Honeycomb

11. Full Pipeline🔗

The pipelined-fetch cell overlaps only fetch; the operand-pipeline chapter proves when the memory reads may also run a cycle early. This chapter composes the two into a single cell that overlaps fetch and operands, so straight-line independent code commits one instruction per cycle, and proves the composition still commits the sequential trace — with a one-cycle bubble only for the one real data hazard (a dependent operand read) or control hazard (a taken branch).

The overlap is a read stage running one instruction ahead of execute. While the execute stage commits the latched instruction fir with its latched operands, the read stage reads the next instruction's operands from the current architectural state — a cycle early, before the committing instruction writes back. The interlock (indepB) decides whether that early read is safe: it is, exactly when the committing instruction is independent of the one being read, and then the cell commits again next cycle; otherwise the early read is dropped and the cell bubbles for one cycle to re-read from the committed state.

namespace Honeycomb -- Boolean interlock, the decidable image of `Indep`. A load is safe to read early -- past an instruction that is not a store and does not write its address -- register; a kernel MAC past one that does not move the pointers. def writesRegB (d : DecodedInstr) (r : Reg defaultConfig) : Bool := (d.op == .movacc || d.op == .li || d.op == .ld || d.op == .alu) && (d.rd == r) def indepB (d1 d2 : DecodedInstr) : Bool := match d2.op with | .ld => (d1.op != .st) && !writesRegB d1 d2.ra | .kmac => (d1.op != .kmac) && (d1.op != .setwptr) && (d1.op != .setsptr) && (d1.op != .stw) | _ => true theorem writesRegB_iff (d : DecodedInstr) (r : Reg defaultConfig) : writesRegB d r = true WritesReg d r := d:DecodedInstrr:Reg defaultConfigwritesRegB d r = true WritesReg d r All goals completed! 🐙 theorem not_writesRegB_iff (d : DecodedInstr) (r : Reg defaultConfig) : writesRegB d r = false ¬ WritesReg d r := d:DecodedInstrr:Reg defaultConfigwritesRegB d r = false ¬WritesReg d r All goals completed! 🐙 theorem indepB_imp_Indep (d1 d2 : DecodedInstr) (h : indepB d1 d2 = true) : Indep d1 d2 := d1:DecodedInstrd2:DecodedInstrh:indepB d1 d2 = trueIndep d1 d2 d1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truematch d2.op with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => True d1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.macmatch CellOp.mac with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.kmacmatch CellOp.kmac with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.clraccmatch CellOp.clracc with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.movaccmatch CellOp.movacc with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.limatch CellOp.li with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.ldmatch CellOp.ld with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.stmatch CellOp.st with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.setwptrmatch CellOp.setwptr with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.setsptrmatch CellOp.setsptr with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.blzmatch CellOp.blz with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.haltmatch CellOp.halt with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.alumatch CellOp.alu with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.jrmatch CellOp.jr with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.stwmatch CellOp.stw with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => True d1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.macmatch CellOp.mac with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.kmacmatch CellOp.kmac with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.clraccmatch CellOp.clracc with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.movaccmatch CellOp.movacc with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.limatch CellOp.li with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.ldmatch CellOp.ld with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.stmatch CellOp.st with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.setwptrmatch CellOp.setwptr with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.setsptrmatch CellOp.setsptr with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.blzmatch CellOp.blz with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.haltmatch CellOp.halt with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.alumatch CellOp.alu with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.jrmatch CellOp.jr with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => Trued1:DecodedInstrd2:DecodedInstrh:(match d2.op with | CellOp.ld => d1.op != CellOp.st && !writesRegB d1 d2.ra | CellOp.kmac => d1.op != CellOp.kmac && d1.op != CellOp.setwptr && d1.op != CellOp.setsptr && d1.op != CellOp.stw | x => true) = truehop:d2.op = CellOp.stwmatch CellOp.stw with | CellOp.ld => d1.op CellOp.st ¬WritesReg d1 d2.ra | CellOp.kmac => d1.op CellOp.kmac d1.op CellOp.setwptr d1.op CellOp.setsptr d1.op CellOp.stw | x => True All goals completed! 🐙

The state pairs the architectural state and instruction memory with a busy bit, a fetch latch (validity, index, instruction), and an operand latch (validity plus the three latched memory operands). The operand-latch invariant OpInv is the load-bearing one: whenever the operands are valid, executing the latched instruction with them equals executing it directly — the latched operands are the right reads.

