11. Full Pipeline
The pipelined-fetch cell overlaps only fetch; the operand-pipeline chapter proves when the memory reads may also run a cycle early. This chapter composes the two into a single cell that overlaps fetch and operands, so straight-line independent code commits one instruction per cycle, and proves the composition still commits the sequential trace — with a one-cycle bubble only for the one real data hazard (a dependent operand read) or control hazard (a taken branch).
The overlap is a read stage running one instruction ahead of execute. While the
execute stage commits the latched instruction fir with its latched operands,
the read stage reads the next instruction's operands from the current
architectural state — a cycle early, before the committing instruction writes
back. The interlock (indepB) decides whether that early read is safe: it is,
exactly when the committing instruction is independent of the one being read, and
then the cell commits again next cycle; otherwise the early read is dropped and
the cell bubbles for one cycle to re-read from the committed state.
namespace Honeycomb
-- Boolean interlock, the decidable image of `Indep`. A load is safe to read early
-- past an instruction that is not a store and does not write its address
-- register; a kernel MAC past one that does not move the pointers.
def writesRegB (d : DecodedInstr) (r : Reg defaultConfig) : Bool :=
(d.op == .movacc || d.op == .li || d.op == .ld || d.op == .alu) && (d.rd == r)
def indepB (d1 d2 : DecodedInstr) : Bool :=
match d2.op with
| .ld => (d1.op != .st) && !writesRegB d1 d2.ra
| .kmac => (d1.op != .kmac) && (d1.op != .setwptr) && (d1.op != .setsptr)
&& (d1.op != .stw)
| _ => true
theorem writesRegB_iff (d : DecodedInstr) (r : Reg defaultConfig) :
writesRegB d r = true ↔ WritesReg d r := d:DecodedInstrr:Reg defaultConfig⊢ writesRegB d r = true ↔ WritesReg d r
All goals completed! 🐙
theorem not_writesRegB_iff (d : DecodedInstr) (r : Reg defaultConfig) :
writesRegB d r = false ↔ ¬ WritesReg d r := d:DecodedInstrr:Reg defaultConfig⊢ writesRegB d r = false ↔ ¬WritesReg d r
All goals completed! 🐙
theorem indepB_imp_Indep (d1 d2 : DecodedInstr) (h : indepB d1 d2 = true) :
Indep d1 d2 := by d1:DecodedInstrd2:DecodedInstrh:indepB d1 d2 = true⊢ Indep d1 d2
unfold indepB Indep at * d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
true⊢ match d2.op with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => True
cases hop : d2.op mac d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.mac⊢ match CellOp.mac with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truekmac d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.kmac⊢ match CellOp.kmac with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Trueclracc d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.clracc⊢ match CellOp.clracc with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truemovacc d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.movacc⊢ match CellOp.movacc with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Trueli d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.li⊢ match CellOp.li with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Trueld d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.ld⊢ match CellOp.ld with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truest d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.st⊢ match CellOp.st with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truesetwptr d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.setwptr⊢ match CellOp.setwptr with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truesetsptr d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.setsptr⊢ match CellOp.setsptr with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Trueblz d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.blz⊢ match CellOp.blz with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truehalt d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.halt⊢ match CellOp.halt with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truealu d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.alu⊢ match CellOp.alu with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truejr d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.jr⊢ match CellOp.jr with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truestw d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.stw⊢ match CellOp.stw with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => True <;> mac d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.mac⊢ match CellOp.mac with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truekmac d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.kmac⊢ match CellOp.kmac with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Trueclracc d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.clracc⊢ match CellOp.clracc with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truemovacc d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.movacc⊢ match CellOp.movacc with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Trueli d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.li⊢ match CellOp.li with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Trueld d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.ld⊢ match CellOp.ld with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truest d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.st⊢ match CellOp.st with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truesetwptr d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.setwptr⊢ match CellOp.setwptr with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truesetsptr d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.setsptr⊢ match CellOp.setsptr with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Trueblz d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.blz⊢ match CellOp.blz with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truehalt d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.halt⊢ match CellOp.halt with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truealu d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.alu⊢ match CellOp.alu with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truejr d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.jr⊢ match CellOp.jr with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => Truestw d1:DecodedInstrd2:DecodedInstrh:(match d2.op with
| CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra
| CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw
| x => true) =
truehop:d2.op = CellOp.stw⊢ match CellOp.stw with
| CellOp.ld => d1.op ≠ CellOp.st ∧ ¬WritesReg d1 d2.ra
| CellOp.kmac => d1.op ≠ CellOp.kmac ∧ d1.op ≠ CellOp.setwptr ∧ d1.op ≠ CellOp.setsptr ∧ d1.op ≠ CellOp.stw
| x => True
simp_all [Bool.and_eq_true, Bool.not_eq_true, bne_iff_ne, not_writesRegB_iff,
or_assoc] All goals completed! 🐙
The state pairs the architectural state and instruction memory with a busy bit, a
fetch latch (validity, index, instruction), and an operand latch (validity plus
the three latched memory operands). The operand-latch invariant OpInv is the
load-bearing one: whenever the operands are valid, executing the latched
instruction with them equals executing it directly — the latched operands are the
right reads.
structure FullPipeCell where
arch : State defaultConfig
imem : Nat -> DecodedInstr
busy : Bool
fvalid : Bool
fpc : Nat
fir : DecodedInstr
ovalid : Bool
ldv : Word defaultConfig
wv : Elem defaultConfig
sv : Elem defaultConfig
def fpWantIdx (s : State defaultConfig) : Nat :=
memIndexOfNat defaultConfig s.pc.toNat
def OpInv (c : FullPipeCell) : Prop :=
c.ovalid = true ->
execLatched c.fir c.ldv c.wv c.sv c.arch = execDecoded c.fir c.arch
def FetchInv (c : FullPipeCell) : Prop :=
c.fvalid = true -> c.fir = c.imem c.fpc
A committing cycle executes fir with its latched operands, prefetches the
predicted fall-through instruction, and reads that instruction's operands early
from the pre-commit state c.arch. The early read is marked valid only when the
interlock reports the committing instruction independent of the prefetched one.
