ChipPilot writes UVM sequences, SVA properties, bind files, and formal collateral; runs simulator and bounded proof gates; parses failures; patches artifacts; and delivers PR-ready diffs with evidence attached.
ChipPilot turns a verification intent into a real run on real tools, then a real patch, then a reviewable PR. Every step is named, gated, and recorded — so a DV lead can audit it and a CI can rerun it.
Target module, protocol, and acceptance gate, in natural language.
RTL, TB, docs, prior patterns retrieved with file/line citations.
Sequence, property, bind file, assumptions, coverage hooks.
Simulator compile + elab + smoke, bounded formal proof.
Log- and CEX-driven patch loop, constrained by policy.
PR-ready diff, transcript, citations, audit trail.
The product story doesn't depend on vague AI claims. ChipPilot is built around reproducible artifacts — tool-gated runs, transcripts, file/line citations, counterexamples, and a PR-ready diff.
// AXI ready/valid handshake — refined after CEX at t=18 module axi_props ( input logic clk, rst_n, input logic valid, ready ); default clocking @(posedge clk); endclocking default disable iff (!rst_n); // stability: valid must hold until ready property ready_hold; valid && !ready |=> valid; endproperty a_ready_hold: assert property(ready_hold); c_ready_hold: cover property(ready_hold); endmodule
[04:18:21] orchestrator intent accepted · gate=bounded_proof [04:18:23] retriever 3 citations · axi_dma.sv axi_agent_pkg.sv axi_bind.sv [04:18:25] generator drafted axi_props.sv · 18 lines [04:18:31] simulator compile PASS · elab PASS · smoke PASS [04:18:42] formal bounded CEX · ready_hold · depth=18 [04:18:43] repair reading cex.vcd · 1 root cause [04:18:48] policy diff=2 LoC · within budget · approved [04:18:52] formal rerun · bounded PROVED · depth=32 [04:18:54] evidence packet ready · attached to PR #1284
Representative pilot dashboard shown for product storytelling. Replace with measured results before external launch.
Shown metrics are from controlled pilot/evaluation runs. Production outcomes vary by codebase, toolchain, and policy configuration.
From CEX detected to PROVED — read CEX, locate root cause, refine SVA, rerun gate, package evidence.
PRs accepted on first review, without revision rounds.
Diff budget caps every patch; reviewers don't audit walls of code.
Every run is a deterministic, reproducible artifact your CI can replay.
DV and formal engineers lose days searching hardware repos, writing repetitive UVM scaffolding, debugging compile and formal failures, tracing counterexamples, maintaining stale plans, and repeating the same fix-verify loop by hand.
vlog-2730: unknown field axi_cfg.ready_mode
reset sequence differs from rtl/top.sv:91
ready deasserted while valid remains high
assertion ready_hold failed
Each agent has a job, a set of tools it's allowed to call, and a gate that decides whether its output is accepted. The orchestrator hands work off, collects evidence, and produces a single PR.
Generates sequences, tests, monitors, checkers, and coverage hooks. Learns repo patterns, then compiles and smoke-runs the result.
class axi_backpressure_seq extends uvm_sequence;
Writes properties, assumptions, covers, and bind files. Runs bounded formal and refines properties from counterexamples.
assert property(ready_hold); // depth 32 · proved
Parses logs, wave artifacts, and CEX traces. Clusters failures and suggests minimal patches or next experiments.
Schedules and prunes regression sets, reruns failing seeds with new evidence, and tracks closure trends across tool runs and toolchains.
Diff budgets, path allowlists, and tool validation before any patch reaches a reviewable PR. Defaults off until you opt in for a target.
// localized · 2 LoC · policy ok - ready <= 1'b1; + ready <= cfg.ready_mode ? gnt : 1'b1;
ChipPilot is the verification cockpit that closes tool-backed loops and leaves behind audit-ready evidence — not just suggestions.
Can draft code. Usually can't retrieve repo context, run EDA tools, parse failures, patch, and prove the result.
Useful in the editor. Weak on end-to-end simulator / formal gates, evidence packaging, and policy control.
Teams already have runners and parsers. Missing: a repo-aware agent that reasons across artifacts and reruns gates.
Intent → repo intel → UVM / SVA generation → real tool run → repair → evidence-backed, PR-ready diff.
The orchestrator sequences planning, repo intelligence, policy checks, simulator and formal runners, failure repair, and the Evidence Graph. Every loop ends in a reviewable evidence packet.
Closes the loop from intent to tool run to repair to evidence-backed review.
ChipPilot is judged by the gates it can drive. Open-source backends ship as the local default; commercial adapters live behind your license boundary.
Lint, compile, and smoke loops when approved in policy. Runs in a sandboxed worker.
Proof sanity where an approved local backend is available. Bounded depth configurable per gate.
Policy-gated runner adapters for private infrastructure. License auth stays inside your env.
Adapter pattern for teams with licensed formal tools. Same gate contract as the local path.
PR with the evidence report, transcript, citations, and diff summary attached.
