formal property verification
**Formal Property Verification** is the **mathematically rigorous verification technique that exhaustively proves whether a hardware design satisfies specified properties (assertions) for ALL possible input sequences** — unlike simulation which tests a finite number of vectors and can miss corner cases, formal verification uses mathematical algorithms (SAT solvers, BDDs, SMT) to either prove a property is always true or find a concrete counterexample (bug), making it indispensable for verifying critical control logic, protocols, and security properties.
**Formal vs. Simulation**
| Aspect | Simulation | Formal Verification |
|--------|-----------|--------------------|
| Coverage | Tests specific scenarios | Exhaustive (all inputs) |
| Bug finding | Finds bugs in tested scenarios | Finds bugs in ALL scenarios |
| Proof | Cannot prove absence of bugs | Mathematically proves correctness |
| Scalability | Scales to full chip | Limited to ~50K-200K state bits |
| Effort | Write testbench + stimuli | Write properties (SVA assertions) |
| Runtime | Hours-days (full regression) | Minutes-hours per property |
**SystemVerilog Assertions (SVA)**
```systemverilog
// Property: request must be acknowledged within 10 cycles
property req_ack_bounded;
@(posedge clk) disable iff (reset)
req |-> ##[1:10] ack;
endproperty
assert property (req_ack_bounded);
// Property: FIFO never overflows
property fifo_no_overflow;
@(posedge clk) disable iff (reset)
(count == DEPTH) |-> !push;
endproperty
assert property (fifo_no_overflow);
// Property: Grant is one-hot (arbiter output)
property grant_onehot;
@(posedge clk) disable iff (reset)
|grant |-> $onehot(grant);
endproperty
assert property (grant_onehot);
```
**Formal Verification Techniques**
| Technique | How | Strength |
|-----------|-----|----------|
| Bounded Model Checking (BMC) | Check property for K cycles deep | Fast bug finding |
| Unbounded (full proof) | Prove for infinite cycles using induction | Complete proof |
| Property-directed reachability (PDR/IC3) | Modern algorithm for full proofs | Efficient for control logic |
| k-Induction | Base case + inductive step | Good for counters, FSMs |
| Abstraction | Simplify design, prove on abstract model | Scales to larger designs |
**Use Cases**
| Application | What Is Verified | Why Formal |
|------------|-----------------|------------|
| Arbiter/scheduler | Fairness, deadlock-freedom, one-hot grant | Exhaustive coverage of all request patterns |
| FIFO | Overflow/underflow, data integrity, ordering | All push/pop interleavings |
| Cache coherence | Protocol correctness (MESI states) | Astronomical state space |
| Bus protocol | AXI/AHB handshake compliance | All timing scenarios |
| Security | No unauthorized access, information leakage | Must prove absence (not just test) |
| FSM | Reachability, no deadlock, liveness | All state transitions |
**Formal Verification Flow**
1. **Write properties**: SVA for key behaviors, constraints for valid inputs.
2. **Set up environment**: Constrain primary inputs (assume valid bus protocol).
3. **Run formal tool**: JasperGold (Cadence), VC Formal (Synopsys), OneSpin (Siemens).
4. **Results**:
- **Proven**: Property holds for all inputs → design is correct for this property.
- **Falsified**: Counterexample trace (CEX) → specific input sequence that violates property → BUG.
- **Inconclusive**: Cannot prove or disprove in given time/bound → increase resources or simplify.
**Scalability Management**
| Technique | How It Helps |
|-----------|-------------|
| Assume-guarantee | Decompose into blocks, verify each with assumptions |
| Cut points | Abstract internal signals → reduce state space |
| Blackbox | Replace complex sub-blocks → focus on control logic |
| Case splitting | Verify modes/configurations separately |
Formal property verification is **the gold standard for verifying critical hardware correctness** — while simulation remains essential for system-level testing, formal verification's ability to mathematically prove properties across all possible behaviors makes it irreplaceable for safety-critical components (automotive, aerospace), security modules (cryptographic engines, access control), and shared resource arbiters where a single unverified corner case can cause catastrophic failures in deployed systems.