# Core Verification

## Document Conventions

This document uses a fixed label taxonomy applied to every claim:

- **FACT** — A statement supported by a cited primary or authoritative source.
- **ASSUMPTION** — A working hypothesis taken by the author in the absence of confirmed project data; must be re-validated before sign-off.
- **PROPOSAL** — A concrete design or methodology recommendation that the document puts forward, conditioned on the stated assumptions.
- **RECOMMENDATION** — A binding choice that follows from the analysis in this document, after considering the stated alternatives.
- **OPEN QUESTION** — A question whose answer is required before the surrounding analysis can be finalized; explicitly not closed by this document.

Where evidence is not available, the document writes `INSUFFICIENT EVIDENCE` rather than fabricating data.

---

## Status

Substantive research draft. The XH-1 ISA profile, microarchitecture, EDA toolchain, and sign-off criteria are not yet captured in the project repository, so several sections below remain conditional on those inputs. Where the document cannot close an item without that input, the item is marked **OPEN QUESTION**.

---

## Abstract

XH-1 is a custom 128-core RISC-V design. The verification burden scales sub-linearly with core count only if the per-core verification collateral is instance-independent (a single testbench and coverage model reused for every replicated instance) and the cross-core interactions (coherence, inter-processor interrupts, debug scan-chain fan-out, trace aggregation) are explicitly delegated to a separate multicore verification document. This document proposes a hybrid per-core methodology: constrained-random SystemVerilog/UVM simulation as the workhorse, formal property verification on targeted bounded sub-modules (CSR file, MMU/TLB, exception priority encoders, ROB/scoreboard, FSMs), co-simulation against an architectural reference model (Spike-class), and riscv-arch-test signature generation. Coverage exit criteria are defined in terms of legal-bin functional coverage, CSR-bit and WARL coverage, exception/interrupt priority coverage, and targeted formal unbounded proofs on bounded sub-modules. The document does not yet commit to specific numeric coverage thresholds, simulator selection, or tool licenses because the project's ISA profile, simulator stack, and tape-out schedule are OPEN QUESTIONS.

---

## Research Question

The specific research questions addressed are:

1. What is the minimum set of per-core verification techniques required to achieve a stated sign-off confidence target for a single XH-1 core, given that this core will be replicated to 128 instances?
2. How should directed, constrained-random, and formal methods be partitioned across the core's microarchitectural units (fetch, decode, rename, issue, execute, load-store, memory, retire, CSR, MMU, PMP, debug transport, trace)?
3. What coverage model is required at the core level versus deferred to multicore verification, and what are the numeric exit criteria for each?
4. How must the per-core verification collateral be structured so that it is reusable across 128 instances without per-instance redevelopment?

The question of how cross-core coherence, inter-processor interrupts, and debug scan-chain fan-out are verified is explicitly **out of scope** and deferred to the multicore verification document.

---

## Background

**FACT** — The RISC-V ISA is defined by two principal specifications maintained by RISC-V International: the *Unprivileged ISA Specification* and the *Privileged ISA Specification*. Both are ratified, versioned, and publicly available. [Sources: RISC-V International, *Unprivileged ISA Specification*; *Privileged ISA Specification*.]

**FACT** — The RISC-V *Debug Specification* is at version 1.0.0 (ratified). [Source: RISC-V International, *RISC-V Debug Specification*, version 1.0.0, https://riscv.org/technical/specifications/ — verified at the URL above as of 2024; this document does not assert that 1.0.0 is the only version ever deployed, only that it is the current ratified version. The Debug 0.13 specification existed historically; whether 0.13 is observed in deployed cores is an unsupported industry-welfare claim and is not stated as FACT in this document. See Open Questions for XH-1's specific Debug version.]

**FACT** — The RISC-V *Trace Specification* is at version 2.0.0 as of the most recent public release prior to this document. No specific release date is recorded here; pin to a version is an **OPEN QUESTION** for XH-1. [Source: RISC-V International, *RISC-V Trace Specification*, version 2.0.0, https://riscv.org/technical/specifications/.]

