Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 91
compiler procedure that generates these scripts also supplies the height ge0 and width ge0
theorems for all blocks used in the description as introduction rules (none in this case, since
map only instantiates the supplied R block). This allows validity proofs to build upon one
another.
The intersection theorem for map (page 87) is proved by the generated tactical:
apply (simp, rule impI, simp)?
apply ((
done
(rule allI )+,
(case tac "0 ≤ n"),
rule impdisj 12of4,
(rule loop sum overlap|rule loop sum overlap’),
(simp add: overlap0’’)+) |
((rule allI )+,
(case tac "0 ≤ n"),
rule impdisj 34of4,
rule loop sum overlap2,
(simp add: overlap0’’)+) |
auto intro: sum ge0 maxf ge0 sum nsub1 plusf maxf encloses)
The loop sum overlap theorems are proved in the Structures theory. This theory contains
theorems that match common layout structures, such as the layout of components in a loop.
loop sum overlap is given as:
Î(n::int) (j :: int) (j ’:: int). m ≤ n ;Îy. 0 ≤ f y =⇒
((m ≤ j) ∧ (j ≤ (n − 1)) ∧ (m ≤ j’) ∧ (j’ ≤ (n − 1)) ∧ (j’ = j)) −→
((sum (m, j − 1, f) + f j) ≤ sum (m, j’ − 1, f) |
(sum (m, j’ − 1, f) + f j ’) ≤ sum (m, j − 1, f))
Its proof involves a number of steps and is given in Appendix B.8. The other loop sum overlap
theorems are similar.
Table 4.1 gives statistics on the proofs for some of the blocks in the Prelude library and details
for all of those where proofs required manual intervention. Overall of nearly 40 blocks in the
Prelude library, only 5 required manual intervention in their proofs. Using the auto method