Autonomous agents built to execute across the chip program lifecycle.
Your AI verification engineer.
A suite of verification agents across the chip.
We’re building the system for autonomous silicon verification.
Our agents take an SoC from spec through verification signoff, working across IP boundaries, connectivity, cross‑IP flows, clocks and resets, CDC and RDC, power, interconnect, security, boot, debug and gate‑level verification.
They operate from one continuously updated dependency graph of the design, verification environment and runs across the hardware engineering lifecycle. From it, they generate tests, investigate failures, drive verification, and close coverage and regression loops autonomously. Ledger, the first of our tools, keeps every run, revision and verdict, so each change starts from what’s already proven. The tools that follow build on the same record.
Our agents keep your timing, power and area targets in mind when planning verification, investigating failures and proposing changes.
They work from the engineer’s terminal, on‑prem or air‑gapped, inside the limits your team sets.
See how it works- ✓IndexedRTL
tof index rtl/ · 1,284 files41s - ✓Updateddependency graph
tof ingest graph --revision r2 --parent r138s - ✓Ranregression
tof record run soc_tb --sim vcs --farm lsf14m 06s - ✓Recordedevidence
tof ingest run art-r29s
| block | r1 | r2 |
|---|---|---|
| soc | 8/8 | 8/8 |
| sec | 4/4 | 0/4 |
| dma | 3/3 | 2/3 |
| npu | 6/6 | 6/6 |
| rev | bresp | key writes |
|---|---|---|
| r1 | SLVERR | 0 |
| r2 | OKAY | 1 |
rtl/sec_firewall.sv:18
- wire is_secure = ~prot[1];
+ wire is_secure = prot[1];
The protection bit is read backwards. A non‑secure write to key 1 returns OKAY, and the DMA path to the key store opens with it.
In this demo, we take a small inference chip, introduce a one-line security bug, and show the system identify exactly which properties fail, trace the failure to the relevant transaction across RTL revisions, preserve the verification evidence behind the diagnosis, repair the RTL, and carry that verification history forward.
For chips where a respin is not an option.
Verification that compounds.
Verification is the largest cost in a chip program. On a leading‑edge design, it takes 40–50% of the budget and is heading toward 60–70% of engineering hours. Most of that goes to iteration. Every late change to the RTL, register map or clock and reset trees puts earlier results in doubt. No one can say which passing tests, closed coverage, formal proofs, CDC and RDC signoff and waivers are still valid for the new design, so teams rerun whole regressions, reopen waveforms by hand and re‑close coverage they already closed, a cost every faster simulator or agent still pays.
Our breakthrough is the validity kernel, which answers that question every time the design changes. It checks each earlier result against one continuously updated dependency graph of the design, the verification environment and the runs. Results that still hold stay, along with the evidence behind them. Results the change broke are thrown out. For anything it can’t be sure about, it runs the smallest set of new checks that gives a clear answer.
Running the kernel requires a new way of keeping verification state. Our graph traces requirements to tests and follows the design through the register and memory map, connectivity, clock and reset trees and crossings, down to individual signals. Where a dependency is uncertain, the kernel treats the result as unknown. Our agents choose where to look and run the checks and tools that settle each result, so every verdict rests on a deterministic check or a tool run. Our ledger then keeps each run, revision and waiver, tied to its source.
After a late change, the agents only rerun the tests and proofs the change could have affected, so coverage and signoff always match the current revision, with state‑of‑the‑art accuracy on our internal benchmarks.
prior results + Δminimum new evidenceverified state
r1r2
- still valid
- invalidated
- unknown
- new evidence
One change, traced through the stack.
Each block on the die is a module in the dependency graph. The agents verify the design; place and route stay with your physical flow. Step through the stack to see where r2 lands and what it reaches.
Tapeout drives the simulators, formal engines and scripts your team already licenses, plus anything that writes a log, a waveform or an exit code.
01Simulation, debug and testbench
VCS (Synopsys VCS)
Xcelium (Cadence Xcelium)
Questa (Siemens Questa)
Verilator- Verdi (Synopsys Verdi)
- SimVision (Cadence SimVision)
- Verisium (Cadence Verisium)
GTKWave
cocotb
UVM (Accellera UVM)
02Formal, emulation and FPGA
- JasperGold (Cadence JasperGold)
- VC Formal (Synopsys VC Formal)
- OneSpin (Siemens OneSpin)
- ZeBu (Synopsys ZeBu)
- Palladium (Cadence Palladium)
- Veloce (Siemens Veloce)
Vivado (AMD Vivado)
Quartus (Altera Quartus)
Yosys- vManager (Cadence vManager)
03Around the flow
Git
GitHub
GitLab
Jira
Slack
Tcl
Python
Make
Verify your next chip with Ledger.
The agents run on your machines, against your RTL, testbenches and tools, and carry every result through to verification signoff. The agents keep your timing, power and area targets in mind as they plan verification, investigate failures and review changes.
Talk to us