1. Formal Methods for System Integration Michael Fourman Informatics The University of Edinburgh

2. Outline 4 System Integration 4 Behaviour and abstraction 4 Case study –specification –design –implementation 4 Summary

3. System Integration 4 Specification 4 Abstract Design 4 Concrete Implementation RF PP speech ROM DSP FPGA custom

4. Synchronous Behaviour 4 Signal –sequence of values –m( t ) 4 Behaviour –relation imposed between signals at ports –D(c, p, q) D q c p forall t. if c t then q t = F( p t ) else q t = G( p t )

5. Specification and Design 4 Specification –relation required between signals at ports  Design –Relating behaviour to specification Implementation (x)  Specification (x)

6. Abstraction  Relating levels of description –i : concreteSignals -> abstractSignal 4 The design task Implementation (x)  Specification (i x)

7. Data Abstraction 4 Eg integersbinary representation statestate encoding  Simple case –f : concreteData -> abstractData –(interpretation x) t = f (x t) –Implementation (x)  Specification (f o x)

8. Temporal Abstraction 4 Eg –micro-instructions –slowdown  Sampling as a Temporal Abstraction –s : abstractTime -> concreteTime –(interpretation x) t = x (s t) –Implementation (x)  Specification (x o s)

9. Synchronous Behaviour 4 Sampling –p when s D s dq c p D(c when s, p when s, q when d) /\...

10. Stopclock  User-level Specification –10 Hz clock –Display –Start/Stop button –Reset button

11. Stopclock  Implementation –1MHz clock –Seven segment display digits need not all change on same cycle –Buttons assumed synchronised at 1MHz but may be pressed at any point in the 1Hz period.

12. Specifying the Stopclock Stopclock(reset, stst,display) = exists run.forall t. display 0 = {tens = 0, secs = 0, tenths = 0} /\ display (t+1) = if (reset t) then {tens = 0, secs = 0, tenths = 0} else if (run t) then (nextTime (display t)) else (display t)...

13. Specifying the Stopclock 4 … 4 /\ run 0 = false 4 /\ run (t+1) = 4 if (reset t) then false 4 else if (stst t) then (not (run t)) 4 else (run t)

14. Top-level partitioning data and control

15. Control Specification Control(reset, stst, run) = forall t. run 0 = false /\ run (t+1) = if (reset t) then false else if (stst t) then (not (run t)) else (run t)

16. Data Specification Data ( reset, run, display ) = forall t. display 0 = {tens = 0, secs = 0, tenths = 0} /\ display (t+1) = if (reset t) then {tens = 0, secs = 0, tenths = 0} else if (run t) then (nextTime (display t)) else (display t)

17. Abstract Hardware

18. Refinement of Control Logic to RT level  abstract signals implemented by sampling concrete signals idea stst = STST when (rise tick) reset = RESET when (rise tick) run = RUN when (rise tick)

19. Abstraction for the reset button  Definition reset n = exists t. Timeof (rise tick) n <= t /\t < Timeof (rise tick) (n+1) /\ resetButton t

20.  Implementation  Theorem resetGlue (resetButton, rise tick, RESET) => reset n = (RESET when (rise tick)) (n+1) Abstraction for the reset button

21.  Implementation  Theorem ststGlue (rise ststButton, rise tick, STST) => stst n = (STST when (rise tick)) (n+1) Abstraction for start-stop button

22. RTL control logic  Theorem ControlImp ( tick, ststButton, resetButton, RESET, RUN ) => forall n. reset n = (RESET when (rise tick)) (n+1) /\ stst n = (STST when (rise tick)) (n+1)

23. Final Design

24. Summary 4 Specification –declarative, high-level 4 Design –creative and abstract 4 Implementation –automated (in future)