HDL-Based Integration of Formal Methods and CAD Tools in the PREVAIL Environment

17 to their colleagues of CHARME for many helpful discussions and friendly cooperation over many years. 16 Many research groups have proposed formal semantics for VHDL, to apply formal verification techniques on designs described in that language. The FSM model for clock synchronized circuits closest to ours is Bull's [15], but currently only machines with identical state encodings can be compared in the commercial verifier VFORMAL [27]. More recently, another approach close to ours for synchronous circuits has been published [28]. Cycle-level synchronization semantics of VHDL [16, 40] serve as a basis for Siemens' verification environment CVE [41] and a model checking system under development at Carnegie-Mellon University [29]. Models based on Petri Nets [30,31] tend to create an excessively large number of states, and a phase of state space reduction is required before model checking tools are applied. The semantic definition of a VHDL subset in SIGNAL and the construction of an interface between SIGNAL and VHDL is the basis for a research on high level synthesis and verification of hybrid systems [32]. The use of theorem provers has also been explored. A model of a small subset of VHDL was made in HOL [33], and a larger subset in ML for linking to Lambda [34], both describing " delta cycle " state changes. The NQTHM definition of [35] is very different from ours: it defines a symbolic simulator for structural timed models, on which properties can be proven; to our knowledge, no automatic translator from VHDL source has been implemented. Seen from the viewpoint of tool integration, the definition of an intermediate format common to independently designed tools is crucial. The " Synchrone " working group in France has defined a common format to integrate the " reactive synchronous " languages Lustre, Esterel and Signal. The VIS system translates Verilog descriptions into the Blif-MV format, to allow the cooperation of synthesis and model checking on non-deterministic FSM's [36,37]. Translating from PIF to Blif-MV would give a VHDL input to VIS, and make it possible to model check non deterministic VHDL models (e.g. through the use of shared variables), currently rejected in Prevail. A more elaborate common format is currently under study for the specification of refinements and proof obligations in design verification, to be used as input to cycle simulation, model checking and theorem proving [38]. The concept of verification environment for VHDL has also been implemented in …