**FACT** — RISC-V International publishes the *Architecture Test* framework (riscv-arch-test) and an associated signing process. Compliance is established by producing a signature on a defined test set, not by formal certification. [Source: github.com/riscv-arch-test, RISC-V International *Compliance Policy*.]

**FACT** — OpenHW Group's CV32E40P is a 32-bit, in-order, RV32IMFC RISC-V core. CV32E40PX is a separate variant that adds PULP/XpulpV2 extensions and an FPU. The two are not interchangeable. [Source: OpenHW Group CV32E40P and CV32E40PX core documentation, https://github.com/openhwgroup/core-cv32e40p and https://github.com/openhwgroup/core-cv32e40px.] (Relevance to XH-1 is not asserted; this fact is included only to disambiguate a common citation error.)

**FACT** — The RISC-V extension taxonomy as ratified by RISC-V International includes the base integer ISA (I), standard extensions (M, A, F, D, C, V, B, H), and a family of sub-extensions under the cryptography namespace. The cryptography extensions comprise the Zk family (Zk, Zkn, Zks, Zbkb, Zbkc, Zbkx) and are not a single monolithic "K" extension. Where this document uses the letter K, it refers to the cryptography extension family in general; specific sub-extensions must be enumerated against the XH-1 ISA profile. [Source: RISC-V International, *Unprivileged ISA Specification*, "Extension" naming conventions; RISC-V International, *Cryptography Extensions*, https://riscv.org/technical/specifications/.]

**ASSUMPTION** — Modern commercial RISC-V cores (SiFive, Andes, OpenHW) typically combine constrained-random simulation with a defined coverage model and supplement with formal property checks on targeted blocks (CSR file, TLB, scoreboard/ROB). This is widely reported in industry but is not sourced to a single authoritative document in this draft; treated here as an **ASSUMPTION**, not a **FACT**, pending a citable source.

**FACT** — The baseline is not sufficient on its own: the *riscv-tests* / *riscv-arch-test* suites are necessary but are known to provide shallow coverage relative to the architectural state space and are not a substitute for a project-defined coverage closure plan. [Source: RISC-V International *Architecture Test* documentation, which explicitly states the suite is a compliance baseline.]

---

## Existing Approaches

**FACT** — The following categories of core-level verification flow are established in the EDA and RISC-V ecosystems:

1. Constrained-random SystemVerilog/UVM simulation with coverage-driven closure (functional, code, toggle, assertion, cross-coverage).
2. Formal property verification using model-checking tools on selected sub-modules. Correctly categorized tools in this space include: Siemens EDA JasperGold, Synopsys VC Formal, Synopsys 360 DV-Formal (formerly OneSpin 360 DV; OneSpin was acquired by Synopsys in 2022 and the product is now positioned as part of the Synopsys formal portfolio), and open-source flows such as Yosys + SymbiYosys (SBY) and ABC-based bounded model checking. [Source: vendor product documentation; the corporate-ownership status of these tools is recorded here for procurement accuracy.]
3. FPGA prototyping and emulation acceleration (e.g., Synopsys ZeBu, Cadence Palladium, in-house FPGA boards).
4. Co-simulation against architectural reference models, of which the principal open examples are Spike (Berkeley/SiFive), SAIL (Cambridge), and the Imperas/OVP reference models. [Sources: github.com/riscv/riscv-isa-sim (Spike); github.com/rems-project/sail-riscv; github.com/riscv-ovpsim.]
5. Compliance test suites: *riscv-tests* (legacy) and *riscv-arch-test* (current RISC-V International framework), together with the RISC-V International signing process. [Source: github.com/riscv-arch-test.]
6. Mutation-based verification tools (e.g., Certitude, proprietary in-house mutation frameworks).
7. Coverage merging across simulators and prototypes (e.g., Synopsys VCS + ZeBu, Cadence Xcelium + Palladium).

