Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 67
assurance that the generated parameterised VHDL library (Chapter 3) is correct.
Verification of the parameterised VHDL would be possible but would have to be substantially
repeated for each new circuit. The alternative approach is to attempt to verify the original
Quartz description. Quartz combinators could be verified once and then this proof could be
used in the proofs of all circuit descriptions that use this combinator. This approach offers a
higher degree of reuse of proofs, which is extremely beneficial.
Since Quartz is a high-order language, we have selected Higher-Order Logic (HOL) as the
appropriate formalism for our proof system. This enables us to model most of the features
of Quartz descriptions and thus to conduct verification at the level closest to the original
circuit description. The use of HOL for functional verification of hardware is well understood
[8, 52], although the level of automation that can be achieved is often not that great.
Other formalisms, such as the Boyer-Moore logic [9] used by the ACL2 theorem prover
[34], are simpler and can be more highly automated however they are less general. Using a
first-order logic makes it impossible to prove properties of Quartz higher-order combinators,
only about their instantiated instances i.e. while we might wish to prove the correctness of
the map n R combinator we would be restricted to separately proving the correctness of the
map n add and map n inv blocks.
In this chapter we develop a system based around the embedding of HOL in the Isabelle
[61] generic theorem prover. Isabelle/HOL [55] is a well developed Isabelle object logic and
comes with many useful definitions and theorems.
Our infrastructure is not specific to Isabelle, or to the Isabelle version of HOL, nor are we
limited to using HOL for proofs. The layout verification stage of the Quartz compiler is
designed to be invoked on polymorphic, high-order circuit descriptions however it could be
invoked later during compilation to produce output for a different formalism. We separate
the generation of proof obligations from the interface to the Isabelle theorem prover and it
would be easy to provide an interface to a different proof tool.