Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 77
consts
maxf :: "(int∗int∗(int⇒ int))⇒ int"
recdef maxf "measure (λ(b, t, f). nat(t+1−b))"
"maxf (bot, top, fun) = (if (top < bot) then 0
else (
case (top = bot) of True ⇒ fun top
| False ⇒ (
let one = fun top in
let two = maxf (bot, top − 1, fun) in
max one two)))"
consts
sum :: "(int∗int∗(int⇒ int))⇒ int"
recdef sum "measure (λ(b, t, f). nat(t+1−b))"
"sum (bot, top, fun) = (
case (top < bot) of True ⇒ 0
| False ⇒ sum (bot, top − 1, fun) + (fun top))"
Figure 4.6: Definitions of the Quartz sum and maxf functions in QuartzLayout
Theorem 11 is particularly useful since we are often confronted with expressions of this form
where a, b and c are size functions for various blocks. Using this theorem we can simplify
the logical proposition substantially, since we will prove that 0 ≤ x for all size expressions x
as a matter of course and can use these theorems in other proofs.
While Isabelle/HOL already includes definitions of max and if, we have to define the complex
functions maxf and sum. The definitions of these functions from theory Functions can be
seen in Figure 4.6. These definitions have the same semantics as the appropriate clauses of
the semantic function for Quartz expressions Eσ β µ given on page 42.
The functions are defined using the recdef method of declaring arbitrary recursive functions.
The measure functions allow Isabelle/HOL to prove termination of the functions by showing
that the supplied measure decreases for each recursive call. We use “case” rather than “if”
expressions within the functions to avoid problems with the use of Isabelle’s simplifier where
conditionals are repeatedly split, leading to a loop. Besides this, the two function identically
and the equivalence between the two can be proved easily (see theorem maxf expand if in
Appendix B.7 for such a proof for the maxf function).
We prove the correctness of the maxf function, showing that it implements a logical definition: