The mechanism
Register-transfer level code describes how state changes and data moves between registers. Simulation executes that description under selected stimulus; assertions and formal methods test properties under stated assumptions. Coverage asks whether planned situations were exercised, not whether every possible bug has been excluded. An accelerator needs arithmetic checks as well as reset, backpressure, ordering, error and clock-domain behavior. OpenTitan supplies a public example of staged verification planning, reusable test environments and regression evidence. Verification must also cover integrated IP boundaries, because individually correct blocks can disagree about protocols or the meaning of a completed operation.
- Write a test plan from externally meaningful requirements, including illegal inputs and recovery behavior.
- Construct reference models for arithmetic and protocol state that can detect implementation disagreement.
- Drive simulation with directed corner cases and constrained randomized sequences.
- Use assertions or formal checks for invariants such as no buffer overwrite before consumption.
- Review failures and coverage gaps, then repeat regressions after integration changes and before stage approval.
Science and assumptions
State-space growth
The configuration space of b independent binary state bits contains two to the power b states.
Symbols and units
- N_states
- Possible configurations of b independent state bits
states
- b
- Independent binary state-bit count
bits
b is the number of independent state bits and Nstates is a count. Even modest state creates a large space of possible configurations.
Assumptions A crude upper bound; constraints and abstraction reduce reachable states but must be justified.
Engineering example
Synthetic FIFO property: after a valid item is accepted, it must emerge once in order unless reset explicitly cancels it. A test that pauses the consumer reveals bugs hidden by continuous ready signals.
Distinctions and tradeoffs
Passing simulation does not prove all states correct; high coverage does not excuse a missing requirement or an invalid formal assumption.
Exhaustive state exploration grows rapidly; engineers combine abstraction, constrained stimulus, formal properties and targeted tests rather than trusting one technique.
A rare deadlock or wrong accumulator rounding can corrupt long training runs even if the common matrix benchmark appears correct.
Specifications and interfaces
- Verification target
- Specification and interface properties
Tests require an expected behavior independent of the implementation.
- Coverage
- Evidence of exercised scenarios
Code or functional coverage is not a mathematical probability of correctness.
Interfaces
- Architecture specification Input
- Cycle behavior, numerical rules and protocol contracts
- Verification evidence Output
- Assertions, regression results, coverage and unresolved failures
Check your understanding
What makes a test useful for a hardware handshake?
- It checks behavior under backpressure and reset against a protocol rule
- It repeats the RTL calculation verbatim
- It only counts how often valid is high
Answer and reasoning
It checks behavior under backpressure and reset against a protocol rule
A handshake’s correctness depends on timing and ownership under difficult conditions, not merely exercising signals.
Evidence and scope
OpenTitan is a methodology example, not an AI accelerator design. Proprietary test coverage and signoff criteria are unknown and are not invented.
Use the manufacturing investigation to trace compatible inputs, assembly and operating constraints; no current standalone calculator models this lesson’s full mechanism.