A Progressive Approach to Synthesizable RTL Design Generation Using LLMs

Abstract: LLMs can generate register-transfer-level (RTL) designs directly from natural language specifications. Their failures, however, arise mostly from understanding rather than coding \cite{zhang2026understanding, qiu2025towards}. A specification is informal and ambiguous, the model's interpretation stays implicit, and every misreading is committed silently into Verilog, where only simulation can expose it. Intermediate representations make the interpretation partly explicit, yet existing works don't verify the interpretation against the specification, and repair simulation failures at the code level regardless of where the misreading originated. VeriRefine instead treats specification refinement as a verifiable stage of RTL generation. It progressively refines the prose specification into an explicit, schema-constrained account of design intent, expressed as per-signal Abstract Signal Transition Functions (ASTFs) that commit each signal's logic style, clock domain, and reset behavior before any code exists and ground every behavior in a verbatim specification sentence. The refined specification then passes a five-layer audit spanning soundness, completeness, consistency, FSM integrity, and core RTL design rules, so interpretation errors are repaired at the representation level before any Verilog is generated. Once code is generated, each simulation failure is classified as an understanding error or a coding error and routed back to the corresponding stage for targeted repair. Because every signal's hardware class is fixed during refinement, synthesizability becomes a structural property of the pipeline rather than a post-hoc check. With Claude Sonnet 4.6, VeriRefine reaches 94.0\% functional correctness on RTLLM v2.0 and 98.1\% on VerilogEval-Human v2.

• The paper introduces VeriRefine, a progressive RTL-generation framework that uses an auditable Abstract Signal Transition Function, specification-grounded refinement, and root-cause-routed debugging to bridge the semantic gap between natural-language intent and synthesizable Verilog.
• The method achieves 94.0% functional correctness on RTLLM v2.0 and 98.1% on VerilogEval-Human v2, while maintaining 93.8–100% synthesizability and producing PPA results comparable to leading baselines.
• The evaluation shows that VeriRefine uses about 54K tokens per correct design versus VerilogCoder’s 197K, a 3.7-fold reduction, although contradictory or ambiguous specifications remain a major unresolved source of failure.

The semantic gap as the central failure mode

The paper's starting point is an empirical observation about where LLM-based RTL generation actually fails. When the same designs are paired with specifications written at different abstraction levels, functional pass@1 drops sharply: GPT-4 achieves 60% on VerilogEval-machine but 43.5% on VerilogEval-human, and RTLCoder drops from 62.5% to 36.7%. Since the target designs are identical and only the specifications differ, the loss cannot be attributed to model capacity or design complexity. It reflects the difficulty of recovering implementation-level details — clock domains, reset polarity, output timing — from intent-level prose. Prior intermediate-representation approaches such as AoT-RTL narrow this gap by inserting structured reasoning before code emission, but they operate open-loop: the IR is generated once, never validated against the specification, and errors propagate silently into RTL. The authors position their framework, VeriRefine, as closing this loop by making specification refinement a verifiable stage of generation.

The ASTF representation

VeriRefine's core artifact is the Abstract Signal Transition Function (ASTF), a per-signal record defined for each driven signal $s$ as a pair $(\mathcal{H}(s), \mathcal{G}(s))$. $\mathcal{H}(s)$ fixes the signal's implementation class — logic style (combinational, sequential, or latch), clock domain, and reset behavior — which alone determines the always-block header without consulting any other signal. $\mathcal{G}(s)$ is a priority-ordered list of guarded actions $(c_i, a_i, \sigma_i)$, where each condition is written only over signals declared elsewhere in the ASTF, each action assigns $s$, and $\sigma_i$ is a verbatim citation from the source specification. Priority ordering resolves guard overlap deterministically, mirroring the if/else-if chain the emitted RTL realizes. FSM designs additionally carry a state transition table and an fsm_meta record specifying encoding, Moore/Mealy output type, reset state, and the full state list.

The design intent is that $\mathcal{H}$ enforces synthesizability structurally — committing hardware class before code exists eliminates mixed always-block styles and unspecified resets — while $\mathcal{G}$ suppresses hallucinated behavior by requiring every command to be grounded in specification text. A worked example on the RTLLM pulse_detect design illustrates the mechanism: both evaluated models fail direct generation by asserting the one-cycle indicator after the pulse's end cycle rather than within it; the ASTF resolves this timing decision during refinement by classifying data_out as combinational and recording Mealy output semantics, and the resulting RTL passes simulation on the first attempt.

Refinement, auditing, and implementation

The Refinement Module produces a verified ASTF through two gates. First, a keyword-based classifier assigns a primary design type (FSM, dual-clock, sequential, combinational) plus up to fifteen structural sub-types, which select rule sections, worked examples, and machine-parsed table facts injected into the generation prompt. Second, a closed JSON schema rejects malformed documents mechanically via standard validation, catching structural defects such as a sequential signal without a clock domain. Well-formed ASTFs then pass a five-layer audit covering soundness (verbatim grounding), completeness (port and behavior coverage), consistency (declared-signal usage, agreement with truth tables and K-maps), FSM integrity (transition completeness, reset discipline, output-type and output-timing checks), and core RTL rules (assignment-operator/style matching, combinational case coverage to prevent latch inference, combinational dependency-cycle detection). Audit violations return to ASTF generation as targeted repair feedback.

The Implementation Module consumes only the audited ASTF. Code generation is governed by seven deterministic rules — port contract fidelity, self-contained modules, style fidelity, verbatim guarded-command translation, startup definedness via initial blocks, no internal tri-state drivers, and standalone compilability under iverilog — with violating candidates regenerated before simulation. A K-map example shows the benefit: direct GPT-4-turbo simplification misses an asserted minterm and fails, whereas the ASTF preserves the asserted conditions and passes.

Verification and root-cause-routed debug

A specification-only internal testbench (ITB) provides the first functional gate. An LLM converts the specification into a schema-constrained verification plan with directed scenarios, one explicit 8–15 cycle sequence, and pseudo-random stress sequences (80 cycles combinational, 200 sequential); a deterministic harness applies identical stimulus to candidate and reference designs and compares outputs every negative clock edge. Because the ITB is generated independently of the candidate RTL, it cannot be biased toward the implementation under test.

When official-benchmark simulation fails, a failure analyzer classifies the error as either an ASTF issue or an RTL issue using the specification, a compact ASTF summary, and the mismatch log, then routes repair accordingly: regenerate the ASTF with hints, or keep the audited ASTF fixed and retry RTL generation. This two-level routing is the paper's principal architectural distinction from VerilogCoder and MAGE, whose feedback operates at output-signal granularity without diagnosing which abstraction level erred.

Results

With Claude Sonnet 4.6, VeriRefine reaches 94.0% functional correctness on RTLLM v2.0 (47/50) and 98.1% on VerilogEval-Human v2 (153/156), improvements of 30.0 and 12.8 percentage points over direct generation. Synthesizability remains in a narrow high band (93.8–100%) across all conditions, supporting the claim that correctness gains carry through synthesis rather than reflecting marginal candidates. PPA products are comparable to the strongest baseline where coverage is matched: roughly 20% below VerilogCoder on RTLLM v2.0 and effectively tied on VerilogEval-Human v2, though the authors correctly note that PPA averages over different design sets are not directly comparable.

The token-cost result is the strongest efficiency claim: VerilogCoder spends 30.5M tokens for 155 correct designs (~197K per design) versus VeriRefine's 8.1M for 153 (~54K per design) — a 3.7-fold difference at nearly equal accuracy. Under a budget equal to VeriRefine's total spend, VerilogCoder could attempt only ~42 of 156 problems. The ablation attributes most of the gain to the audited ASTF alone (18.0 points on RTLLM, 6.4 on VerilogEval-Human at iteration 0), with the two debug iterations contributing the remainder; notably, the improvement rate in unsolved-design reduction is nearly constant across benchmarks (83% vs. 87%), suggesting the benefit is not benchmark-specific.

Limitations and open questions

The failure analysis is candid about the framework's boundary. Four of six unsolved designs stem from specification–testbench contradictions or module-name mismatches that no faithful implementation can pass — the internal testbench passes two of these, localizing the defect outside the generated RTL. One failure (serial2parallel) arises from genuine specification ambiguity where both readings are faithful, making it invisible to the audit by construction. Two remaining failures (Prob149, Prob153) show constant mismatch signatures across regenerations, indicating stable misreadings that additional debug iterations would not resolve. The classification step itself is a hand-curated keyword scan, so misclassification of novel design types could misroute prompt assembly, and the audit's soundness check depends on the LLM producing accurate verbatim citations. The authors' stated future direction — having the framework question the specification itself rather than trust it unconditionally — remains unimplemented.

Conclusion

VeriRefine demonstrates that treating specification refinement as a first-class, auditable stage — with schema-constrained per-signal records, verbatim provenance, and root-cause-routed debug — yields near-state-of-the-art functional correctness at roughly a quarter of the token cost of the leading agentic baseline, while making synthesizability a structural property of the pipeline. Its principal residual weakness is inherited faithfully: a system strictly faithful to its specification cannot repair defective specifications, leaving specification-level reasoning as the clear open problem this work identifies.