Overview
Peripherals — tile area follows register count, colour follows the share of registers verified.
Mutation score per component: the share of injected faults the Spec tests detect (target 80%).
Instructions by family
verified: a test with an oracle ran it. verified by differential: only a lockstep comparison against QEMU ran it (an independent reference, not a spec-derived assertion). exercised only: only fuzzing or firmware ran it, nothing asserted its result. never run: no test executed it. Click a chip for its specification reference.
Encoding space
One pixel per encoding, so the gaps in the decoder's input space are visible. Dark = not an instruction in the catalogue and never run; teal = executed identically to QEMU in lockstep (the exhaustive sweeps record only the encodings on which both agreed; an unallocated encoding both machines reject with the same fault also counts; a Thumb-2 first halfword is teal once its sampled second halfwords agree and none carries an open or known-limitation disagreement); blue = run although no catalogue entry matches (reserved and undefined probes); grey = reserved, UNPREDICTABLE or implementation defined in the specification, listed by the PIO sweep and by the Arm reference-interpreter sweep (no oracle can exist). Green on the Thumb maps means the emulator agreed after every step with a reference interpreter (ThumbRef) that was written from memory of the Armv8-M ARM and then checked line by line, in three passes on 2026-10-26, against the text of DDI0553A.m (October 2019, a third-party copy, not the current release): the decode tables, the Encoding, Decode and Operation of all 309 instruction pages (integer, DSP, SIMD, load/store, system, hint, coprocessor and floating-point, including VLLDM / VLSTM and the lazy state preservation) and the shared pseudocode (shifts, saturation, IT, ExecuteFPCheck, RSPCheck, the floating-point rounding and NaN rules). A violated should-be-zero or should-be-one bit counts as agreement when the emulator produced any of the four outcomes C1.7 permits (UNDEFINED, NOP, as if the bit had its drawn value, UNKNOWN destination). A Thumb-2 first halfword is green when every sampled second halfword agreed, was UNDEFINED in both, or is unspecified; green outranks teal. Grey stays for what the manual leaves UNPREDICTABLE, implementation defined or contradicts itself on (empty or SP/PC register lists, BX/BLX with Rm = SP/PC, BXNS/BLXNS, SDIV/UDIV with a wrong fixed field, IT with firstcond 1111, CPS with I = F = 0, and similar); the Secure-state instructions SG, BXNS, BLXNS and TT are checked by directed tests only. Green does not mean silicon was compared, that the second halfwords were enumerated (they are sampled from the encoding patterns), or that the exception machinery was asserted (EXC_RETURN checks, tail-chaining, FPCCR banking and the Non-secure FP access, the stack-limit check at exception entry, the Secure transitions beyond the directed tests, the MPU, the SAU, CCR.UNALIGN_TRP); where the manual is silent or contradicts itself the encoding is grey, not green. The explicit list is docs/VERIFICATION.md section 18, "Still unverified". An instruction counts as verified once any one of its encodings ran under an oracle test, so these maps are stricter than the chips above: most of the space is only swept, not asserted.
PIO MOV matrix
Destination × source for each operation (none, invert ~, bit-reverse ::), datasheet 11.4.10.
Peripheral registers
One square per register in address order. A register is verified when both directions it supports were exercised by oracle tests (reset value, round trip, access type).
Datasheet sections cited by tests
Every section of the datasheet's functional chapters (2 to 13). Colour is the number of tests that cite the section in [Trait("Spec", …)] (red 0, amber 1–2, green 3 or more). This measures traceability to the datasheet, not behavioural completeness.