structure FullPipeCell where arch : State defaultConfig imem : Nat -> DecodedInstr busy : Bool fvalid : Bool fpc : Nat fir : DecodedInstr ovalid : Bool ldv : Word defaultConfig wv : Elem defaultConfig sv : Elem defaultConfig def fpWantIdx (s : State defaultConfig) : Nat := memIndexOfNat defaultConfig s.pc.toNat def OpInv (c : FullPipeCell) : Prop := c.ovalid = true -> execLatched c.fir c.ldv c.wv c.sv c.arch = execDecoded c.fir c.arch def FetchInv (c : FullPipeCell) : Prop := c.fvalid = true -> c.fir = c.imem c.fpc

A committing cycle executes fir with its latched operands, prefetches the predicted fall-through instruction, and reads that instruction's operands early from the pre-commit state c.arch. The early read is marked valid only when the interlock reports the committing instruction independent of the prefetched one.

def fpCommit (c : FullPipeCell) : FullPipeCell := let arch' := execLatched c.fir c.ldv c.wv c.sv c.arch let pidx := memIndexOfNat defaultConfig (c.arch.pc.toNat + 1) let nir := c.imem pidx { arch := arch', imem := c.imem, busy := !arch'.halted, fvalid := true, fpc := pidx, fir := nir, ovalid := indepB c.fir nir, ldv := readData c.arch (memIndexOfWord defaultConfig (readReg c.arch nir.ra)), wv := readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr), sv := readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr) } def fpBubble (c : FullPipeCell) : FullPipeCell := let widx := fpWantIdx c.arch let wir := c.imem widx { arch := c.arch, imem := c.imem, busy := c.busy, fvalid := true, fpc := widx, fir := wir, ovalid := true, ldv := readData c.arch (memIndexOfWord defaultConfig (readReg c.arch wir.ra)), wv := readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr), sv := readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr) } def fpstep (c : FullPipeCell) : FullPipeCell := if c.busy then if c.arch.halted then c else if c.fvalid && c.ovalid && (c.fpc == fpWantIdx c.arch) then fpCommit c else fpBubble c else c

A bubble reads its operands from the committed state, so execLatched_eq makes its operand latch valid immediately — a bubble always satisfies OpInv.

theorem fpBubble_opInv (c : FullPipeCell) : OpInv (fpBubble c) := c:FullPipeCellOpInv (fpBubble c) c:FullPipeCella✝:(fpBubble c).ovalid = trueexecLatched (fpBubble c).fir (fpBubble c).ldv (fpBubble c).wv (fpBubble c).sv (fpBubble c).arch = execDecoded (fpBubble c).fir (fpBubble c).arch c:FullPipeCella✝:(fpBubble c).ovalid = trueexecLatched (c.imem (fpWantIdx c.arch)) (readData c.arch (memIndexOfWord defaultConfig (readReg c.arch (c.imem (fpWantIdx c.arch)).ra))) (readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr)) (readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr)) c.arch = execDecoded (c.imem (fpWantIdx c.arch)) c.arch All goals completed! 🐙 theorem fpBubble_fetchInv (c : FullPipeCell) : FetchInv (fpBubble c) := c:FullPipeCellFetchInv (fpBubble c) c:FullPipeCella✝:(fpBubble c).fvalid = true(fpBubble c).fir = (fpBubble c).imem (fpBubble c).fpc; All goals completed! 🐙

The commit preserves both invariants. The fetch latch reloads from memory at the recorded index. For the operand latch: assuming OpInv c, the current commit computes arch' = execDecoded c.fir c.arch, and then the early read of the next instruction's operands from c.arch is exactly the safe overlap — valid against arch' precisely when the interlock fired.

