Writing Good Properties: Decomposing Intent into Checkable Guarantees: Software and Programmer View

Software and verification-program view

Checker quality must be treated like API quality, with contracts, versioning, and migration discipline.

What teams feel

• inconsistent formal outcomes across tool or config updates

• CI noise from vacuous passes and inconclusive aging

• traceability gaps between spec requirements and property IDs

Workflow and API impact

• assertion and checker naming standards for cross-team triage

• assumption ownership and change review policy

• trace and replay artifact retention expectations

Toolchain and automation implications

• engine strategy reproducibility across compute environments

• incremental rerun behavior under RTL churn

• automation for vacuity and coverage deltas

Mitigations

• enforce assumption-review templates with spec references

• fail CI on critical vacuity and stale-inconclusive thresholds

• standardize trace capture and minimal replay packaging

SOFTWARE VIEW - Writing Good Properties: Decomposing Intent into Checkable Guarantees
// gate promotion on non-vacuous closure and assumption audit stability

Formal deep dive

Property and constraint engineering is successful when decomposition, reuse, and abstraction preserve legal behavior.

Concept diagram

PROPERTY DEVELOPMENT PIPELINE

spec clause -> decomposed properties -> constraints -> covers -> closure packet

Metric graph

CONSTRAINT HYGIENE TREND

over-constraint risk    ████
cover reachability      ███████
library consistency     █████

Metrics and artifacts to collect

• assume/assert separation coverage

• critical cover reachability score

• checker library adoption and drift

• over-constraint warning trend

Mini case study

A reusable checker library reduced regression noise after assumptions were explicitly documented and reviewed per IP.

Debug branches

• Review every assumption against a spec citation.

• Use covers to confirm legal corner scenarios remain reachable.

• Track abstraction choices in a rollback-ready ledger.

Senior review question

Ask: which requirement intent is proven, under which assumptions, and what residual risk remains?

Key takeaways

• Tie each proof claim to assumption boundaries and reachability evidence.

• Prefer minimal reversible fixes and preserve legal behavior visibility.

Common pitfalls

• Treating runtime reduction as proof-quality improvement without audits.

• Declaring closure while critical covers remain unreachable.

• Using broad waivers instead of first-divergence root-cause ownership.

Principal formal review addendum

Writing Good Properties: Decomposing Intent into Checkable Guarantees should be reviewed as a requirement-evidence workflow, not a single status report.

Use non-vacuous closure rate, counterexample turnaround time, and requirement-level residual risk trend as the monitoring lens and formal closure packet: assumptions audit, proof status matrix, counterexample classification, and requirement traceability as closure proof.

Property development is architecture translation work: requirement intent must survive decomposition, abstraction, and reuse. Strong teams preserve legal reachability while improving convergence.