Boosting the Bounds of Symbolic QED for Effective Pre-Silicon Verification of Processor Cores

TL;DR

This paper introduces an enhanced symbolic QED method leveraging symbolic starting states, enabling rapid and effective detection of complex logic bugs and hardware Trojans in processor cores without manual test guidance.

Contribution

It presents a novel approach combining symbolic QED with symbolic starting states to improve bug detection capabilities and efficiency in pre-silicon verification.

Findings

Detected 100% of bugs and Trojans in seconds to hours.

Identified previously unknown bugs in open-source RISC-V cores.

Achieved near-complete bug detection with minimal manual intervention.

Abstract

Existing techniques to ensure functional correctness and hardware trust during pre-silicon verification face severe limitations. In this work, we systematically leverage two key ideas: 1) Symbolic Quick Error Detection (Symbolic QED or SQED), a recent bug detection and localization technique using Bounded Model Checking (BMC); and 2) Symbolic starting states, to present a method that: i) Effectively detects both "difficult" logic bugs and Hardware Trojans, even with long activation sequences where traditional BMC techniques fail; and ii) Does not need skilled manual guidance for writing testbenches, writing design-specific assertions, or debugging spurious counter-examples. Using open-source RISC-V cores, we demonstrate the following: 1. Quick (<5 minutes for an in-order scalar core and <2.5 hours for an out-of-order superscalar core) detection of 100% of hundreds of logic bug and hardware Trojan scenarios from commercial chips and research literature, and 97.9% of "extremal" bugs (randomly-generated bugs requiring ~100,000 activation instructions taken from random test programs). 2. Quick (~1 minute) detection of several previously unknown bugs in open-source RISC-V designs.