A Functional Approach for Formalizing Regular. Universitat Karlsruhe, Institut fur Rechnerentwurf und Fehlertoleranz,

Transcription

1 A Functional Appoach fo Fomalizing Regula Hadwae Stuctues? Dik Eisenbiegle 1, Klaus Schneide 1 and Ramayya Kuma 2 1 Univesitat Kalsuhe, Institut fu Rechneentwuf und Fehletoleanz, (Pof. D. Schmid), P.O. Box 6980, Kalsuhe, Gemany, e{mail:schneide@ia.uka.de 2 Foschungszentum Infomatik, Haid{und{Neustae 10{14, Kalsuhe, Gemany, e{mail:kuma@fzi.de Abstact. An appoach fo fomalizing hadwae behaviou is pesented which is based on a small functional pogamming language called pimitive ML (PML). Since the basic constucts of PML ae simply typed {tems, PML lends itself both to simulation and veication. The semantics of PML is fomally embedded in highe{ode logic. The fomalization scheme is based on PML{functions that allow hadwae desciptions fom the logical level up to the algoithmic level. Besides desciptions of eal cicuits, abstact foms of hadwae desciptions can also be dealt with in PML. The main emphasis is theeby put on egula hadwae stuctues which ae descibed by means of pimitive ecusion. PML{ desciptions can easily be conveted to syntactic stuctues, called hadwae fomulae, which can then be veied by the MEPHISTO system. 1 Intoduction Embedding hadwae desciption languages (HDLs) in a logic o some calculi is essential fo veication. The semantics of such embedded HDLs, which coespond to cetain fomulae in the undelying fomal famewok, can then be used to { veify cetain popeties of an implementation, { pove equivalences of two o moe implementations and { pefom coect HDL{to{HDL tanslations. Existing HDLs such as VHDL and ELLA ae vey poweful and complex. The expessive powe is an advantage fo cicuit design, but thei semantics ae not fomally dened due to thei complexity. Fomalizing the semantics of a HDL means bidging the gap between a high level design language and the simple elements of the logic o a paticula calculus. Functional HDLs such as ELLA ae athe close to logic. Those elements which consist exclusively of {tems can be conveted to highe{ode logic almost unchanged. In contast to functional languages, pocedual languages ae moe dicult to be fomalized due to thei opeational semantics. Fo evey basic instuction, it? This wok has been patly nanced by a geman national gant, poject Automated System Design, SFB No.358.

2 must be descibed, how the execution of the instuction changes the global state. The eect of compound instuctions must be deived fom the eect of the basic instuctions and the contol stuctues. Thee ae seveal eseach pojects about fomalizing existing HDLs in highe{ ode logic [BGGH92, BGHT91, CaGM86] o othe calculi [Hunt86, BoPS92]. In contast to these pojects, the stating{point of the appoach pesented in this pape is not a given HDL. Instead, a simple functional language called pimitive ML (PML) is built on top of the logic such that its semantics is given ight away. PML will be the basis fo hadwae desciptions. It can be egaded as a common sublanguage of HOL and ML (gue 1) its syntax is simila to ML and evey constuct has a HOL Fig. 1. Relation between HOL, ML and PML. PML coesponding epesentation in HOL. The embedding of PML has been done in a shallow manne [BGGH92]. Howeve, both PML{tems and the coesponding HOL{ tems ae simply typed {tems and thee ae only vey small syntactical dieences which could simply be ovecome by petty{pinting. Relational desciptions ae fequently used fo fomalizing cicuits, i.e. input and output signals need not be distinguished and signals can aect each othe in an abitay manne. Howeve, elational cicuit desciptions can be ambiguous o even contadictoy. In contast, cicuits ae descibed in PML in a functional manne, i.e. cicuits ae epesented by functions mapping input signals onto output signals. PML cannot be viewed as a hadwae desciption language such as VHDL, but as a geneal pupose pogamming language we use fo descibing hadwae. In contast to VHDL, PML has no hadwae specic syntactic elements such as signals, intefaces and timing declaations. PML pogammes can meely descibe pimitive ecusive and {ecusive functions and these functions can be egaded as a epesentation of the coesponding hadwae. In ou hadwae fomalization scheme, we will descibe two kinds of PML{functions: ones that epesent single eal cicuits and othes that descibe sets of eal cicuits. Functions epesenting exactly one eal cicuit ae called concete cicuits and functions descibing a set of eal cicuits ae called abstact cicuits. Abstact cicuits do not epesent eal cicuits, but coespond to a scheme fo descibing egula hadwae stuctues. Concete cicuits can be deived fom abstact cicuits by type instantiation and vaiable substitution. In this pape, only the fomalization of cicuits is descibed. PML can be viewed as a moe abstact laye fo MEPHISTO [KuSK93, ScKK93c]. The veication of desciptions using PML is achieved by conveting them into fomulae which can be handled by MEPHISTO. Afte having given a desciption of PML in section 2, concete and abstact cicuits ae fomalized in section 3 and 4, espectively. Finally, we biey discuss the use of PML in simulation and veication in section 5. ML