theorem fpCommit_fetchInv (c : FullPipeCell) : FetchInv (fpCommit c) := c:FullPipeCellFetchInv (fpCommit c) c:FullPipeCella✝:(fpCommit c).fvalid = true(fpCommit c).fir = (fpCommit c).imem (fpCommit c).fpc; All goals completed! 🐙 theorem fpCommit_opInv (c : FullPipeCell) (hc : OpInv c) (hv : c.ovalid = true) : OpInv (fpCommit c) := c:FullPipeCellhc:OpInv chv:c.ovalid = trueOpInv (fpCommit c) c:FullPipeCellhc:OpInv chv:c.ovalid = truehov:(fpCommit c).ovalid = trueexecLatched (fpCommit c).fir (fpCommit c).ldv (fpCommit c).wv (fpCommit c).sv (fpCommit c).arch = execDecoded (fpCommit c).fir (fpCommit c).arch c:FullPipeCellhc:OpInv chv:c.ovalid = truehov:indepB c.fir (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) = trueexecLatched (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (readData c.arch (memIndexOfWord defaultConfig (readReg c.arch (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))).ra))) (readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr)) (readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr)) (execLatched c.fir c.ldv c.wv c.sv c.arch) = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (execLatched c.fir c.ldv c.wv c.sv c.arch) c:FullPipeCellhc:OpInv chv:c.ovalid = truehov:indepB c.fir (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) = trueexecLatched (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (readData c.arch (memIndexOfWord defaultConfig (readReg c.arch (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))).ra))) (readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr)) (readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr)) (execDecoded c.fir c.arch) = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (execDecoded c.fir c.arch) c:FullPipeCellhc:OpInv chv:c.ovalid = truehov:indepB c.fir (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) = truehindep:Indep c.fir (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1)))execLatched (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (readData c.arch (memIndexOfWord defaultConfig (readReg c.arch (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))).ra))) (readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr)) (readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr)) (execDecoded c.fir c.arch) = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (execDecoded c.fir c.arch) c:FullPipeCellhc:OpInv chv:c.ovalid = truehov:indepB c.fir (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) = truehindep:Indep c.fir (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1)))hso:execLatched (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (memOps (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) c.arch).fst (memOps (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) c.arch).snd.fst (memOps (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) c.arch).snd.snd (execDecoded c.fir c.arch) = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (execDecoded c.fir c.arch)execLatched (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (readData c.arch (memIndexOfWord defaultConfig (readReg c.arch (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))).ra))) (readWeight c.arch (memIndexOfLocal defaultConfig c.arch.wptr)) (readStream c.arch (memIndexOfLocal defaultConfig c.arch.sptr)) (execDecoded c.fir c.arch) = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc + 1))) (execDecoded c.fir c.arch) All goals completed! 🐙

With OpInv maintained, a committing cycle refines the ISA step: the hit condition makes the latch hold the wanted instruction, OpInv makes the latched operands the right reads, so the commit equals execDecoded of the wanted instruction, which refines step.

theorem fpCommit_refines_step (c : FullPipeCell) (hc : OpInv c) (Variable name `hbusy` is not explicitly referenced. The binding can be removed (if unused) or named `_` (if used implicitly). Note: This linter can be disabled with `set_option linter.unusedVariables false`hbusy : c.busy = true) (hhalt : c.arch.halted = false) (hvalid : c.fvalid = true) (hov : c.ovalid = true) (hpc : c.fpc = fpWantIdx c.arch) (hfetch : FetchInv c) : step defaultConfig (programOf c.imem) c.arch = some (fpCommit c).arch := c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv cstep defaultConfig (programOf c.imem) c.arch = some (fpCommit c).arch c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcstep defaultConfig (programOf c.imem) c.arch = some (fpCommit c).arch c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.archstep defaultConfig (programOf c.imem) c.arch = some (fpCommit c).arch c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.archstep defaultConfig (programOf c.imem) c.arch = some (execDecoded c.fir c.arch) c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.archhstep:step defaultConfig (programOf c.imem) c.arch = some (execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch)step defaultConfig (programOf c.imem) c.arch = some (execDecoded c.fir c.arch) c:FullPipeCellhc:OpInv chbusy:c.busy = truehhalt:c.arch.halted = falsehvalid:c.fvalid = truehov:c.ovalid = truehpc:c.fpc = fpWantIdx c.archhfetch:FetchInv chir:c.fir = c.imem c.fpcharch:(fpCommit c).arch = execDecoded c.fir c.archhstep:step defaultConfig (programOf c.imem) c.arch = some (execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch)hidx:c.fir = c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))step defaultConfig (programOf c.imem) c.arch = some (execDecoded c.fir c.arch) All goals completed! 🐙

A non-committing cycle — a mispredicted fetch (taken branch) or a stalled operand (dependent read) — is a bubble: it leaves the architectural state untouched and produces a hit-ready state, so the very next cycle commits. Two clocks therefore advance exactly one sequential step. Straight-line independent code never bubbles and commits one instruction per cycle.

