Rtl2lean: Automated RTL-to-Lean Translation with Hierarchical Theorem Generation and Lemma Reuse

Abstract: Formal verification with interactive theorem provers can provide strong correctness guarantees for register transfer level designs, but applying it to existing SystemVerilog code requires substantial manual effort in semantic modeling and proof construction. This paper presents Rtl2lean, a framework that automatically translates RTL designs into executable Lean 4 models and builds a hierarchical theorem library for subsequent verification. The generated model represents hardware execution as a pure state transition function, while a four layer theorem framework captures combinational semantics, sequential updates, single cycle behavior, and reachability and invariants. When a high level property cannot be discharged by the existing theorem base, an LLM based proving loop proposes intermediate lemmas from the current proof context and Lean feedback. Only lemmas accepted by the Lean kernel are added to the reusable lemma pool. Experiments on six SystemVerilog designs generate 403 theorems, all of which are successfully checked by Lean. Among 358 foundational lemmas, 287 are available for automatic reuse, yielding a reusable lemma ratio of 80.2 percent. The results demonstrate that Rtl2lean can construct machine checked RTL proof libraries with low checking overhead and substantial cross property lemma reuse.

• The paper introduces an automated SystemVerilog-to-Lean 4 compiler that models RTL as typed state, input, output, and cycle-level transition functions while preserving assignment semantics.
• Rtl2lean generates four layers of theorems—from combinational and sequential lemmas to step-level properties, reachability, and invariants—then uses an LLM to propose only kernel-checked auxiliary lemmas.
• Across six OpenCores designs, the framework checked 403 theorems with 100% proof success, an 80.2% reusable-lemma ratio, and no more than 1.4 seconds of Lean checking per design, though industrial-scale scalability remains untested.

Motivation and problem statement

Interactive theorem provers such as Lean 4 offer correctness guarantees for RTL designs that hold for arbitrary inputs and execution lengths, in contrast to simulation, bounded model checking, and SAT/SMT-based flows that are constrained by finite traces or state explosion. Prior hardware-verification efforts embedded in proof assistants—Kami and Silver Oak—demonstrated modular, parameterized verification, but they require designs to be written or re-expressed within the proof assistant's idiom. Applying such guarantees to existing SystemVerilog remains costly for two reasons: Verilog's event-driven semantics differ substantially from Lean's pure-function, type-theoretic reasoning model, and proofs of complex hardware properties require design-specific auxiliary definitions, invariants, and intermediate lemmas that are difficult to enumerate in advance. Rtl2lean addresses both obstacles by combining an automated RTL-to-Lean 4 compiler with an LLM-assisted proving loop in which only kernel-checked lemmas enter a reusable pool.

Framework overview

The framework proceeds in three stages. First, RTL-to-Lean semantic compilation parses SystemVerilog with PySlang into a typed AST, normalizes conditional updates as selection expressions while preserving blocking/non-blocking assignment semantics, applies standard optimizations (constant folding, dead-code elimination, common-subexpression elimination), and emits a Lean model consisting of State, Inputs, Outputs, and a single-cycle transition function step(s, i). This pure functional encoding hides event-driven execution details while faithfully exposing cycle-level transition semantics.

Second, four-layer theorem framework generation constructs a bottom-up proof skeleton:

1. Combinational-logic lemmas: semantic lemmas for updated fields and preservation lemmas (marked @[simp]) for unaffected fields of each combinational function.
2. Sequential-block lemmas: determinism lemmas, write-set preservation lemmas, and reset-behavior lemmas for each sequential process such as always_ff.
3. Step-level theorems: module-level properties over the unified step function, including reset behavior, transition determinism, output reflection, and FSM transitions.
4. Reachability and invariants: reachability defined by folding step over finite input sequences from the initial state, preservation under one additional transition, and state invariants over all reachable states, providing induction bases for multi-cycle specifications.

Third, autonomous proving with lemma reuse: when the theorem base cannot discharge a high-level goal, an LLM proposes candidate intermediate lemmas conditioned on the current goal, relevant definitions, available lemmas, and Lean error messages. Each candidate must pass kernel type checking before use; rejected candidates are returned to the LLM with diagnostics. Accepted lemmas—and auxiliary have statements discovered during successful proofs—are added to the lemma pool for reuse via rw, apply, and simp. The paper's formalization expresses this as an iterative loop $$p_{k+1} = \operatorname{Generate}(\mathcal{C}(T), e_k)$$ terminating when $\operatorname{Check}(T, p_k) = \mathrm{Pass}$.

A notable structural observation is that the deterministic four-layer templates require no proof search or external model calls; the LLM is invoked only when template-based proving fails on design-specific goals.

Experimental results

The evaluation uses six OpenCores SystemVerilog designs (debounce/edge detection, FIR filter, PWM generator, LFSR/CRC, synchronous FIFO, PS/2 keyboard controller) checked with Lean 4.26.

Design	Properties	Lemmas	Reusable	Total	Proof success	Reuse ratio
debounce_edge	8	71	56	79	100%	78.9%
fir_filter	7	22	14	29	100%	63.6%
pwm_generator	7	74	62	81	100%	83.8%
lfsr_crc	7	35	27	42	100%	77.1%
sync_fifo	8	86	70	94	100%	81.4%
ps2_keyboard	8	70	58	78	100%	82.9%
Total	45	358	287	403	100%	80.2%

All 403 generated theorems pass Lean checking, yielding a 100% proof success rate across every design—a strong claim, though it should be read against the fact that all six benchmarks are small OpenCores IP blocks rather than industrial-scale designs. The reusable lemma ratio reaches 80.2% overall, with five of six designs exceeding 77%; fir_filter's lower ratio (63.6%) suggests reuse degrades for datapath-dominated designs with fewer shared control relations. Lemma counts vary widely (22 to 86) despite similar property counts (7–8), indicating library size tracks state-variable complexity and update dependencies rather than specification count.

Checking overhead is low: total Lean checking time is 5.573 s, with no design exceeding 1.4 s. Checking cost is not strictly proportional to theorem count—ps2_keyboard takes longer than the larger sync_fifo—implying that bit-vector expression complexity influences kernel time. End-to-end pipeline time is reported as 0.650 s, which reflects the deterministic template generation stage; the paper does not report wall-clock time or token costs for the LLM-driven proving loop itself, which is a significant omission given that LLM inference typically dominates such pipelines.

Limitations and open questions

Several limitations are acknowledged or evident. The reusable lemma ratio measures availability for automatic reuse, not actual dynamic usage within individual proofs, so the true reduction in proof effort is not directly quantified. The benchmark suite consists of six small OpenCores modules; scalability to processor-scale designs with deep pipelines, parameterized module hierarchies, and large register files remains untested. The claim of "faithful" cycle-level semantics preservation rests on the compiler's normalization of blocking/non-blocking assignments but is not validated against a reference semantics or differential testing against simulation. Finally, the LLM proving loop's contribution is not ablated—the paper does not isolate how many high-level properties required LLM-generated lemmas versus template-only proofs, nor how often candidate lemmas were rejected before acceptance.

Conclusion

Rtl2lean contributes an automated translation flow from SystemVerilog to executable Lean 4 models, a four-layer hierarchical theorem framework spanning combinational semantics through reachability invariants, and a kernel-gated LLM lemma-generation loop. On six OpenCores designs it produces 403 machine-checked theorems with a 100% success rate, an 80.2% reusable lemma ratio, and sub-second-per-design checking overhead. The results support the viability of combining deterministic semantic compilation with structured theorem scaffolding and kernel-checked LLM assistance, though scaling behavior and the quantitative benefit of LLM-generated lemmas remain open questions.