3 2 Syntax and Semantics of PML PML is a sublanguage of ML (gue 1). The syntax is simila, but thee ae less syntactical constucts fo example thee ae no exceptions and no side eects. Futhemoe, data types in PML coespond to HOL{style data types and theefoe they ae weake than ML data types [Gunt92]. Although PML has only a small numbe of basic elements, abitay {ecusive functions can be expessed by PML functions, i.e. PML is Tuing{complete. 2.1 Data Types and Pimitive Recusion In PML only HOL{style data types ae allowed. Fo a detailed explanation of data types in HOL and the mechanism fo dening them see [Melh88]. The syntax of a PML data type declaation is as follows: pimitive_datatype sting ; The paamete sting denes the data type by giving the name of the type, the names of the constuctos and the types of thei aguments. The syntax is the same as in the HOL function dene type, e.g. pimitive_datatype " bool = T F " ; pimitive_datatype " num = Zeo Suc of num " ; The semantics of HOL{style data types is descibed by a theoem which states that the pimitive ecusion ove this type is unambiguous. In HOL, this theoem is deived wheneve a new data type is intoduced by dene type. A data type declaation in PML also intoduces a basic function named PRIMREC type, which is geneated automatically. PRIMREC type is deived fom the semantics of the data type and it can be used fo expessing pimitive ecusion ove that data type. Fo example, the data types num and bool lead to the functions PRIMREC bool and PRIMREC num, espectively. They have the following semantics: PRIMREC bool T a b = a PRIMREC bool F a b = b PRIMREC num Zeo a f = a PRIMREC num (Suc n) a f = f n (PRIMREC num n a f) Abitay pimitive ecusive functions can be expessed by constant denitions based on PRIMREC{functions. 2.2 Deived Functions As in ML, functions and constants can be added by the language constucts fun and val, espectively. Howeve, function and constant denitions in PML both coespond to constant denitions in HOL. Theefoe, function and constant denitions of PML ae less poweful than those in ML. The estictions ae: { Thee must be only one equation within a fun o val denition, e.g. fun is zeo 0 = T j is zeo(suc n) = F; is not a valid PML denition.

4 { The paametes on the left hand side of the equation may only be vaiables and paied vaiables, e.g. val (Suc n) = y; is not allowed. { The expessions on the ight hand side ae built up by function applications (f a) and {abstactions (fn x => a). The only basic functions ae PRIMREC{ functions and WHILE (WHILE will be intoduced late in section 2.5). { The function being dened must not appea on the ight hand side of the equation, e.g. fun odd n = PRIMREC num n F (fn a => fn b => not(odd a)); is not a valid PML denition. Recusion can always be expessed by equivalent denitions which use PRIMREC{functions and WHILE. { Thee is no exception handling. { (case : : : of : : :) has not yet been implemented. 2.3 Pedened Data Types Some data types ae aleady dened in ode to suppot petty{pinting fo them. Fo example, it is possible to wite 2 instead of Suc(Suc Zeo). Howeve, thee is no petty{pinting fo use dened types. The pedened data types ae: 3 pimitive_datatype " bool = T F " ; pimitive_datatype " pod = Comma of 'a # 'b " ; pimitive_datatype " list = Nil Cons of 'a # list " ; pimitive_datatype " num = Zeo Suc of num " ; The following syntactic suga efes to the pedened types. They can all be put down to expessions based on data type constuctos and PRIMREC{functions. { (a; b) may be used instead of (Comma a b) { (fn (x; y) => p[x; y]) may be used instead of (fn z => PRIMREC pod z (fn x => fn y => p[x; y])) { (let val x = p in q[x] end) may be used instead of ((fn x => q[x]) p). { numeals 0, 1, 2,: : : may be used instead of Zeo; (Suc Zeo); (Suc(Suc Zeo)); : : : { [ ], [a], [a; b],: : : may be used instead of Nil, (Cons a Nil), (Cons a (Cons b Nil)),: : : 2.4 Example We illustate the use of the language constucts by a tac light contolle. Fist, a new data type named state is dened, which epesents the states of the tac light. pimitive_datatype " state = Geen Yellow Red " ; This type declaation automatically intoduces the function PRIMREC state with the following semantics: PRIMREC state Geen a b c = a PRIMREC state Yellow a b c = b PRIMREC state Red a b c = c 3 In PML, type vaiables ae expessed by 'a, 'b, 'c, etc. wheeas the coesponding type vaiables in HOL ae expessed by,,, etc. It should be noted that the polymophism in PML coesponds to that of HOL only.

