(authors listed in alphabetical order) Abstract. Higher order logic (HOL) is a modelling language suitable for specifying behaviour at many levels of abstraction. We describe a compiler from a ‘synthesisable subset ’ of HOL function definitions to correctby-construction clocked synchronous hardware. The compiler works by theorem proving in the HOL4 system and goes through several phases, each deductively refining the specification to a more concrete form, until a representation that corresponds to hardware is deduced. It also produces a proof that the generated hardware implements the HOL functions constituting the specification. Synthesised designs can be translated to Verilog HDL, simulated and then input to standard design automation tools. Users can modify the theorem proving scripts that perform compilation. A simple example is adding rewrites for peephole optimisation, but all the theorem-proving infrastructure in HOL4 is available for tuning the compilation. Users can also extend the synthesisable subset. For example, the core system can only compile tail-recursions, but a ‘third-party ’ tool linRec is being developed to automatically generate tail recursive definitions to implement linear recursions, thereby extending the synthesisable subset of HOL to include linear recursion. 1

Proof producing synthesis compiles a source specification (see 2) to an implementation and generates a theorem certifying that the implementation is correct. The specification is expressed in higher order logic. 2 What is the synthesisable subset of HOL? The compiler automatically translates functions f: σ1 × · · ·×σm → τ1 × · · ·×τn, where the argument (σi) and result (τj) types are words. It can translate any tail recursive definition of such a function as long as the sub-functions used in the definition are in the library of primitive or previously defined functions. Formal refinement into this subset is