---

## Alternative Designs

The principal methodology alternatives considered are:

- **A1. Pure simulation-driven sign-off.** Constrained-random UVM with full coverage closure; no formal. Lowest tool-chain complexity but slowest closure on deep corner cases (CSR WARL semantics, TLB invariants, exception priority encoders).
- **A2. Hybrid simulation + formal (selected).** Constrained-random UVM as workhorse, formal model-checking on bounded sub-modules (CSR, TLB, scoreboard/ROB, FSMs, exception priority encoder). Higher engineering effort but materially faster closure on sub-modules where simulation reaches diminishing returns.
- **A3. Formal-first, simulation-supplemental.** Heavy formal front-end; simulation used only for integration and compliance. This document makes no claim about the absolute practicality of A3 for a specific XH-1 microarchitecture; the qualitative observation is that A3 has been applied to bounded in-order cores but is not commonly adopted for complex out-of-order cores because the unbounded state space of the memory subsystem is not tractable for current model checkers. The feasibility of A3 for XH-1 is conditioned on whether the core is in-order or out-of-order (OPEN QUESTION).
- **A4. Emulation/FPGA-first.** Boots real software (Linux, distro, stress workloads) early. High infrastructure cost; visibility into microarchitectural state is limited relative to event-driven simulation; sign-off against the microarchitectural coverage model is still owed. The infrastructure cost is a function of the array size; for 128 cores, FPGA capacity and emulation licensing scale with capacity and may be a hard constraint. Capacity availability for XH-1 is an **OPEN QUESTION**.

Within the simulation domain:

- **B1. In-house UVM testbench.** Full control, no license cost, but high engineering effort.
- **B2. Commercial verification IP.** Faster start; recurring license cost; opaque to RTL changes.
- **B3. Generator-based flows (e.g., riscv-dv from Google/CHIPS Alliance).** Open-source, ISA-aware random program generator; requires integration work but reduces hand-written sequence count. [Source: github.com/chipsalliance/riscv-dv.]

Within the formal-tool domain:

- **F1. Commercial model checkers.** Examples: Siemens EDA JasperGold, Synopsys VC Formal, Synopsys 360 DV-Formal. Higher capacity, commercial support, license cost.
- **F2. Open-source model checkers.** Examples: Yosys + SymbiYosys (SBY), ABC-based bounded model checking, academic frameworks. Lower cost; smaller capacity; smaller ecosystem. [Source: https://github.com/YosysHQ/yosys; https://github.com/YosysHQ/sby.]

Coverage-model alternatives:

- **C1. Structural only (line/branch/toggle).** Fast to collect; known to miss functional holes.
- **C2. Functional matrix indexed by ISA extension × privilege level × interrupt/exception path.** Necessary for sign-off; higher collection and debug cost.
- **C3. Functional + mutation score.** Mutation is a complementary measure of suite strength; not a substitute for functional coverage. Whether mutation is part of the XH-1 sign-off artifact is an **OPEN QUESTION** (see Verification Considerations).

---

## Comparison

**INSUFFICIENT EVIDENCE** for a quantitative comparison. The relative run time, license cost, engineering effort, coverage-closure time, and debug productivity of A1–A4, B1–B3, and F1–F2 depend on the chosen EDA stack, the ISA profile, and the in-house team's existing code base, none of which are captured in the project repository. A numeric trade-off table is not fabricated here. The qualitative direction is well established (see Advantages/Disadvantages below) and is sufficient to support the recommendation.

---

## Advantages

**Hybrid simulation + formal (A2):**

- Formal closes deep corner cases (CSR WARL, TLB invariants, exception priority encoder) faster than simulation, where simulation reaches diminishing returns. (Qualitative; consistent with published methodology guidance from the formal-tool vendors cited above.)
- Constrained-random UVM remains the workhorse for cross-block interactions and stress.
- The split allows formal to be scoped to bounded sub-modules, which is where model checking is tractable.

**Generator-based flow (B3, e.g., riscv-dv):**

- Open-source and ISA-aware; reduces hand-written sequence count.
- Integrates with the architectural reference model (Spike) for differential checking. [Source: github.com/chipsalliance/riscv-dv; github.com/riscv/riscv-isa-sim.]

**Open-source formal (F2):**

- No license cost; can be applied to small bounded sub-modules (single FSMs, small CSR files) without commercial procurement.
- Useful as a pre-screen or as a fallback for sub-modules where commercial formal capacity is not warranted.

