← Formal Verification Interviews
Interview Question · Design
Planning Formal Across a Subsystem
- Likely at Apple
- Likely at Micron
- Likely at MediaTek
The Question
The interviewer asks
You lead formal for a new subsystem of a dozen blocks, with two engineers and six months. How do you decide where formal goes and what "done" means?
You have two and a half minutes. Speak or type, then press Get Feedback under your answer. No credits needed.
Speech-to-text runs in your browser. Chrome and Edge may send audio to their own speech service.
You can edit your answer before you send it. Feedback uses AI and checks your answer only against our written answer. No credits are used and your answer is not saved.
Reveal the Model Answer
Rank blocks by where formal pays: control-heavy logic with deep corners and clean interfaces. Examples are arbiters, credit logic, FIFOs, register blocks and protocol bridges. Give each block a goal, bug hunting or sign-off, because the exit criteria differ. Run the cheap apps across the subsystem early, plan abstractions and depth budgets per block, and bind every assumption into simulation. Track proofs, bounded results and open UNKNOWNs as a risk list.
Read the diagram as text
- Plan: scope, goal, spec rows, assumptions, exit criteria
- Run: properties and covers written; first proofs; staging over-constraints listed
- Regress: covers and proofs every night; cone map and mutation runs as milestones
- Close: every field filled; open items named; the lead signs
- Plan → Run
- Run → Regress
- Regress → Close
- Regress → Run: a cover goes unreached
An over-constraint used to stage the work is a plan entry with a date to remove it, never a silent line in the bench.
Read the diagram as text
- Property verification (F1 to F4): the general case: you write every rule
- Generated from a table or the RTL: automatic checks, connectivity, registers, X, unreachability
- Generated from a second design: equivalence (F6)
- A person names the rule: CDC protocol properties, information flow, post-silicon covers
- Where a team with no formal engineer starts: connectivity and registers: a spreadsheet in, a verdict out
- Generated from a table or the RTL → Property verification (F1 to F4)
- Generated from a second design → Property verification (F1 to F4)
- A person names the rule → Property verification (F1 to F4)
- Generated from a table or the RTL → Where a team with no formal engineer starts
The generated group needs no formal expertise to run, but someone still has to read every verdict against the spec.
Self-Check
Tick each key point you covered in your answer.
What Interviewers Listen For (Senior)
A good senior answer chooses blocks by their structure, and keeps bug-hunting goals apart from sign-off goals. It binds block assumptions into simulation as checks.
What Interviewers Listen For (Staff)
A good staff answer turns this into a staffed plan. It sets the effort per block, a fallback when proofs stall, and early design-for-formal requests. It adds a joint sign-off review with the simulation lead.
Cross-Questions
Where the interviewer goes next. Open a node to practise that follow-up.
WhyWhat IfCompareScale It
- Planning Formal Across a Subsystem
-
WhyBug Hunting vs Sign-Off GoalsL2 Mid-LevelL3 Senior
Why do bug hunting and sign-off need different exit criteria?
2:30You have two and a half minutes. Speak or type, then press Get Feedback under your answer. No credits needed.
Speech-to-text runs in your browser. Chrome and Edge may send audio to their own speech service.
You can edit your answer before you send it. Feedback uses AI and checks your answer only against our written answer. No credits are used and your answer is not saved.
Reveal the Model Answer
Bug hunting aims to find failures fast. So it accepts over-constraints, shallow bounds and partial property sets, and it ends when the bug rate drops. Sign-off claims the block is correct against its spec. So it needs complete properties, justified assumptions with covers, and proofs or argued bounds. Mixing the two leads to a bug-hunting bench presented as a sign-off.
Self-Check
Tick each key point you covered in your answer.
-
What IfWhen Key Proofs Still Do Not ConvergeL3 SeniorL4 Staff
Halfway through the schedule, two key proofs still do not converge. What is your fallback?
2:30You have two and a half minutes. Speak or type, then press Get Feedback under your answer. No credits needed.
Speech-to-text runs in your browser. Chrome and Edge may send audio to their own speech service.
You can edit your answer before you send it. Feedback uses AI and checks your answer only against our written answer. No credits are used and your answer is not saved.
Reveal the Model Answer
Decide per property, early. Try abstraction and decomposition first, within a time box. If that fails, ship a bounded result with its required depth and covers. Move the remaining risk to targeted simulation or emulation tests. Record the decision and its residual risk in the sign-off, so nobody reads the block as fully proven.
Self-Check
Tick each key point you covered in your answer.
-
CompareBounded Proofs at Sign-OffL3 Senior
Your full proofs will not converge before tape-out. Can you sign off with bounded proofs instead?
2:30You have two and a half minutes. Speak or type, then press Get Feedback under your answer. No credits needed.
Speech-to-text runs in your browser. Chrome and Edge may send audio to their own speech service.
You can edit your answer before you send it. Feedback uses AI and checks your answer only against our written answer. No credits are used and your answer is not saved.
Reveal the Model Answer
Yes, if the bound is argued, not hoped. The page must show the required depth from the counters and transactions, and a run that reaches it. It must also show covers of the deepest behaviour inside the bound. The page reports the result as bounded, with the depth, the tool version and the date. It also states the risk of a deeper bug.
Self-Check
Tick each key point you covered in your answer.
-
CompareSplitting an IP Between Formal and SimulationL3 Senior
You own verification of a new IP. How do you decide what formal covers and what simulation covers?
2:30You have two and a half minutes. Speak or type, then press Get Feedback under your answer. No credits needed.
Speech-to-text runs in your browser. Chrome and Edge may send audio to their own speech service.
You can edit your answer before you send it. Feedback uses AI and checks your answer only against our written answer. No credits are used and your answer is not saved.
Reveal the Model Answer
Split by question, not by team. Formal takes control logic whose rules fit in a few cycles: protocol compliance, arbitration, FIFO and credit invariants, registers, connectivity and deadlock. Simulation keeps data flows across many blocks, long scenarios, performance and firmware interaction. Every formal assumption is also bound into simulation as an assertion, so a wrong assumption is caught at system level.
Self-Check
Tick each key point you covered in your answer.
-
Scale ItGetting Designers to Build for FormalL3 SeniorL4 Staff
As formal lead, how do you get designers to make their blocks cheaper to prove?
2:30You have two and a half minutes. Speak or type, then press Get Feedback under your answer. No credits needed.
Speech-to-text runs in your browser. Chrome and Edge may send audio to their own speech service.
You can edit your answer before you send it. Feedback uses AI and checks your answer only against our written answer. No credits are used and your answer is not saved.
Reveal the Model Answer
Agree on a few habits before RTL is written. These are right-sized state, control separated from data, parameterised timers and depths, one reset, and important state exposed or named. Show one measured before-and-after from your own project, because that persuades more than a rule. Designers who run formal on fresh RTL also find bugs while they still remember the code.
Self-Check
Tick each key point you covered in your answer.
What People Get Wrong
Common wrong answers and why they fail.
Wrong Altitude
Lists the properties of one block when asked for a subsystem plan.
At this level the interviewer wants selection, staffing, goals and risk. Property detail comes later, if asked.
Half-Truth
"Formally sign off every block, then simulation can stop at block level."
A block proof holds only where its assumptions hold. System simulation must still check those assumptions and everything outside the properties.
Source Seligman, Schubert and Kiran Kumar, Formal Verification (2nd ed.) ch. 6 "Quality checks and exit criteria", Tip 6.17
Delivery
Names tools before asking about the blocks, the schedule or the goal.
A plan starts from what must be true at tape-out and what the team can afford. Clarifying questions first are part of the answer.