Verifikation reaktiver Systeme - Universität Kaiserslautern

228
Implementation To verify the given implementation, it must be described by a
boolean term S(in, out) withfreevariablesx and y. S(in, out) istrueifand
only if some combination of in and out is externally observable on the wires.
For the parity checker, a relation PARITY IMP(inp,out) will be constructed
describing its behaviour.
As the parity checker is built from standard logic devices, some standard
logical devices must be defined before the implementation of the parity checker
can be given:
val ONE_def = Define ‘ONE(out:num->bool) =
!t. out t = T‘;
val NOT_def = Define ‘NOT(inp, out:num->bool) =
!t. out t = ~inp t‘;
val MUX_def = Define ‘MUX(sw,in1,in2,out:num->bool) =
!t. out t = if sw t then in1 t else in2 t‘;
val REG_def = Define ‘REG(inp,out:num->bool) =
!t. out t = if (t=0) then F else inp(t-1)‘;
The predicate ONE is true of a signal out if for all times t the value of out is
T. The binary predicate NOT is true of a pair of signals (inp,out) ifthevalueof
out is always the negation of the value of inp. Registers are unit-delay elements:
Theoutputattimet+1 is the input at the preceding time t, except at time 0
when the register outputs F as required above.
Apparently, the parity checker can be implemented with a register storing
the parity value. Whenever T is an input, its content is complemented. But the
output at time t cannot be just the value stored in that register, since it is
(according to the specification) a function of the input at time t. Thus, there
must be a combinational path from the input to the output.
Provided that all registers initially store F, Figure 3 shows the design of a
device that is intended to implement the specification of the parity checker. This
diagram can be represented as a predicate by conjoining the relations holding
between the various signals and then existentially quantifying the internal lines
as described in (e.g. see 3 4)
val PARITY_IMP_def = Define ‘PARITY_IMP(inp,out) =
?l1 l2 l3 l4 l5.
NOT(l2,l1) /\
MUX(inp,l1,l2,l3) /\
REG(out,l2) /\
ONE l4 /\
REG(l4,l5) /\
MUX(l5,l3,l4,out)‘;
Verification The main goal of the verification to prove the fact that the observed
behaviour of the parity checker fulfils its specification. This safety property can
be stated in the following way:
g ‘!inp out. PARITY_IMP(inp,out) ==> !t. out t = PARITY t inp‘;