Forbench is introduced, a word-level symbolic simulation framework that retains the familiar execution semantics of simulation but augments it with solver-backed symbolic signals and state transitions, enabling systematic exploration of RTL behaviors under symbolic inputs and conditions.
Abstract
Simulation remains the dominant approach in pre-silicon verification due to its ease of deployment and intuitive workflow. However, as simulation only explores a limited subset of possible execution traces within feasible time budgets, it often fails to explore rare corner cases, leaving latent bugs undetected. In contrast, formal verification offers mathematically rigorous guarantees of correctness. However, its practical adoption is constrained, not only by the scalability challenges over large-scale designs, but also by the change of mindset from stimulus-driven operations to the sequence-centric axiomatic view of design behaviors, introducing extra difficulty of writing precise properties to capture the exact verification intent. This paper aims to lower the barrier of applying formal methods in verification, by making simulation"more formal."It introduces Forbench, a word-level symbolic simulation framework that retains the familiar execution semantics of simulation but augments it with solver-backed symbolic signals and state transitions, enabling systematic exploration of RTL behaviors under symbolic inputs and conditions. It offers a Python interface, similar to the existing simulation-based frameworks, for defining constraints, coordinating symbolic (co-)simulations, and performing property checks. In additional to this more accessible interface, experiments also show that Forbench achieves notably speed-up over prior symbolic methods without the loss of coverage.
This work proposes VPID, a multi-agent framework for generating complex Verilog that achieves monotonic functional improvement and introduces an experience-guided refinement strategy that distills historical waveform mismatches into constraints, guiding the targeted debugging for the unverified ports.
Hongguang Wang, Jiaming Guo, Rui Zhang et al.· 0 citations
This approach uses LLMs to infer candidate specifications solely from test code and dynamic execution traces: the LLM observes only the program interface, selected inputs, and corresponding outputs or state changes, while the implementation internals remain hidden.
Tianhai Liu, Maximilian Müller, Tobias Hey et al.· 0 citations
Hybrid kernel fuzzing combines kernel fuzzing and symbolic execution: symbolic execution resolves hard-to-reach branch conditions, while kernel fuzzing mitigates path explosion. This collaboration has shown strong potential for uncovering deep kernel vulnerabilities. However, existing approaches have not fully accounted for the challenges introduced by the kernel’s persistent state, concurrent task execution, and large codebase, leading to (1) inconsistent execution environments between fuzzer and symbolic engine, (2) excessive symbolic tracking overhead, and (3) inefficient constraint solving. We present SymSyz, a hybrid kernel fuzzing framework that addresses these challenges with three techniques: Snapshot-Driven Environment Synchronization for state consistency, Origin-Scoped Symbolic Execution to reduce symbolic tracking overhead, and Priority-Guided Constraint Solving to improve solving efficiency. As a result, SymSyz improves coverage by up to 27%, achieves equivalent coverage levels with a speedup of up to $2.2\times $ , and delivers a symbolic tracking speedup of $5.6\times $ compared to the state-of-the-art kernel fuzzers. It detected 9 additional bugs on a legacy kernel and 13 previously unknown bugs on the latest Linux kernel, with 4 confirmed and 2 CNNVD IDs assigned.
Lu Xu, Baosheng Wang, Bo Yu et al.· IEEE Transactions on Informa...· 0 citations
FLEX is presented, a foundational Constrained Horn Clause (CHC) solver implemented in LEAN, that reduces the trusted base to the kernel alone, and allows using LEAN's entire proof ecosystem to verify low-level systems code, via three contributions.
J. Khan, Petros Markopoulos, Nicolás Lehmann et al.· 0 citations
SymCert is presented, a framework implemented in Lean for building verified SMT-based analyses of Cedar policies that provide a verified symbolic compiler and authorizer for reducing policies to SMT formulas, a hierarchy enforcer for ensuring well-formedness of counterexamples, and a counterex-ample extractor for proving analysis completeness.
As FPGA design complexity increases, the correctness and reliability of logic synthesis tools are critical to ensuring correct hardware implementation. These tools translate hardware description languages (e.g., Verilog) into gate-level netlists, where latent faults may introduce functional errors or performance degradation during synthesis. Existing approaches rely on automatically generated Verilog test cases to find these latent faults. However, their effectiveness depends heavily on generator configurations and is typically guided by input diversity, which fails to accurately capture differences in synthesis behavior. Moreover, the high-dimensional configuration space of generator further hinders efficient exploration. To address these challenges, we propose SynaSpace, a behavior-driven configuration optimization framework for fault detection in logic synthesis tools. SynaSpace focuses on synthesis behavior coverage to guide configuration search, by constructing behavioral representations through joint analysis of synthesis logs and gate-level netlists. The framework comprises four components: (1) configuration space modeling for unified parameter representation; (2) Bayesian optimization–based configuration search for efficient exploration; (3) synthesis behavior characterization and coverage evaluation for capturing and quantifying behavioral differences; and (4) fault detection and utility modeling for extracting effective feedback via differential testing and deduplication. These components are integrated into a unified optimization framework to enable efficient configuration exploration and improved testing effectiveness. We evaluate SynaSpace on two established logic synthesis tools (i.e., Vivado and Yosys). SynaSpace identifies 18 faults across four categories, all of which have been confirmed and fixed by vendors and the open-source community.
Peiyu Zou, Xiaochen Li, Yijia Meng et al.· ACM Transactions on Design A...· 0 citations