**Compliance framework:**

- riscv-arch-test with the RISC-V International signing process produces a portable, vendor-neutral artifact that downstream software/OS teams can use. [Source: github.com/riscv-arch-test; RISC-V International *Compliance Policy*.]

---

## Disadvantages

**Hybrid simulation + formal (A2):**

- Two tool flows must be integrated, which adds engineering effort and requires a coverage-merging strategy across flows.
- Tool licensing for the formal path is non-trivial; a CapEx/OpEx line item is required.

**Generator-based flow (B3):**

- riscv-dv is RV32/RV64 ISA-focused; non-ISA RTL (custom accelerators, custom CSRs) is not generated and must be hand-written.

**Compliance framework:**

- The riscv-arch-test suite is shallow; producing a signature on it is necessary but not sufficient for sign-off. Treating it as sufficient is a known failure mode. (This is a usage guideline, not a property of the framework itself.)

**Open-source formal (F2):**

- Lower model-checking capacity than commercial tools; not all sub-modules will close.
- Smaller ecosystem of commercial support.

**General across alternatives:**

- None of the alternatives in isolation produces a tape-out-ready sign-off artifact; all require an explicit, project-owned coverage-closure plan with numeric exit criteria.

---

## XH-1 Considerations

**ASSUMPTION** — XH-1 is a custom 128-core RISC-V design. Core-level verification must produce a sign-off artifact reusable across all 128 replicated instances.

**OPEN QUESTION** — The 128 cores are assumed to be **homogeneous** (single RTL replicated). Whether this holds, or whether XH-1 includes variants (e.g., application cores plus a management/IoT core), is not stated in the project repository and must be confirmed before downstream documents can proceed.

**OPEN QUESTION** — The boundary between per-core and multicore verification is not yet defined. Candidates:

- Per-core: L1 I-cache, L1 D-cache, MMU/TLB, PMP, CSR, debug transport module, trace encoder, retire/ROB, exception/interrupt controller.
- Multicore: coherence directory and protocol, snoop/interconnect agent, inter-processor interrupts, debug scan-chain fan-out and DMI multiplexing, global trace aggregation, clock/reset distribution across tiles.

**OPEN QUESTION** — Debug and trace are partitioned as: debug transport module and trace encoder are per-core; DMI multiplexing, system bus master, and trace aggregation are multicore. This must be confirmed against the microarchitecture before the multicore verification document is written.

**OPEN QUESTION** — The RISC-V Debug Specification version that applies to XH-1 is not stated. The current ratified version is 1.0.0; the project's choice between 1.0.0 and any earlier revision (including 0.13, which was a pre-ratification draft) is not captured. Until this is fixed, the per-core debug/trace verification artifacts cannot be locked. The Trace Specification version is similarly unresolved (current ratified version is 2.0.0).

---

## 128-Core Scalability

**PROPOSAL** — Per-core verification collateral (testbench, sequences, assertions, coverage models) is constructed as a **single instance-independent artifact** that is run for each of the 128 replicated cores (or, equivalently, run once with a parameterizable instance handle). The collateral does not carry per-instance state; coverage, scoreboard state, and reference-model state are reset between instance runs unless a cross-instance scenario is explicitly constructed (and cross-instance scenarios are owned by the multicore document). This is the same artifact exercised 128 times, not 128 specialized artifacts.

**PROPOSAL** — The formal-tool bound (proof depth, state-space depth, number of register bits) is selected such that the same bound applies to all 128 instances; the bound is not a function of the instance index. The formal collateral is therefore also instance-independent.

**ASSUMPTION** — The 128-core design reuses a single verified core RTL. If the array is heterogeneous, the instance-independence collapses to one per variant, and the per-core effort is multiplied by the number of variants.

**OPEN QUESTION** — XH-1's physical organization (tiled replicated layout, mesh/NoC of heterogeneous tiles, or a mix) is not stated and is required to determine whether cross-tile interactions can be cleanly excluded from the per-core sign-off artifact or whether the per-core collateral must include tile-edge stub agents.

