A manager asks the verification lead: "Is the block verified?" The lead can answer "yes", which nobody can actually know, or "no", which is never true either, since a lot of verification has been done. The honest answer is neither. It is a statement of evidence: what was checked, how thoroughly, what was not, and how much risk that leaves.
If verification cannot prove a design correct, what does it produce, and how do you know it is enough?
The obvious answer is a binary: verified or not verified, usually decided by a number such as "100% coverage" or "zero failing tests". Each such number measures one kind of evidence and is silent about the rest. Coverage says situations were exercised, not that results were checked; zero failures says the checks passed, not that the checks were right. Treating any single number as "verified" turns a judgement about risk into a false certainty.
Evidence | What it shows | What it does not show |
|---|---|---|
Tests pass | The checks found no mismatch in what was run | That the checks were right, or that enough was run |
Coverage reached | The planned situations were exercised | That results were checked in them, or that the plan was complete |
Formal proof | A property holds for every allowed input sequence | That the property and assumptions say what was meant |
Bug trend flattening | Current methods are finding fewer bugs | That few bugs remain (lesson 12.6) |
Reviews | Knowledgeable people found no gaps | Anything systematic they share as a blind spot |
Independence | Checks and design were written separately | That both readings were right |
Each kind covers a weakness of another. Coverage without checks is a false pass; checks without coverage leave untested regions; proofs without review can prove the wrong thing. Confidence comes from several kinds agreeing, not from any one being high.
Residual risk is what remains after all the evidence: the parts not verified, the assumptions not checked, the bugs likely still present.
Sign-off is a decision to accept it, made by people who understand it, not a certificate that it is zero (Part 14).
Stating it explicitly lets the business decide: ship, add a workaround path, or spend more verification on the riskiest part.
Practice | What it adds |
|---|---|
Sign-off criteria across several kinds of evidence | No single number can declare completion |
Waivers recorded with reasons and owners | Known gaps are visible instead of hidden |
Residual-risk statements at tape-out | The decision-makers know what they are accepting |
A block (illustrative) was declared verified at 100% functional coverage. A later review found that a third of its scoreboard checks were disabled by a configuration flag set during bring-up and never cleared. The coverage was genuine; the checking was not. Combining coverage with checks on whether each checker actually fired would have exposed it the day the flag was set.
The checks might not check what matters (or not run at all), and the coverage plan might be missing important situations; also the specification itself might be wrong.
Each kind has blind spots that another covers; agreement across kinds is what makes confidence justified.
Verification produces evidence and confidence, not proof.
Each kind of evidence has blind spots; confidence comes from several kinds agreeing.
The honest goal is a stated, accepted residual risk.