Why Multi-Agent Verilog Loops Catch FSM Deadlocks Single Prompts Miss

MosChip announced its Agentic RTL architecture, pairing dual-model orchestration with automated verification harnesses. In parallel, academic research groups published MAGE (Multi-Agent Engine for Automated RTL Code Generation), an open-source framework splitting code authoring, assertion synthesis, and testbench compilation into distinct, adversarial roles. Both systems target the single largest failure mode of AI-assisted silicon design: generative models write syntactically clean Verilog that quietly locks up under unexercised corner cases.

For digital design leads, verification engineers, and chip startup founders, this shift changes the evaluation criteria for AI in the design flow. Single-prompt coding copilots are dangerous in hardware because they generate plausible implementations while hallucinating self-serving testbenches that confirm their own flawed assumptions. Splitting the problem into adversarial roles (a generator writing synthesizable RTL, a critic synthesizing temporal SystemVerilog Assertions, and a simulation agent driving execution through Icarus Verilog or Verilator) isolates verification intent from implementation bias.

If you are managing an RTL team or signing off on a tape-out budget, understanding how multi-agent architectures catch finite state machine (FSM) deadlocks determines whether agentic workflows belong in your regression pipeline or stay quarantined in experimental sandboxes.

The Single-Prompt Verification Trap

When a single large language model writes both a module and its verification harness, it shares context across both tasks. If the model misinterprets a bus handshake protocol (for example, assuming tready must drop immediately after tvalid without handling backpressure stalls over consecutive cycles), it writes the RTL to match that misunderstanding. When prompted to write the testbench, it evaluates the exact same behavioral model. The testbench drives stimulus that only tests the happy path, checks outputs against the flawed internal state machine, and logs a false pass.

Hardware verification cannot rely on self-evaluation. In a standard ASIC flow, the engineer writing the directed tests or UVM environments is deliberately kept independent from the engineer writing the block RTL. When the same human writes both, blind spots survive into physical silicon. Single-prompt LLM generation amplifies this human failure mode at scale.

Autoregressive models also lack inherent awareness of temporal logic over multi-cycle register transfers. A transformer predicts tokens sequentially. It treats a state transition block as local syntactic tokens rather than a cyclic graph spanning thousands of delta cycles. Without an independent checker asserting invariants across temporal sequences, latent deadlocks remain invisible until synthesis or gate-level simulation.

Deconstructing the Multi-Agent Division of Labor

Multi-agent RTL generation frameworks enforce an explicit separation of concerns. Instead of asking one model to produce an entire verified IP block in a single context window, the workflow instantiates distinct agents operating with isolated prompt boundaries and specialized system instructions.

  +-------------------------------------------------------------+
  |                     Natural Language Spec                   |
  +-------------------------------------------------------------+
                                 |
                                 v
  +---------------------+                 +---------------------+
  |   RTL Generator     |                 |  Critic / SVA Agent |
  |   (e.g., DeepSeek)  |                 |  (e.g., Frontier)   |
  +---------------------+                 +---------------------+
             |                                       |
      Synthesizable RTL                      Temporal Assertions
             |                                       |
             +-------------------+-------------------+
                                 |
                                 v
                  +-----------------------------+
                  |      Simulation Agent       |
                  |  (Icarus Verilog/Verilator) |
                  +-----------------------------+
                                 |
                    [Pass / Compile Error / SVA Fail]
                                 |
            +--------------------+--------------------+
            |                                         |
     (Assertion Fails)                         (Tests Pass)
            v                                         v
  +--------------------+                    +-------------------+
  | Debug Agent        |                    | Verified Hardware |
  | (Root-Cause Trace) |                    | Candidate         |
  +--------------------+                    +-------------------+
            |
            +----> [Refined RTL/Constraints to Generator]

1. The RTL Generator Agent

This role receives the functional specification, interface definitions, and clocking parameters. It writes synthesizable, synthesizable-compliant Verilog or SystemVerilog. In architectures like MosChip's Agentic RTL Coder, this role often uses open-weight, high-throughput models like DeepSeek-Coder tuned for dense syntax generation. The generator does not write assertions and does not see the testbench implementation.

2. The Critic and SVA Synthesis Agent

The Critic agent receives only the interface specification, functional requirements, and protocol rules. Its single goal is to write temporal properties and functional coverage models designed to break invalid implementations. It writes SystemVerilog Assertions (SVA) using concurrent properties (assert property), formal sequences, and covergroups. Because it operates without inspecting the internal signal names of the generator's state machine, it asserts black-box invariants based strictly on interface contracts.

3. The Verifier and Execution Loop Agent

The Verifier compiles both the generator's RTL and the Critic's assertions inside an open-source or commercial simulator (such as Icarus Verilog or Verilator). It captures simulation exit codes, assertion violation traces, and lint warnings. When an assertion fails, the execution agent formats the failure timestamp, active signal values, and the violated property into an error envelope sent to a Debugger agent. The Debugger then prompts the Generator with precise failure dynamics without polluting the Critic's independent assertion suite.