5 A constant named init containing the initial state Red can be dened as: val init = Red; The function next takes a state as paamete and calculates the successo state. In this simple tac light contolle, the state changes fom ed diectly to geen, but changes fom geen to ed via yellow. fun next x = PRIMREC_state x Yellow Red Geen; Figue 2 shows the entie pogamme and the coesponding HOL{fomula descibing its semantics. PML{Pogam Semantics pimitive datatype "state = Geen Yellow Red"; val init = Red; fun next x = PRIMREC state x Yellow Red Geen; (8a b c: 9 1g: (g Geen = a) ^ (g Yellow = b) ^ (g Red = c) ) ^ (8a b c: (PRIMREC state Geen a b c = a) ^ (PRIMREC state Yellow a b c = b) ^ (PRIMREC state Red a b c = c) ) ^ (init = Red) ^ (8x: next x = PRIMREC state x Yellow Red Geen ) Fig. 2. Tac light pogamme. 2.5 {Recusion Accoding to Chuch's Thesis, thee ae seveal equivalent schemes fo descibing computable functions. {ecusive functions ae one means fo descibing computable functions. With the elements descibed until now, only pimitive ecusive functions can be descibed, while {ecusive functions cannot. Pimitive ecusive functions ae sucient fo descibing hadwae implementations, but they ae too weak fo fomalizing algoithmic specications. Pevious wok such as the appoaches followed by the Boye{Mooe community, ae limited to pimitive ecusive specications that cannot expess all kinds of algoithms. Unlike pimitive ecusive functions, {ecusive functions need not be total. In ML it is possible that the evaluation of a function application does not teminate. The equations of an ML function denition can be consideed as a constant specication in HOL whee the specied function need not be descibed unambiguously, i.e. nothing can be said about the value of a function application whee the evaluation does not teminate. In contast to ML, the esult of a PML function always has an explicitly dened value, even if the function application does not teminate. In this case, the value of the function is explicitly dened to be the constant Undened, othewise the esult is (Dened y) fo a cetain y. The data type patial is used fo descibing values of {ecusive functions:

6 pimitive_datatype " patial = Defined of 'a Undefined " ; The coesponding function PRIMREC patial has the following semantics: PRIMREC patial (Dened x) f a = f x PRIMREC patial Undened f a = a The function WHILE is the basis fo {ecusion in PML and can be used to ceate loops. Given functions f and g and a paamete x, it iteates f until a value x is eached with g x = F. ` iota f = PRIMREC bool (9 1 f) (Dened(" f)) Undened ` teminates(f; n) = (f n) ^ (8m: m < n ) :(f m)) ` mu f = iota(m: teminates(f; m)) ` powe f n x = PRIMREC num n (Dened x) (a b: PRIMREC patial b f Undened) ` WHILE g f x = PRIMREC patial (mu(n: PRIMREC patial (powe f n x) (y: PRIMREC bool (g y) F T) F)) (n: powe f n x) Undened The semantics of WHILE is descibed using fou auxiliay constants: iota, teminates, mu and powe. The function iota esembles the Hilbet opeato. But in contast to the Hilbet opeato its value is (Dened y) in case the pedicate species a unique value and Undened if it does not. The pedicate teminates(f; n) states that n is the smallest numbe such that (f n) becomes tue. mu is a fomalization of the {opeato whee mu f = Undened coesponds to (f)" 4 and mu f = Dened k coesponds to (f) = k. The function powe computes the multiple application of a function, i.e. (powe f n x) computes f n (x). The expession (WHILE g f x) calculates f (n:g(fn (x))=f) (x) Example The tac light example of section 2.4 is extended by a {ecusive function ed time. ed time is calculating the next time when the tac light becomes ed. The tac light is descibed by a function f num!state, that is assigning a state to evey time. Fo a given function f num!state and a time t num, the function ed time calculates the smallest n t with f n = Red. Figue 3 shows an implementation in PML in compaison with an implementation in ML. The implementations in PML and ML ae not eally equivalent, since thei types die. In PML the esult of ed time has the type (num patial) wheeas in ML it is num. 4 (f) is the smallest element of ff(x) = Tjx2Ng and (f)" denotes that ff(x) = Tjx2Ng is empty. 5 Extending pimitive ecusive functions by WHILE is equivalent to the extension by the {opeato, i.e. both extensions lead to computable functions. Howeve, WHILE{ expessions can be evaluated moe eciently by an intepete than expessions using the {opeato.

