Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 84
∀ d1 . . . dn r.
(∀(A :: block d A 1 . . . dA m ∼ rA ) ∈ {d1, . . .,dn, r}.
∀ d A 1 . . .d A m r A . 0 ≤ HeightA d A 1 . . . d A m r A ) ∧
(∀ c ∈ assertions(B). c) ⇒
0 ≤ HeightB d1 . . . dn r
The width theorem is similar, with width functions substituted for height functions 1 .
The validity theorems for each block’s height and width function are given the names
height ge0 and width ge0 and can be used in other theories. It is common to require these
proofs when determining the validity of size functions for blocks that use them.
Containment theorems are generated for each statement that involves block instantiations,
stating that the leftmost bottom point of each block is greater than of equal to (0, 0) and
the top rightmost is less than or equal to (width, height) for all possible values of block
parameters (provided assertions are met). The recursive descent algorithm that calculates
containment theorems is shown in Figure 4.10.
For the map n R combinator this generates a containment theorem of:
theorem "Î(n::int) (R::((’t395⇒ ’t396⇒ bool,’t395⇒ ’t396⇒ int)block)) (i::(’t395)vector) (o
::(’t396)vector). ∀ (j::int). ((0 ≤ j) ∧ (j ≤ (n − 1))) −→ Def (i ;;; R ;;; o ) ; ∀ (
qs691::’t395) (qs692::’t396). 0 ≤ (Height (qs691 ;;; R ;;; qs692)) ; ∀ (qs691 ::’ t395) (qs692
::’ t396). 0 ≤ (Width (qs691 ;;; R ;;; qs692)) =⇒
∀ (j :: int). ((0 ≤ j) ∧ (j ≤ (n − 1))) −→ (((0::int) ≤ 0) ∧ (0 ≤ sum (0, j − 1, λqs403.
Height (i ;;; R ;;; o ))) ∧ ((0 + (Width (i ;;; R ;;; o ))) ≤ (
maxf (0, n − 1, λqs401. Width (i ;;; R ;;; o )))) ∧ ((sum (0, j − 1, λ
qs403. Height (i ;;; R ;;; o )) + (Height (i ;;; R ;;; o ))) ≤
sum (0, n − 1, λqs402. Height (i ;;; R ;;; o ))))"
Note that the Quartz compiler has annotated the Isabelle theory with the results of its own
1 Actually the Isabelle module generates 4 validity theorems, in two different representations. This is done
because a size function can be evaluated either as (Height A) p1 . . . pn or as Height(pn−1 ; A p1 . . . pn−2 ; pn).
Both of these are precisely equivalent and the compiler automatically generates a proof for one in terms of
the other, requiring the designer to only prove 2 of the theorems manually. It was originally felt that both
representations could be useful in proofs however it has emerged that one format is the most useful and thus
the other 2 theorems are essentially redundant.