Abstract. Understanding the roles that rigour and formality can have in the design of critical systems is critical to anyone wishing to contribute to their development. Whereas knowledge of these issues is good in software development, in the use of hardware – specifically programmable logic devices (PLDs) and the combination of PLDs and software – the issues are less well known. Indeed, even in industry there are many differences between current and recommended practice and engineering opinion differs on how to apply existing standards. This situation has led to gaps in the formal and rigorous treatment of PLDs in critical systems. In this paper we examine the range of and potential for formal specification and analysis techniques that address the requirements for verifiable PLD programs. We identify existing formalisms that may be used, and lay out the areas of contributions that academia and industry in collaboration can make that would allow high-integrity PLD programming to be as practicable as high-integrity software development. This paper also touches briefly on some important practical, technical, organisational, social, and psychological aspects of the introduction of formal methods into industrial practice for hardware and system design. It also provides an update and summary of the recent UK Defence Standard 00-56, as it relates to hardware.

Abstract. Programmable logic devices (PLDs) are now common components of safety-critical systems, and are increasingly used for safetyrelated or safety-critical functionality. Recent safety standards demand similar rigour in PLD specification, design and verification to that in critical software design. Existing PLD development tools and techniques are inadequate for the higher integrity levels. In this paper we examine the use of Ada as a design language for PLDs. We analyse earlier work on Ada-to-HDL compilation and identify where it could be improved. We show how program fragments written in the SPARK Ada subset can be efficiently and rigorously translated into PLD programs, and how a SPARK Ada program can be effectively interfaced to a PLD program. The techniques discussed are then applied to a substantial case study and some preliminary conclusions are drawn from the results. 1