Existing techniques to ensure functional correctness and hardware trust during pre-silicon verification face severe limitations. In this work, we systematically leverage two key ideas: 1) Symbolic Quick Error Detection (Symbolic QED or SQED), a recent bug detection and localization technique using Bounded Model Checking (BMC); and 2) Symbolic starting states, to present a method that: i) Effectively detects both "difficult" logic bugs and Hardware Trojans, even with long activation sequences where traditional BMC techniques fail; and ii) Does not need skilled manual guidance for writing testbenches, writing design-specific assertions, or debugging spurious counter-examples. Using open-source RISC-V cores, we demonstrate the following: 1. Quick (<5 minutes for an in-order scalar core and <2.5 hours for an out-of-order superscalar core) detection of 100% of hundreds of logic bug and hardware Trojan scenarios from commercial chips and research literature, and 97.9% of "extremal" bugs (randomly-generated bugs requiring ~100,000 activation instructions taken from random test programs). 2. Quick (~1 minute) detection of several previously unknown bugs in open-source RISC-V designs.

中文翻译：

---

提高符号 QED 的界限，以实现处理器内核的有效硅前验证

在硅前验证期间确保功能正确性和硬件信任的现有技术面临着严重的限制。在这项工作中，我们系统地利用了两个关键思想：1）符号快速错误检测（符号 QED 或 SQED），这是最近使用有​​界模型检查 (BMC) 的错误检测和定位技术；和 2) 符号启动状态，提出一种方法： i) 有效检测“困难”逻辑错误和硬件木马，即使在传统 BMC 技术失败的长时间激活序列中；和 ii) 不需要熟练的手动指导来编写测试平台、编写特定于设计的断言或调试虚假的反例。使用开源 RISC-V 内核，我们展示了以下内容： 1. 快速（对于有序标量内核 <5 分钟，<2. 5 小时无序超标量内核）100% 检测来自商业芯片和研究文献的数百个逻辑错误和硬件木马场景，以及 97.9% 的“极值”错误（随机生成的错误需要约 100,000 条激活指令）取自随机测试程序）。2. 快速（约 1 分钟）检测开源 RISC-V 设计中几个以前未知的错误。