Anatomy of an FSM Deadlock: A Concrete Walkthrough

To see how multi-agent structures catch what single models miss, consider a common RTL bug: a multi-client round-robin arbiter with credit-based flow control and a hold-until-acknowledged grant condition.

The Failure Mode in Single-Agent RTL

A standard single-prompt LLM will construct the state machine with three states: IDLE, GRANT, and WAIT_ACK. If client 0 is granted access and raises a request, the FSM transitions to GRANT. If the downstream bus signals backpressure by deasserting ready, the FSM enters WAIT_ACK.

Here is where the bug occurs: if client 0 drops its req line while the downstream bus is stalled (a valid condition in burst protocols where a client cancels an uncommitted burst), the single-agent code fails to evaluate the branch where req == 0 and ready == 0 simultaneously. The FSM remains trapped in WAIT_ACK indefinitely because the transition back to IDLE requires ack == 1, but the downstream slave never generates ack because valid dropped.

// Single-prompt flawed FSM snippet
type enum logic [1:0] {
    IDLE     = 2'b00,
    GRANT    = 2'b01,
    WAIT_ACK = 2'b10
} state_t;

state_t current_state, next_state;

always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n)
        current_state <= IDLE;
    else
        current_state <= next_state;
end

always_comb begin
    next_state = current_state;
    case (current_state)
        IDLE: begin
            if (|req_vec)
                next_state = GRANT;
        end
        GRANT: begin
            if (bus_ready)
                next_state = WAIT_ACK;
            else
                next_state = GRANT;
        end
        WAIT_ACK: begin
            // Latent deadlock: if bus_ack fails to assert due to client drop, FSM hangs
            if (bus_ack)
                next_state = IDLE;
            // Missing: else if (!req_vec[current_grant] && !bus_ready) next_state = IDLE;
        end
        default: next_state = IDLE;
    endcase
end

A single-prompt assistant testing its own code will write a directed test where client 0 asserts req, waits for GRANT, receives bus_ready, receives bus_ack, and returns to IDLE. The test passes with 100% line coverage on that specific path. The deadlock remains undetected.

How the Critic Agent Exposes the Deadlock

In a multi-agent structure, the Critic agent writes temporal assertions derived directly from protocol invariants, without seeing the internal WAIT_ACK state. It formulates a liveness property and an interface forward-progress property:

// Independent SVA written by Critic Agent
property p_arbiter_no_deadlock;
    @(posedge clk) disable iff (!rst_n)
    (|req_vec) |-> strong(##[1:16] (|grant_vec));
endproperty

property p_grant_release_on_drop;
    @(posedge clk) disable iff (!rst_n)
    (grant_vec[0] && !req_vec[0] && !bus_ack) |=> ##[1:4] (!grant_vec[0]);
endproperty

assert_arbiter_liveness: assert property (p_arbiter_no_deadlock)
    else $error("DEADLOCK DETECTED: Request asserted but no grant issued within 16 cycles");

assert_grant_drop: assert property (p_grant_release_on_drop)
    else $error("PROTOCOL VIOLATION: Grant held high after request deasserted without ack");

When the simulation agent executes the randomized stimulus generated by the test harness, client 0 drops req_vec[0] while bus_ack is low. The simulation hits the p_grant_release_on_drop assertion at cycle 42. The Verifier agent traps the failure and feeds the simulation trace back to the Debugger agent, forcing the Generator agent to patch the missing state transition.

Receipts: Single-Prompt vs Multi-Agent Performance

Research on multi-agent RTL generation demonstrates clear differences in functional verification sign-off compared to single-shot LLM prompts. The table below represents an illustrative composite of benchmark metrics compiled from published evaluations of MAGE, MosChip's dual-model frameworks, and baseline frontier models evaluated against standard RTL benchmarks (including standard FSM, arbiter, FIFO, and AXI bus-interface designs).

Note: Illustrative composite based on data from MAGE (arXiv:2412.07822v1), MosChip agentic benchmarks, and standard open-source RTL evaluation harnesses.

Direct generation fails in nearly a third of all multi-state control designs due to unhandled corner cases. Iterative self-correction where the same model reads compiler errors improves syntax but leaves the latent deadlock escape rate above 20% because the model cannot critique its own architectural blind spots. The multi-agent loop reduces the deadlock escape rate to 4.2%, trading increased token consumption and simulation cycles for actual verification rigor.

The Operational Limits of Multi-Agent RTL

Multi-agent loops solve the self-confirmation bias of single LLMs, but they introduce operational friction that engineering managers must track.

1. Token Budgets and Compute Latency

A fully agentic loop requires between 5 and 10 LLM inference passes per module, paired with automated Verilator compilation and simulation runs. If an SVA assertion triggers a false failure because the Critic agent misread the interface spec, the Generator agent will rewrite functional code to satisfy a bogus assertion. This assertion drift consumes thousands of tokens and can burn 10 to 15 minutes of wall-clock time per block.

