Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 66
still vital to ensure that the layout is correct.
While close examination by a human designer is an good method of finding many bugs in
layout descriptions, it is no substitute for a formal assurance of correctness. In the develop-
ment of the example designs illustrated in Chapter 6 there have been several occasions where
Quartz descriptions which appeared on first inspection to be correctly laid out have turned
out to contain errors.
The hierarchical decomposition that is typical of Quartz circuit designs can be exploited so
that sections of the a circuit can be proved correct independently of each other and then
these proofs integrated into a proof of correctness for the entire design. However, the type
of proofs involved in formally verifying a layout description are not particularly well suited
to hand-proof by the designer, or indeed a different proof expert.
Layouts of large numbers of components leads to long theorems requiring proof - but the
constituents of these theorems are often either trivial or quite simple. These two factors
combine to make it likely that “pen and paper” proof of these theorems is likely to be
particularly unreliable unless extreme care is taken.
Furthermore, there is a high level of proof re-use between different circuit descriptions, by
exploiting similar properties of arithmetic operators, binary relations and Quartz size expres-
sion functions. This suggests that layout verification may be a good candidate for the use of
mechanised proof tools.
In this chapter we describe a proof infrastructure based on Higher-Order Logic which elimi-
nates the possibility of human error in proofs and demonstrates a high level of automation.
4.2 Choice of Formalism
There are two main possible approaches to verifying Quartz layouts. The first is to verify the
output circuit description for each compiled circuit, either in the form of parameterised/hier-
archical VHDL or in netlist format. Verification of placed netlists is effectively carried out
by the synthesis tools that generate the FPGA bitstream since they will raise an error if an
incorrect layout is specified, however this is not of much use if the desire is to provide an