diglot — one IR, two readings

The Verilog you would synthesise and the SMT a solver would see are emitted from the same Design value. They are two denotations of one object, related by mechanised consistency theorems — not two independent translations that happen to agree. Everything below runs in your browser; nothing is sent anywhere.

loading…
source — .dg
netlist denotation → Verilog

    

    

      
transition-system denotation → SMT-LIB

      

    

  






  
simulation — the netlist denotation, executed

  

    A third rendering of the same Design: the simulator evaluates the IR
    directly, and its per-cycle trajectory is checked against the SMT transition system
    cycle by cycle (the differential, ADR-0017 §3). A run below shows a
    trace — one path through the design — not a proof; the proof is the SMT on
    the right. Ghost state is kept here (it is erased from the Verilog): watch
    the ghost lanes move on ghost_fifo.dg.
  


  

    
    
    
    
    
    
  


  

    

      
      
    

    

      

      

      

        ▁▔ 1-bit wire
        ✓ assert holds
        ✗ assert VIOLATED
        ● cover reached
        ⚠ assume broken
        ghost state the Verilog does not keep