Read-only ingest by default. Allowlisted write paths once a target is approved.
ChipPilot runs where your IP already lives. On-prem, private cloud / VPC, or hybrid routing — with no-retention mode, RBAC, audit logs, secret redaction, network egress disabled, write-path allowlists, max diff budgets, and mandatory tool gates.
dv/** · tb/** · formal/**A focused evaluation path for UVM + Formal/SVA first. Start read-only, wire the runners, pick controlled target tasks, run gated loops, then review the evidence packet before expansion.
Index RTL, TB, docs, and verification plans without write access. Confirm redaction and citation behavior.
Attach Verilator or licensed runners behind your boundary with command allowlists and tool gates.
Pick one UVM sequence, SVA property, bind file, or compile/elab failure that already costs DV time.
Generate, compile, smoke simulate, run bounded proof, parse failures, patch, and rerun within policy.
Review the transcript, citations, diff, CEX notes, and gate result. Expand only if the evidence is useful.
The same control loop drives UVM generation, SVA proofs, compile repair, and CEX triage. Pick a tab to see how the gate produces review evidence.
plan -> inspect axi_agent_pkg.sv
-> generate sequence
-> compile tb_top
result
axi_backpressure_seq.sv + coverage hook with file/line citations.class axi_backpressure_seq extends uvm_sequence #(axi_item); `uvm_object_utils(axi_backpressure_seq) function new(string name = "axi_backpressure_seq"); super.new(name); endfunction task body(); repeat (64) begin `uvm_do_with(req, { burst_len inside {[8:64]}; ready_gap dist {0 := 10, [1:4] := 40}; }) end endtask endclass
formal gate -> bounded check launched -> evidence capturedresult
property ready_hold; @(posedge clk) disable iff (!rst_n) valid && !ready |=> valid; endproperty a_ready_hold: assert property(ready_hold); c_ready_hold: cover property(ready_hold); // bind file bind axi_dma axi_props u_axi_props (.*);
vlog-2730 -> field ready_mode not found
-> patch config reference
result
// dv/env/axi_seq.sv:42 - if (axi_cfg.ready_mode == FAST) begin + if (axi_cfg.bp_mode == FAST) begin req.gap = 0; endrerun
[04:21:02] simulator compile PASS [04:21:09] simulator elab PASS [04:21:18] simulator smoke PASS
cycle 18: valid=1 ready=0 data_changed=1 -> root cause located -> SVA refinedresult
- assume ready |-> valid; + valid && !ready |=> valid;
Every closed loop emits a single versioned bundle. Open it and you find the same four things, every time — the artifacts a DV lead would have asked for anyway, only assembled before the review meeting.
04:18:42 formal CEX d=18 04:18:43 repair 1 root cause 04:18:48 policy approved 04:18:52 rerun PROVED
- assume ready |-> valid; + valid && !ready |=> valid; # formal/axi_props.sv · 2 LoC
rtl/axi_dma.sv:184 dv/env/axi_agent_pkg.sv:42 formal/axi_bind.sv:17 ──────────────────── ● sha256 · digest
Every tool call, gate decision, and policy check, with deterministic timestamps.
Constrained patch within your diff budget and path allowlist. Nothing more.
Counterexample witness — VCD plus a one-paragraph root-cause summary.
File / line references the agent retrieved and used. Reviewable in seconds.
We've heard them all. Short answers below; longer ones in the docs and on the pilot call. If your team is harder on this than we are — good. So are we.
Generation is allowed to be wrong. Acceptance is not. A run isn't finished until the simulator compiles it, the smoke test runs, the property proves, and the diff is within policy. No gate, no PR.
No. On-prem and private-VPC deployments are the default. Network egress is a hard-off policy bit. Retention is opt-in. License auth for commercial tools stays in your environment.
Only when you opt in for a target, with a path allowlist and a diff budget. Default is verification collateral only — sequences, properties, bind files, assumes, coverage hooks.
Local open-source backends ship as the default. Enterprise simulators and formal tools attach via adapters behind your license boundary. Same gate contract on both paths.
Every run produces a reproducible evidence packet — transcript, diff, CEX, citations — and reattaches it on every PR. You decide the gate; the agent provides the receipts.
Four-day pilot path. One repo, one target, one real gate, one review. No black-box demo. You walk away with the evidence packets whether or not you continue.
Packaging is intentionally pilot-led while the product matures. Treat these as engagement models, not contracted customer pricing.
Sandbox one repo, pick one target, run one real gate, review one packet.
A DV / formal team running closed loops in CI, with policy and review controls.
Multi-org, multi-region evidence review with custom deployment.
Released, in development, and on the horizon. Gates expand, deployment surface expands, the loop stays closed.
Simulator compile / smoke, bounded formal, evidence report, single-repo loop.
Spec → verification plan, CEX refinement, debug triage, coverage guidance.
Regression orchestration, multi-repo, RBAC, policy-as-code, hybrid deployment.
Coverage closure agents, formal review recipes, and tape-out evidence bundles.
Runs where your IP lives — on-prem, private cloud, or hybrid.