def fpCommit (c : FullPipeCell) : FullPipeCell :=
let arch' := execLatched c.fir c.ldv c.wv c.sv c.arch
let pidx := memIndexOfNat defaultConfig (c.arch.pc.toNat + 1)
let nir := c.imem pidx
{ arch := arch', imem := c.imem, busy := !arch'.halted,
fvalid := true, fpc := pidx, fir := nir,
ovalid := indepB c.fir nir,
ldv := readData c.arch (memIndexOfWord defaultConfig (readReg c.arch nir.ra)),
wv := readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr),
sv := readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr) }
def fpBubble (c : FullPipeCell) : FullPipeCell :=
let widx := fpWantIdx c.arch
let wir := c.imem widx
{ arch := c.arch, imem := c.imem, busy := c.busy,
fvalid := true, fpc := widx, fir := wir, ovalid := true,
ldv := readData c.arch (memIndexOfWord defaultConfig (readReg c.arch wir.ra)),
wv := readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr),
sv := readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr) }
def fpstep (c : FullPipeCell) : FullPipeCell :=
if c.busy then
if c.arch.halted then c
else if c.fvalid && c.ovalid && (c.fpc == fpWantIdx c.arch) then fpCommit c
else fpBubble c
else c
A bubble reads its operands from the committed state, so execLatched_eq makes
its operand latch valid immediately — a bubble always satisfies OpInv.
theorem fpBubble_opInv (c : FullPipeCell) : OpInv (fpBubble c) := by c:FullPipeCell⊢ OpInv (fpBubble c)
intro _ c:FullPipeCella✝:(fpBubble c).ovalid = true⊢ execLatched (fpBubble c).fir (fpBubble c).ldv (fpBubble c).wv (fpBubble c).sv (fpBubble c).arch =
execDecoded (fpBubble c).fir (fpBubble c).arch
simp only [fpBubble] c:FullPipeCella✝:(fpBubble c).ovalid = true⊢ execLatched (c.imem (fpWantIdx c.arch))
(readData c.arch (memIndexOfWord defaultConfig (readReg c.arch (c.imem (fpWantIdx c.arch)).ra)))
(readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr))
(readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr)) c.arch =
execDecoded (c.imem (fpWantIdx c.arch)) c.arch
exact execLatched_eq (c.imem (fpWantIdx c.arch)) c.arch All goals completed! 🐙
theorem fpBubble_fetchInv (c : FullPipeCell) : FetchInv (fpBubble c) := by c:FullPipeCell⊢ FetchInv (fpBubble c)
intro _ c:FullPipeCella✝:(fpBubble c).fvalid = true⊢ (fpBubble c).fir = (fpBubble c).imem (fpBubble c).fpc; rfl All goals completed! 🐙
The commit preserves both invariants. The fetch latch reloads from memory at the
recorded index. For the operand latch: assuming OpInv c, the current commit
computes arch' = execDecoded c.fir c.arch, and then the early read of the next
instruction's operands from c.arch is exactly the safe overlap — valid against
arch' precisely when the interlock fired.
theorem fpCommit_fetchInv (c : FullPipeCell) : FetchInv (fpCommit c) := by c:FullPipeCell⊢ FetchInv (fpCommit c)
intro _ c:FullPipeCella✝:(fpCommit c).fvalid = true⊢ (fpCommit c).fir = (fpCommit c).imem (fpCommit c).fpc; rfl All goals completed! 🐙
theorem fpCommit_opInv (c : FullPipeCell) (hc : OpInv c) (hv : c.ovalid = true) :
OpInv (fpCommit c) := by c:FullPipeCellhc:OpInv chv:c.ovalid = true⊢ OpInv (fpCommit c)
intro hov c:FullPipeCellhc:OpInv chv:c.ovalid = truehov:(fpCommit c).ovalid = true⊢ execLatched (fpCommit c).fir (fpCommit c).ldv (fpCommit c).wv (fpCommit c).sv (fpCommit c).arch =
execDecoded (fpCommit c).fir (fpCommit c).arch
simp only [fpCommit] at hov ⊢ c:FullPipeCellhc:OpInv chv:c.ovalid = truehov:indepB c.fir (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) = true⊢ execLatched (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1)))
(readData c.arch
(memIndexOfWord defaultConfig
(readReg c.arch (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))).ra)))
(readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr))
(readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr)) (execLatched c.fir c.ldv c.wv c.sv c.arch) =
execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1)))
(execLatched c.fir c.ldv c.wv c.sv c.arch)
rw [hc hv c:FullPipeCellhc:OpInv chv:c.ovalid = truehov:indepB c.fir (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) = true⊢ execLatched (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1)))
(readData c.arch
(memIndexOfWord defaultConfig
(readReg c.arch (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))).ra)))
(readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr))
(readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr)) (execDecoded c.fir c.arch) =
execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (execDecoded c.fir c.arch)] c:FullPipeCellhc:OpInv chv:c.ovalid = truehov:indepB c.fir (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) = true⊢ execLatched (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1)))
(readData c.arch
(memIndexOfWord defaultConfig
(readReg c.arch (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))).ra)))
(readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr))
(readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr)) (execDecoded c.fir c.arch) =
execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (execDecoded c.fir c.arch)
have hindep : Indep c.fir (c.imem (memIndexOfNat defaultConfig (c.arch.pc.toNat + 1))) :=
indepB_imp_Indep _ _ hov c:FullPipeCellhc:OpInv chv:c.ovalid = truehov:indepB c.fir (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) = truehindep:Indep c.fir (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1)))⊢ execLatched (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1)))
(readData c.arch
(memIndexOfWord defaultConfig
(readReg c.arch (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))).ra)))
(readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr))
(readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr)) (execDecoded c.fir c.arch) =
execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (execDecoded c.fir c.arch)
have hso := safe_overlap c.fir
(c.imem (memIndexOfNat defaultConfig (c.arch.pc.toNat + 1))) c.arch hindep c:FullPipeCellhc:OpInv chv:c.ovalid = truehov:indepB c.fir (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) = truehindep:Indep c.fir (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1)))hso:execLatched (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1)))
(memOps (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) c.arch).fst
(memOps (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) c.arch).snd.fst
(memOps (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) c.arch).snd.snd
(execDecoded c.fir c.arch) =
execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (execDecoded c.fir c.arch)⊢ execLatched (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1)))
(readData c.arch
(memIndexOfWord defaultConfig
(readReg c.arch (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))).ra)))
(readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr))
(readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr)) (execDecoded c.fir c.arch) =
execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (execDecoded c.fir c.arch)
simpa only [memOps] using hso All goals completed! 🐙
With OpInv maintained, a committing cycle refines the ISA step: the hit
condition makes the latch hold the wanted instruction, OpInv makes the latched
operands the right reads, so the commit equals execDecoded of the wanted
instruction, which refines step.
