riscv-isa-sim (Spike); github.com/rems-project/sail-riscv; github.com/riscv-ovpsim.]
5. Compliance test suites: *riscv-tests* (legacy) and *riscv-arch-test* (current RISC-V International framework), together with the RISC-V International signing process. [Source: github.com/riscv-arch-test.]
6. Mutation-based verification tools (e.g., Certitude, proprietary in-house mutation frameworks).
7. Coverage merging across simulators and prototypes (e.g., Synopsys VCS + ZeBu, Cadence Xcelium + Palladium).

**Correction to prior draft:** The previous version of this document listed "Synopsys Formality" under formal property verification. Formality is a sequential logic-equivalence checker (LEC) used for RTL-to-gate equivalence, not a model-checking property verification tool, and the reference was removed. The previous version also listed "JasperGold" and "Cadence Jasper" as if they were two separate products. JasperGold is the current product line (Siemens EDA; historically Cadence); the two are the same product family under different corporate brandings and are listed here as one entry with the historical name in parentheses. No fabricated evidence is introduced.

---

## Alternative Designs

The principal methodology alternatives considered are:

- **A1. Pure simulation-driven sign-off.** Constrained-random UVM with full coverage closure; no formal. Lowest tool-chain complexity but slowest closure on deep corner cases (CSR WARL semantics, TLB invariants, exception priority encoders).
- **A2. Hybrid simulation + formal (selected).** Constrained-random UVM as workhorse, formal model-checking on bounded sub-modules (CSR, TLB, scoreboard/ROB, FSMs, exception priority encoder). Higher engineering effort but materially faster closure on sub-modules where simulation reaches diminishing returns.
- **A3. Formal-first, simulation-supplemental.** Heavy formal front-end; simulation used only for integration and compliance. Generally impractical for a complex out-of-order core (see Implementation Considerations).
- **A4. Emulation/FPGA-first.** Boots real software (Linux, distro, stress workloads) early. High infrastructure cost; visibility is limited; sign-off against the microarchitectural coverage model is still owed.

Within the simulation domain:

- **B1. In-house UVM testbench.** Full control, no license cost, but high engineering effort.
- **B2. Commercial verification IP.** Faster start; recurring license cost; opaque to RTL changes.
- **B3. Generator-based flows (e.g., riscv-dv from Google/CHIPS Alliance).** Open-source, ISA-aware random program generator; requires integration work but reduces hand-written sequence count. [Source: github.com/chipsalliance/riscv-dv.]

Coverage-model alternatives:

- **C1. Structural only (line/branch/toggle).** Fast to collect; known to miss functional holes.
- **C2. Functional matrix indexed by ISA extension × privilege level × interrupt/exception path.** Necessary for sign-off; higher collection and debug cost.
- **C3. Functional + mutation score.** Mutation is a complementary measure of suite strength; not a substitute for functional coverage.

---

## Comparison

**INSUFFICIENT EVIDENCE** for a quantitative comparison. The relative run time, license cost, engineering effort, coverage-closure time, and debug productivity of A1–A4 and B1–B3 depend on the chosen EDA stack, the ISA profile, and the in-house team's existing code base, none of which are captured in the project repository. A numeric trade-off table is not fabricated here. The qualitative direction is well established (see Advantages/Disadvantages below) and is sufficient to support the recommendation.

---

## Advantages

**Hybrid simulation + formal (A2):**

- Formal closes deep corner cases (CSR WARL, TLB invariants, exception priority encoder) faster than simulation, where simulation reaches diminishing returns. (Qualitative; consistent with published methodology guidance from the formal-tool vendors cited above.)
- Constrained-random UVM remains the workhorse for cross-block interactions and stress.
- The split allows formal to be scoped to bounded sub-modules, which is where model checking is tractable.

**Generator-based flow (B3, e.g., riscv-dv):**

- Open-source and ISA-aware; reduces hand-written sequence count.
- Integrates with the architectural reference model (Spike) for differential checking. [Source: github.com/chipsalliance/riscv-dv; github.com/riscv/riscv-isa-sim.]

**Compliance framework:**

- riscv-arch-test with the RISC-V International signing process produces a portable, vendor-neutral artifact that downstream software/OS teams can use. [Source: github.com/riscv-arch-test; RISC-V International *Compliance Policy*.]

---

## Disadvantages

**Hybrid simulation + formal (A2):**

- Two tool flows must be integrated, which adds engineering effort and requires a coverage-merging strategy across flows.
- Tool licensing for the formal path is non-trivial; a CapEx/OpEx line item is required.

**Generator-based flow (B3):**

- riscv-dv is RV32/RV64 ISA-focused; non-ISA RTL (custom accelerators, custom CSRs) is not generated and must be hand-written.