**PROPOSAL** — Cross-core interactions (coherence, inter-processor interrupts, debug scan-chain fan-out) are **out of scope** for the per-core document and are owned by the multicore verification document. (This is a PROPOSAL based on the verification-reasoning argument that mixing per-core and multicore concerns produces a fragile, instance-coupled artifact; it is not a "known anti-pattern" in the sense of an externally codified rule.)

**OPEN QUESTION** — How is the riscv-arch-test signing flow extended to 128 instances? The compliance flow is per-core; the project intent (one signature per instance, one signature from a representative instance, or a parameterized signature) is not stated.

**PROPOSAL** — Regression parallelism across 128 instances is achieved by distributing identical per-core runs across the host farm. A single failing seed in one instance blocks the regression for that instance but does not invalidate the other 127 instance runs; triage is per-instance. Cross-instance coverage merging is performed by aggregating the per-instance coverage databases into a single per-core dashboard.

**OPEN QUESTION** — FPGA prototyping or emulation capacity for 128 cores is not stated. A4 (Emulation/FPGA-first) is feasible only if the platform can host the full array; the alternative is to emulate a single instance plus a representative tile-edge stub, which is a per-core artifact, not a multicore one.

---

## Performance Considerations

**OPEN QUESTION** — Core-level simulation throughput (instructions/second, coverage points/hour) depends on the chosen simulator (commercial event-driven, Verilator, cocotb, or custom), the workload, and the host farm, none of which are fixed. No numeric simulation throughput is fabricated here.

**ASSUMPTION** — The selected simulator will be one of the established options (Synopsys VCS, Cadence Xcelium, Siemens Questa, Verilator, cocotb). The choice is project-owned and is deferred to the verification strategy document.

**OPEN QUESTION** — The trade-off between open-source simulators (Verilator, cocotb) and commercial event-driven simulators at 128-core regression scale is not characterized here. The relevant axes are: per-instance throughput, license cost, UVM support, coverage-tool integration, and debug visibility. A quantitative trade-off depends on the chosen farm size and is not fabricated.

**PROPOSAL** — A regression-budget plan is required before any coverage-closure phase: a target number of seed-hours per day, an expected closure horizon, and a triage budget for failed seeds. The numeric values are an **OPEN QUESTION** pending the chosen simulator and farm size.

---

## Area Considerations

**INSUFFICIENT EVIDENCE** — Verification-influenced area decisions (adding observability or assertion logic, formal-friendly state encodings, scan/DFT hooks) are not characterized for XH-1.

**ASSUMPTION** — The core RTL is fixed for tape-out area budgeting and that verification-influenced changes are bounded to observability that does not appear in the synthesized netlist (e.g., `ifdef` guards). This must be confirmed against the synthesis/scan insertion flow.

**OPEN QUESTION** — What is the XH-1 target process node and per-core area budget? Both are required before area-influenced verification choices (e.g., one-hot vs. binary FSM encoding for formal tractability) can be evaluated.

---

## Power and Energy Considerations

**INSUFFICIENT EVIDENCE** — Per-core power and energy are not characterized for XH-1.

**ASSUMPTION** — Verification-influenced power decisions (e.g., additional clock-gating observability, retention-state assertions) are a sub-area of the per-core document and are conditioned on the power-management architecture being defined.

**OPEN QUESTION** — Does XH-1 implement RISC-V power-management extensions (e.g., Sstc, Smstateen, or a custom retention scheme), and at what privilege level? Until this is answered, power-aware verification cannot be scoped.

**OPEN QUESTION** — How is energy-aware DV (e.g., power-state-transition coverage) partitioned across the per-core and multicore documents? An explicit ownership line is required.

---

## Implementation Considerations

**OPEN QUESTION** — XH-1 implements a defined subset of the RISC-V ISA (base integer I, and a selected set of M, A, C, F, D, V, B, H, and cryptography sub-extensions under the Zk/Zkn/Zks/Zb* namespace, plus platform extensions). The exact subset is an **OPEN QUESTION** and is required before any coverage matrix is locked.

