Formal Methods for System Integration Michael Fourman Informatics The University of Edinburgh

Outline 4 System Integration 4 Behaviour and abstraction 4 Case study –specification –design –implementation 4 Summary

System Integration 4 Specification 4 Abstract Design 4 Concrete Implementation RF PP speech ROM DSP FPGA custom

Synchronous Behaviour 4 Signal –sequence of values –m( t ) 4 Behaviour –relation imposed between signals at ports –D(c, p, q) D q c p forall t. if c t then q t = F( p t ) else q t = G( p t )

Specification and Design 4 Specification –relation required between signals at ports  Design –Relating behaviour to specification Implementation (x)  Specification (x)

Abstraction  Relating levels of description –i : concreteSignals -> abstractSignal 4 The design task Implementation (x)  Specification (i x)

Data Abstraction 4 Eg integersbinary representation statestate encoding  Simple case –f : concreteData -> abstractData –(interpretation x) t = f (x t) –Implementation (x)  Specification (f o x)

Temporal Abstraction 4 Eg –micro-instructions –slowdown  Sampling as a Temporal Abstraction –s : abstractTime -> concreteTime –(interpretation x) t = x (s t) –Implementation (x)  Specification (x o s)

Synchronous Behaviour 4 Sampling –p when s D s dq c p D(c when s, p when s, q when d) /\...

Stopclock  User-level Specification –10 Hz clock –Display –Start/Stop button –Reset button

Stopclock  Implementation –1MHz clock –Seven segment display digits need not all change on same cycle –Buttons assumed synchronised at 1MHz but may be pressed at any point in the 1Hz period.

Specifying the Stopclock Stopclock(reset, stst,display) = exists run.forall t. display 0 = {tens = 0, secs = 0, tenths = 0} /\ display (t+1) = if (reset t) then {tens = 0, secs = 0, tenths = 0} else if (run t) then (nextTime (display t)) else (display t)...

Specifying the Stopclock 4 … 4 /\ run 0 = false 4 /\ run (t+1) = 4 if (reset t) then false 4 else if (stst t) then (not (run t)) 4 else (run t)

Top-level partitioning data and control

Control Specification Control(reset, stst, run) = forall t. run 0 = false /\ run (t+1) = if (reset t) then false else if (stst t) then (not (run t)) else (run t)

Data Specification Data ( reset, run, display ) = forall t. display 0 = {tens = 0, secs = 0, tenths = 0} /\ display (t+1) = if (reset t) then {tens = 0, secs = 0, tenths = 0} else if (run t) then (nextTime (display t)) else (display t)

Abstract Hardware

Refinement of Control Logic to RT level  abstract signals implemented by sampling concrete signals idea stst = STST when (rise tick) reset = RESET when (rise tick) run = RUN when (rise tick)

Abstraction for the reset button  Definition reset n = exists t. Timeof (rise tick) n <= t /\t < Timeof (rise tick) (n+1) /\ resetButton t

 Implementation  Theorem resetGlue (resetButton, rise tick, RESET) => reset n = (RESET when (rise tick)) (n+1) Abstraction for the reset button

 Implementation  Theorem ststGlue (rise ststButton, rise tick, STST) => stst n = (STST when (rise tick)) (n+1) Abstraction for start-stop button

RTL control logic  Theorem ControlImp ( tick, ststButton, resetButton, RESET, RUN ) => forall n. reset n = (RESET when (rise tick)) (n+1) /\ stst n = (STST when (rise tick)) (n+1)

Final Design

Summary 4 Specification –declarative, high-level 4 Design –creative and abstract 4 Implementation –automated (in future)