8 Conclusions and Future Work

[5] M. Mutz. Using the HOL theorem proving environment for proving the correctness of term rewriting rules reducing terms of sequential behavior. and automating hardware proofs in a higher-order theorem-proving environment. In this paper, an approach to the formal synthesis of verification-friendly hardware structures has been presented. Having applied standard scheduling and allocation algorithms , known from high-level synthesis, an implementation description in a HDL-like language results. Its semantics is given directly as a compsition of handshake circuits-based on a synchronous handshake protocol. During the composition of these handshake circuits, a set of correctness theorems is derived which justifies the correctness of the specified circuit. Hence the correctness of scheduling and allocation, performed outside the formal framework, is checked. If during the specification phase, the designer's key ideas are provided via loop invariants, then all correctness proofs are done automatically, provided that decidable domain like bitvectors have been used. In case of more complex data types, proof obligations on the data domain are derived automatically, which have then to be justified otherwise, e.g. by manual proofs. The approach is well suited for data driven applications, which are used in safety critical environments. For pure controller circuits, other approaches are better suited, e.g. by performing a post-verification based on model checking. Using our approach, no time consuming post verification step is necessary to achieve correctness statements on the resulting circuits. Obviously, the handshake module paradigm leads in some cases to suboptimal hardware solutions. We are currently investigating optimization strategies at higher abstraction levels like operator folding and low level techniques like multilevel logic minimization, FSM minimization and retiming to reduce hardware costs. Circuit Name Time in seconds Table 7-1: Runtimes of different benchmark circuits overall behavior is not changed if the intermediate storage of the combinational results of Add is missing.