theorem fpBubble_then_commit (c : FullPipeCell) (hbusy : c.busy = true) (hhalt : c.arch.halted = false) (hmiss : (c.fvalid && c.ovalid && (c.fpc == fpWantIdx c.arch)) = false) : step defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch := c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsestep defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble cstep defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truestep defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truehbhalt:(fpBubble c).arch.halted = falsestep defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truehbhalt:(fpBubble c).arch.halted = falsehbpc:(fpBubble c).fpc = fpWantIdx (fpBubble c).archstep defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truehbhalt:(fpBubble c).arch.halted = falsehbpc:(fpBubble c).fpc = fpWantIdx (fpBubble c).archhcommit:fpstep (fpBubble c) = fpCommit (fpBubble c)step defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truehbhalt:(fpBubble c).arch.halted = falsehbpc:(fpBubble c).fpc = fpWantIdx (fpBubble c).archhcommit:fpstep (fpBubble c) = fpCommit (fpBubble c)href:step defaultConfig (programOf (fpBubble c).imem) (fpBubble c).arch = some (fpCommit (fpBubble c)).archstep defaultConfig (programOf c.imem) c.arch = some (fpstep (fpstep c)).arch c:FullPipeCellhbusy:c.busy = truehhalt:c.arch.halted = falsehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehb:fpstep c = fpBubble chbbusy:(fpBubble c).busy = truehbhalt:(fpBubble c).arch.halted = falsehbpc:(fpBubble c).fpc = fpWantIdx (fpBubble c).archhcommit:fpstep (fpBubble c) = fpCommit (fpBubble c)href:step defaultConfig (programOf (fpBubble c).imem) (fpBubble c).arch = some (fpCommit (fpBubble c)).archstep defaultConfig (programOf c.imem) c.arch = some (fpCommit (fpBubble c)).arch All goals completed! 🐙 def fpRun : Nat -> FullPipeCell -> FullPipeCell | 0, c => c | k + 1, c => fpRun k (fpstep c) end Honeycomb

The correctness account is now complete in the same shape as the pipelined-fetch chapter: every committing cycle equals one execDecoded and refines the ISA step while preserving both latch invariants; every non-committing cycle is a value-free bubble immediately followed by a commit. So the sequence of committed architectural states is exactly the sequential ISA trace, with isolated single-cycle bubbles at a taken branch or a genuine operand dependency. This is the model the generated pipelined cell is rendered from next.

11.1. The whole run, machine-checked🔗

As with the synchronous cell, the composition is a theorem (review R4). The pipeline's timing is data-dependent — a taken branch or a dependent operand costs a bubble — so the cycle count is a computed schedule rather than a constant: fpCycles n c charges one clock per ready commit and two per bubbled one, and is at most 2 * n. Under that schedule the pipeline is a simulation of the combinational cycle model, and therefore — while the machine keeps executing — of the ISA trace itself: n instructions retire in at most 2 * n clocks, exactly the sequential trace, bubbles and all.

