Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 90
Overall our tacticals prove good at proving intersection theorems and are mostly effective at
proving validity and containment theorems.
4.6.2 Improved Proof Scripts
Following our experiments with tactical-based proofs of the Prelude library, we attempt the
same proofs using Isabelle’s standard auto proof method. This method interleaves invocations
of the simplifier and classical reasoner and can be supplied with sets of simplification rules
and theorems to use. All our decompositional theorems are proved in the style of introduction
rules and are supplied to auto as such.
This method proves effective for validity and containment theorems however its results on
intersection theorems are far from impressive. Isabelle’s automatic tools consistently select
the wrong parts of the disjunctions to attempt to prove and leave proof states that are not
just unproven but actually unprovable.
We therefore design a new set of rules for generating proof scripts that combines the best of
these methods. auto-based proofs are generated for validity and containment theorems while
custom tacticals are generated for intersection theorems. The intersection tacticals include
an invocation to auto as a last resort when the other options in the tactical fail to prove the
goal, thus handling the rare circumstances when the classical reasoner can prove a goal but
our custom tactical can not.
Returning to our map example, the complete height function validity theorem and proof is
generated as:
theorem height ge0 int: "Î(n::int) (R::((’t395⇒ ’t396⇒ bool,’t395⇒ ’t396⇒ int)block)) (i::(’
t395)vector) (o ::(’t396)vector).
∀ (qs691 ::’ t395) (qs692 ::’ t396). 0 ≤ (Height (qs691 ;;; R ;;; qs692)) =⇒
0 ≤ (height (n, R) i o )"
apply (auto intro: sum ge0 maxf ge0 sum ge0 frange maxf ge0 frange z aleq bc simp add:
done
Let def max def)
The containment theorem is similarly proved using an appropriately parameterised auto. The