Tracking Design Changes with Formal Verification

Designs are often modiied for use in new circumstances. If formal proof is to be an acceptable veriication methodology for industry , it must be capable of tracking design changes quickly. We describe our experiences formally verifying an implementation of an ATM network component, and on our subsequent veriication of modiied designs. Three of the designs veriied are in use in a working network. They were designed and implemented with no consideration for formal methods. This case study gives an indication of the diiculties in formally verifying a real design and of subsequently tracking design changes.