**OPEN QUESTION** — Is the core in-order or out-of-order? This drives the verification surface:

- In-order: simpler scoreboard, no speculation-recovery paths.
- Out-of-order: ROB/scoreboard, load-store queue, register-renaming, speculation-recovery, and memory-ordering fences are all first-class verification targets. A formal model of the ROB is typically bounded (small replay queue depth, fixed rename-map width) and tractable within that bound; a full out-of-order memory subsystem is generally beyond unbounded proof.

**OPEN QUESTION** — The ROB formal bound (proof depth, replay-queue depth, rename-map width) is project-owned and is not fixed here. The bound is selected to make the model checker tractable while exercising the recovery paths the project considers in-scope for formal closure. The bounded proof covers the in-bound states; the unbounded remainder is covered by simulation. This division of labor is stated as a PROPOSAL, conditional on the in-order/out-of-order answer and on the project's risk posture.

**ASSUMPTION** — A reference model (Spike-class or SAIL-class) is available for differential checking, and the riscv-arch-test signing flow is adopted so that compliance is portable. Both are working assumptions until confirmed.

**PROPOSAL** — Where the project's extensions include V (vector), B (bitmanip), H (hypervisor), or cryptography sub-extensions (Zk/Zkn/Zks/Zb*), the per-core coverage matrix is extended with extension-specific cross-coverage, and formal proofs on the corresponding functional units are added to the formal scope. The conditional language here is the binding form: the coverage and formal scopes are conditioned on the confirmed ISA profile.

**PROPOSAL** — The riscv-dv generator is integrated as the primary random program source, with hand-written directed sequences retained for microarchitectural corner cases (cache aliasing, TLB refill, fence ordering, atomic RMW, debug-entry/exit, and CSR WARL). [Source: github.com/chipsalliance/riscv-dv.]

---

## Verification Considerations

**PROPOSAL** — A coverage closure plan is defined before any RTL is signed off. Exit criteria are stated in terms of:

- **Functional coverage.** Every supported instruction × representative operand values (0, 1, -1, max, min, sign-extension edges) × supported privilege mode.
- **Exception/interrupt coverage.** Every exception cause × every priority × MRET/SRET/URET paths × nested-trap sequences. [Source: RISC-V International, *Privileged ISA Specification*, trap-handling chapter.]
- **CSR coverage.** Every implemented CSR × every writable bit × reset value × WARL semantics. Formal proof of WARL invariants is a sub-goal.
- **Memory access coverage.** Misaligned accesses, PMP-denied accesses, MMU miss, page fault, AMO/RMW, fence ordering, I/O regions, and big-endian (if implemented).
- **Reset and debug.** Every reset reason (power-on, warm, retention, debug) and every debug state transition in the RISC-V Debug Specification version confirmed for XH-1.
- **Formal.** Targeted bounded proofs on bounded sub-modules: CSR file WARL invariants, TLB invariants, exception priority encoder, retire/ROB, debug-transport FSM, trace-encoder FSM. The bound for each sub-module is project-owned (see Implementation Considerations).

**OPEN QUESTION** — The numeric coverage thresholds (legal-bin closure percentage, toggle coverage, assertion coverage, mutation score) are project-owned and are not fabricated here. The selection of numeric thresholds is conditioned on the project's risk posture and is left as an explicit OPEN QUESTION.

**OPEN QUESTION** — Mutation / fault-injection (alternative C3) is a complementary measure of suite strength. Whether it is in or out of the XH-1 sign-off artifact is not decided in this document. Options: (i) include mutation score as an explicit exit criterion; (ii) use mutation as a development-time diagnostic without a numeric exit criterion; (iii) exclude mutation entirely. The decision is deferred to the verification strategy document.

**PROPOSAL** — Extension-specific items in the coverage list are conditioned on the confirmed ISA profile:

- F/D coverage (including NaN-boxing) is included only if the F/D extension is implemented.
- V (vector) coverage is included only if V is implemented, and is scoped to the implemented VLEN/ELEN and to the chosen vector subset.
- B (bitmanip) coverage is included only if B is implemented.
- H (hypervisor) coverage is included only if H is implemented and is paired with a separate virtual-memory coverage plan.
- Cryptography coverage (Zk, Zkn, Zks, Zbkb, Zbkc, Zbkx) is included only for the implemented sub-extensions, with side-channel considerations deferred to a separate document.

