summaryrefslogtreecommitdiffstats
path: root/proof.tex
diff options
context:
space:
mode:
authorJohn Wickerson <j.wickerson@imperial.ac.uk>2020-11-18 16:27:29 +0000
committeroverleaf <overleaf@localhost>2020-11-18 16:27:40 +0000
commite7e3dc2e0fcbec518d43c661a4d305a736ab7092 (patch)
treea671bd0c40749b013fbad77fcae4e68a39a790d7 /proof.tex
parenteae027da7619d7f459e7cdbda38eeb8f0dafbeb0 (diff)
downloadoopsla21_fvhls-e7e3dc2e0fcbec518d43c661a4d305a736ab7092.tar.gz
oopsla21_fvhls-e7e3dc2e0fcbec518d43c661a4d305a736ab7092.zip
Update on Overleaf.
Diffstat (limited to 'proof.tex')
-rw-r--r--proof.tex2
1 files changed, 1 insertions, 1 deletions
diff --git a/proof.tex b/proof.tex
index 4c0359e..67b3e0b 100644
--- a/proof.tex
+++ b/proof.tex
@@ -88,7 +88,7 @@ The HTL to Verilog simulation is quite simple, as the only transformation is fro
The translation from maps to case statements is done by turning each node of the tree into a case expression with the statments in each being the same. The main difficulty for the proof is that a structure that can be directly accessed is transformed into an inductive structure where a certain number of constructors need to be called to get to the correct case. The proof of the translation from maps to case statements follows by induction over the list of elements in the map and the fact that each key in this list will be unique. In addition to that, the statement that is currently being evaluated is guaranteed by the correctness of the list of elements to be in that list. The latter fact therefore eliminates the base case, as an empty list does not contain the element we know is in the list. The other two cases follow by the fact that either the key is equal to the evaluated value of the case expression, or it isn't. In the first case we can then evaluate the statement and get the state after the case expression, as the uniqueness of the key tells us that the key cannot show up in the list anymore. In the other case we can just apply the inductive hypothesis and remove the current case from the case statement, as it did not match.
-Another problem with the representation of the state as an actual register is that we have to make sure that the state does not overflow. Currently, the state register will always be 32 bits, meaning the maximum number of states can only be $2^{32} - 1$. We therefore have to prove that the state value will never go over that value. This means that during the translation we have to check for each state that it can fit into an integer. Finally, as we have to assume that there are $2^{32} - 1$ states, Vericert will error out when there are more instructions to be translated, which allows us to satisfy and prove that assumption correct.
+Another problem with the representation of the state as an actual register is that we have to make sure that the state does not overflow. Currently, the state register will always be 32 bits, meaning the maximum number of states can only be $2^{32} - 1$. We therefore have to prove that the state value will never go over that value. This means that during the translation we have to check for each state that it can fit into an integer. Finally, as we have to assume that there are $2^{32} - 1$ states, \vericert{} will error out when there are more instructions to be translated, which allows us to satisfy and prove that assumption correct.
\subsection{Deterministic Semantics}