Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 5. SPECIALISATION 115
constdefs (∗ Semantics for hardware primitives ∗)
and2 :: "wire⇒ wire⇒ wire⇒ bool"
"and2 ≡ (λ a b c. c = (a ∧ b))"
inv :: "wire⇒ wire⇒ bool"
"inv ≡ (λ a b. b = (˜ a))"
xor2 :: "wire⇒ wire⇒ wire⇒ bool"
"xor2 ≡ (λ a b c. c = (a ∧ (˜ b) | b ∧ (˜a)))"
constdefs (∗ Semantics for partial specialisation blocks ∗)
and2’ :: "bool⇒ wire⇒ wire⇒ bool"
"and2’ ≡ (λ a b c. if a then (c = b) else (c = False))"
xor2’ :: "bool⇒ wire⇒ wire⇒ bool"
"xor2’ ≡ (λ a b c. if a then (inv b c) else (c = b))"
(∗ Correctness theorems for specialised blocks ∗)
theorem and2 spec: "Îabc. and2 a b c = and2’ a b c"
by (simp add: and2 def and2’ def)
theorem xor2 spec: "Îabc. xor2 a b c = xor2’ a b c"
by (simp add: xor2 def xor2’ def inv def)
Figure 5.5: Functional verification of distributed specialisation of and2 and xor2
semantic function Bβ (Figure 4.8, page 81).
This is actually a rather simpler verification model than would be desired, since the wire
type is simply a synonym for bool and thus there is no need for explicit reference to the types
of the input/output signals - nevertheless it suitably demonstrates the concept. The two
theorems demonstrating the equivalence of the blocks are proved by using just the simplifier
and expanding the block definitions.
Functional verification is only one side of the verification task: it is also vital to verify the
correctness of the layout of a specialised circuit. This can be done using the layout verification
framework we described in Chapter 4. When specialising designs it is useful to state and
prove a particular additional correctness theorem of the form:
∀sigs. Width cctspec sigs ≤ Widthcctgen sigs ∧ Heightcctspec sigs ≤ Heightcctgen sigs
In fact, this theorem should be phrased so it is only universally quantified over dynamic
parameters. Parameters which genuinely affect the size of the circuit and are not expected to
vary at run-time (such as the bit-width of a ripple adder) can not be included in such proofs
since it would clearly render the theorem unprovable.