7 PML{Implementation fun is not ed x = PRIMREC state x T T F; fun ed time f t = WHILE (fn n => is not ed(f n)) (fn n => Defined(Suc n)) t; ML{Implementation fun ed time f t = if ((f t) = Red) then t else (ed time f (Suc t)); Fig. 3. Implementations of ed time. 3 Concete Cicuits The functions descibed in this section ae called concete cicuits since each of them coesponds to exactly one eal cicuit. A concete cicuit is epesented by a function that assigns an input signal onto an output signal. Hadwae stuctues ae build up by function denitions. Expessing a stuctue by a function denition is possible, if and only if the stuctue does not have cycles. Since stuctues of sequential cicuits essentially have cycles, sequential cicuits ae epesented by a tiple consisting of a combinational tansient cicuit, a combinational output cicuit and an initial state. Instead of combining sequential cicuits diectly, thei tansient cicuits, output cicuits and initial states ae combined. 3.1 Combinational Cicuits Individual signals of combinational cicuits have type bool. Othe than individual signals can be obtained by paiing individual signals. Combinational cicuits ae epesented by functions assigning an input signal to an output signal. Figue 4 shows a 1{bit fulladde implemented by the cicuits and, o and xo. cin a b xo and w1 w2 xo and w3 o sum cout Fig. 4. Stuctue of a 1{bit fulladde and the PML epesentation. fun fulladde (cin,(a,b)) = let val w1 = xo(a,b) in let val w2 = and(b,a) in let val sum = xo(cin,w1) in let val w3 = and(cin,w1) in let val cout = o(w3,w2) in (sum,cout) end end end end end; 3.2 Sequential Cicuits The signals of sequential cicuits ae time dependent. Thei type is num! whee the type num epesents the discete time and is the type of a time independent

8 signal. Sequential cicuits map time dependent input signals onto time dependent output signals, thus they have the following type: (num! )! (num! ). The desciption style used fo combinational cicuits does not allow cycles which ae necessay fo sequential cicuits. In ode to use this scheme also fo sequential cicuits, we dene a sequential cicuit by a tiple (f; g; q) consisting of a combinational tansient cicuit f, a combinational output cicuit g and an initial state q. Thus, sequential stuctues can be expessed by inteconnecting combinational cicuits. Since stuctues of Mealy machines might lead to zeo{delay{cycles, in this pape only Mooe cicuits will be consideed (see gue 5). f memoy g Fig. 5. Scheme of a Mooe cicuit. A function named makeseq is intoduced, which computes a sequential cicuit fo a given tiple (f; g; q). makeseq can be dened by the equations below. The function denition given by these equations does not have the fom of a PML function denition. It can athe be egaded as a ML{style function denition o a constant specication in HOL. These equations descibe the desied popeties of the intended PML function in a cleae manne. makeseq (f; g; q) a 0 = f q makeseq (f; g; q) a (Suc t) = makeseq (f; g; g(a t; q)) (t: a(suc t)) t The coesponding implementation in PML: fun makeseq (f,g,q) a t = f (PRIMREC_num t q (fn n => fn => g(a n,))); It shall be demonstated, how stuctues of sequential cicuits can be descibed in PML by function denitions. Figue 6 shows an example fo a stuctue consisting x y A C w1 B w3 w4 w2 z fun fd (qa,qb,qc) = let val (z,w2) = (fb qb) in z end; fun gd ((x,y),(qa,qb,qc)) = let val (w1,(z,w2),(w3,w4)) = (fa qa,fb qb,fc qc) in (ga(x,w4),gb(w1,w3),gc(w2,y)) end; val qd = (qa,qb,qc); Fig. 6. Stuctue of a sequential cicuit and the PML epesentation. of thee sequential cicuits A, B and C. The cicuits A, B and C ae epesented by (fa; ga; qa), (fb; gb; qb) and (fc; gc; qc). The entie cicuit is called D and its tiple (fd; gd; qd) can diectly be extacted fom the stuctue.

