MIT, Google, and UW Unveil "Granite": A Breakthrough in Hardware Verification That Could Reshape How Chips Are Proven Secure

---

AI Summary

Researchers from MIT, Google, and the University of Washington have published a technical paper introducing "Granite," a modular methodology for formally verifying both the functional correctness and the security (specifically, nonleakage of timing information) of RTL processors against ISA contracts. RTL (Register Transfer Level) is the code-level description of how a chip's logic operates cycle by cycle, and ISA (Instruction Set Architecture) is the formal contract between software and hardware that defines what a processor is supposed to do. Granite's key innovation is proving mathematically — not just testing — that a processor's cycle-by-cycle timing behavior does not leak sensitive information, while also confirming the processor performs its instructions correctly. For Malaysia's semiconductor sector, which handles significant chip design, verification, and packaging work in Penang and Kulim, this methodology could eventually change how local engineering teams approach chip security validation and reduce costly late-stage redesigns.

---

Key Takeaways

• Granite unifies two verification problems into one framework. Most existing methods check either functional correctness (does the chip compute the right answer?) or security (does the chip leak secrets?). Granite addresses both simultaneously, which could reduce verification time and gaps.
• "Nonleakage" is about timing side-channels, not just data. The methodology proves that a processor's cycle-by-cycle timing does not vary based on secret data — closing the door on a class of attacks similar in spirit to Spectre and Meltdown, which exploited timing observations to extract sensitive information.
• Modularity is the structural breakthrough. Rather than verifying an entire processor as one monolithic block, Granite breaks the problem into smaller, composable verification tasks — making formal verification feasible for real-world processor designs, not just toy academic examples.
• ISA contracts are the anchor. The approach formalises the Instruction Set Architecture as a "contract" that specifies both what the processor must compute and what it must not reveal, giving hardware and software teams a shared, checkable specification.
• This is foundational research, not a commercial product. The paper is an academic contribution from top-tier institutions. Commercial adoption will require tooling, integration with existing EDA flows, and industry collaboration — but the direction is significant for anyone in chip design.

---

What Happened

Researchers from the Massachusetts Institute of Technology (MIT), Google, and the University of Washington published a technical paper titled "Granite: A Modular Methodology for Foundational Verification of Hardware-Software Leakage Contracts." The paper appeared in coverage by Semiconductor Engineering, a leading industry technical publication.

Granite is described as a methodology for "modular verification of both functional correctness and nonleakage of RTL processors against ISA contracts." Breaking that down: RTL, or Register Transfer Level, is the stage of chip design where engineers describe the processor's logic in a hardware description language like Verilog or VHDL. It is the blueprint from which actual silicon is manufactured. ISA, or Instruction Set Architecture, is the interface contract — the set of instructions and behaviors that software expects from the processor. Every program ever written for a chip family (x86, ARM, RISC-V) depends on the ISA contract being honored.

The paper's central claim is that Granite can prove — mathematically, not just through simulation or testing — that "the cycle-by-cycle timing of a processor" does not leak sensitive information. This is what the researchers call "nonleakage." In practice, it means that if a secret value (say, a cryptographic key) is being processed, the number of clock cycles an operation takes does not depend on the value of that secret. An attacker who can observe timing — even indirectly, through power consumption, electromagnetic emanations, or shared cache behavior — gains no information.

The modular aspect of Granite is what makes it practically interesting. Traditional formal verification of processors has been notoriously difficult because the state space — the number of possible internal configurations a processor can be in — grows exponentially with design complexity. By breaking the verification into modules and composing the results, Granite aims to make the problem tractable for designs that approach real-world complexity. This is a collaboration between MIT (long a leader in formal methods), Google (which designs its own custom silicon for data centers, including TPUs), and the University of Washington (a top systems and architecture research group).

---

Why It Matters

The semiconductor industry has a verification crisis. According to widely cited industry surveys, verification consumes 50–70% of the total engineering effort in a modern chip design project. As processors grow more complex — more cores, deeper pipelines, speculative execution, security enclaves — the gap between what can be tested and what must be guaranteed keeps widening. Simulation-based testing, no matter how extensive, can only cover a fraction of possible scenarios. It proves the presence of bugs, not their absence.

