Bridging the Gap: Automated RISC-V Verification via Trace Notation

TL;DR

The inherent flexibility of the RISC-V ISA is a double-edged sword: it enables massive customization but makes formal functional verification a nightmare. This paper introduces a trace notation modeling framework that captures pipelined behavior to automatically generate formal properties. By combining structural ISA semantics with timing-annotated traces and the C-S2 QED method, the authors achieve a high-coverage, low-effort verification flow capable of catching complex pipeline bugs in industrial-grade cores.

The Verification Bottleneck in Customizable Silicons

In the modern SoC era, verifying a processor consumes over 50% of the development cycle. While RISC-V allows engineers to add custom instructions (for AI, security, etc.), each addition necessitates a complete overhaul of the verification IP. Traditional formal methods often struggle with:

1. Complexity of Pipelining: Detecting bugs that only occur during specific instruction interleaves (Multiple-Instruction Bugs).
2. Manual Effort: Writing "complete" sets of properties is error-prone and requires deep expertise in both the ISA and formal tools like SVA.

Methodology: From Structural ISA to Timed Traces

The authors decouple the verification task into two distinct models to maximize reusability.

1. Structural ISA Model (MetaRISC)

This is microarchitecture-agnostic. It defines the "What": what instructions exist, their bit-encodings, and their logical effects on registers (GPR, PC, CSR).

2. Trace Notation (The "How")

To capture the "How"—the sequential flow of an instruction through fetch, decode, execute, memory, and write-back—the paper introduces a Trace Metamodel.

• Traces represent instruction classes (e.g., all Arithmetic instructions follow the same pipeline flow).
• Transitions are annotated with "Length" (clock cycles) and "Guards."

Fig 1: The MetaRISC metamodel defining the structural hierarchy of instructions and states.

3. Automated Property Generation

Using a Python-based model-driven flow, the framework transforms these specifications into ITL (Interval Temporal Language) properties. Crucially, they incorporate C-S2 QED, which adds consistency checks between two symbolic execution instances of the CPU. This allows the tool to catch bugs caused by instruction dependencies without manual test-case writing.

Fig 2: Trace representation for a 5-stage pipeline, mapping instructions to specific temporal states.

Experimental Results: Industrial Validation

The framework was tested on several RISC-V variants used in automotive SoCs.

• Coverage: It successfully verified RV32I, M, C, and Zicsr extensions.
• Bug Detection: It identified both SIBs (Single-Instruction Bugs, e.g., wrong opcode decoding) and MIBs (Multiple-Instruction Bugs, e.g., pipeline hazard failures).
• Efficiency: For the base RV32I core, 12 generated properties reached convergence in under 30 minutes.

Fig 3: Analysis of manual effort vs. Generated Code. Note the high reusability when adding extensions.

Critical Insight & Conclusion

The genius of this approach lies in its abstraction of timing. By treating the pipeline as a series of transitions in a trace notation, the authors can adapt the verification suit to a 3-stage or 5-stage pipeline simply by updating the transition "Length" attribute in the model, rather than rewriting the formal properties.

Takeaway: For teams building custom RISC-V extensions, the "Modeling First" approach—defining traces rather than writing assertions—is the most viable path to maintaining a high-velocity design gate.

Limitations: While effective for in-order pipelines, the current work does not yet address the state-space explosion inherent in Out-of-Order (OoO) processors, which remains the "final boss" of formal verification.