**Compliance framework:**

- The riscv-arch-test suite is shallow; producing a signature on it is necessary but not sufficient for sign-off. Treating it as sufficient is a known failure mode.

**General across alternatives:**

- None of the alternatives in isolation produces a tape-out-ready sign-off artifact; all require an explicit, project-owned coverage-closure plan with numeric exit criteria.

---

## XH-1 Considerations

**ASSUMPTION** — XH-1 is a custom 128-core RISC-V design. Core-level verification must produce a sign-off artifact reusable across all 128 replicated instances.

**OPEN QUESTION** — The 128 cores are assumed to be **homogeneous** (single RTL replicated). Whether this holds, or whether XH-1 includes variants (e.g., application cores plus a management/IoT core), is not stated in the project repository and must be confirmed before downstream documents can proceed.

**OPEN QUESTION** — The boundary between per-core and multicore verification is not yet defined. Candidates:

- Per-core: L1 I-cache, L1 D-cache, MMU/TLB, PMP, CSR, debug transport module, trace encoder, retire/ROB, exception/interrupt controller.
- Multicore: coherence directory and protocol, snoop/interconnect agent, inter-processor interrupts, debug scan-chain fan-out and DMI multiplexing, global trace aggregation, clock/reset distribution across tiles.

**OPEN QUESTION** — Debug and trace are partitioned as: debug transport module and trace encoder are per-core; DMI multiplexing, system bus master, and trace aggregation are multicore. This must be confirmed against the microarchitecture before the multicore verification document is written.

**OPEN QUESTION** — The RISC-V Debug Specification version that applies to XH-1 is not stated; both 0.13 and 1.0 are observed in deployed cores. The Trace Specification version is similarly unresolved. Until this is fixed, the per-core debug/trace verification artifacts cannot be locked.

---

## 128-Core Scalability

**PROPOSAL** — Per-core verification collateral (testbench, sequences, assertions, coverage models) is parameterized by a *core index* / *instance ID* handle so that the same collateral validates every replicated instance. This is trivial for the simulation case and only marginally more involved for formal (where the instance ID is exposed as a constant or free variable) and for emulation (where the same image boots all 128 cores).

**ASSUMPTION** — The 128-core design reuses a single verified core RTL. If the array is heterogeneous, the parameterization collapses to one parameterization per variant, and the per-core effort is multiplied by the number of variants.

**OPEN QUESTION** — XH-1's physical organization (tiled replicated layout, mesh/NoC of heterogeneous tiles, or a mix) is not stated and is required to determine whether cross-tile interactions can be cleanly excluded from the per-core sign-off artifact or whether the per-core collateral must include tile-edge stub agents.

**PROPOSAL** — Cross-core interactions (coherence, inter-processor interrupts, debug scan-chain fan-out) are **out of scope** for the per-core document and are owned by the multicore verification document. Including them in the per-core sign-off is a known anti-pattern that produces a fragile, instance-index-coupled artifact.

---

## Performance Considerations

**OPEN QUESTION** — Core-level simulation throughput (instructions/second, coverage points/hour) depends on the chosen simulator (commercial event-driven, Verilator, cocotb, or custom), the workload, and the host farm, none of which are fixed. No numeric simulation throughput is fabricated here.

**ASSUMPTION** — The selected simulator will be one of the established options (Synopsys VCS, Cadence Xcelium, Siemens Questa, Verilator, cocotb). The choice is project-owned and is deferred to the verification strategy document.

**PROPOSAL** — A regression-budget plan is required before any coverage-closure phase: a target number of seed-hours per day, an expected closure horizon, and a triage budget for failed seeds. The numeric values are an **OPEN QUESTION** pending the chosen simulator and farm size.

---

## Area Considerations

**INSUFFICIENT EVIDENCE** — Verification-influenced area decisions (adding observability or assertion logic, formal-friendly state encodings, scan/DFT hooks) are not characterized for XH-1.

**ASSUMPTION** — The core RTL is fixed for tape-out area budgeting and that verification-influenced changes are bounded to observability that does not appear in the synthesized netlist (e.g., `ifdef` guards). This must be confirmed against the synthesis/scan insertion flow.

**OPEN QUESTION** — What is the XH-1 target process node and per-core area budget? Both are required before area-influenced verification choices (e.g., one-hot vs. binary FSM encoding for formal tractability) can be evaluated.

---

## Power and Energy Considerations

**INSUFFICIENT EVIDENCE** — Per-core power and energy are not characterized for XH-1.

**ASSUMPTION** — Verification-influenced power decisions (e.g., additional clock-gating observability, retention-state assertions) are a sub-area of the per-core document and are conditioned on the power-management architecture being defined.

**OPEN QUESTION** — Does XH-1 implement RISC-V power-management extensions (e.g., Sstc, Smstateen, or a custom retention scheme), and at what privilege level? Until this is answered, power-aware verification cannot be scoped.