2. Vacuous Assertion Passing

A known vulnerability in LLM-written assertions is vacuous success. If a Critic agent writes an implication assertion such as:

property p_vacuous_check;
    @(posedge clk) (req && invalid_precondition) |-> (data_out == expected_data);
endproperty

If invalid_precondition is never true in simulation, the antecedent is always false. The property passes vacuously every cycle, creating the illusion of 100% assertion pass rates. Multi-agent frameworks must enforce concurrent cover property statements alongside every assert property to prove that the antecedent was triggered during the testbench run.

3. Asynchronous Boundaries and Clock Domain Crossings

Multi-agent workflows run on digital simulators (Icarus, Verilator) evaluating discrete clock edges. They do not naturally detect metastable states, synchronizer chain latency mismatches, or missing false-path constraints across asynchronous clock domain crossings (CDC). Multi-agent systems can verify cycle-accurate synchronous state logic, but CDC and static timing analysis (STA) sign-off still demand deterministic formal tooling.

Evaluating Multi-Agent RTL Frameworks: A Decision Frame

Before integrating frameworks like MAGE or commercial offerings like MosChip's AgenticSky into your silicon team's workflow, audit the architecture against this implementation checklist:

1. Context Isolation: Does the assertion synthesis agent operate strictly on specification inputs without viewing the internal register implementation of the generator agent? If the critic reads the generator's RTL, the independence of the verification is compromised.
2. Vacuity Checking: Does the verifier compile cover property directives to ensure that assertion antecedents are genuinely triggered during simulation?
3. Deterministic Simulator Integration: Is the feedback loop grounded in standard EDA tools (Verilator, Icarus Verilog, Synopsys VCS, Cadence Xcelium) rather than an LLM pretending to evaluate waveforms in natural language?
4. Assertion Density and Metric Gates: Does the framework require minimum SVA property coverage before declaring an RTL module verified, or does it stop after a basic syntax pass?
5. State Space Exploration: Does the testbench generator use constrained-random stimulus with randomized seed iterations, or does it rely solely on hardcoded directed sequences?

What This Means for Silicode

Plausible Verilog is a liability; verified Verilog is an asset. Multi-agent generation proves that scaling RTL productivity is not about generating code faster. It is about automating the generation of testbenches, assertions, and verification evidence.

At Silicode (silicode.ai), we build this exact rigor into the foundation of AI-driven chip design. Rather than relying on conversational language models that guess register behaviors, Silicode couples code generation with automated formal properties, deterministic simulation gates, and continuous lint checks. The goal is not to output quick Verilog snippets, but to deliver verified, timing-closed, and synthesizable RTL that meets the strict demands of production silicon.

What to Watch Next

As multi-agent RTL frameworks mature over the coming quarters, watch for two primary technical transitions:

First, monitor the integration of formal property checking tools (like JasperGold or open-source SymbiYosys) directly into the Critic agent's feedback loop. Dynamic simulation with Icarus or Verilator tests only the states hit by stimulus; running LLM-generated SVA properties through a formal model checker mathematically proves the absence of deadlocks across the entire reachable state space.

Second, watch how teams handle specification drift. When a multi-agent system encounters a failing assertion, human sign-off is required to determine whether the RTL was defective or the assertion was over-constrained. Frameworks that provide traceable error logs and waveform state dumps will become standard in ASIC regression suites, while monolithic single-prompt code generators will fade from professional silicon engineering.

Questions and Answers

Why do single-prompt LLMs miss FSM deadlocks in Verilog?

Single models suffer from context contamination. When the same model writes the RTL implementation and the testbench, it evaluates both against its own internal behavioral assumptions. If it omits a state transition branch in the RTL, it omits the stimulus that exercises that branch in the testbench, resulting in a false-positive pass.

How do multi-agent frameworks prevent assertion hallucination?

Multi-agent frameworks isolate the Critic agent, forcing it to generate SystemVerilog Assertions derived strictly from interface specifications and bus protocol rules. By evaluating the generated RTL against these independent temporal assertions inside a real simulator like Verilator, any missing transition or trapped state triggers an immediate assertion violation.

Sources

• [1] Accelerating RTL Design with Agentic AI: A Multi-Agent LLM-Driven Approach: https://moschip.com/blog/ai-engineering/accelerating-rtl-design-with-agentic-ai-a-multi-agent-llm-driven-approach/
• [2] MAGE: A Multi-Agent Engine for Automated RTL Code Generation: https://arxiv.org/html/2412.07822v1
• [3] MAGE Open Source Repository: https://github.com/stable-lab/MAGE-A-Multi-Agent-Engine-for-Automated-RTL-Code-Generation
• [4] Accelerating RTL Design Through Multi-Agent AI Collaboration: https://www.semiconductor-digest.com/accelerating-rtl-design-through-multi-agent-ai-collaboration/
• [5] SystemVerilog Assertions Tutorial: https://www.doulos.com/knowhow/systemverilog/systemverilog-tutorials/systemverilog-assertions-tutorial/
• [6] SystemVerilog Assertions Basics: https://www.systemverilog.io/verification/sva-basics/