9 4 Abstact Cicuits In the pevious section, functions wee used fo descibing single eal cicuits. In contast to concete cicuits, abstact cicuits epesent sets of (concete) cicuits and ae theefoe moe poweful than concete cicuits. Simila to concete cicuits, abstact cicuits can also be epesented by PML{functions. Abstact cicuits can be polymophic and allow paametes which have types that ae not esticted to pais (e.g. lists and tees may be used fo instance). Concete cicuits can be obtained fom abstact cicuits by type instantiation and vaiable substitution. The function is an example fo an abstact cicuit: fun ((s:bool),(a:'a),(b:'a)) = PRIMREC_bool s b a; Concete cicuits can be deived fom by instantiating the type vaiable ( is expessed by 'a within the PML syntax). Figue 7 shows two instances of. bool = bool 1 P PPPq = bool*bool bool bool bool bool*bool bool*bool bool bool*bool Fig. 7. Instances of a polymophic 2:1{multiplexe. Abstact cicuits ae used fo fomalizing egula hadwae stuctues which can be expessed by means of pimitive ecusion. In geneal, f egula cicuit stuctues lead to egula signal stuctues. If fo example, a stuctue is descibed, that consists of n combinational cicuits connected in paallel, f then it would be appopiate to use the type list fo. gouping togethe the input and the output signals. The stuctue of the input signal detemines the stuctue of the cicuit and the stuctue of the output signal. f Gouping signals togethe by ecusive types such as list Fig. 8.: Regula cicuit. is exible, since the stuctue of the signals and especially the numbe of the individual signals depends on the value. Othe types than list can be used fo gouping signals. In the next example, signals ae gouped togethe by a list and a binay tee. pimitive_datatype "list = Nil Cons of 'a # list"; pimitive_datatype "btee = Bleaf of 'a Bnode of btee # btee"; The semantics of the coesponding PRIMREC{functions is: PRIMREC list Nil a f = a PRIMREC list (Cons x y) a f = f x y (PRIMREC list y a f) PRIMREC btee (Bleaf x) f g = f x PRIMREC btee (Bnode x y) f g = g x y (PRIMREC btee x f g) (PRIMREC btee y f g)

10 The input of the 2 n :1{multiplexe consists of a goup of data inputs and an addess signal fo selecting one of the data inputs. The data input signals have an abitay type and they ae gouped togethe as ( btee). The addess signals ae epesented by a list of booleans (see gue 8). 8 >< btee >: bool list z } {.... Fig n :1{multiplexe. The stuctue of the 2 n :1{multiplexe depends on the stuctue of the input signals (i.e. it depends on the length of the boolean list) and it also depends on the shape of the binay tee. The PML function epesenting the 2 n :1{multiplexe function is total and so the 2 n :1{multiplexe has to be designed fo abitay lists and abitay binay tees, even though afte instantiation the binay tee has a constant depth which is equal to the length of the list. Figue 10 illustates, how the the stuctue of the 2 n :1{multiplexe b is de- ned. Fo a given stuctue of the input signals, a cicuit stuctue descibes how the 2 n :1{multiplexe can ecusively be put down to othe 2 n :1{multiplexes having `smalle' input stuctues in the sense of a canonical tem{odeing. The following equations give a fomal denition of the desciption in gue 10. The equations coespond to the cicuit stuctues of the gue in a one{to{one manne. b(x; Bleaf a) = a b(nil; Bnode b c) = b(nil; b) b(cons h t; Bnode b c) = (h; b(t; b); b(t; c)) Obviously b is a pimitive ecusive function, but these equations cannot diectly be used fo the PML implementation. To implement b in PML, the denition has to be tansfomed: the intelocking pimitive ecusions ove list and btee have to be boken up: b(x; Bleaf a) = a b(nil; Bnode b c) = b(nil; b) b(cons h t; Bnode b c) = (h; b(t; b); b(t; c)) +