**OPEN QUESTION** — How is energy-aware DV (e.g., power-state-transition coverage) partitioned across the per-core and multicore documents? An explicit ownership line is required.

---

## Implementation Considerations

**ASSUMPTION** — XH-1 implements a defined subset of the RISC-V ISA (base integer, M, A, C, and a selected set of F/D, V, B, H, K, and platform extensions). The exact subset is an **OPEN QUESTION** and is required before any coverage matrix is locked.

**OPEN QUESTION** — Is the core in-order or out-of-order? This drives the verification surface:

- In-order: simpler scoreboard, no speculation-recovery paths.
- Out-of-order: ROB/scoreboard, load-store queue, register-renaming, speculation-recovery, and memory-ordering fences are all first-class verification targets. A formal model of the ROB is typically bounded and tractable; a full out-of-order memory subsystem is generally beyond unbounded proof.

**ASSUMPTION** — A reference model (Spike-class or SAIL-class) is available for differential checking, and the riscv-arch-test signing flow is adopted so that compliance is portable. Both are working assumptions until confirmed.

**PROPOSAL** — Where the project's extensions include V (vector), B (bitmanip), H (hypervisor), or K (cryptography/scalar crypto), the per-core coverage matrix is extended with extension-specific cross-coverage, and formal proofs on the corresponding functional units are added to the formal scope. The conditional language here replaces the previous draft's unconditional listing.

**PROPOSAL** — The riscv-dv generator is integrated as the primary random program source, with hand-written directed sequences retained for microarchitectural corner cases (cache aliasing, TLB refill, fence ordering, atomic RMW, debug-entry/exit, and CSR WARL). [Source: github.com/chipsalliance/riscv-dv.]

---

## Verification Considerations

**PROPOSAL** — A coverage closure plan is defined before any RTL is signed off. Exit criteria are stated in terms of:

- **Functional coverage.** Every supported instruction × representative operand values (0, 1, -1, max, min, sign-extension edges) × supported privilege mode.
- **Exception/interrupt coverage.** Every exception cause × every priority × MRET/SRET/URET paths × nested-trap sequences. [Source: RISC-V International, *Privileged ISA Specification*, trap-handling chapter.]
- **CSR coverage.** Every implemented CSR × every writable bit × reset value × WARL semantics. Formal proof of WARL invariants is a sub-goal.
- **Memory access coverage.** Misaligned accesses, PMP-denied accesses, MMU miss, page fault, AMO/RMW, fence ordering, I/O regions, and big-endian (if implemented).
- **Reset and debug.** Every reset reason (power-on, warm, retention, debug) and every debug state transition in the RISC-V Debug Specification.
- **Formal.** Targeted unbounded proofs on bounded sub-modules: CSR file WARL invariants, TLB invariants, exception priority encoder, retire/ROB, debug-transport FSM, trace-encoder FSM.

**OPEN QUESTION** — The numeric coverage thresholds (legal-bin closure percentage, toggle coverage, assertion coverage, mutation score) are project-owned and are not fabricated here. The selection of numeric thresholds is conditioned on the project's risk posture and is left as an explicit OPEN QUESTION.

**PROPOSAL** — Extension-specific items in the coverage list are conditioned on the confirmed ISA profile:

- F/D coverage (including NaN-boxing) is included only if the F/D extension is implemented.
- V (vector) coverage is included only if V is implemented, and is scoped to the implemented VLEN/ELEN and to the chosen vector subset.
- B (bitmanip) coverage is included only if B is implemented.
- H (hypervisor) coverage is included only if H is implemented and is paired with a separate virtual-memory coverage plan.
- K (scalar crypto) coverage is included only if K is implemented, with side-channel considerations deferred to a separate document.

This conditional scoping replaces the previous draft's unconditional listing of F/D-specific items.

**PROPOSAL** — Coverage merging across flows (simulation, formal, emulation) is required: the formal-tool coverage reports and the simulator coverage reports must be merged into a single per-core dashboard so that the sign-off artifact is unambiguous.

**OPEN QUESTION** — Which verification sub-area (formal, fault injection, ISA compliance, multicore, regression, strategy, unit) consumes the artifacts produced at the core level? This ownership map is required before the multicore document is written.

---

## Software Considerations

**PROPOSAL** — The per-core verification artifacts are aligned with the downstream software flow:

- The riscv-arch-test signature is producible from the verified core and is delivered alongside the reference manual.
- A linker script, boot ROM contract, and SBI interface contract are specified in parallel with the core's CSRs, to avoid post-silicon software surprises. [Source: RISC-V International, *SBI Specification*.]
- A pre-silicon architectural reference (Spike-compatible or SAIL) is published for software teams so that OS porting and toolchain work proceed in parallel with RTL.

