INTRODUCTION

The VIPER microprocessor designed at the Royal Signals and Radar Estasblishment (RSRE) is probably the first commercially produced computer to have been developed using modern formal methods. Details of VIPER can be found in Cullyer [1985, 1986, 1987] and Pygott [1986]. The approach used by W. J. Cullyer and C. Pygott for its verification is explained in Cullyer & Pygott [1985], in which a simple counter is chosen to illustrate the verification techniques developed at RSRE. Using the same counter, we illustrate the approach to hardware verification developed at Cambridge, which formalizes Cullyer and Pygott's method. The approach is based on the HOL system, a version of LCF adapted to higher-order logic (Camilleri et al. [1987], Gordon [1983, 1985]). This research has formed the basis for the subsequent project to verify the whole of VIPER to register transfer level (Cohn [1987, 1989]).

In Cullyer and Pygott's paper, the implementation of the counter is specified at three levels of decreasing abstractness:

• As a state-transition system called the host machine;

• As an interconnection of functional blocks called the high level design;

• As an interconnection of gates and registers called the circuit.

Ultimately, it is the circuit that will be built and its correctness is the most important. However, the host machine and high level design represent successive stages in the development of the implementation and so one would like to know if they too are correct.