Introduction into Agentic AI for Hardware Design and Verification
Riadh Ben Abdelhamid
Novel Computing Technologies Group · ZITI · Heidelberg University
RTL Forge and chipchamp: two working systems, shown later in this talk
This talk
Act I
What "agentic" actually means: beyond the buzzword
Act II
Why hardware: the best domain for agents, and the hardest
Act III
State of the art: research, industry, and silicon that already shipped
Act IV
Using it today: harnesses, tools, models: open vs. closed
Act V
Two working systems: RTL Forge & chipchamp, with honest measurements
Act I · What "agentic" actually means
Three eras in five years
2021
Autocomplete
Copilot finishes your line. You are still the engineer; the model is a fancy keyboard.
2023
Chat
ChatGPT writes a whole module. You copy-paste, run, and debug it by hand. The loop is you.
2025→
Agents
The model runs the tools, reads the errors, fixes its own work, and comes back when it's done. The loop is the machine.
The difference is not a bigger model. It is an architecture around the model.
Act I · What "agentic" actually means
An LLM is not an agent
One-shot LLM
You get what you get. Errors ship silently.
Agent
A loop with tools, feedback, state. Errors become inputs.
Act I · What "agentic" actually means
Five ingredients of an agentic system
1
Tools: the model can run things: linters, simulators, file I/O, synthesis
2
Feedback loops: tool output flows back into the next attempt
3
State & checkpoints: long tasks survive failure, resume, and can be audited
4
Routing: when something fails, whose fault is it? Fix the right artifact
5
Decomposition: split big problems into sub-problems with contracts between them
Keep these five in mind. Each one reappears, concretely, in Act V.
Act I · What "agentic" actually means
In software, this already happened
~2% → ~96%
real GitHub issues fixed end-to-end: SWE-bench, Oct 2023 → SWE-bench Verified, mid-2026
hours
of autonomous multi-step work per task is now routine for coding agents (Claude Code, Codex, Gemini CLI…)
Agents open the repo, reproduce the bug, edit, run tests, iterate, unattended
Adoption went from research demo to daily tool for millions of developers in ~2 years
Why it worked: software has executable feedback: compilers and tests
Hold that thought: what does hardware have?
SWE-bench: Jimenez et al., Oct '23, best model 1.96% (full set) · Verified subset: OpenAI, Aug '24 (33.2%) · 49% late '24 · 80.9% late '25 · ≈96% mid-'26, vendor-reported, tracked by aggregators · press C for sources
Act I · What "agentic" actually means
The load-bearing distinction
Estimated
"Model, does this code look correct to you?"
Plausible. Confident. Sometimes fiction.
Measured
Verilator compiled it. The simulation ran. The assertions held.
Ground truth, independent of the model's opinion.
An agentic flow is only as trustworthy as its least-grounded verdict.
Act II · Why hardware
Verification is eating the schedule
60–70%
of engineering effort on a chip project goes to verification
≥1 : 1
verification engineers per designer on many ASIC teams, and rising
$M + months
cost of a respin: there is no hotfix after tape-out
And the industry is short tens of thousands of engineers. The work is growing faster than the workforce.
2024 Siemens EDA / Wilson Research Group functional-verification study · Lux Capital, "The looming labor crisis in chip design" · press C for sources
Act II · Why hardware
So why didn't the software wave carry hardware with it?
Data scarcity
Public Verilog is a rounding error next to public Python. The best RTL on Earth is locked inside companies.
Absolute correctness
"Mostly works" is fine for a demo app. It is meaningless for silicon.
Tribal knowledge
Methodology, tool flags, house lint rules. Little of it is written down where a model could learn it.
So the naive move, "just prompt an LLM for Verilog", disappoints. Something else is needed.
Act II · The thesis
Hardware is not the hardest domain for agentic AI. It may be the best one.
Foundry NDAs, export control. "Upload the chip to a cloud API" is often simply illegal.
The model is the easy part. The loop around it is the engineering.
Act III · State of the art · research
What the benchmarks say
VerilogEval-Human pass@1 · % (higher is better)
LLM, promptingagentic systemrealistic benchmark
Agents beat prompting: VerilogCoder gains +33.9 points over the best non-agentic run of the same class of model.