This conditional scoping is the binding form: the coverage list is fixed at the granularity of *conditioned on the confirmed ISA profile*.

**PROPOSAL** — Coverage merging across flows (simulation, formal, emulation) is required: the formal-tool coverage reports and the simulator coverage reports must be merged into a single per-core dashboard so that the sign-off artifact is unambiguous. At 128-instance scale, the merge is performed per-instance and then aggregated.

**OPEN QUESTION** — Which verification sub-area (formal, fault injection, ISA compliance, multicore, regression, strategy, unit) consumes the artifacts produced at the core level? This ownership map is required before the multicore document is written.

---

## Software Considerations

**PROPOSAL** — The per-core verification artifacts are aligned with the downstream software flow:

- The riscv-arch-test signature is producible from the verified core and is delivered alongside the reference manual. At 128-instance scale, the signature-generation step is repeated per instance (or per representative instance, per the project-owned decision; see 128-Core Scalability).
- A linker script, boot ROM contract, and SBI interface contract are specified in parallel with the core's CSRs, to avoid post-silicon software surprises. [Source: RISC-V International, *SBI Specification*.]
- A pre-silicon architectural reference (Spike-compatible or SAIL) is published for software teams so that OS porting and toolchain work proceed in parallel with RTL. The specific version of Spike or SAIL is pinned to a commit or release tag as part of the verification strategy document; this document does not commit to a version.

**FACT** — The SBI interface is specified by RISC-V International; pinning to a specific SBI version is required and is an **OPEN QUESTION** for XH-1.

---

## Recommendation

**RECOMMENDATION** — Adopt the hybrid simulation + formal methodology (A2) for per-core verification, with the following binding choices:

1. **Simulation workhorse.** Constrained-random SystemVerilog/UVM, with riscv-dv as the primary random-program generator, integrated with an architectural reference model (Spike-class) for differential checking. The specific simulator and reference-model version are project-owned and are deferred to the verification strategy document (see Open Questions).
2. **Formal scope.** Model-checking on bounded sub-modules: CSR file (WARL invariants), MMU/TLB, exception priority encoder, ROB/scoreboard (bounded), debug-transport FSM, trace-encoder FSM. Candidate tool categories are commercial model checkers (e.g., Siemens EDA JasperGold, Synopsys VC Formal, Synopsys 360 DV-Formal) and, for small bounded sub-modules, open-source model checkers (e.g., Yosys + SymbiYosys). Specific tool selection, license procurement, and per-sub-module tool assignment are deferred to the verification strategy document and are not bound by this document.
3. **Compliance.** riscv-arch-test signature generation is part of the sign-off artifact. At 128-instance scale, the per-instance signature-generation policy is an **OPEN QUESTION** (see 128-Core Scalability).
4. **Coverage model.** Functional matrix indexed by ISA extension × privilege level × interrupt/exception path, with extension-specific items conditioned on the confirmed ISA profile. Mutation / fault-injection status is deferred to the verification strategy document (see Verification Considerations).
5. **Collateral reuse.** Per-core verification collateral is constructed as a single instance-independent artifact reused across all 128 instances. Cross-instance scenarios are owned by the multicore verification document.
6. **Ownership.** Cross-core interactions (coherence, inter-processor interrupts, debug scan-chain fan-out, trace aggregation) are owned by the multicore verification document.

The numeric coverage thresholds, the choice of simulator and formal tool, the specific reference-model version, and the coverage-closure horizon are **OPEN QUESTIONS** and are deferred to the verification strategy document and the project's sign-off policy. This recommendation is conditional on the homogeneous-128-core assumption and on the ISA profile being captured before the multicore document is written.

---

## Confidence

Medium. The methodology recommendation follows from established industry practice and the cited RISC-V specifications; the recommendation does not depend on the unresolved numeric thresholds. Confidence would be upgraded to High once the **OPEN QUESTIONS** below are closed.

