Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 97
=⇒ 0 ≤ Width (snd.snd $ (converse.converse $ (apr $ int na))) xa ya
2.ÎRna l t b r x y xa ya.
∀ qs137 a b aa ba. 0 ≤ Height R qs137 (a, b) (aa, ba);
∀ qs137 a b aa ba. 0 ≤ Width R qs137 (a, b) (aa, ba);
∀ l t b r. 0 ≤ irow.width na R l t b r
=⇒ 0 ≤ Width
(beside $
((| Def = λb c. arbitrary, Height = λb c. arbitrary,
Width = λ(l, t). split (irow.width na R l t) |),
R $ int na + 1))
xa ya
3.ÎRna l t b r x y.
∀ qs137 a b aa ba. 0 ≤ Height R qs137 (a, b) (aa, ba);
∀ qs137 a b aa ba. 0 ≤ Width R qs137 (a, b) (aa, ba);
∀ l t b r. 0 ≤ irow.width na R l t b r
=⇒ 0 ≤ Width (fst.fst $ (apr $ int na)) x y
The proof can then be completed by auto. Similar techniques can be adopted for other proofs,
although not all will require induction (the containment theorem for irow does not). Note
that we have not required any properties of maxf or sum - these functions are used when
describing the layout of iteratively defined blocks and are not needed for recursively defined
combinators.
We also attempted proofs for manually specified size functions which expanded the definitions
of apr and apl etc, referring to explicit vector indexes. These are simpler expressions than the
full expressions produced by the inference algorithm, however a slightly unexpected result is
that this substantially complicates the proofs. Proof now requires expansion of the definitions
of intermediate signals within the series compositions to check that there is a correspondence
between the values produced by the usages of the append blocks and those that are manually
specified. This should be a simple process but it is not because of the way blocks are defined
as logical predicates rather than functions.
The usage of block predicates to define values bound by the define description operator
requires the elimination of definite descriptions to extract the real value. This is a significant