11 x y b z x a Q y = Bleaf QQ a y = Bnode b c Q QQs + z Q x = Nil QQ x = Cons h t Q + Qs Nil h t b c b z b c b b z Fig. 10. Recusive desciption of the stuctue of the 2 n :1{multiplexe. b(nil; Bleaf a) = a b(nil; Bnode b c) = b(nil; b) b(cons h t; Bleaf a) = a b(cons h t; Bnode b c) = (h; b(t; b); b(t; c)) + b(nil; y) = PRIMREC btee y ( a: a) ( a b v w: v) b(cons h t; y) = PRIMREC btee y ( a: a) ( a b v w: (h; b(t; v); b(t; w)) + b(x; y) = PRIMREC list x ( s: PRIMREC btee s ( a: a) ( a b v w: v)) ( h t s: PRIMREC btee s ( a: a) ( b c v w: (h; b; c)) ) y The coesponding implementation in PML is: fun b (x,(y:'a btee)) = PRIMREC_list x (fn s => PRIMREC_btee s (fn a => a) (fn a => fn b => fn v => fn w => v) ) (fn h => fn t => fn => fn s => PRIMREC_btee s (fn a => a)

12 y; (fn b => fn c => fn v => fn w => (h, b, c)) ) Up to now, meely egula stuctues of combinational cicuits wee consideed. Regula stuctues of sequential cicuits can also be descibed since sequential cicuits can be put down to combinational cicuits. Figue 11 shows a egula stuctue Fig. 11. A seies of Mooe cicuits. A A A {z } n+1 based on a Mooe cicuit called A. The function seies has been implemented in PML. It takes A and n as paametes and calculates the entie cicuit as shown in gue 11. Both the paamete A and the esult of the function application ae Mooe cicuits that ae epesented by the tiple as descibed in the pevious section. 5 Simulation and Veication 5.1 An Intepete fo PML PML pogammes can simply be executed by a ML intepete, howeve, the ML envionment has to be extended by some functions and data types. The type declaation constuct pimitive datatype has to be implemented as a ML{function, the pedened data types of PML have to be declaed and the function WHILE has to be implemented. As all PML pogammes ae also ML pogammes and the extended ML intepete still accepts ML pogammes, it is not tested whethe the input is a PML pogamme o moe geneal, a ML pogamme. 5.2 Simulation Tools Some geneal tools fo simulating cicuits have been implemented in the extended ML intepete. These tools ae not PML functions, but they take PML functions which descibe cicuits as aguments. Moeove, they display values of output signals duing the simulation of combinational and sequential cicuits. Fo this eason, output functions called type to sting have been implemented fo all pedened data types. These output functions convet a value of a cetain PML type to a sting. When a new data type is added, a coesponding output function should also be implemented. Output functions ae used as paametes of the following simulation tools. A function called function table has been implemented fo combinational cicuits fo pefoming the simulation and displaying the esults as a table. Sequential cicuits that ae epesented by tiples (f; g; q) could be simulated using the function makeseq. Howeve, if the output is consideed ove a peiod, the use of make seq would be vey inecient because fo evey single output, the