theorem fpCommit_refines_step (c : FullPipeCell) (hc : OpInv c)
(hbusy : c.busy = true) (hhalt : c.arch.halted = false)
(hvalid : c.fvalid = true) (hov : c.ovalid = true)
(hpc : c.fpc = fpWantIdx c.arch) (hfetch : FetchInv c) :
step defaultConfig (programOf c.imem) c.arch = some (fpCommit c).arch := by c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv c⊢ step defaultConfig (programOf c.imem) c.arch = some (fpCommit c).arch
have hir : c.fir = c.imem c.fpc := hfetch hvalid c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpc⊢ step defaultConfig (programOf c.imem) c.arch = some (fpCommit c).arch
have harch : (fpCommit c).arch = execDecoded c.fir c.arch := by
simp only [fpCommit] c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpc⊢ execLatched c.fir c.ldv c.wv c.sv c.arch = execDecoded c.fir c.arch; exact hc hov c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.arch⊢ step defaultConfig (programOf c.imem) c.arch = some (fpCommit c).arch
rw [harch c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.arch⊢ step defaultConfig (programOf c.imem) c.arch = some (execDecoded c.fir c.arch)] c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.arch⊢ step defaultConfig (programOf c.imem) c.arch = some (execDecoded c.fir c.arch)
have hstep := execDecoded_refines_step c.imem c.arch hhalt c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.archhstep:step defaultConfig (programOf c.imem) c.arch =
some (execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch)⊢ step defaultConfig (programOf c.imem) c.arch = some (execDecoded c.fir c.arch)
have hidx : c.fir = c.imem (memIndexOfNat defaultConfig c.arch.pc.toNat) := by c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv c⊢ step defaultConfig (programOf c.imem) c.arch = some (fpCommit c).arch
rw [hir, c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.archhstep:step defaultConfig (programOf c.imem) c.arch =
some (execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch)⊢ c.imem c.fpc = c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc)) hpc c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.archhstep:step defaultConfig (programOf c.imem) c.arch =
some (execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch)⊢ c.imem (fpWantIdx c.arch) = c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))] c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.archhstep:step defaultConfig (programOf c.imem) c.arch =
some (execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch)⊢ c.imem (fpWantIdx c.arch) = c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc)); rfl c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.archhstep:step defaultConfig (programOf c.imem) c.arch =
some (execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch)hidx:c.fir = c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))⊢ step defaultConfig (programOf c.imem) c.arch = some (execDecoded c.fir c.arch)
rw [hstep, c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.archhstep:step defaultConfig (programOf c.imem) c.arch =
some (execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch)hidx:c.fir = c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))⊢ some (execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch) =
some (execDecoded c.fir c.arch) hidx c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.archhstep:step defaultConfig (programOf c.imem) c.arch =
some (execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch)hidx:c.fir = c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))⊢ some (execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch) =
some (execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch)] All goals completed! 🐙
A non-committing cycle — a mispredicted fetch (taken branch) or a stalled operand (dependent read) — is a bubble: it leaves the architectural state untouched and produces a hit-ready state, so the very next cycle commits. Two clocks therefore advance exactly one sequential step. Straight-line independent code never bubbles and commits one instruction per cycle.
theorem fpBubble_then_commit (c : FullPipeCell)
(hbusy : c.busy = true) (hhalt : c.arch.halted = false)
(hmiss : (c.fvalid && c.ovalid && (c.fpc == fpWantIdx c.arch)) = false) :
step defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch := by c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = false⊢ step defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch
have hb : fpstep c = fpBubble c := by simp [fpstep, hbusy, hhalt, hmiss] c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble c⊢ step defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch
have hbbusy : (fpBubble c).busy = true := hbusy c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = true⊢ step defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch
have hbhalt : (fpBubble c).arch.halted = false := hhalt c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truehbhalt:(fpBubble c).arch.halted = false⊢ step defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch
have hbpc : (fpBubble c).fpc = fpWantIdx (fpBubble c).arch := rfl c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truehbhalt:(fpBubble c).arch.halted = falsehbpc:(fpBubble c).fpc = fpWantIdx (fpBubble c).arch⊢ step defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch
have hcommit : fpstep (fpBubble c) = fpCommit (fpBubble c) := by
have hit : ((fpBubble c).fvalid && (fpBubble c).ovalid
&& ((fpBubble c).fpc == fpWantIdx (fpBubble c).arch)) = true := by c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = false⊢ step defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch
simp [fpBubble] c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truehbhalt:(fpBubble c).arch.halted = falsehbpc:(fpBubble c).fpc = fpWantIdx (fpBubble c).archhit:((fpBubble c).fvalid && (fpBubble c).ovalid && (fpBubble c).fpc == fpWantIdx (fpBubble c).arch) = true⊢ fpstep (fpBubble c) = fpCommit (fpBubble c)
simp [fpstep, hbbusy, hbhalt, hit] c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truehbhalt:(fpBubble c).arch.halted = falsehbpc:(fpBubble c).fpc = fpWantIdx (fpBubble c).archhcommit:fpstep (fpBubble c) = fpCommit (fpBubble c)⊢ step defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch
have href := fpCommit_refines_step (fpBubble c) (fpBubble_opInv c) hbbusy hbhalt
rfl rfl hbpc (fpBubble_fetchInv c) c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truehbhalt:(fpBubble c).arch.halted = falsehbpc:(fpBubble c).fpc = fpWantIdx (fpBubble c).archhcommit:fpstep (fpBubble c) = fpCommit (fpBubble c)href:step defaultConfig (programOf (fpBubble c).imem) (fpBubble c).arch = some (fpCommit (fpBubble c)).arch⊢ step defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch
rw [hb, c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truehbhalt:(fpBubble c).arch.halted = falsehbpc:(fpBubble c).fpc = fpWantIdx (fpBubble c).archhcommit:fpstep (fpBubble c) = fpCommit (fpBubble c)href:step defaultConfig (programOf (fpBubble c).imem) (fpBubble c).arch = some (fpCommit (fpBubble c)).arch⊢ step defaultConfig (programOf c.imem) c.arch = some (fpstep (fpBubble c)).arch hcommit c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truehbhalt:(fpBubble c).arch.halted = falsehbpc:(fpBubble c).fpc = fpWantIdx (fpBubble c).archhcommit:fpstep (fpBubble c) = fpCommit (fpBubble c)href:step defaultConfig (programOf (fpBubble c).imem) (fpBubble c).arch = some (fpCommit (fpBubble c)).arch⊢ step defaultConfig (programOf c.imem) c.arch = some (fpCommit (fpBubble c)).arch] c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truehbhalt:(fpBubble c).arch.halted = falsehbpc:(fpBubble c).fpc = fpWantIdx (fpBubble c).archhcommit:fpstep (fpBubble c) = fpCommit (fpBubble c)href:step defaultConfig (programOf (fpBubble c).imem) (fpBubble c).arch = some (fpCommit (fpBubble c)).arch⊢ step defaultConfig (programOf c.imem) c.arch = some (fpCommit (fpBubble c)).arch
exact href All goals completed! 🐙
def fpRun : Nat -> FullPipeCell -> FullPipeCell
| 0, c => c
| k + 1, c => fpRun k (fpstep c)
end Honeycomb
The correctness account is now complete in the same shape as the pipelined-fetch
chapter: every committing cycle equals one execDecoded and refines the ISA
step while preserving both latch invariants; every non-committing cycle is a
value-free bubble immediately followed by a commit. So the sequence of committed
architectural states is exactly the sequential ISA trace, with isolated
single-cycle bubbles at a taken branch or a genuine operand dependency. This is
the model the generated pipelined cell is rendered from next.