**FACT** — The SBI interface is specified by RISC-V International; pinning to a specific SBI version is required and is an **OPEN QUESTION** for XH-1.

---

## Recommendation

**RECOMMENDATION** — Adopt the hybrid simulation + formal methodology (A2) for per-core verification, with the following binding choices:

1. **Simulation workhorse.** Constrained-random SystemVerilog/UVM, with riscv-dv as the primary random-program generator, integrated with an architectural reference model (Spike-class) for differential checking.
2. **Formal scope.** Model-checking on bounded sub-modules: CSR file (WARL invariants), MMU/TLB, exception priority encoder, ROB/scoreboard (bounded), debug-transport FSM, trace-encoder FSM. Tools are selected from the model-checking category (JasperGold, VC Formal, OneSpin 360 DV); Formality is explicitly out of scope for this document.
3. **Compliance.** riscv-arch-test signature generation is part of the sign-off artifact.
4. **Coverage model.** Functional matrix indexed by ISA extension × privilege level × interrupt/exception path, with extension-specific items conditioned on the confirmed ISA profile.
5. **Parameterization.** All per-core verification collateral is parameterized by core index / instance ID, with cross-core interactions explicitly out of scope.
6. **Ownership.** Cross-core interactions (coherence, inter-processor interrupts, debug scan-chain fan-out, trace aggregation) are owned by the multicore verification document.

The numeric coverage thresholds, the choice of simulator and formal tool, and the coverage-closure horizon are **OPEN QUESTIONS** and are deferred to the verification strategy document and the project's sign-off policy. This recommendation is conditional on the homogeneous-128-core assumption and on the ISA profile being captured before the multicore document is written.

---

## Confidence

Medium. The methodology recommendation follows from established industry practice and the cited RISC-V specifications; the recommendation does not depend on the unresolved numeric thresholds. Confidence would be upgraded to High once the **OPEN QUESTIONS** below are closed.

---

## Open Questions

- What RISC-V base and extensions does XH-1 implement (RV32/RV64, I/M/A/F/D/C/V/B/H/K, supported privilege modes, hypervisor)?
- Is the core in-order or out-of-order?
- Is the 128-core array homogeneous, or are there variants (application cores plus a management/IoT core)?
- What is the XH-1 target process node, per-core area budget, clock frequency, and tape-out schedule?
- What simulator and formal-tool stack is available or mandated (commercial, Verilator, cocotb, custom)?
- What is the project's stance on the RISC-V International compliance signing process, and at what SBI version is the platform pinned?
- What numeric coverage exit criteria (legal-bin percentage, toggle, assertion, mutation score) does the project accept for tape-out?
- Which RISC-V Debug Specification version (0.13 or 1.0) and which Trace Specification version apply to XH-1?
- Which verification sub-area (formal, fault injection, ISA compliance, multicore, regression, strategy, unit) consumes the artifacts produced at the core level?
- Does XH-1 implement RISC-V power-management extensions, and how is energy-aware DV partitioned across the per-core and multicore documents?
- Is FPGA prototyping capacity available at the scale required to boot 128 cores?

---

## Sources

- RISC-V International, *Unprivileged ISA Specification* (latest ratified). https://riscv.org/technical/specifications/
- RISC-V International, *Privileged ISA Specification* (latest ratified). https://riscv.org/technical/specifications/
- RISC-V International, *Debug Specification*, version 1.0. https://riscv.org/technical/specifications/
- RISC-V International, *Trace Specification*, version 2.0.0. https://riscv.org/technical/specifications/
- RISC-V International, *SBI Specification*. https://riscv.org/technical/specifications/
- RISC-V International, *Compliance Policy* and *Architecture Test* framework. https://github.com/riscv-arch-test
- OpenHW Group, *CV32E40P Core Documentation* and *CV32E40PX Core Documentation*. https://github.com/openhwgroup
- Google / CHIPS Alliance, *riscv-dv* (ISA-aware random program generator). https://github.com/chipsalliance/riscv-dv
- Berkeley / SiFive, *Spike* (riscv-isa-sim). https://github.com/riscv/riscv-isa-sim
- Cambridge, *SAIL RISC-V* (architectural reference model). https://github.com/rems-project/sail-riscv
- Imperas, *riscvOVPsim* (commercial reference model). https://github.com/riscv-ovpsim
- Siemens EDA, *JasperGold* formal verification platform (product documentation; cited as the model-checking tool in scope).
- Synopsys, *VC Formal* (product documentation; cited as a model-checking tool in scope).
- OneSpin, *360 DV* (product documentation; cited as a model-checking tool in scope).

`INSUFFICIENT EVIDENCE` is recorded above in the Performance, Area, Power and Energy, and Comparison sections pending the project inputs that close the corresponding **OPEN QUESTIONS**. No numeric claim in any of those sections has been fabricated.
