Scaling Input Stimulus Generation through Hybrid Static and Dynamic Analysis of RTL

We enhance STAR, an automatic technique for functional input vector generation for design validation. STAR statically analyzes the source code of the Register-Transfer Level (RTL) design. The STAR approach is a hybrid between RTL symbolic execution and concrete simulation that offsets the disadvantages of both. The symbolic execution, which follows the concrete simulation path, extracts constraints for that path. The guard in the path constraints is then mutated and passed to an SMT solver. A satisfiable assignment generates a valid input vector. However, STAR suffers the problem of path explosion during symbolic execution. In this article, we present an explored symbolic state caching method to attack path explosion. Explored symbolic states are states starting from which all subpaths have been explored. Each explored symbolic state is stored in the form of bitmap encoding of branches to ease comparison. When the explored symbolic state is reached again in the following symbolic execution, all subpaths can be pruned. In addition, we use two types of optimizations: (a) dynamic UD chain slicing; and (b) local conflict resolution to improve the running efficiency of STAR. We demonstrate that the results of the enhanced STAR are promising in showing high coverage on benchmark RTL designs, and the runtime of the test generation process is reduced from several hours to less than 20 minutes.