Debugging Interface Violations with Formal Counterexamples

In this lesson, you will learn how to parse formal verification counterexamples to pinpoint the precise cycle-accurate sequence of events that violates your hardware-software interface contracts.

When you use formal verification tools (like model checkers or bounded model checkers) to prove an interface property—such as "a READY signal must remain high until the data bus is read"—the tool doesn't just tell you that your logic is broken; it provides a counterexample. This is a trace, often displayed as a waveform or a state-by-state execution log, showing the exact stimulus that leads to a failure.

Anatomy of a Counterexample Trace

A counterexample trace typically maps out the state of every input, output, and internal register across consecutive clock cycles. To isolate the violation, follow these steps:

1. Identify the Failure Point: Locate the cycle where the formal assertion (e.g., an assert property in SystemVerilog) fails. This is your "smoking gun."
2. Trace Backwards: Work backward from the failure cycle to find the "pre-condition" violation. Did the processor initiate a write while the hardware was busy, or did an unexpected interrupt transition the state machine into an invalid mode?
3. Cross-Reference with the Protocol: Compare the trace against your previously defined interface contract (e.g., the handshaking sequence for a memory-mapped register).

Example: The "Lost Acknowledgement"

Suppose you have a protocol where the peripheral must assert ACK within three cycles of receiving a REQ. If your formal tool returns a trace where REQ is asserted at T=10, but ACK is still low at T=14, you have a violation.

Cycle | REQ | ACK | Internal_State
-----------------------------------
T=10  | 1   | 0   | IDLE
T=11  | 1   | 0   | PROCESSING
T=12  | 1   | 0   | PROCESSING
T=13  | 1   | 0   | STALLED  <-- The protocol violation happens here
T=14  | 1   | 0   | FAULT

In this trace, you can see the Internal_State transitioned to STALLED due to a buffer overflow, which prevented the ACK signal from triggering. By analyzing the STALLED state, you identify that the logic fails to account for backpressure, allowing you to patch the hardware state machine before it ever reaches physical silicon.

Key Takeaway: A formal counterexample is not just an error message; it is a cycle-accurate reproduction of the failure that allows you to trace a logic violation back to its root cause in the state machine.