Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 2. BACKGROUND AND RELATED WORK 24
2.4.3 Comparison with Model Checking
Although theorem proving tends to require much more human intervention than model check-
ing, it has distinct advantages. Firstly, it does not suffer from the state-space explosion that
afflicts model checking as circuits grow in size. Secondly, it is often easy to prove theorems
for entire classes of circuits while model checking tends to be restricted to specific instances
of circuits, for example, the Quartz retiming law proved earlier as Theorem 1 can be applied
to any circuit described using repeated composition and similar laws have been proved for
common circuit structures such as rows, columns etc.
When there is a high degree of proof re-use possible theorem proving may have an advantage
since key lemmas can be proved once and used in other proofs many times. Also, when model
checking is used to completely verify an implementation against a specification it is often
necessary to expend considerable effort on simplifying the implementation model to reduce
the state space of the problem to something tractable. Recent work [5] has demonstrated that
theorem proving can produce better/stronger results in a similar amount of time to model
checking for the verification of a security architecture, although a greater level of proof expert
involvement was required.
2.4.4 Logic and Proof
The essential step in all theorem proving is to formulate the problem in some kind of logic and
the choice of logic to be used is an issue of some debate. Problems can be formulated either
in “raw logic” or can be embedded in an application-specific notation however the power of
the underlying logic is key. Simple logics support more automation and computer-assisted
proof search procedures are more likely to be effective however powerful logics support better
specification and embedding.
Set theory and first order logic is a standard logical foundation for many theorem proving
applications. Higher-order logics, which allow more flexibility in the scope of quantifiers and
the use of higher-order arguments to functions/predicates, are more expressive than first
order logic however they are less “well behaved” and this makes automation more difficult.
In general, it is easier for tool users to switch between different logics, which all share common