Granite matters because it targets two categories of problem that traditional verification handles poorly. The first is functional correctness: does the processor compute the right result for every possible instruction, in every possible state? The second is security — specifically, timing side-channel leakage. This second category gained enormous attention after the disclosure of Spectre and Meltdown in 2018, which demonstrated that speculative execution features in modern processors could be exploited to read memory that should be inaccessible, by measuring tiny timing differences. Those vulnerabilities affected virtually every modern processor and cost the industry billions in patches, redesigns, and lost performance.

By formalising the ISA as a "contract" that includes both functional and nonleakage obligations, Granite offers a framework where security is not bolted on after the fact but built into the specification itself. This is a philosophical shift. Today, most chip security is addressed through penetration testing, fuzzing, and ad-hoc review — valuable activities, but reactive by nature. A contract-based, formally verified approach means the design is provably correct against a stated security property before tape-out, not after a vulnerability is discovered in the field.

The collaboration between academia (MIT, UW) and industry (Google) is also significant. Google's involvement signals that the methodology is being evaluated against real design challenges, not just academic benchmarks. Google designs custom silicon — including Tensor Processing Units (TPUs) for AI workloads and Tensor chips for Pixel devices — and has a direct interest in verification methods that reduce risk and time-to-market. If Granite or its successors mature into practical tools, they could influence how the entire industry approaches pre-silicon verification over the next five to ten years.

---

What This Means for Malaysia

Malaysia occupies a critical position in the global semiconductor supply chain. Penang and Kulim (Kedah) host major operations for companies including Intel, AMD, Infineon, Bosch, and Western Digital. The country is not merely an assembly and test hub — design centres in Penang routinely handle RTL design, verification, and physical implementation for components that ship in products worldwide. According to government and industry data, Malaysia accounts for approximately 13% of global back-end semiconductor capacity and is actively moving up the value chain into front-end design through initiatives supported by MIDA, MDEC, and the National Semiconductor Industry Strategy.

For Malaysian engineering teams, Granite's methodology is relevant in two ways. First, verification engineers — a large and growing segment of Malaysia's semiconductor workforce — are the direct audience for advances in formal verification. If Granite-inspired tools become available through EDA platforms like Synopsys, Cadence, or open-source RISC-V toolchains, Malaysian teams will need to understand and adopt them to remain competitive. Design centres that can offer formally verified, security-guaranteed IP blocks will command premium contracts, especially from automotive and defence clients who demand provable security.

Second, Malaysia's push to develop indigenous semiconductor IP — particularly in the RISC-V ecosystem, where the open ISA makes formal contract verification especially tractable — could benefit directly. RISC-V's open and modular ISA is a natural fit for the kind of ISA contract that Granite formalises. Local companies and university research groups (USM, UTAR, Multimedia University) working on RISC-V cores could adopt contract-based verification as a differentiator, positioning Malaysian-designed IP as security-certified by construction rather than by事后 testing.

The policy implication is that government funding for semiconductor R&D — including under Budget 2024 and 2025 allocations for the chip sector — should consider supporting formal verification training and tool adoption. Countries that build deep expertise in formal methods for hardware will have a structural advantage as security requirements in automotive (ISO 21434), medical, and critical infrastructure sectors tighten globally.

---

How Your Business Can Use This

If you operate a semiconductor design or verification team in Malaysia, the practical implications of Granite are medium-term but worth preparing for now. Here is a step-by-step approach:

1. Audit your current verification methodology. Most Malaysian design centres rely on simulation (UVM-based verification), formal equivalence checking, and coverage-driven testbenches. Ask your verification leads whether they currently perform any formal property checking — tools like JasperGold (Cadence) or VC Formal (Synopsys) are already available but underutilised in many teams. Understanding your starting point is essential.

2. Begin training verification engineers in formal methods. Formal verification requires a different mindset from simulation-based testing — it is about mathematical proof, not test coverage. Invest in training programs, perhaps through partnerships with local universities or online courses from providers like Coursera and DAC conferences. Engineers who understand SMT solvers, property specification (SystemVerilog Assertions), and contract-based design will be the first to adopt Granite-style methodologies when tools become available.

3. Evaluate ISA contract specifications for your current IP. Even without Granite, you can begin documenting your processor or accelerator's ISA as a formal contract — specifying not just what each instruction does, but what timing guarantees it must satisfy. This exercise alone often reveals ambiguities and unspoken assumptions that lead to bugs.

4. If you are building RISC-V-based IP, engage with the open-source formal verification community. RISC-V's open ISA makes it the most natural target for contract-based verification. Projects like Sail-RISC-V (a formal ISA model) and the RISC-V Formal Verification Framework already provide infrastructure that aligns with the Granite philosophy. Malaysian teams building custom RISC-V extensions for IoT, automotive, or AI edge applications should consider making formal nonleakage proofs part of their IP deliverable.

