Overview
Peripherals — tile area follows register count, colour follows the share of registers verified.
Mutation score per component: the share of injected faults the Spec tests detect (target 80%).
Instructions by family
verified: a test with an oracle ran it. verified by differential: only a lockstep comparison against QEMU ran it (an independent reference, not a spec-derived assertion). exercised only: only fuzzing or firmware ran it, nothing asserted its result. never run: no test executed it. Click a chip for its specification reference.
Encoding space
One pixel per encoding, so the gaps in the decoder's input space are visible. Dark = not an instruction in the catalogue and never run; teal = executed identically to QEMU in lockstep (the exhaustive sweeps record only the encodings on which both agreed; an unallocated encoding both machines reject with the same fault also counts; a Thumb-2 first halfword is teal once its sampled second halfwords agree and none carries an open or known-limitation disagreement); blue = run although no catalogue entry matches (reserved and undefined probes); grey = reserved, UNPREDICTABLE or implementation defined in the specification, listed by the PIO sweep and by the Arm reference-interpreter sweep (no oracle can exist). Green on the Thumb maps means the emulator agreed after every step with a reference interpreter (ThumbRef) that was written from memory of the Armv8-M ARM and then checked on 2026-10-26 against the text of DDI0553A.m (October 2019, a third-party copy, not the current release): the decode tables, the UNDEFINED / UNPREDICTABLE Decode lines of every instruction page and the shared pseudocode (shifts, saturation, IT, the floating-point rounding and NaN rules). A second pass read the Encoding, Decode and Operation of every integer, DSP and SIMD instruction page (parallel add and subtract with their GE flags, SEL, USAD8, PKH, the extends, SSAT16 / USAT16, QADD to QDSUB, the 16-bit and dual multiplies, UMAAL, SMMLA to SMMUL), of the load/store, system and hint pages and of BKPT, WFE, WFI and SEV line by line against the interpreter (DDI0553A.m C2.4.1 to C2.4.250 and C2.4.307 to C2.4.309); the coprocessor and floating-point instruction pages were not re-read, only their shared pseudocode. A Thumb-2 first halfword is green when every sampled second halfword agreed, was UNDEFINED in both, or is unspecified; green outranks teal. Green does not mean silicon was compared, that the second halfwords were enumerated (they are sampled from the encoding patterns), that the coprocessor and floating-point instruction pages were re-read line by line, or that anything outside the instruction itself was asserted (exceptions, stack limits, the MPU, the SAU and the Secure transitions, CCR.UNALIGN_TRP); where the manual is silent or contradicts itself the encoding is grey, not green. An instruction counts as verified once any one of its encodings ran under an oracle test, so these maps are stricter than the chips above: most of the space is only swept, not asserted.
PIO MOV matrix
Destination × source for each operation (none, invert ~, bit-reverse ::), datasheet 11.4.10.
Peripheral registers
One square per register in address order. A register is verified when both directions it supports were exercised by oracle tests (reset value, round trip, access type).
Datasheet sections cited by tests
Every section of the datasheet's functional chapters (2 to 13). Colour is the number of tests that cite the section in [Trait("Spec", …)] (red 0, amber 1–2, green 3 or more). This measures traceability to the datasheet, not behavioural completeness.