Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 2. BACKGROUND AND RELATED WORK 32
defined in Figure 2.5. This proof can be represented in Isabelle as:
theorem "A −→ A"
apply (rule impI)
apply (assumption)
done
The first instruction is for Isabelle to apply the rule impI which lifts the object level implica-
tion to a meta-logic implication of the form P =⇒ P (The unknowns P and Q in the axiom
are both unified with the constant A). From this state the proof can be completed using the
assumption method which attempts to solve the right hand side of a meta-implication using
the assumptions on the left. A =⇒ A can be proved this way leaving an empty (complete)
proof state and the proof is completed with the done command.
Isabelle can also solve simple theorems automatically. For example, the proof (in higher-order
logic) that reversing a list twice is the same as the original list can be proved as:
theorem rev rev [simp]: "rev (rev xs) = xs"
apply (induct xs)
apply (auto)
done
This theorem has been named (rev rev) and declared as a simplification rule. It is proved
by the application of induction on the variable xs and then automatically by Isabelle. The
auto method uses both of Isabelle’s two most useful automation tools, the simplifier and the
classical reasoner.
The simplifier is a term rewriting tool. It repeatedly applies equations from left to right,
using declared sets of simplification rules. Virtually any theorem in the form A = B can be
used as a simplification rule however it is generally the case that only rules which genuinely
simplify the proposition should be declared as automatic simplification rules. In the example
above,xs is clearly simpler thanrev (rev xs) so this could be safely used as a simplification
rule however if the theorem were proved in reverse – xs = rev (rev xs) – then this would
not be a suitable simplification rule. Not only does it not simplify the proposition but it
will actually cause the simplifier to loop infinitely by continually expanding the xs on the
right hand side. It is often useful to invoke the simplifier by itself, which can be done using
Isabelle’s simp method.