Writing SystemVerilog tests that respect real hardware constraints (X, reachability, isolation)

Lessons from testing simulator X-behaviour on VCS, Icarus and Verilator. Most of them apply to any SystemVerilog test that is supposed to say something about real hardware.

**1. Create X the way hardware does.** Hand-writing logic en = 1'bx; and comparing it against arbitrary constants builds states no design can reach. Get x from the sources real designs have: an unreset flop, an undriven net, an uninitialized memory, an out-of-range select, a multiply-driven bus. Then drive the design through real stimulus.

logic mode_q;                                   // no reset: x until first load
always_ff @(posedge clk) if (load) mode_q <= in;

**2. Only compare against values the logic can reach.** Before you assert "this should be x / true / false", list the operand's legal values. Replicated bits are correlated: {4{b}} is only 0000 or 1111. A sign-extended field ties its top bits to the sign bit. An enum holds only its members, and a one-hot vector has exactly one bit set. A check against an unreachable value ends up testing the simulator's optimizer, not your design. Use constraint blocks in randomized tests so stimulus stays legal.

**3. Know how each construct treats x, and test through the consumer you care about:** - == / !=: x if ambiguous. - ===: exact match, never x. - if (x): takes the else branch. - case: uses === matching, so an x selector falls to default. - c ? a : b with an x condition: bitwise merge of a and b. - $isunknown(): 1 if any bit is x/z.

$display alone isn't evidence. Check what a flop stores and which branch a mux or case takes.

**4. Check X on inputs, not derived values.** assert property (@(posedge clk) disable iff (!rst_n) !$isunknown(sel)) on the select or control signal catches the unreset flop. A check on a downstream comparison can be optimized away or silenced.

**5. Sample after things settle.** Read results after #1, at a clock edge, or in a final block, never at time 0 against initializers. Remember that nonblocking updates land after the active region.

**6. Isolate when probing tool behaviour.** Simulators optimize per compile. Unrelated declarations, $dumpvars and -debug_access+all changed results in otherwise identical files. Put one check per file, keep a fixed skeleton, use fresh build directories, and record the exact version and flags.

**7. Use a real 4-state referee, and ground truth.** Icarus (iverilog -g2012) follows the LRM for 4-state in our tests, with one quirk: $isunknown() on a comparison returned 1 under $dumpvars where the value was 0. Verilator is 2-state for most of this (x/z become 0), so it can't referee X behaviour. Slang's constant evaluation (localparam + $info) is a quick third opinion. Also ask what the synthesized netlist or real silicon would do. A tool that matches hardware but not the LRM has a conformance quirk, not a correctness bug.

**8. Self-check against expected values derived independently.** Compute each expected value from the LRM or a reference model *before* running, store it next to the test, and diff automatically. Include control cases where the right answer really is 0 or 1, so you can tell a broken check from a broken simulator.

**9. Before you scale up, write one realistic failure.** Ask: "Would a designer write this on purpose, and what goes wrong for them?" If the only failing cases are impossible conditions, stop and rethink. A larger matrix just multiplies the wrong premise.