11.1. The whole run, machine-checked
As with the synchronous cell, the composition is a theorem (review R4). The
pipeline's timing is data-dependent — a taken branch or a dependent operand
costs a bubble — so the cycle count is a computed schedule rather than a
constant: fpCycles n c charges one clock per ready commit and two per
bubbled one, and is at most 2 * n. Under that schedule the pipeline is a
simulation of the combinational cycle model, and therefore — while the machine
keeps executing — of the ISA trace itself: n instructions retire in at most
2 * n clocks, exactly the sequential trace, bubbles and all.
namespace Honeycomb
/-- The cycle-model view of a full-pipeline cell. -/
def FullPipeCell.toCellState (c : FullPipeCell) : CellState :=
{ arch := c.arch, imem := c.imem, busy := c.busy }
/-- The commit-readiness test, exactly the hit condition `fpstep` keys on. -/
def fpReady (c : FullPipeCell) : Bool :=
c.fvalid && c.ovalid && (c.fpc == fpWantIdx c.arch)
/-- The pipeline's schedule: one clock per ready commit, two per bubbled one. -/
def fpCycles : Nat → FullPipeCell → Nat
| 0, _ => 0
| n + 1, c =>
if fpReady c then 1 + fpCycles n (fpstep c)
else 2 + fpCycles n (fpstep (fpstep c))
/-- ... and through the pipeline. -/
theorem fpstep_stalls (c : FullPipeCell)
(h : ¬(c.busy = true ∧ c.arch.halted = false)) : fpstep c = c := by c:FullPipeCellh:¬(c.busy = true ∧ c.arch.halted = false)⊢ fpstep c = c
by_cases hb : c.busy pos c:FullPipeCellh:¬(c.busy = true ∧ c.arch.halted = false)hb:c.busy = true⊢ fpstep c = cneg c:FullPipeCellh:¬(c.busy = true ∧ c.arch.halted = false)hb:¬c.busy = true⊢ fpstep c = c
· pos c:FullPipeCellh:¬(c.busy = true ∧ c.arch.halted = false)hb:c.busy = true⊢ fpstep c = c have hh : c.arch.halted = true := by
cases hx : c.arch.halted false c:FullPipeCellh:¬(c.busy = true ∧ c.arch.halted = false)hb:c.busy = truehx:c.arch.halted = false⊢ false = truetrue c:FullPipeCellh:¬(c.busy = true ∧ c.arch.halted = false)hb:c.busy = truehx:c.arch.halted = true⊢ true = true
· false c:FullPipeCellh:¬(c.busy = true ∧ c.arch.halted = false)hb:c.busy = truehx:c.arch.halted = false⊢ false = true exact absurd ⟨hb, hx⟩ h All goals completed! 🐙
· true c:FullPipeCellh:¬(c.busy = true ∧ c.arch.halted = false)hb:c.busy = truehx:c.arch.halted = true⊢ true = true rfl pos c:FullPipeCellh:¬(c.busy = true ∧ c.arch.halted = false)hb:c.busy = truehh:c.arch.halted = true⊢ fpstep c = c
simp [fpstep, hb, hh] All goals completed! 🐙
· neg c:FullPipeCellh:¬(c.busy = true ∧ c.arch.halted = false)hb:¬c.busy = true⊢ fpstep c = c simp [fpstep, hb] All goals completed! 🐙
/-- A ready commit is one iteration of the cycle model on the projected state. -/
theorem fpCommit_toCellState (c : FullPipeCell)
(hOp : OpInv c) (hFetch : FetchInv c)
(hb : c.busy = true) (hh : c.arch.halted = false) (hr : fpReady c = true) :
(fpCommit c).toCellState = cellExecCycle c.toCellState := by c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = true⊢ (fpCommit c).toCellState = cellExecCycle c.toCellState
simp only [fpReady, Bool.and_eq_true, beq_iff_eq] at hr c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehr:(c.fvalid = true ∧ c.ovalid = true) ∧ c.fpc = fpWantIdx c.arch⊢ (fpCommit c).toCellState = cellExecCycle c.toCellState
obtain ⟨⟨hfv, hov⟩, hpc⟩ := hr c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = true⊢ (fpCommit c).toCellState = cellExecCycle c.toCellState
have harch : (fpCommit c).arch
= execDecoded (c.imem (memIndexOfNat defaultConfig c.arch.pc.toNat)) c.arch := by
show execLatched c.fir c.ldv c.wv c.sv c.arch = _ c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = true⊢ execLatched c.fir c.ldv c.wv c.sv c.arch =
execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch
rw [hOp hov, c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = true⊢ execDecoded c.fir c.arch = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch hFetch hfv, c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = true⊢ execDecoded (c.imem c.fpc) c.arch = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch hpc c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = true⊢ execDecoded (c.imem (fpWantIdx c.arch)) c.arch =
execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch] c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = true⊢ execDecoded (c.imem (fpWantIdx c.arch)) c.arch =
execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch
rfl c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = trueharch:(fpCommit c).arch = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch⊢ (fpCommit c).toCellState = cellExecCycle c.toCellState
have hbusy : (fpCommit c).busy
= !(execDecoded (c.imem (memIndexOfNat defaultConfig c.arch.pc.toNat))
c.arch).halted := by
show (!(execLatched c.fir c.ldv c.wv c.sv c.arch).halted) = _ c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = trueharch:(fpCommit c).arch = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch⊢ (!(execLatched c.fir c.ldv c.wv c.sv c.arch).halted) =
!(execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch).halted
rw [hOp hov, c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = trueharch:(fpCommit c).arch = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch⊢ (!(execDecoded c.fir c.arch).halted) =
!(execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch).halted hFetch hfv, c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = trueharch:(fpCommit c).arch = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch⊢ (!(execDecoded (c.imem c.fpc) c.arch).halted) =
!(execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch).halted hpc c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = trueharch:(fpCommit c).arch = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch⊢ (!(execDecoded (c.imem (fpWantIdx c.arch)) c.arch).halted) =
!(execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch).halted] c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = trueharch:(fpCommit c).arch = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch⊢ (!(execDecoded (c.imem (fpWantIdx c.arch)) c.arch).halted) =
!(execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch).halted
rfl c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = trueharch:(fpCommit c).arch = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.archhbusy:(fpCommit c).busy = !(execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch).halted⊢ (fpCommit c).toCellState = cellExecCycle c.toCellState
simp [FullPipeCell.toCellState, cellExecCycle, hb, hh, harch, hbusy] c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = trueharch:(fpCommit c).arch = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.archhbusy:(fpCommit c).busy = !(execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch).halted⊢ (fpCommit c).imem = c.imem
rfl All goals completed! 🐙
/-- **The run-level simulation, on the pipeline's own schedule.** Under the two
latch invariants, `fpCycles n c` clocks are exactly `n` iterations of the