Then the benchmark saturated, so NVIDIA built CVDP: 783 realistic tasks. Best model at launch: ~34%.
And one year later, a purpose-built scaffold (generator + reflector + coordinator) puts open models at 97% on CVDP's agentic categories. The climb came from the loop, not a bigger model.
The lesson, twice over: the loop is the product.
VerilogEval (NVIDIA ICCAD'23, v2 2024) · VerilogCoder (AAAI'25) · MAGE (DAC'25) · CVDP (NVIDIA 2025, now hosted by Si2) · ACE-RTL (NVIDIA, July 2026) · press C for sources
Act III · State of the art · research
A field assembling itself, fast
generatespec → RTL
ChipNeMo: domain-adapted LLMs for chip design (NVIDIA '23)1
AutoChip: the first sim-feedback generation loop2
Fine-tunes (RTLCoder, CodeV, CraftRTL): a 7B reasoning fine-tune beats 671B DeepSeek-R1 on RTLLM3
Every agent decision validated against deterministic physics engines (Questa, Calibre…)6
The startup wave
ChipAgents $134M; with STMicro, claimed: assertions 240×, UVM bring-up 400×7
Cognichip $93M for a "physics-informed foundation model"8
ChipStack's exit to Cadence: the first AI-DV acquisition4
And the chipmakers themselves
All three vendors' agents run on NVIDIA Nemotron models3
AMD rolled Claude out across its engineering org9
Anthropic contributes to next-gen NVIDIA chip design10
All "×" and "L" figures are vendor claims · press C for sources
Act III · State of the art · the honest tension
Hold both of these in your head
The marketing
"L5: fully autonomous virtual design engineer"
"40× faster RTL validation"
"400× faster UVM environment bring-up"
The measurement
Hardest public benchmark (CVDP): best model ≈ 34%
Agentic task categories score lower, not higher
Formal reasoning: still a frontier-model weakness
Both are real. The space between them is called the trustworthiness gap, and it is where hardware engineers will spend the next decade.
"L5" borrows the self-driving autonomy ladder: L1 assistance → L5 fully autonomous, no human in the loop. Synopsys and Cadence grade their EDA agents on it · press C for sources
Act IV · Using it today
The anatomy of your setup
Act IV · Using it today · tools
Giving the agent hands: CLI first, MCP next
The zero-effort start
Coding agents can already run any shell command. If your flow is scriptable, an agent can drive it today:
$ verilator --lint-only -Wall fifo.sv
$ make sim && gtkwave dump.vcd # agent reads the log
$ yosys -p "synth_ice40" top.v
Plus a CLAUDE.md/AGENTS.md teaching it your flow. That's the whole setup. (Community plugins like GateFlow already wrap Verilator, SymbiYosys, Yosys & nextpnr into Claude Code.)
MCP: a USB-C port for tools
Model Context Protocol: now Linux-Foundation-governed, 10,000+ active servers. EDA is filling in:
OpenROAD-MCP: official, from the OpenROAD project itself
Best agentic reliability: long tool-use chains, self-correction
Your data never leaves the building · fine-tunable on your RTL
Cost model
Per token: a heavy agent day can cost real money
Buy the GPU once, iterate for electricity
Verilog today
Saturates classic benchmarks; ~⅓ of realistic CVDP tasks
30B-class models are genuinely usable in a good loop; 7B fine-tunes rival 671B generalists on RTL generation
For chip companies the deciding factor is usually not quality: it's IP confidentiality. That's why open models matter more in hardware than almost anywhere else.
Act IV · Using it today · local inference
"Local" stopped being a compromise
A 24–32 GB GPU runs a quantized 30B-class coder at interactive speeds
A $2–5k, 128 GB unified-memory box (DGX Spark, Strix Halo, Mac) runs 100B+ MoE coders on a desk
The 2026 sweet spot: MoE models with tiny active params: 80B-total / 3B-active coders hit ~70% SWE-bench, fully offline
Ollama / LM Studio / vLLM make it a one-command install
Everything in Act V, every measured run, used local models on hardware like this. Not a frontier API in sight for most of it.