namespace Honeycomb /-- The cycle-model view of a full-pipeline cell. -/ def FullPipeCell.toCellState (c : FullPipeCell) : CellState := { arch := c.arch, imem := c.imem, busy := c.busy } /-- The commit-readiness test, exactly the hit condition `fpstep` keys on. -/ def fpReady (c : FullPipeCell) : Bool := c.fvalid && c.ovalid && (c.fpc == fpWantIdx c.arch) /-- The pipeline's schedule: one clock per ready commit, two per bubbled one. -/ def fpCycles : Nat FullPipeCell Nat | 0, _ => 0 | n + 1, c => if fpReady c then 1 + fpCycles n (fpstep c) else 2 + fpCycles n (fpstep (fpstep c)) /-- ... and through the pipeline. -/ theorem fpstep_stalls (c : FullPipeCell) (h : ¬(c.busy = true c.arch.halted = false)) : fpstep c = c := c:FullPipeCellh:¬(c.busy = true c.arch.halted = false)fpstep c = c c:FullPipeCellh:¬(c.busy = true c.arch.halted = false)hb:c.busy = truefpstep c = cc:FullPipeCellh:¬(c.busy = true c.arch.halted = false)hb:¬c.busy = truefpstep c = c c:FullPipeCellh:¬(c.busy = true c.arch.halted = false)hb:c.busy = truefpstep c = c c:FullPipeCellh:¬(c.busy = true c.arch.halted = false)hb:c.busy = truehh:c.arch.halted = truefpstep c = c All goals completed! 🐙 c:FullPipeCellh:¬(c.busy = true c.arch.halted = false)hb:¬c.busy = truefpstep c = c All goals completed! 🐙 /-- A ready commit is one iteration of the cycle model on the projected state. -/ theorem fpCommit_toCellState (c : FullPipeCell) (hOp : OpInv c) (hFetch : FetchInv c) (hb : c.busy = true) (hh : c.arch.halted = false) (hr : fpReady c = true) : (fpCommit c).toCellState = cellExecCycle c.toCellState := c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = true(fpCommit c).toCellState = cellExecCycle c.toCellState c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehr:(c.fvalid = true c.ovalid = true) c.fpc = fpWantIdx c.arch(fpCommit c).toCellState = cellExecCycle c.toCellState c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = true(fpCommit c).toCellState = cellExecCycle c.toCellState c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = trueharch:(fpCommit c).arch = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch(fpCommit c).toCellState = cellExecCycle c.toCellState c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = trueharch:(fpCommit c).arch = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.archhbusy:(fpCommit c).busy = !(execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch).halted(fpCommit c).toCellState = cellExecCycle c.toCellState c:FullPipeCellhOp:OpInv chFetch:FetchInv chb:c.busy = truehh:c.arch.halted = falsehpc:c.fpc = fpWantIdx c.archhfv:c.fvalid = truehov:c.ovalid = trueharch:(fpCommit c).arch = execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.archhbusy:(fpCommit c).busy = !(execDecoded (c.imem (memIndexOfNat defaultConfig (BitVec.toNat c.arch.pc))) c.arch).halted(fpCommit c).imem = c.imem All goals completed! 🐙 /-- **The run-level simulation, on the pipeline's own schedule.** Under the two latch invariants, `fpCycles n c` clocks are exactly `n` iterations of the combinational cycle model — with the invariants preserved and the schedule bounded by two clocks per instruction. Unconditional in `n`: a halted or stopped machine holds state on both sides. -/ theorem fpRun_refines_cellExecCycleN (n : Nat) (c : FullPipeCell) (hOp : OpInv c) (hFetch : FetchInv c) : (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * n := n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv c(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * n induction n generalizing c with c:FullPipeCellhOp:OpInv chFetch:FetchInv c(fpRun (fpCycles 0 c) c).toCellState = cellExecCycleN 0 c.toCellState OpInv (fpRun (fpCycles 0 c) c) FetchInv (fpRun (fpCycles 0 c) c) fpCycles 0 c 2 * 0 exact rfl, hOp, hFetch, c:FullPipeCellhOp:OpInv chFetch:FetchInv cfpCycles 0 c 2 * 0 All goals completed! 🐙 n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv c(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:c.busy = true c.arch.halted = false(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1)n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:c.busy = true c.arch.halted = false(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = false(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = true(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1)n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = true(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = true(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) -- ready: one clock commits n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit c(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) 2 * n(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) refine ?_, ?_, ?_, n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellStatefpCycles (n + 1) c 2 * (n + 1) All goals completed! 🐙 n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState(fpRun (fpCycles n (fpstep c) + 1) c).toCellState = cellExecCycleN (n + 1) c.toCellState n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellState(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN (n + 1) c.toCellState All goals completed! 🐙 n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellStateOpInv (fpRun (fpCycles (n + 1) c) c) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellStateOpInv (fpRun (fpCycles n (fpstep c) + 1) c) All goals completed! 