combinational cycle model — with the invariants preserved and the schedule
bounded by two clocks per instruction. Unconditional in `n`: a halted or
stopped machine holds state on both sides. -/
theorem fpRun_refines_cellExecCycleN (n : Nat) (c : FullPipeCell)
(hOp : OpInv c) (hFetch : FetchInv c) :
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState
∧ OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c)
∧ fpCycles n c ≤ 2 * n := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
induction n generalizing c with
| zero => zero c:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles 0 c) c).toCellState = cellExecCycleN 0 c.toCellState ∧
OpInv (fpRun (fpCycles 0 c) c) ∧ FetchInv (fpRun (fpCycles 0 c) c) ∧ fpCycles 0 c ≤ 2 * 0 exact ⟨rfl, hOp, hFetch, by c:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ fpCycles 0 c ≤ 2 * 0 simp [fpCycles] All goals completed! 🐙⟩
| succ n ih => succ n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hunf : cellExecCycleN (n + 1) c.toCellState
= cellExecCycleN n (cellExecCycle c.toCellState) := rfl succ n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
by_cases hlive : c.busy = true ∧ c.arch.halted = false pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:c.busy = true ∧ c.arch.halted = false⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
· pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:c.busy = true ∧ c.arch.halted = false⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1) obtain ⟨hb, hh⟩ := hlive pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = false⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
by_cases hr : fpReady c = true pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = true⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = true⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
· pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = true⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1) -- ready: one clock commits
have hstep : fpstep c = fpCommit c := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
have : (c.fvalid && c.ovalid && (c.fpc == fpWantIdx c.arch)) = true := hr n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truethis:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = true⊢ fpstep c = fpCommit c
simp [fpstep, hb, hh, this] pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit c⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hcyc : fpCycles (n + 1) c = 1 + fpCycles n (fpstep c) := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
simp [fpCycles, hr] pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hOp' : OpInv (fpstep c) := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
rw [hstep n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)⊢ OpInv (fpCommit c)] n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)⊢ OpInv (fpCommit c)
exact fpCommit_opInv c hOp (by n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)⊢ c.ovalid = true
simp only [fpReady, Bool.and_eq_true] at hr n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hr:(c.fvalid = true ∧ c.ovalid = true) ∧ (c.fpc == fpWantIdx c.arch) = true⊢ c.ovalid = true; exact hr.1.2 All goals completed! 🐙) pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hFetch' : FetchInv (fpstep c) := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
rw [hstep n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)⊢ FetchInv (fpCommit c)] n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)⊢ FetchInv (fpCommit c); exact fpCommit_fetchInv c pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
obtain ⟨hsim, hOp'', hFetch'', hbound⟩ := ih (fpstep c) hOp' hFetch' pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * n⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hproj : (fpstep c).toCellState = cellExecCycle c.toCellState := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
rw [hstep n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * n⊢ (fpCommit c).toCellState = cellExecCycle c.toCellState] n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * n⊢ (fpCommit c).toCellState = cellExecCycle c.toCellState; exact fpCommit_toCellState c hOp hFetch hb hh hr pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
refine ⟨?_, ?_, ?_, by n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ fpCycles (n + 1) c ≤ 2 * (n + 1) omega All goals completed! 🐙⟩
· pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState rw [hcyc, pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ (fpRun (1 + fpCycles n (fpstep c)) c).toCellState = cellExecCycleN (n + 1) c.toCellState show 1 + fpCycles n (fpstep c) = fpCycles n (fpstep c) + 1 by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n omega All goals completed! 🐙] pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ (fpRun (fpCycles n (fpstep c) + 1) c).toCellState = cellExecCycleN (n + 1) c.toCellState
show (fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = _ pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ (fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN (n + 1) c.toCellState
rw [hsim, pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ cellExecCycleN n (fpstep c).toCellState = cellExecCycleN (n + 1) c.toCellState hunf, pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ cellExecCycleN n (fpstep c).toCellState = cellExecCycleN n (cellExecCycle c.toCellState) hproj pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ cellExecCycleN n (cellExecCycle c.toCellState) = cellExecCycleN n (cellExecCycle c.toCellState)] All goals completed! 🐙
· pos.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ OpInv (fpRun (fpCycles (n + 1) c) c) rw [hcyc, pos.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ OpInv (fpRun (1 + fpCycles n (fpstep c)) c) show 1 + fpCycles n (fpstep c) = fpCycles n (fpstep c) + 1 by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n omega All goals completed! 🐙] pos.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ OpInv (fpRun (fpCycles n (fpstep c) + 1) c)
exact hOp'' All goals completed! 🐙
· pos.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ FetchInv (fpRun (fpCycles (n + 1) c) c) rw [hcyc, pos.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ FetchInv (fpRun (1 + fpCycles n (fpstep c)) c) show 1 + fpCycles n (fpstep c) = fpCycles n (fpstep c) + 1 by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n omega All goals completed! 🐙] pos.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) ≤ 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState⊢ FetchInv (fpRun (fpCycles n (fpstep c) + 1) c)
exact hFetch'' All goals completed! 🐙
· neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = true⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1) -- miss: a bubble, then the commit — two clocks
have hmiss : (c.fvalid && c.ovalid && (c.fpc == fpWantIdx c.arch)) = false := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