Why this matters here
Open models + open EDA + an open PDK =
a fully sovereign, fully inspectable, zero-license path from prompt to GDSII.
No cloud dependency. No license server. Nothing you can't read the source of. A university, or a student, can own the entire stack.
Act IV · Using it today · the open toolchain
You are sitting in the perfect playground
Simulate & verify
Verilator (functional coverage since 5.050) · GHDL · cocotb 2.0 (Python testbenches, the language LLMs know best) · SymbiYosys · eqy
Synthesize & harden
Yosys · OpenROAD (ships an official MCP server) · LibreLane: this week's workshop flow, IHP PDKs built in → GDSII
Real silicon
Tiny Tapeout on three foundries · IHP 130nm CMOS5L Open Source PDK: low-cost open-source MPW shuttles · and this school's funded tapeout
Every box is free, scriptable, and license-unlimited: an agent can hammer this loop a thousand times a night, which is exactly what commercial license seats forbid. Open EDA isn't just the cheap option; for agents it's the better option.
Vacuous passes: a testbench that checks nothing, green forever
Reward hacking: agents will delete the failing test, weaken the assertion, shrink the timeout
Naive wrappers can hurt: a bad loop can score below one-shot prompting
The failure modes are not hypothetical. Act V shows you every one of them, measured.
Act V · Two working systems
I built both halves of the problem, and the eyes
greenfield
RTL Forge
Natural language → verified SystemVerilog. A 13-stage pipeline with fix loops, formal checks, and a deterministic judge.
"produce the RTL"
brownfield
chipchamp
A Claude-Code-style agent platform for existing RTL codebases, driving real EDA tools and earning trust with signed evidence.
"own the loop, and prove it"
companion
alwavelets
A terminal waveform viewer (VCD/FST). Not an agent itself, but built to be driven by one: an MCP server and a live control socket let an agent steer the exact view on your screen and read back what you see.
"the agent's eyes on the waves"
Same thesis, two attack angles plus an instrument: the loop is the product. Everything runs on local, open models.
Act V · RTL Forge
Thirteen stages, half of them checkers
✓-stages don't write; they check. That ratio is the design philosophy.
Formal properties are model-checked, not just emitted.
A wrong testbench is worse than no testbench, so it gets its own review pair.
Act V · RTL Forge
Retry is not a strategy. Convergence is engineered
Every patch is classified
accept-progress · accept-equivalent · reject-no-improvement · reject-regression · reject-compile-fail. "Reject" means reject, and the model is told why.
A champion is kept
The best measured state is tracked across the whole run. A bad fix can never overwrite a good state. Stagnation is detected; token-burning stops.
The testbench is attacked
Mutation testing: inject bugs into the passing RTL; a testbench that kills no mutants is exposed as vacuous. "Deleting a test is never a fix" is a hard rule.
Debugging reads the waves
Triage runs a bounded probe loop over the VCD: the model requests signal windows, the harness answers from the dump. Evidence, not vibes.
Act V · RTL Forge · what we measured
The experiment that humbled me
Idea: harvest each model's recurring lint errors → distill rules → inject into its next generation prompt. A/B, 5 designs, real Verilator.
error class
no rules
rules injected
unsized literals
2/5
0/5
rule helped
parameter headers
3/5
1/5
rule helped
block placement
3/5
3/5
no change
complex ports
0/5
3/5
rule backfired
The backfiring rule was the only one that named the anti-pattern: naming the wrong form primed the model to produce it. The pink elephant effect.
And the control arm swung 37 → 24 errors with no change at all, at temperature 0. Run-to-run noise ≈ 40%. Measure, don't vibe, and know your noise floor.
Act V · RTL Forge · learning
The loop learns between runs, and what it learns is text
Harvest, per model
A training mode runs the pipeline over a spec corpus and harvests each model's recurring failure classes from real lint and simulation. The catalogs are keyed by model: a 24B's habits are not a 70B's habits.