5. For non-semiconductor businesses: understand what "verified hardware" will mean for procurement. If you are a Malaysian company procuring chips or devices for critical infrastructure — fintech hardware, automotive systems, medical devices — ask your suppliers about their verification methodology. Over the next 3–5 years, the ability to demonstrate formal security verification will become a procurement differentiator, particularly for government and regulated industry contracts.

---

The Agentic AI Angle

The connection between formal hardware verification and agentic AI is more direct than it first appears. As AI agents are increasingly deployed to automate chip design tasks — including RTL generation, verification planning, and coverage analysis — the quality of the specifications they work against becomes the bottleneck. An AI agent that generates RTL code can only be trusted if the output can be automatically and rigorously checked against a formal contract.

Granite's ISA contract framework could serve as the verification layer for AI-driven chip design workflows. Imagine an agentic system where one agent writes RTL, another agent writes test properties, and a third agent — using a Granite-style modular verifier — provides mathematical proof that the design satisfies both functional and security contracts. This is not speculative; companies like Synopsys and Cadence are already integrating AI into their EDA tools, and Google has used AI (through its AlphaChip work) to generate chip floorplans. The missing piece is automated formal verification that can close the loop — and Granite points toward how that loop gets closed.

For Malaysian semiconductor companies, the strategic move is to invest in the intersection of AI-assisted design and formal verification. Teams that can use AI agents to accelerate RTL development while maintaining formal correctness guarantees will compress design cycles significantly — potentially from years to months for certain IP blocks. This is where the competitive frontier is heading.

---

Risks and Limitations

Granite is an academic research paper, not a commercial tool. The methodology has been demonstrated on specific processor models under controlled conditions. Whether it scales to the largest commercial designs — with billions of transistors, speculative execution, out-of-order scheduling, and multi-level caches — remains unproven. Formal verification has historically struggled with the state explosion problem, and while modularity helps, it does not eliminate the challenge entirely.

There are also practical adoption barriers. Formal verification expertise is scarce globally and nearly absent in many Malaysian design teams. The learning curve is steep, and ROI is difficult to demonstrate until a prevented bug saves a costly tape-out revision. Companies may hesitate to invest unless large customers or industry standards explicitly require formal nonleakage proofs. Additionally, the methodology focuses on timing leakage; other attack vectors — power analysis, electromagnetic side-channels, fault injection — require different verification approaches that Granite does not address.

---

The Bottom Line

Granite represents a meaningful step toward a future where processor security and correctness are mathematically proven before silicon is fabricated, rather than discovered after products ship. For Malaysia's semiconductor sector — already a global hub for design and verification — the signal is clear: formal verification skills will become increasingly valuable, and teams that build this expertise early will differentiate themselves in the market. The immediate action for Malaysian engineering leaders is to assess their current verification capabilities, invest in formal methods training, and begin treating the ISA as a formal, checkable contract. The companies that do this will be positioned to lead, not follow, as the industry's verification paradigm evolves.

---

FAQ

What is RTL and why does verifying it matter? RTL (Register Transfer Level) is the code that describes a chip's logic before it is manufactured. Errors or security flaws in RTL become permanent once the chip is fabricated — fixing them requires an expensive redesign and new manufacturing run, costing millions.

Is Granite available as a commercial tool I can buy today? No. Granite is a research methodology described in an academic paper from MIT, Google, and the University of Washington. Commercial EDA vendors may incorporate similar concepts into their tools in the coming years, but there is no off-the-shelf Granite product.

How does this affect Malaysian semiconductor workers specifically? Verification engineers in Penang and Kulim should monitor formal verification developments closely. As methodologies like Granite mature, teams with formal methods expertise will be assigned higher-value work and command higher compensation. Engineers should seek training in property-based verification and ISA-level modelling now.

---

Sources / References

• Semiconductor Engineering — "Modular Verification of RTL Processors Against ISA Contracts (MIT, Google, UW)": Primary source for this article. Provided the paper title, authoring institutions (MIT, Google, University of Washington), the methodology name (Granite), and the core technical claims about modular verification of functional correctness and nonleakage against ISA contracts. URL: https://semiengineering.com/modular-verification-of-rtl-processors-against-isa-contracts-mit-google-uw/