A method for formally verifying the equivalence of an architecture description with an implementation description. The method comprises the steps of reading an implementation description, reading an architecture description, demonstrating that during execution of a same program with same initial values an architecture sequence of data transfers described by the architecture description is mappable to an implementation sequence of data transfers implemented by the implementation description, such that the mapping is bijective and ensures that the temporal order of the architecture sequence of data transfers corresponds to the temporal order of the implementation sequence of data transfers, and outputting a result of the verification of the equivalence of the architecture description with the implementation description.