---

## Open Questions

- What RISC-V base and extensions does XH-1 implement (RV32/RV64, I/M/A/F/D/C/V/B/H, cryptography sub-extensions under Zk/Zkn/Zks/Zb*, supported privilege modes, hypervisor)?
- Is the core in-order or out-of-order?
- Is the 128-core array homogeneous, or are there variants (application cores plus a management/IoT core)?
- What is the XH-1 target process node, per-core area budget, clock frequency, and tape-out schedule?
- What simulator and formal-tool stack is available or mandated (commercial, Verilator, cocotb, Yosys + SymbiYosys, custom)?
- What is the project's stance on the RISC-V International compliance signing process, and at what SBI version is the platform pinned?
- What numeric coverage exit criteria (legal-bin percentage, toggle, assertion, mutation score) does the project accept for tape-out, and is mutation in or out of the sign-off artifact?
- Which RISC-V Debug Specification version (0.13 or 1.0.0) and which Trace Specification version (2.0.0 or other) apply to XH-1?
- Which verification sub-area (formal, fault injection, ISA compliance, multicore, regression, strategy, unit) consumes the artifacts produced at the core level?
- Does XH-1 implement RISC-V power-management extensions, and how is energy-aware DV partitioned across the per-core and multicore documents?
- Is FPGA prototyping or emulation capacity available at the scale required to boot 128 cores?
- What is the per-instance riscv-arch-test signature policy (one per instance, one per representative instance, parameterized)?
- What are the formal proof bounds (depth, state-space width) for the ROB and other bounded sub-modules?

---

## Sources

- RISC-V International, *Unprivileged ISA Specification* (latest ratified). https://riscv.org/technical/specifications/
- RISC-V International, *Privileged ISA Specification* (latest ratified). https://riscv.org/technical/specifications/
- RISC-V International, *Debug Specification*, version 1.0.0. https://riscv.org/technical/specifications/
- RISC-V International, *Trace Specification*, version 2.0.0. https://riscv.org/technical/specifications/
- RISC-V International, *Cryptography Extensions* (Zk, Zkn, Zks, Zbkb, Zbkc, Zbkx). https://riscv.org/technical/specifications/
- RISC-V International, *SBI Specification*. https://riscv.org/technical/specifications/
- RISC-V International, *Compliance Policy* and *Architecture Test* framework. https://github.com/riscv-arch-test
- OpenHW Group, *CV32E40P Core Documentation*. https://github.com/openhwgroup/core-cv32e40p
- OpenHW Group, *CV32E40PX Core Documentation*. https://github.com/openhwgroup/core-cv32e40px
- Google / CHIPS Alliance, *riscv-dv* (ISA-aware random program generator). https://github.com/chipsalliance/riscv-dv
- Berkeley / SiFive, *Spike* (riscv-isa-sim). https://github.com/riscv/riscv-isa-sim (no specific version pinned in this document; pinning is deferred to the verification strategy document.)
- Cambridge, *SAIL RISC-V* (architectural reference model). https://github.com/rems-project/sail-riscv
- Imperas, *riscvOVPsim* (commercial reference model). https://github.com/riscv-ovpsim
- Siemens EDA, *JasperGold* formal verification platform (product documentation). https://eda.sw.siemens.com/en-US/ic/jaspergold/
- Synopsys, *VC Formal* (product documentation). https://www.synopsys.com/verification/static-and-formal-verification/vc-formal.html
- Synopsys, *360 DV-Formal* (formerly OneSpin 360 DV; OneSpin acquired by Synopsys in 2022). https://www.synopsys.com/verification/static-and-formal-verification/360-dv-formal.html
- YosysHQ, *Yosys* (open-source synthesis and formal-verification framework). https://github.com/YosysHQ/yosys
- YosysHQ, *SymbiYosys (SBY)* (open-source formal verification front-end). https://github.com/YosysHQ/sby

`INSUFFICIENT EVIDENCE` is recorded above in the Performance, Area, Power and Energy, and Comparison sections pending the project inputs that close the corresponding **OPEN QUESTIONS**. No numeric claim in any of those sections has been fabricated.
