Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 85
CON T :: Block → Bool
CON T block bid d1 . . . dn ∼ r { τ1 id1 . . . τp idp. stmts } =
∀d1 . . . dn r. S ∅stmts ⇒ SCON T ′ stmts
SCON T ′ :: StmtList → Bool
SCON T ′
β stmt1 . . . stmtn =
let c1 = SCON T stmt1 in
.
let cn = SCON T stmtn in
c1 ∧ . . . ∧ cn
SCON T :: Stmt → Bool
SCON T assert e str = True
SCON T e1 = e2 = True
SCON T if e { stmts1 } else { stmts2 } =
if e then SCON T ′ stmts1 else SCON T ′ stmts2
SCON T for i = e1..e2 { stmts } =
∀i. e1 ≤ i ≤ e2 −→ SCON T ′ stmts
SCON T a ; blkinst ; b at (x, y) =
(0 ≤ x) ∧ (0 ≤ y) ∧
(x + Width(a ; blkinst ; b) ≤ widthd1 . . .dn r) ∧
(y + Height(a ; blkinst ; b) ≤ heightd1 . . . dn r)
Figure 4.10: Generating containment theorems
type inference, ensuring that the Isabelle types are correct. The semantic interpretation of
the block is generated as a set of assumptions, defining assertions and possibly determining
the values of internal signals (none in the case of map ).
Intersection theorems are the most complex. They are generated for each block instantiation
except the first, checking intersection against the previous statements. Figure 4.11 gives the
algorithm that generates intersection proof obligations. At first glance this appears quite
complex, however its structure is really quite simple. The compiler makes a forward pass
through the block statements, accumulating statements that have already been processed in
the list φ. For each block instantiation that is encountered the least and maximum x and
y co-ordinates are identified and are then compared with the equivalent co-ordinates for all
blocks previously instantiated. This implements Definition 7, as can be most clearly seen in
the last clause of function IN T ERSECT .
An important case is the handling of for loops by the function SIN T ERφ. This generates
two set of requirements - that the elements within a loop don’t intersect with previously
instantiated blocks and that the elements within the loop don’t intersect with each other. This