have : fpReady c = false := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
cases hx : fpReady c false n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehx:fpReady c = false⊢ false = falsetrue n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehx:fpReady c = true⊢ true = false
· false n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehx:fpReady c = false⊢ false = false rfl All goals completed! 🐙
· true n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehx:fpReady c = true⊢ true = false exact absurd hx hr n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truethis:fpReady c = false⊢ (c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = false
simpa [fpReady] using this neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = false⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hstep1 : fpstep c = fpBubble c := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n simp [fpstep, hb, hh, hmiss] neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble c⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hready2 : fpReady (fpBubble c) = true := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
simp [fpReady, fpBubble] neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = true⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hstep2 : fpstep (fpBubble c) = fpCommit (fpBubble c) := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
have hhit : ((fpBubble c).fvalid && (fpBubble c).ovalid
&& ((fpBubble c).fpc == fpWantIdx (fpBubble c).arch)) = true := hready2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehhit:((fpBubble c).fvalid && (fpBubble c).ovalid && (fpBubble c).fpc == fpWantIdx (fpBubble c).arch) = true⊢ fpstep (fpBubble c) = fpCommit (fpBubble c)
have hbb : (fpBubble c).busy = true := hb n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehhit:((fpBubble c).fvalid && (fpBubble c).ovalid && (fpBubble c).fpc == fpWantIdx (fpBubble c).arch) = truehbb:(fpBubble c).busy = true⊢ fpstep (fpBubble c) = fpCommit (fpBubble c)
have hbh : (fpBubble c).arch.halted = false := hh n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehhit:((fpBubble c).fvalid && (fpBubble c).ovalid && (fpBubble c).fpc == fpWantIdx (fpBubble c).arch) = truehbb:(fpBubble c).busy = truehbh:(fpBubble c).arch.halted = false⊢ fpstep (fpBubble c) = fpCommit (fpBubble c)
simp [fpstep, hbb, hbh, hhit] neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hcyc : fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c)) := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
have : fpReady c = false := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
cases hx : fpReady c false n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hx:fpReady c = false⊢ false = falsetrue n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hx:fpReady c = true⊢ true = false
· false n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hx:fpReady c = false⊢ false = false rfl All goals completed! 🐙
· true n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hx:fpReady c = true⊢ true = false exact absurd hx hr n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)this:fpReady c = false⊢ fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))
simp [fpCycles, this] neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hOp' : OpInv (fpstep (fpstep c)) := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
rw [hstep1, n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))⊢ OpInv (fpstep (fpBubble c)) hstep2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))⊢ OpInv (fpCommit (fpBubble c))] n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))⊢ OpInv (fpCommit (fpBubble c))
exact fpCommit_opInv _ (fpBubble_opInv c) rfl neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hFetch' : FetchInv (fpstep (fpstep c)) := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
rw [hstep1, n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))⊢ FetchInv (fpstep (fpBubble c)) hstep2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))⊢ FetchInv (fpCommit (fpBubble c))] n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))⊢ FetchInv (fpCommit (fpBubble c)); exact fpCommit_fetchInv _ neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
obtain ⟨hsim, hOp'', hFetch'', hbound⟩ := ih (fpstep (fpstep c)) hOp' hFetch' neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * n⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hproj : (fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
rw [hstep1, n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * n⊢ (fpstep (fpBubble c)).toCellState = cellExecCycle c.toCellState hstep2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * n⊢ (fpCommit (fpBubble c)).toCellState = cellExecCycle c.toCellState] n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * n⊢ (fpCommit (fpBubble c)).toCellState = cellExecCycle c.toCellState
have := fpCommit_toCellState (fpBubble c) (fpBubble_opInv c)
(fpBubble_fetchInv c) hb hh hready2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nthis:(fpCommit (fpBubble c)).toCellState = cellExecCycle (fpBubble c).toCellState⊢ (fpCommit (fpBubble c)).toCellState = cellExecCycle c.toCellState
rw [this n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nthis:(fpCommit (fpBubble c)).toCellState = cellExecCycle (fpBubble c).toCellState⊢ cellExecCycle (fpBubble c).toCellState = cellExecCycle c.toCellState] n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nthis:(fpCommit (fpBubble c)).toCellState = cellExecCycle (fpBubble c).toCellState⊢ cellExecCycle (fpBubble c).toCellState = cellExecCycle c.toCellState
show cellExecCycle c.toCellState = _ n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nthis:(fpCommit (fpBubble c)).toCellState = cellExecCycle (fpBubble c).toCellState⊢ cellExecCycle c.toCellState = cellExecCycle c.toCellState
rfl neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
refine ⟨?_, ?_, ?_, by n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ fpCycles (n + 1) c ≤ 2 * (n + 1) omega All goals completed! 🐙⟩
· neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState rw [hcyc, neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ (fpRun (2 + fpCycles n (fpstep (fpstep c))) c).toCellState = cellExecCycleN (n + 1) c.toCellState show 2 + fpCycles n (fpstep (fpstep c))
= fpCycles n (fpstep (fpstep c)) + 1 + 1 by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n omega All goals completed! 🐙] neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ (fpRun (fpCycles n (fpstep (fpstep c)) + 1 + 1) c).toCellState = cellExecCycleN (n + 1) c.toCellState
show (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState = _ neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState = cellExecCycleN (n + 1) c.toCellState
