I spent years working on CPU validation. One classic method is random template based injection. You do three setup things: 1) pick a bunch of registers and buss

I spent years working on CPU validation. One classic method is random template based injection. You do three setup things: 1) pick a bunch of registers and busses that you will toggle to 1/0 in the RTL, 2) then code a bunch of mutexes of things that absolutely cannot happen (e.g., and AND cannot act like an XOR), 3) and then write checkers that look for bad conditions that should not happen. Then you press go literally run "coverage" by generating trillions of random test patterns and see if they toggle checker failures. There are behavioral tricks to reduce the search space (hierarchy helps), but it is one classic method. It can only be done a few times, so you really have to nail down your revision before you each up weeks of compute time on thousands of servers running random noise!