Distill, with guardrails
Failures become positively-phrased rules (the pink-elephant lesson from the last slide is enforced, not just remembered). Embedding-based dedup detects saturation: when new runs only paraphrase known rules, harvesting stops itself.
Remember what fixed what
Cross-run memory keys fix recipes by failure signature: the next run that hits the same signature sees what worked last time: evidence-carrying reflow across runs, not just within one.
The federated possibility
Rules, recipes and skills are kilobytes of text: no weights, no RTL. Teams could exchange distilled engineering judgment while designs never leave the building: federated learning of rules, not gradients. The artifact is auditable: you can read what your peers taught your agent.
Measured caveat: a too-weak model harvests noise, not lessons: there is a capability floor under which "training" pollutes the catalog. The guardrails exist because we hit this.
Act V · RTL Forge · the receipts
You don't have to take my word for it: demo at the end
1 page
of plain English in: a register block with interrupt logic
13
stages ran overnight, unattended: spec, RTL, formal, testbench, judge
50/54
of its own tests pass, re-measured live on stage with real Verilator
It proved a bug on itself
SymbiYosys found a counterexample: irq lags its enable by one cycle, violating its own property. The simulation failures point at the same defect. Two detectors, one bug.
And the judge says FAIL
Final verdict: 77/100, FAIL. Weighted criteria, formal counterexample charged, per-requirement traceability. The system does not bluff. That honesty is the demo.
Deterministic on purpose: the demo re-verifies finished artifacts. No model call, no network.
Act V · chipchamp
Claude Code, if it had grown up in a fab
An agentic CLI over an existing RTL codebase: it queries an elaborated design database (hierarchy, clock domains, FSMs, fan-in cones), not a pile of files
96 tools, disclosed progressively: the model sees a 31-tool core, 72% less context per request
Waveforms & coverage are queried, never dumped: wave.when, cov.holes, first-divergence compare
# any provider, including fully local
$ chipchamp --provider ollama
╭──────────────────────────────╮
│ ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ │
│ ▓▓ chipchamp ▓▓▓▓▓▓▓▓▓▓▓▓▓ │
│ ▓▓ agentic RTL & DV ▓▓▓▓▓▓ │
│ ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 2631 ▓ │
╰──────────────────────────────╯
✔ design DB · 176 modules · 6 s
The banner is an ASCII die shot, lot-code stamped with the git revision.
Act V · chipchamp · the core idea
Success is structurally unforgeable
Anti-gaming gates: green-by-deletion, disabled assertions, shrunk timeouts, pinned seeds: all detected, all block completion
Evidence bundles are hash-signed and tamper-evident, auditable long after the session
Subagents physically lack the "declare success" tool: only the orchestrator can, and only through the gates
Act V · chipchamp · how deep the loop goes
Prompt to GDSII, measured
RTL → GDSII LibreLane · SKY130
Full physical signoff as agent gates: DRC 0 · LVS 0 · antenna 0 · WNS +1.64 ns
213 KB of GDSII out
Physical feedback to RTL: area by source line, power from real activity, critical path → file:line
Optimize, with proof eqy
Coverage finds 28 dead flops; the agent narrows the logic
Equivalence checker proves the edit safe
400 µm² recovered; the whole loop takes ~5 seconds
FPGA & eFPGA nextpnr · Vivado · FABulous
iCE40 bitstream in ~2 s; Vivado xc7a35t in ~2 min, timing met
Drives FABulous eFPGA fabrics, the technology at the center of this school's tapeout
RISC-V spike · RISCOF
Lock-step co-simulation against the reference model
"divergence at instruction #2: core executed PC 0x1040, reference 0x1008 (add gp, ra, sp)"
A named instruction, not "test 7 fails"
Stress-tested overnight, on local models: 9 models × 8 scenarios, 11 hours unattended, 27/30 platform checks passing.