🐙 n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellStateFetchInv (fpRun (fpCycles (n + 1) c) c) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:fpReady c = truehstep:fpstep c = fpCommit chcyc:fpCycles (n + 1) c = 1 + fpCycles n (fpstep c)hOp':OpInv (fpstep c)hFetch':FetchInv (fpstep c)hsim:(fpRun (fpCycles n (fpstep c)) (fpstep c)).toCellState = cellExecCycleN n (fpstep c).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hFetch'':FetchInv (fpRun (fpCycles n (fpstep c)) (fpstep c))hbound:fpCycles n (fpstep c) 2 * nhproj:(fpstep c).toCellState = cellExecCycle c.toCellStateFetchInv (fpRun (fpCycles n (fpstep c) + 1) c) All goals completed! 🐙 n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = true(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) -- miss: a bubble, then the commit — two clocks n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = false(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble c(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = true(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState = cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) 2 * n(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState = cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) refine ?_, ?_, ?_, n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState = cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellStatefpCycles (n + 1) c 2 * (n + 1) All goals completed! 🐙 n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState = cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState = cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState(fpRun (fpCycles n (fpstep (fpstep c)) + 1 + 1) c).toCellState = cellExecCycleN (n + 1) c.toCellState n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState = cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellState(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState = cellExecCycleN (n + 1) c.toCellState All goals completed! 🐙 n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState = cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellStateOpInv (fpRun (fpCycles (n + 1) c) c) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState = cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellStateOpInv (fpRun (fpCycles n (fpstep (fpstep c)) + 1 + 1) c) All goals completed! 🐙 n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState = cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellStateFetchInv (fpRun (fpCycles (n + 1) c) c) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hb:c.busy = truehh:c.arch.halted = falsehr:¬fpReady c = truehmiss:(c.fvalid && c.ovalid && c.fpc == fpWantIdx c.arch) = falsehstep1:fpstep c = fpBubble chready2:fpReady (fpBubble c) = truehstep2:fpstep (fpBubble c) = fpCommit (fpBubble c)hcyc:fpCycles (n + 1) c = 2 + fpCycles n (fpstep (fpstep c))hOp':OpInv (fpstep (fpstep c))hFetch':FetchInv (fpstep (fpstep c))hsim:(fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c))).toCellState = cellExecCycleN n (fpstep (fpstep c)).toCellStatehOp'':OpInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hFetch'':FetchInv (fpRun (fpCycles n (fpstep (fpstep c))) (fpstep (fpstep c)))hbound:fpCycles n (fpstep (fpstep c)) 2 * nhproj:(fpstep (fpstep c)).toCellState = cellExecCycle c.toCellStateFetchInv (fpRun (fpCycles n (fpstep (fpstep c)) + 1 + 1) c) All goals completed! 🐙 n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) -- stopped: both machines hold n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = c(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellState(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * n(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = true(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1)n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = true(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = true(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) refine ?_, ?_, ?_, n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n cfpCycles (n + 1) c 2 * (n + 1) All goals completed! 🐙 n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellStaten:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n cOpInv (fpRun (fpCycles (n + 1) c) c)n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n cFetchInv (fpRun (fpCycles (n + 1) c) c) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n cFetchInv (fpRun (fpCycles n c + 1) c) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n c(fpRun (fpCycles n c + 1) c).toCellState = cellExecCycleN (n + 1) c.toCellStaten:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n cOpInv (fpRun (fpCycles n c + 1) c)n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n cFetchInv (fpRun (fpCycles n c + 1) c) first | (n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n cFetchInv (fpRun (fpCycles n c + 1) c) All goals completed! 🐙) | (n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n cFetchInv (fpRun (fpCycles n c + 1) c) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n cOpInv (fpRun (fpCycles n c) c); All goals completed! 🐙) | (n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n cFetchInv (fpRun (fpCycles n c) (fpstep c)) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:fpReady c = truehcyc:fpCycles (n + 1) c = 1 + fpCycles n cFetchInv (fpRun (fpCycles n c) c); All goals completed! 