Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 83
Isabelle defines arbitrary recursive functions using the recdef construct however functions
defined this way require termination to be proved automatically and this is difficult for the
theorem prover to do because of the way Quartz blocks are defined. Unfortunately recdef is a
closed box and it is not possible to manually direct the proof and recdef compilation process
to generate useful results.
Luckily Isabelle does provide a (less general) recursive construct called primrec for imple-
menting recursion over data structures. This can be used with the natural numbers type to
write recursive equations for Quartz blocks in the form R0 = g and Rn+1 = f(Rn). This is
limited to cases where the recursion of the block is controlled by a single integer parameter
that decreases to zero, however this comfortably describes most recursively defined Quartz
blocks.
We have carried out the translation from recdef to primrec manually, however there is no
reason why the process could not be automated.
4.5.3 Generating Proof Obligations
The Quartz compiler also generates a series of proof obligations that check the correctness
of a layout specification. The correctness theorems are split into three groups, representing
proofs for validity, containment and intersection. These theorems are contained within the
same theory file that defines the block’s semantic definition, height and width functions. This
ensures that the theory of a block can only be loaded to support that of a block dependent
on it once it has itself been proved correct.
All theorems are universally quantified across all domain and range signals. Validity theorems
are the simplest and are proved under the assumption that the size functions of all higher-
order block parameters are also valid. Assertion pre-conditions asserted within the block’s
body are also assumed and can be used in the proof. The general format of the height validity
theorem for a block B of type d1 . . . dn ∼ r is: