Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 95
primrec
"width 0 R l t b r = 0"
"width (Suc n) R l t b r =
Width ((l, t) ;;;
snd $ (converse $ (apr $ (int n))) ;;
beside $ ((| Def = λb c. arbitrary, Height = λb c. arbitrary, Width = λ
(l,t) (b, r). width n R l t b r |), R $ (int n + 1)) ;;
fst $ (apr $ (int n))
;;; (b, r)
)"
Figure 4.15: Isabelle definition of the irow width function
theory to convert the integer parameter to a natural number. int2nat is similar to the inbuilt
nat type converter except that it is only defined for values where n ≥ 0.
Proofs for recursive functions tend to follow a simple structure: induction and then some
application of auto, possibly combined with other methods. In order to prove the validity
theorems for irow it is necessary to massage the propositions [55], in order to move variables
that must be encompassed by the induction onto the right-hand-side of the meta-implication.
For example, the width validity theorem for irow is phrased as:
theorem width ge0 int [rule format]: "
Î(n::nat)
(R::(( int⇒ (’t107∗’t108)⇒ (’t109∗’t107)⇒ bool,int⇒ (’t107∗’t108)⇒ (’t109∗’t107)⇒ int)block)).
∀ (qs137::int) (qs138 ::(’ t107∗’t108)) (qs139 ::(’ t109∗’t107)).
0 ≤ (Height (qs138 ;;; R $ qs137 ;;; qs139)) ;
∀ (qs137::int) (qs138 ::(’ t107∗’t108)) (qs139 ::(’ t109∗’t107)).
0 ≤ (Width (qs138 ;;; R $ qs137 ;;; qs139))
=⇒ ∀ l t b r. 0 ≤ (width n R l t b r)"
This differs from the standard representation in that the signals l, t, b and r have been moved
from being meta-quantified to being object-level quantified. The “rule format” tag instructs
Isabelle to re-phrase the theorem using meta-quantification once it is proved.
Proof of this theorem involves applying induction to split it into two cases to prove:
goal (theorem (width ge0 int), 2 subgoals):
1.ÎnR. ∀ qs137 qs138 qs139. 0 ≤ Height (qs138 ;;; R $ qs137 ;;; qs139);
∀ qs137 qs138 qs139. 0 ≤ Width (qs138 ;;; R $ qs137 ;;; qs139)
=⇒ ∀ l t b r. 0 ≤ irow.width 0 R l t b r