Feature sizes in VLSI circuits are steadily shrinking. This results in increasing susceptibility to soft errors, e.g. due to environmental radiation. Precautions against soft errors can be taken on all design stages, e.g. the architectural level, algorithmic level, or on the layout level. Whether the final implementation contains flaws or really provides robustness to soft errors remains to be checked.Here, we propose an approach to formally verify the robustness of a circuit with respect to multiple soft errors. We propose a fault model that prunes the exponentially sized space of multiple soft errors and an algorithm that automatically analyzes a given circuit.