Formal Verification · All levels
Proof Engines & Convergence: Tricky Q&A
Senior interview and review questions for Proof Engines & Convergence.
Section Q&A bank
Use these drills after completing all topics in Proof Engines & Convergence. Answer with requirement context, mechanism proof, artifact, owner, and signoff decision.
A property fails under BMC at depth 18 but appears to pass unbounded attempts with weak assumptions. What is the most likely interpretation?
[INT][FORMAL][PROOF-ENGINES-CONVERGENCE]
Q: A property fails under BMC at depth 18 but appears to pass unbounded attempts with weak assumptions. What is the most likely interpretation?
A:
Treat the BMC failure as real until disproven: bounded counterexamples are concrete traces, while unbounded non-convergence or vacuous success can hide over-constraint. Recheck assumptions, vacuity, and reset reachability before trusting any unbounded status.
FOLLOW-UP TRAP: Assuming an unbounded status label automatically outweighs a concrete bounded counterexample.Why does k-induction often stall even when no bug trace is found at practical BMC depths?
[INT][FORMAL][PROOF-ENGINES-CONVERGENCE]
Q: Why does k-induction often stall even when no bug trace is found at practical BMC depths?
A:
BMC not finding a bug only means no counterexample within the explored horizon. K-induction still needs strong inductive invariants; without helper assertions or strengthened assumptions, the inductive step can fail on states that are mathematically possible but not yet excluded.
FOLLOW-UP TRAP: Believing deep-enough BMC implies induction should close without additional invariants.When is case-splitting preferable to adding more global assumptions?
[INT][FORMAL][PROOF-ENGINES-CONVERGENCE]
Q: When is case-splitting preferable to adding more global assumptions?
A:
Use case-splitting when behavior is naturally mode-partitioned and each mode has distinct invariants. It narrows proof obligations without globally constraining legal behavior, reducing risk of over-constraint compared with broad assumptions that silently remove hard scenarios.
FOLLOW-UP TRAP: Adding sweeping assumptions first because they speed runtimes, without proving they preserve intent.How do you keep blackboxing and abstraction from invalidating signoff confidence?
[INT][FORMAL][PROOF-ENGINES-CONVERGENCE]
Q: How do you keep blackboxing and abstraction from invalidating signoff confidence?
A:
Maintain explicit assume-guarantee contracts, track every abstraction in a ledger, and run refinement checks or replay on fuller models for representative properties. Confidence comes from traceable equivalence of intent, not from faster proofs alone.
FOLLOW-UP TRAP: Treating any converged abstract-model proof as signoff-complete without refinement evidence.Q&A drill guide
REQUIREMENT -> PROPERTY -> EVIDENCE -> OWNER ACTION -> RESIDUAL RISKSketch while answering
CONVERGENCE DECISION FLOW
property bucket -> engine strategy -> helper invariants -> convergence audit -> closureCommon traps
Bucket properties by structure and intent before tuning.
Inspect proof core stability, not runtime alone.
Reject speed gains that reduce legal reachability.
Key takeaways
Tie each proof claim to assumption boundaries and reachability evidence.
Prefer minimal reversible fixes and preserve legal behavior visibility.
Common pitfalls
Treating runtime reduction as proof-quality improvement without audits.
Declaring closure while critical covers remain unreachable.
Using broad waivers instead of first-divergence root-cause ownership.