Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 103
4.8 Discussion
Our approach to layout verification is effective, both at verifying the correctness of combina-
tors and in finding the source of errors. However, it does have some drawbacks:
1. It generates many proof goals for blocks.
2. Many proofs that should be completed automatically require some manual intervention
to tweak the role of the automated tactics.
3. We have not formally established the link between the proof obligations we generate
for each block and the original definitions of correctness.
The first issue stems from the increased role of the size inference system over what was
originally expected. When this work was begun it was presumed that size inference would be
inefficient and it would almost always be preferable to manually specify block sizes. However,
we have found that the opposite is often the case. Except for primitive blocks, where sizes
must always be specified manually, size inference is usually easier than writing complex size
expressions by hand. In addition, while hand-coded size expressions are more efficient than
inferred ones, the differences between the two tend to follow common patterns (some of which
we have proved as theorems during the course of this work).
It seems likely that in most cases the manually specified size functions could be produced by
applying correctness-preserving transformations to the inferred size expressions automatically
in the compiler.
Using the size inference system, it should no longer be necessary to prove validity and con-
tainment for each block’s size expressions if these properties could be proved for the inference
algorithm itself. We can satisfy ourselves by inspection that sizes inferred by the inference
system have correct containment properties since the inference algorithm is designed to select
the topmost, rightmost possible co-ordinate of a layout 3 . We can also prove a theorem about
the size inference function to show validity of its results:
Theorem 22 For all blocks A, where R is the set of higher-order parameters of A and for
3 “Correct by definition” is not totally satisfactory, however it is sufficient for our purposes.