differential-verification

Differential Verification

Overview

You trust a design by running it against something you already trust and comparing. The DUT (device under test) executes a stimulus; a golden reference model executes the same stimulus; you compare the resulting state. A mismatch is a bug in one of them, and finding which is the work.

Core principle: Same stimulus, two executors, compare state. Everything else (fuzzing, coverage, campaigns) exists to generate good stimulus and to localize the divergence. The comparison is only as good as the state you capture and how honestly you name it.

When to Use

• Checking a CPU core against an ISA simulator (Spike, an emulator)
• Checking an FPGA's observed outputs against a golden function
• Checking a netlist against a circuit simulation (SPICE/ngspice)
• Building a coverage-guided fuzzer for any of the above
• Comparing silicon behavior to a simulator and chasing where they disagree

The Core Loop

generate stimulus -> run on DUT -> capture DUT state
                  -> run on golden model -> capture golden state
                  -> compare -> divergence? report : record coverage

1. One stimulus, two runs. Drive the DUT and the reference with the identical input (the same program, the same vector, the same netlist excitation).
2. Capture comparable state. Final register file, memory regions, PC, retired-instruction trace, or node activity, whatever both sides can produce.
3. Compare honestly. A field you read but record as "absent" or false is a false pass waiting to happen. Make sure a captured value is actually compared.

Name State By The Hardware, Not The ABI

Capture and compare register state under raw hardware names: x0..x31, pc, raw CSR names. ABI aliases (a0, ra, sp) are a rendering concern for the frontend only. If the comparison layer speaks ABI names, two tools will eventually disagree about which physical register a0 is and you'll chase a phantom mismatch.

Coverage-Guided Fuzzing