Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 94
block irow (int n, block R int (‘a, ‘b) ∼ (‘c, ‘a)) (‘a l , ‘b t[n]) ∼ (‘c b[n], ‘a r)
attributes {
height = if(n==0, 0, height((l, t) ; snd (converse (apr (n − 1))) ;
beside (irow (n−1, R), R n) ; fst (apr (n−1)) ; (b, r))).
width = if(n==0, 0, width((l, t) ;snd (converse (apr (n − 1))) ;
beside (irow (n−1, R), R n) ; fst (apr (n−1)) ; (b, r))).
} {
// Wires: l = left , t = top, b = bottom, r = right
assert (n >= 0) ”n >= 0 is required”.
if (n == 0) { l = r. } // b and t are empty vectors anyway
else {
(l , t) ;
snd (converse (apr (n − 1))) ;
beside (irow (n−1, R), R n) ;
fst (apr (n−1)) ;
(b, r) at (0,0).
} .
}
Figure 4.14: Recursive definition of irow n R
We investigate proofs of two different versions of the index operators: defined iteratively and
defined recursively. Recursively defined versions of some index operators are of particular
interest because these versions can be used to represent less regular circuit descriptions.
Iterative versions of the index operators are defined a very similar way to the standard prelude
operators, and the proof infrastructure developed and tested on the prelude works well for
them - all iterative definitions are proved fully automatically.
Recursive definitions are slightly more complex and we will examine irow n R as an example.
Figure 4.14 gives the recursive definition of this combinator.
The first step in verifying this layout is to generate the theory definitions using the compiler as
normal, however we must then re-jig the definitions to use Isabelle’s primrec rather than recdef
constructs (see Section 4.5.2). This process could be performed automatically. The recursive
width function definition for the irow block after this process is given in Figure 4.15. Because
the width function recurses over the natural number n, when the parameter is supplied to
the R block the conversion function “int” must be used to convert the natural number to an
integer.
Similarly, the definition of the irow uses the int2nat function we define in the IntAlgebra