Formal Verification · All levels
Equivalence Checking (LEC/SEC): Tricky Q&A
Senior interview and review questions for Equivalence Checking (LEC/SEC).
Section Q&A bank
Use these drills after completing all topics in Equivalence Checking (LEC/SEC). Answer with requirement context, mechanism proof, artifact, owner, and signoff decision.
Why can combinational LEC fail immediately after synthesis even when the netlist is actually correct?
[INT][FORMAL][EQUIVALENCE-CHECKING]
Q: Why can combinational LEC fail immediately after synthesis even when the netlist is actually correct?
A:
Most early failures are setup and mapping issues, not true functional bugs. Hierarchy flattening, renamed registers, library primitive modeling, or missing black-box directives can prevent key-point alignment, making equivalent logic appear unmatched. The first step is to repair correspondence and modeling assumptions before judging functional divergence.
FOLLOW-UP TRAP: Treating every first-pass combinational mismatch as proof of a synthesis bug.When is SEC required instead of classic cycle-aligned LEC?
[INT][FORMAL][EQUIVALENCE-CHECKING]
Q: When is SEC required instead of classic cycle-aligned LEC?
A:
Use SEC when transformations change latency or state evolution while preserving externally visible behavior, such as retiming, pipeline rebalance, or control rescheduling. Cycle-aligned LEC assumes same-cycle correspondence and will flag false failures for valid micro-architectural timing shifts.
FOLLOW-UP TRAP: Forcing cycle-by-cycle compare on designs with intentional latency movement.What makes RTL-to-gate equivalence signoff credible across the full synthesis flow?
[INT][FORMAL][EQUIVALENCE-CHECKING]
Q: What makes RTL-to-gate equivalence signoff credible across the full synthesis flow?
A:
Credibility comes from proving equivalence across all enabled synthesis variants and constraints, including DFT and low-power options, with correct primitive modeling and reset semantics. A single green run under one compile mode is insufficient if downstream recipes can alter optimization behavior.
FOLLOW-UP TRAP: Signing off after one successful LEC run without mode-coverage discipline.How should teams debug non-equivalence after a late ECO with retiming and clock-gating changes?
[INT][FORMAL][EQUIVALENCE-CHECKING]
Q: How should teams debug non-equivalence after a late ECO with retiming and clock-gating changes?
A:
Start by classifying failures into setup/model mismatch versus genuine behavior change, then reduce traces to the first divergence and map it to specific ECO edits, moved state elements, or gating enables. Validate the fix in formal and simulation to ensure no hidden side effects remain under real operating constraints.
FOLLOW-UP TRAP: Jumping directly to waiver discussions before isolating first divergence and cause.Q&A drill guide
REQUIREMENT -> PROPERTY -> EVIDENCE -> OWNER ACTION -> RESIDUAL RISKSketch while answering
EQUIVALENCE WORKFLOW
golden and revised design -> mapping and alignment -> mismatch triage -> closure evidenceCommon traps
Classify mismatch source before editing waiver sets.
Use SEC when latency movement is intentional.
Replay first divergence in simulation for cross-validation.
Key takeaways
Tie each proof claim to assumption boundaries and reachability evidence.
Prefer minimal reversible fixes and preserve legal behavior visibility.
Common pitfalls
Treating runtime reduction as proof-quality improvement without audits.
Declaring closure while critical covers remain unreachable.
Using broad waivers instead of first-divergence root-cause ownership.