🐙) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = true(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = false(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellState OpInv (fpRun (fpCycles (n + 1) c) c) FetchInv (fpRun (fpCycles (n + 1) c) c) fpCycles (n + 1) c 2 * (n + 1) refine ?_, ?_, ?_, n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n cfpCycles (n + 1) c 2 * (n + 1) All goals completed! 🐙 n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c(fpRun (fpCycles (n + 1) c) c).toCellState = cellExecCycleN (n + 1) c.toCellStaten:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n cOpInv (fpRun (fpCycles (n + 1) c) c)n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n cFetchInv (fpRun (fpCycles (n + 1) c) c) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n cFetchInv (fpRun (fpCycles n c + 1 + 1) c) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n c(fpRun (fpCycles n c + 1 + 1) c).toCellState = cellExecCycleN (n + 1) c.toCellStaten:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n cOpInv (fpRun (fpCycles n c + 1 + 1) c)n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n cFetchInv (fpRun (fpCycles n c + 1 + 1) c) first | (n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n cFetchInv (fpRun (fpCycles n c + 1 + 1) c) All goals completed! 🐙) | (n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n cFetchInv (fpRun (fpCycles n c + 1 + 1) c) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n cOpInv (fpRun (fpCycles n c) c); All goals completed! 🐙) | (n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n cFetchInv (fpRun (fpCycles n c) (fpstep (fpstep c))) n:Natih: (c : FullPipeCell), OpInv c FetchInv c (fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellState OpInv (fpRun (fpCycles n c) c) FetchInv (fpRun (fpCycles n c) c) fpCycles n c 2 * nc:FullPipeCellhOp:OpInv chFetch:FetchInv chunf:cellExecCycleN (n + 1) c.toCellState = cellExecCycleN n (cellExecCycle c.toCellState)hlive:¬(c.busy = true c.arch.halted = false)hstall:fpstep c = chcell:cellExecCycle c.toCellState = c.toCellStatehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStatehOp'':OpInv (fpRun (fpCycles n c) c)hFetch'':FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nhr:¬fpReady c = truehrf:fpReady c = falsehcyc:fpCycles (n + 1) c = 2 + fpCycles n cFetchInv (fpRun (fpCycles n c) c); All goals completed! 🐙) /-- **The ISA trace, at one-to-two clocks per instruction.** While the machine keeps executing, `fpCycles n c ≤ 2 * n` clocks of the full pipeline compute exactly `n` ISA steps: the interlocked, fall-through-predicted pipeline retires the sequential trace on its own schedule. -/ theorem fpRun_commits_trace (n : Nat) (c : FullPipeCell) (hOp : OpInv c) (hFetch : FetchInv c) (hlive : k, k < n (cellExecCycleN k c.toCellState).busy = true (cellExecCycleN k c.toCellState).arch.halted = false) : stepN (programOf c.imem) n c.arch = some (fpRun (fpCycles n c) c).arch fpCycles n c 2 * n := n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv chlive: (k : Nat), k < n (cellExecCycleN k c.toCellState).busy = true (cellExecCycleN k c.toCellState).arch.halted = falsestepN (programOf c.imem) n c.arch = some (fpRun (fpCycles n c) c).arch fpCycles n c 2 * n n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv chlive: (k : Nat), k < n (cellExecCycleN k c.toCellState).busy = true (cellExecCycleN k c.toCellState).arch.halted = falsehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStateleft✝¹:OpInv (fpRun (fpCycles n c) c)left✝:FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nstepN (programOf c.imem) n c.arch = some (fpRun (fpCycles n c) c).arch fpCycles n c 2 * n n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv chlive: (k : Nat), k < n (cellExecCycleN k c.toCellState).busy = true (cellExecCycleN k c.toCellState).arch.halted = falsehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStateleft✝¹:OpInv (fpRun (fpCycles n c) c)left✝:FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nh:stepN (programOf c.toCellState.imem) n c.toCellState.arch = some (cellExecCycleN n c.toCellState).archstepN (programOf c.imem) n c.arch = some (fpRun (fpCycles n c) c).arch fpCycles n c 2 * n n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv chlive: (k : Nat), k < n (cellExecCycleN k c.toCellState).busy = true (cellExecCycleN k c.toCellState).arch.halted = falsehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStateleft✝¹:OpInv (fpRun (fpCycles n c) c)left✝:FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nh:stepN (programOf c.toCellState.imem) n c.toCellState.arch = some (cellExecCycleN n c.toCellState).archstepN (programOf c.imem) n c.arch = some (fpRun (fpCycles n c) c).arch n:Natc:FullPipeCellhOp:OpInv chFetch:FetchInv chlive: (k : Nat), k < n (cellExecCycleN k c.toCellState).busy = true (cellExecCycleN k c.toCellState).arch.halted = falsehsim:(fpRun (fpCycles n c) c).toCellState = cellExecCycleN n c.toCellStateleft✝¹:OpInv (fpRun (fpCycles n c) c)left✝:FetchInv (fpRun (fpCycles n c) c)hbound:fpCycles n c 2 * nh:stepN (programOf c.toCellState.imem) n c.toCellState.arch = some (cellExecCycleN n c.toCellState).archstepN (programOf c.imem) n c.arch = some (cellExecCycleN n c.toCellState).arch All goals completed! 🐙 end Honeycomb