rw [hsim, neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ cellExecCycleN n (fpstep (fpstep c)).toCellState = cellExecCycleN (n + 1) c.toCellState hunf, neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ cellExecCycleN n (fpstep (fpstep c)).toCellState = cellExecCycleN n (cellExecCycle c.toCellState) hproj neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ cellExecCycleN n (cellExecCycle c.toCellState) = cellExecCycleN n (cellExecCycle c.toCellState)] All goals completed! 🐙
· neg.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ OpInv (fpRun (fpCycles (n + 1) c) c) rw [hcyc, neg.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ OpInv (fpRun (2 + fpCycles n (fpstep (fpstep c))) c) show 2 + fpCycles n (fpstep (fpstep c))
= fpCycles n (fpstep (fpstep c)) + 1 + 1 by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n omega All goals completed! 🐙] neg.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ OpInv (fpRun (fpCycles n (fpstep (fpstep c)) + 1 + 1) c)
exact hOp'' All goals completed! 🐙
· neg.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ FetchInv (fpRun (fpCycles (n + 1) c) c) rw [hcyc, neg.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ FetchInv (fpRun (2 + fpCycles n (fpstep (fpstep c))) c) show 2 + fpCycles n (fpstep (fpstep c))
= fpCycles n (fpstep (fpstep c)) + 1 + 1 by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n omega All goals completed! 🐙] neg.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState =
cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) ≤ 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState⊢ FetchInv (fpRun (fpCycles n (fpstep (fpstep c)) + 1 + 1) c)
exact hFetch'' All goals completed! 🐙
· neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1) -- stopped: both machines hold
have hstall : fpstep c = c := fpstep_stalls c hlive neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = c⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hcell : cellExecCycle c.toCellState = c.toCellState := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
apply cellExecCycle_stalls n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = c⊢ ¬(c.toCellState.busy = true ∧ c.toCellState.arch.halted = false)
simpa [FullPipeCell.toCellState] using hlive neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellState⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
obtain ⟨hsim, hOp'', hFetch'', hbound⟩ := ih c hOp hFetch neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * n⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
by_cases hr : fpReady c = true pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = true⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = true⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
· pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = true⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1) have hcyc : fpCycles (n + 1) c = 1 + fpCycles n c := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
simp [fpCycles, hr, hstall] pos n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
refine ⟨?_, ?_, ?_, by n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ fpCycles (n + 1) c ≤ 2 * (n + 1) omega All goals completed! 🐙⟩ <;> pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellStatepos.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ OpInv (fpRun (fpCycles (n + 1) c) c)pos.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ FetchInv (fpRun (fpCycles (n + 1) c) c)
rw [hcyc, pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ (fpRun (1 + fpCycles n c) c).toCellState = cellExecCycleN (n + 1) c.toCellState show 1 + fpCycles n c = fpCycles n c + 1 by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n omega All goals completed! 🐙] pos.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ OpInv (fpRun (fpCycles n c + 1) c) pos.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c + 1) c) <;> pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ (fpRun (fpCycles n c + 1) c).toCellState = cellExecCycleN (n + 1) c.toCellStatepos.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ OpInv (fpRun (fpCycles n c + 1) c)pos.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c + 1) c)
first
| (show (fpRun (fpCycles n c) (fpstep c)).toCellState = _ pos.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c + 1) c)
rw [hstall, pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN (n + 1) c.toCellState hsim, pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ cellExecCycleN n c.toCellState = cellExecCycleN (n + 1) c.toCellState hunf, pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ cellExecCycleN n c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState) hcell pos.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ cellExecCycleN n c.toCellState = cellExecCycleN n c.toCellState] All goals completed! 🐙)
| (show OpInv (fpRun (fpCycles n c) (fpstep c)) pos.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c + 1) c)
rw [hstall pos.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ OpInv (fpRun (fpCycles n c) c)] pos.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ OpInv (fpRun (fpCycles n c) c); exact hOp'' All goals completed! 🐙)
| (show FetchInv (fpRun (fpCycles n c) (fpstep c)) pos.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c) (fpstep c))
rw [hstall pos.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c) c)] pos.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c) c); exact hFetch'' All goals completed! 🐙)
· neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = true⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1) have hrf : fpReady c = false := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
cases hx : fpReady c false n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehx:fpReady c = false⊢ false = falsetrue n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehx:fpReady c = true⊢ true = false
· false n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehx:fpReady c = false⊢ false = false rfl All goals completed! 🐙
· true n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehx:fpReady c = true⊢ true = false exact absurd hx hr neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = false⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
have hcyc : fpCycles (n + 1) c = 2 + fpCycles n c := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n
simp [fpCycles, hrf, hstall] neg n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState ∧
OpInv (fpRun (fpCycles (n + 1) c) c) ∧ FetchInv (fpRun (fpCycles (n + 1) c) c) ∧ fpCycles (n + 1) c ≤ 2 * (n + 1)
refine ⟨?_, ?_, ?_, by n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ fpCycles (n + 1) c ≤ 2 * (n + 1) omega All goals completed! 🐙⟩ <;> neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ (fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellStateneg.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ OpInv (fpRun (fpCycles (n + 1) c) c)neg.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ FetchInv (fpRun (fpCycles (n + 1) c) c)