Act V · chipchamp · versus a general coding agent
What Claude Code structurally cannot do here
a general cloud agent
chipchamp
needs a cloud API, so NDA'd RTL and PDKs leave the building
→
air-gapped: free local models close real silicon flows; PDK reads are refused below the model
"done" is as good as the model's discipline that day
→
evidence-gated closure: report.done is rejected until class-specific gates are paid with post-edit proof
bash runs are ephemeral; the evidence trail is whatever got narrated
→
provenance ledger: every job has an id, repro command, input hashes (incl. fabric state), greppable logs
one model, fixed for the session
→
mid-task routing: hot-swap to the next local model on refusal / timeout / stall, same transcript
Live proof of row 2: a local model edited its design after its last proof and tried to close: rejected. It re-proved with a fresh bitstream, then closed. The harness enforced honesty; the model learned it.
Act V · chipchamp · which local models, and who drives
Local models have shapes; the router knows them
model
shape
qwen3.6:35b-a3b
the closer: authored + debugged + closed every eFPGA demo; best debugger
gpt-oss-120b
cleanest RTL author; weak self-diagnosis, can claim unearned wins
nemotron-nano-4b
fast, reuses IP, decomposes; RTL rarely lints clean first try
gpt-oss-20b
fast but chronically refuses mid-task
Profiles score each model per capability (author / debug / plan / verify / speed), seeded from measured campaigns, not vibes.
$ chipchamp → /router on
# mid-task, the current model stalls…
⇄ model_switch gpt-oss-20b → qwen3.6:35b
reason: refusal · transcript preserved
✔ task closed by the fallback
A 3-model relay on one transcript is validated end-to-end: refusal → swap → stall → swap → close.
Act V · chipchamp · packaged expertise
Skills teach the loop; the library feeds it
Skills SKILL.md playbooks
Expert procedure as versioned markdown. Invoked manually (/waveform-debug, /alwavelets-viewer-control) or auto-matched from the task. The skill index rides the system prompt; the playbook loads on demand.
$ chipchamp skills add ./team-skills
$ chipchamp skills list
✔ waveform-debug · alwavelets-viewer-control
IP library my private library · 134 components
Manifest-indexed component libraries with name-independent semantic match: the agent asks for "async FIFO with gray-code pointers", not a filename, then fetches RTL + C++ golden ref together.
$ chipchamp library add ~/rtllib-pillars
$ chipchamp library match "async fifo"
$ chipchamp library fetch cdc_fifo
Both are how a team's know-how outlives the session: the skill is the how, the library is the what, and the agent reuses both instead of reinventing them.
Act V · chipchamp · what is implemented today
The agentic loop, capability by capability
Progressive disclosure
31-tool core, groups load on demand: 72% less context. Mis-named tools get did-you-mean, not "unknown"
Evidence gates
report.done re-validates class-specific gates against signed job records; anti-gaming detectors block green-by-deletion
Context compaction
old tool results evict to their job ids under a live budget, so long runs survive small local context windows
Teaching errors
every miss names the fix: id shape + recent jobs, path did-you-mean, "not available to your role" vs unknown
Model routing
capability profiles per local model; hot-swap on refusal / stall / timeout, transcript preserved
Subagent orchestration
least-privilege roles, shared job store; only the orchestrator can claim success, and only through the gates
Budgets & policy
token / CPU / license ledgers the model cannot talk its way past; PDK reads refused below the model
MCP, both directions
consumes external MCP servers as typed tools (live waveform viewer control); serves its own design DB over MCP
Skills
SKILL.md playbooks, auto-matched or /invoked. Shipped: waveform-debug, viewer control; teams add their own
Plus: session resume · experiment recorder for blind model campaigns · prompt-injection scanning on tool output · reproducible job records with input hashes
Close
What happens to the engineer?
from
to
writing RTL by hand
→
writing specs that survive contact with an agent
running the tools
→
auditing the verdicts the agent earned
debugging syntax
→
judging architecture, constraints, corner cases
Verification taste becomes more valuable, not less. The bottleneck moves from typing speed to judgment.
Close
Three things to take home
1. Hardware has what agents need most: cheap, deterministic oracles. It's a leading domain for agentic AI, not a lagging one.
2. Trust must be engineered, not narrated: evidence the model can't forge, gates it can't lower, tests it can't delete.
3.Measure, don't vibe. Aggregates hide opposing effects, and your noise floor is higher than you think.