The process of verifying a new microprocessor is a major problem for the computer industry. Currently, architects design processors to be fast, power-efficient, and reliable. However, architects do not quantify the impact of these design decisions on the effort required to verify them, potentially increasing the time to market. We propose designing processors with formal verifiability as a first-class design constraint. Using Cadence SMV, a composite formal verification tool that combines model checking and theorem proving, we explore several aspects of processor design, including caches, TLBs, pipeline depth, ALUs, and bypass logic. We show that subtle differences in design decisions can lead to large differences in required verification effort.