Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 101
lengths (save on the interface points). This kind of structure can be realised by a recursive
combinator which alternates between a horizontal and vertical layout for each sub-tree. A
Quartz description of this combinator can be seen in Figure 4.19. Functionally this combi-
nator is identical to a standard binary-tree arrangement, although the layout description is
quite complicated.
The verification of this kind of combinator is especially important, as we saw with the irreg-
ular grid example, since the complex layout is relatively more likely to contain errors. The
semantic definition, height and width functions for this block are recursive and defined using
Isabelle primrec constructs. The use of multiple internal signals requires special handling.
We have used tuples of internal signals to bind them in a single predicate, however Isabelle’s
handling of tuples does not allow these to be split easily, so it is better to re-define the internal
signals individually binding them with identical copies of the predicate, where other signals
are existentially quantified within it. This leads to definitions that are long and contain a
great deal of redundancy but makes proofs substantially easier and since the proof tool is
designed to handle large definitions and proof scripts easily this is a trade-off worth making.
Validity theorems are proved by induction on n and then use of the auto method. Contain-
ment theorems require a combination of auto with some primitive deduction. Intersection is
proved automatically with the expansion of the definition of the half block.
4.7.4 Surround
In Section 3.6 we introduced the surround combinator which describes a square block sur-
rounded by interface elements. Figure 4.20 illustrates the generic instantiation of this com-
binator with an A block surrounded by B, C, D and E interface elements. It is important
to note that this combinator is general and could describe situations where the interface
elements are the same, or absent (replaced by the identity block).
The Quartz description for this block given in Figure 3.14 (Page 3.14) is similarly general.
It must describe a correct layout for situations where the sizes of the blocks within the
combinator vary arbitrarily. In fact, during the verification of this combinator we discovered
an error in the block placement which would probably have otherwise remained undiscovered.