13 calculation would stat fom the beginning. The simulation function fo sequential cicuits that has been implemented does not have this disadvantage. The cicuit is simulated only once until the last point of time of the consideed peiod is eached. The paametes fo a sequential simulation ae: the cicuit epesented by (f; g; q), a time dependent input signal, a condition fo teminating the simulation and an output function fo conveting the cicuits output to a sting. 5.3 Veication A function called extend theoy by pml is implemented fo conveting a PML pogamme to HOL. Some tools ae povided fo easoning about PML functions. They ae concened with: extending constant abbeviations, evaluation and induction. Fo concete cicuits and some classes of abstact cicuits, a moe diect appoach fo veication is used. The PML{tems can be conveted into cetain fomulae, called hadwae{fomulae [ScKK93c], which can be automatically veied within the MEPHISTO system [KuSK93] (see gue 12). Thus PML desciptions can also be used as a font{end specication language within this veication famewok. fun fulladde (cin,(a,b)) = let val w1 = xo(a,b) in let val w2 = and(b,a) in let val sum = xo(cin,w1) in let val w3 = and(cin,w1) in let val cout = o(w3,w2) in (sum,cout) end end end end end;! 8cin a b sum cout: fulladde(cin; a; b; sum; cout), 9w1 w2 w3: xo(a; b; w1) ^ and(b; a; w2) ^ xo(cin; w1; sum) ^ and(cin; w1; w3) ^ o(w3; w2; cout) Fig. 12. Conveting PML cicuit desciptions to hadwae{fomulae. 6 Conclusion and Futue Wok We have pesented a geneal pupose pogamming language that is fomally embedded in highe{ode logic and we have also demonstated, how this language can be used fo fomalizing both combinational and sequential cicuits. The main emphasis has been put on demonstating how egulaity can be expessed by means of pimitive ecusion. PML is a vey simple language and witing PML pogammes can be athe tough since all function denitions have to be boken up to the pimitive ecusion and {ecusion constucts. It is intended to impove the applicability of PML by adding a moe comfotable ML{style mechanism fo expessing ecusive functions. In futue eseach it shall be analyzed, how PML desciptions of cicuits can be used fo hadwae design. PML desciptions shall be used in seveal elds: veication, simulation, symbolic simulation, synthesis and optimization (HDL{to{HDL tansfomations).

14 Refeences [BGGH92] R. Boulton, A. Godon, M. Godon, J. Hebet, and J. van Tassel. Expeiences with Embedding hadwae desciption languages in HOL. In V. Stavidou, T.F. Melham, and R. Boute, editos, Confeence on Theoem Poves in Cicuit Design, IFIP Tansactions A-10, pages 129{156. Noth-Holland, [BGHT91] R. Boulton, M. Godon, J. Hebet, and J. van Tassel. The HOL veication of ELLA designs. In Intenational Wokshop on Fomal Methods in VLSI Design, Januay [BoPS92] D. Boione, L. Piee, and A. Salem. Fomal veication of VHDL desciptions in Boye-Mooe: Fist esults. In J. Memet, edito, VDHL fo Simulation, Synthesis and Fomal Poofs of Hadwae, pages 227{243. Kluwe Academic Pess, [CaGM86] A. Camillei, M.J.C. Godon, and Th. Melham. Hadwae veication using highe ode logic. In D. Boione, edito, Fom HDL Desciptions to Guaanteed Coect Cicuit Designs, pages 41{66. Noth-Holland, [Cami88] J. Camillei. Executing behavioual denitions in highe ode logic. Technical Repot 140, Univesity of Cambidge Compute Laboatoy, [Cami91] J. Camillei. Symbolic compilation and execution of pogams by poof: a case study in HOL. Technical Repot 240, Univesity of Cambidge Compute Laboatoy, [Gunt92] E. Gunte. Why we can't have SML-style datatype declaations in HOL. In L.J.M. Claesen and M.J.C. Godon, editos, Highe Ode Logic Theoem Poving and its Applications, volume A-20 of IFIP Tansactions, pages 561{568, Leuven, Belgium, Noth-Holland. [Hunt86] W.A. Hunt. The mechanical veication of a micopocesso design. In D. Boione, edito, Fom HDL Desciptions to Guaanteed Coect Cicuit Designs, pages 89{132. Noth-Holland, [Jone87] S.L.P. Jones. The Implementation of Functional Pogamming Languages. Pentice Hall, [KuSK93] R. Kuma, K. Schneide, and Th. Kopf. Stuctuing and automating hadwae poofs in a highe-ode theoem-poving envionment. Jounal of Fomal Methods in System Design, 2(2):165{223, [Melh88] T. F. Melham. Automating ecusive type denitions in highe ode logic. Technical Repot 146, Univesity of Cambidge Compute Laboatoy, Septembe [ScKK93c] K. Schneide, R. Kuma, and Th. Kopf. Eliminating highe-ode quanitifes to obtain decision pocedues fo hadwae veication. In Intenational Wokshop on Highe-Ode Logic Theoem Poving and its Applications, Vancouve, Canada, August [Shee88] M. Sheean. Retiming and slowdown in Ruby. In G.J. Milne, edito, The fusion of Hadwae Design and Veication, pages 289{308, Glasgow, Noth Holland. This aticle was pocessed using the LaT E X maco package with LLNCS style