rw [hcyc, neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ (fpRun (2 + fpCycles n c) c).toCellState = cellExecCycleN (n + 1) c.toCellState show 2 + fpCycles n c = fpCycles n c + 1 + 1 by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * n omega All goals completed! 🐙] neg.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ OpInv (fpRun (fpCycles n c + 1 + 1) c) neg.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c + 1 + 1) c) <;> neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ (fpRun (fpCycles n c + 1 + 1) c).toCellState = cellExecCycleN (n + 1) c.toCellStateneg.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ OpInv (fpRun (fpCycles n c + 1 + 1) c)neg.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c + 1 + 1) c)
first
| (show (fpRun (fpCycles n c) (fpstep (fpstep c))).toCellState = _ neg.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c + 1 + 1) c)
rw [hstall, neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ (fpRun (fpCycles n c) (fpstep c)).toCellState = cellExecCycleN (n + 1) c.toCellState hstall, neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ (fpRun (fpCycles n c) c).toCellState = cellExecCycleN (n + 1) c.toCellState hsim, neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ cellExecCycleN n c.toCellState = cellExecCycleN (n + 1) c.toCellState hunf, neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ cellExecCycleN n c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState) hcell neg.refine_1 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ cellExecCycleN n c.toCellState = cellExecCycleN n c.toCellState] All goals completed! 🐙)
| (show OpInv (fpRun (fpCycles n c) (fpstep (fpstep c))) neg.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c + 1 + 1) c)
rw [hstall, neg.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ OpInv (fpRun (fpCycles n c) (fpstep c)) hstall neg.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ OpInv (fpRun (fpCycles n c) c)] neg.refine_2 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ OpInv (fpRun (fpCycles n c) c); exact hOp'' All goals completed! 🐙)
| (show FetchInv (fpRun (fpCycles n c) (fpstep (fpstep c))) neg.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c) (fpstep (fpstep c)))
rw [hstall, neg.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c) (fpstep c)) hstall neg.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c) c)] neg.refine_3 n:Natih:∀ (c : FullPipeCell),
OpInv c →
FetchInv c →
(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState ∧
OpInv (fpRun (fpCycles n c) c) ∧ FetchInv (fpRun (fpCycles n c) c) ∧ fpCycles n c ≤ 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true ∧ c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c⊢ FetchInv (fpRun (fpCycles n c) c); exact hFetch'' All goals completed! 🐙)
/-- **The ISA trace, at one-to-two clocks per instruction.** While the machine
keeps executing, `fpCycles n c ≤ 2 * n` clocks of the full pipeline compute
exactly `n` ISA steps: the interlocked, fall-through-predicted pipeline retires
the sequential trace on its own schedule. -/
theorem fpRun_commits_trace (n : Nat) (c : FullPipeCell)
(hOp : OpInv c) (hFetch : FetchInv c)
(hlive : ∀ k, k < n →
(cellExecCycleN k c.toCellState).busy = true
∧ (cellExecCycleN k c.toCellState).arch.halted = false) :
stepN (programOf c.imem) n c.arch = some (fpRun (fpCycles n c) c).arch
∧ fpCycles n c ≤ 2 * n := by n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv chlive:∀ (k : Nat), k < n → (cellExecCycleN k c.toCellState).busy = true ∧ (cellExecCycleN k c.toCellState).arch.halted = false⊢ stepN (programOf c.imem) n c.arch = some (fpRun (fpCycles n c) c).arch ∧ fpCycles n c ≤ 2 * n
obtain ⟨hsim, _, _, hbound⟩ := fpRun_refines_cellExecCycleN n c hOp hFetch n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv chlive:∀ (k : Nat), k < n → (cellExecCycleN k c.toCellState).busy = true ∧ (cellExecCycleN k c.toCellState).arch.halted = falsehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStateleft✝¹:OpInv (fpRun (fpCycles n c) c)left✝:FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * n⊢ stepN (programOf c.imem) n c.arch = some (fpRun (fpCycles n c) c).arch ∧ fpCycles n c ≤ 2 * n
have h := cellExecCycleN_refines_stepN n c.toCellState hlive n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv chlive:∀ (k : Nat), k < n → (cellExecCycleN k c.toCellState).busy = true ∧ (cellExecCycleN k c.toCellState).arch.halted = falsehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStateleft✝¹:OpInv (fpRun (fpCycles n c) c)left✝:FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nh:stepN (programOf c.toCellState.imem) n c.toCellState.arch = some (cellExecCycleN n c.toCellState).arch⊢ stepN (programOf c.imem) n c.arch = some (fpRun (fpCycles n c) c).arch ∧ fpCycles n c ≤ 2 * n
refine ⟨?_, hbound⟩ n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv chlive:∀ (k : Nat), k < n → (cellExecCycleN k c.toCellState).busy = true ∧ (cellExecCycleN k c.toCellState).arch.halted = falsehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStateleft✝¹:OpInv (fpRun (fpCycles n c) c)left✝:FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nh:stepN (programOf c.toCellState.imem) n c.toCellState.arch = some (cellExecCycleN n c.toCellState).arch⊢ stepN (programOf c.imem) n c.arch = some (fpRun (fpCycles n c) c).arch
rw [show (fpRun (fpCycles n c) c).arch
= (fpRun (fpCycles n c) c).toCellState.arch from rfl, n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv chlive:∀ (k : Nat), k < n → (cellExecCycleN k c.toCellState).busy = true ∧ (cellExecCycleN k c.toCellState).arch.halted = falsehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStateleft✝¹:OpInv (fpRun (fpCycles n c) c)left✝:FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nh:stepN (programOf c.toCellState.imem) n c.toCellState.arch = some (cellExecCycleN n c.toCellState).arch⊢ stepN (programOf c.imem) n c.arch = some (fpRun (fpCycles n c) c).toCellState.arch hsim n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv chlive:∀ (k : Nat), k < n → (cellExecCycleN k c.toCellState).busy = true ∧ (cellExecCycleN k c.toCellState).arch.halted = falsehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStateleft✝¹:OpInv (fpRun (fpCycles n c) c)left✝:FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nh:stepN (programOf c.toCellState.imem) n c.toCellState.arch = some (cellExecCycleN n c.toCellState).arch⊢ stepN (programOf c.imem) n c.arch = some (cellExecCycleN n c.toCellState).arch] n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv chlive:∀ (k : Nat), k < n → (cellExecCycleN k c.toCellState).busy = true ∧ (cellExecCycleN k c.toCellState).arch.halted = falsehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStateleft✝¹:OpInv (fpRun (fpCycles n c) c)left✝:FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c ≤ 2 * nh:stepN (programOf c.toCellState.imem) n c.toCellState.arch = some (cellExecCycleN n c.toCellState).arch⊢ stepN (programOf c.imem) n c.arch = some (cellExecCycleN n c.toCellState).arch
simpa [FullPipeCell.toCellState] using h All goals completed! 🐙
end Honeycomb