Safety vs Liveness, Strong vs Weak: Debug Playbook

Debug playbook

Debug Playbook for Safety vs Liveness, Strong vs Weak is anchored on non-vacuous closure rate, counterexample turnaround, and residual-risk trend by requirement class. Convert outcomes into assumption-aware, evidence-backed actions.

1. Freeze assumptions, RTL hash, and engine metadata.

2. Locate first divergence cycle and classify source.

3. Classify mechanism: model mismatch, weak property, setup issue, or RTL defect.

4. Apply one focused reproducer and one bounded fix.

5. Re-run sibling properties and critical covers before closure.

Review memo template

FORMAL REVIEW MEMO - SystemVerilog Assertions (SVA) / Safety vs Liveness, Strong vs Weak

1. Symptom
   - Failing metric: non-vacuous closure rate, counterexample turnaround, and residual-risk trend by requirement class
   - Trigger context: <mode/reset/env assumptions>
   - First divergence boundary: <model/property/rtl>

2. Mechanism hypothesis
   - Candidate mechanism: Safety properties state that something bad never happens (for example mutual exclusion: `assert property (@(posedge clk) !(wr && rd));`), while liveness properties state that something good eventually happens (for example progress: `req |->
   - Competing hypotheses: weak property, over-constraint, setup mismatch, rtl bug
   - Missing evidence: <trace, vacuity report, cover status>

3. Proposed action
   - Smallest reversible change: <assumption/property/rtl>
   - Expected movement: <closure quality, runtime, bug isolation>
   - Regression risk: hidden legal behavior, false pass, schedule churn

4. Signoff
   - Required artifact: closure packet for Safety vs Liveness, Strong vs Weak: assumptions audit, proof status matrix, and replay-ready divergence trace
   - Required owners: formal verification owner, rtl owner, SystemVerilog Assertions (SVA) owner
   - Final decision: close, bounded closure, rollback, or escalate

Formal deep dive

SVA scales when temporal intent, clock sampling, and reset gating are precise enough to be replayed and reviewed.

Concept diagram

SVA INTENT CHAIN

timing contract -> sequence composition -> property implication -> sampled failure trace

Metric graph

ASSERTION QUALITY SIGNALS

non-vacuous hit rate    ████████
clock/reset mismatches  ████
false-positive churn    ███

Metrics and artifacts to collect

• assertion trigger hit-rate

• implication timing mismatch bucket

• reset-window noise ratio

• assertion decomposition quality score

Mini case study

A protocol failure vanished after correcting `|->` vs `|=>` semantics and reset masking boundaries.

Debug branches

• Confirm antecedent trigger at sampled clock edges.

• Verify implication operator matches protocol timing contract.

• Split monolithic properties into stage-local checks.

Senior review question

Ask: which requirement intent is proven, under which assumptions, and what residual risk remains?

Key takeaways

• Tie each proof claim to assumption boundaries and reachability evidence.

• Prefer minimal reversible fixes and preserve legal behavior visibility.

Common pitfalls

• Treating runtime reduction as proof-quality improvement without audits.

• Declaring closure while critical covers remain unreachable.

• Using broad waivers instead of first-divergence root-cause ownership.

Debug ladder

Sequence: reproduce -> classify -> isolate first divergence -> patch -> revalidate sibling properties.

Avoid mixing assumption and RTL fixes in the same experiment.