Formal verification

The engineering objective

Use properties and exhaustive reasoning within a defined model and assumptions.

The work starts from design model, properties, environmental assumptions and proof objectives. The team should identify the authoritative revision of each input and record any assumptions needed to proceed. This prevents a later result from being interpreted against a different specification or configuration.

What needs technical attention

An overconstrained environment can hide a defect; assumptions need independent review.

The review centres on vacuity, reachability, assumption strength and proof completeness. Each finding should identify the input revision, observed behaviour and supporting evidence. Distinguish a confirmed defect from a configuration issue, an unsupported case or an open engineering question before deciding how to resolve it.

How the work is reviewed

The practical sequence is: specify properties; review assumptions; run proofs; investigate counterexamples and inconclusive results. Intermediate reviews allow the client to resolve decisions while changes are still manageable. If an input changes, identify the affected activities and repeat the checks that depend on it.

The expected package comprises properties, proof results, counterexamples and documented limitations. Acceptance criteria should specify what the receiving team needs to reproduce, inspect or integrate these artifacts. Include known limitations and outstanding actions in that package, rather than assuming that delivery of a file implies acceptance.

Make the interface contract executable

A specification becomes useful when the team can distinguish legal behaviour from a defect at each interface. Record which side drives a transaction, when data becomes valid, how backpressure works and what happens if reset arrives during a transfer. Register descriptions should state access permissions, reset values and side effects. Configuration parameters need a supported range; a design verified in one configuration should not automatically be treated as verified in every configuration.

Performance requirements need a workload and an observation point. Specify whether a latency target measures an isolated transaction or a stream under contention. State how throughput is counted when requests stall, retry or cross clock boundaries. This makes architecture reviews more productive: a buffer, pipeline stage or arbitration change can be compared against an explicit requirement rather than a headline frequency.

Keep functional verification, structural checks and implementation feasibility as distinct review activities. A successful compile, proof or synthesis run answers the question posed by its setup; it does not establish that the setup covered the entire product requirement. Review assumptions, exclusions and unsupported modes alongside the result. Where an interface is supplied by another team, agree a small integration test and its expected response before connecting the full subsystem.

An illustrative review scenario

Consider a producer that can issue consecutive requests while its consumer occasionally stalls. Review whether the interface preserves ordering, holds data stable and resumes without losing a request. Add a reset during the stall and a boundary-length transfer. Record the expected behaviour first, then retain the test and result with the design revision. This is an illustrative review scenario, not a claim about a delivered client project.