|
| 1 | +# Wave Loop 418 Plan |
| 2 | + |
| 3 | +**Issue:** #1353 |
| 4 | +**Branch:** `wave-loop-418` |
| 5 | + |
| 6 | +--- |
| 7 | + |
| 8 | +## Decision gate |
| 9 | + |
| 10 | +| Bench available? | Pick | |
| 11 | +|--------------------|------| |
| 12 | +| P12 + analyzer + DLC10/Digilent cable | Variant A | |
| 13 | +| Relay / power switch + cable | Variant B | |
| 14 | +| Nothing | Variant C | |
| 15 | + |
| 16 | +Current state (2026-07-04): **nothing** — P12 unwired, DLC10 cable missing, no |
| 17 | +USB relay detected. The W417 hygiene wave did not change the bench. Default to |
| 18 | +**Variant C** for W418. |
| 19 | + |
| 20 | +--- |
| 21 | + |
| 22 | +## Goals |
| 23 | + |
| 24 | +1. If the bench becomes available, capture real CCLK for `OSCFSEL=6/7` and |
| 25 | + commit instrument-to-Lean theorems (Variant A). |
| 26 | +2. If relay hardware becomes available, automate cold-POR power-cycling and |
| 27 | + capture real STAT (Variant B). |
| 28 | +3. Otherwise, keep hardening the formal model and the instrument-import path: |
| 29 | + add a PVT-envelope lower-bound regression test, extend VCD parser coverage for |
| 30 | + `$date`/`$version`/`$comment` headers and analog CSV voltage columns, build a |
| 31 | + standalone Lean integration test from a synthetic CSV, and document the |
| 32 | + first-real-capture checklist (Variant C). |
| 33 | + |
| 34 | +--- |
| 35 | + |
| 36 | +## Work breakdown |
| 37 | + |
| 38 | +### Variant A — Physical CCLK capture |
| 39 | + |
| 40 | +Files: `fpga/HARDWARE_SSOT.md`, `proofs/lean4/Trinity/TernaryFPGABoot.lean`, `docs/reports/*` |
| 41 | + |
| 42 | +- Wire P12 to the logic analyzer. |
| 43 | +- Generate `OSCFSEL=6` and `OSCFSEL=7` variants with `tri fpga cclk-variants`. |
| 44 | +- Program each variant to flash, cold-POR boot, and capture CCLK. |
| 45 | +- Import captures with `tri fpga measured-to-lean --csv/--vcd --raw-ns --standalone --validate --pvt-context`. |
| 46 | +- Commit generated theorems and update `fpga/HARDWARE_SSOT.md`. |
| 47 | + |
| 48 | +### Variant B — Real relay-controlled cold-POR |
| 49 | + |
| 50 | +Files: `cli/tri/src/fpga.rs`, `fpga/HARDWARE_SSOT.md` |
| 51 | + |
| 52 | +- Select a relay interface (USB-serial relay module, smart power strip, or MCU GPIO bridge). |
| 53 | +- Implement a `RelayControl` trait with `power_cycle(delay_ms: u64)`. |
| 54 | +- Extend `FpgaCmd::ColdPor` to accept real `--relay-port` values. |
| 55 | +- Capture STAT after relay power-cycle and write a non-mock log. |
| 56 | +- Document wiring and safety rules. |
| 57 | + |
| 58 | +### Variant C — Further formal tooling (default fallback) |
| 59 | + |
| 60 | +Files: `cli/tri/src/fpga.rs`, `proofs/lean4/Trinity/TernaryFPGABoot.lean`, `fpga/HARDWARE_SSOT.md`, `docs/reports/*` |
| 61 | + |
| 62 | +1. **PVT-envelope regression test** |
| 63 | + - Add a Rust unit test that exhaustively samples the operating rectangle |
| 64 | + (temp, vccint, corner) and asserts |
| 65 | + `n25q128_min_sck_half_ns_pvt ≥ NOMINAL_HALF_NS`. |
| 66 | + - Add a Lean 4 lemma `n25q128_min_sck_half_ns_pvt_nonneg` proving the same |
| 67 | + bound symbolically. |
| 68 | + - Document in `fpga/HARDWARE_SSOT.md` how to replace the linear coefficients |
| 69 | + once real N25Q128_3V PVT curves are available. |
| 70 | + |
| 71 | +2. **Instrument import coverage** |
| 72 | + - VCD parser: skip `$date`, `$version`, `$comment` multi-line header sections |
| 73 | + without confusing them with `$var` declarations. |
| 74 | + - CSV parser: support analog CSV exports that contain a voltage column |
| 75 | + directly, so `--vcd-threshold-v` is not the only analog path. |
| 76 | + - Add unit tests for both. |
| 77 | + |
| 78 | +3. **Standalone Lean integration test** |
| 79 | + - Extend `measured-to-lean --standalone` output so the generated file is a |
| 80 | + complete, lake-buildable package snippet (imports + theorem + main proof). |
| 81 | + - Add a Rust integration test that writes a synthetic CSV, runs |
| 82 | + `tri fpga measured-to-lean --csv --raw-ns --standalone --pvt-context`, and |
| 83 | + type-checks the result in a temporary `lake` package. |
| 84 | + |
| 85 | +4. **First-real-capture checklist** |
| 86 | + - Update `fpga/HARDWARE_SSOT.md` with a step-by-step checklist for the first |
| 87 | + real CCLK capture (wiring, samplerate, PVT context, validation, |
| 88 | + theorem generation). |
| 89 | + |
| 90 | +--- |
| 91 | + |
| 92 | +## Weak points |
| 93 | + |
| 94 | +1. **Physical evidence gap remains** under Variant C. The formal pipeline keeps |
| 95 | + improving, but no silicon evidence is produced until P12 is wired and the |
| 96 | + cable/relay hardware is available. |
| 97 | +2. **PVT envelope coefficients are still informed estimates**, not Micron |
| 98 | + datasheet curves. The regression test only guards the lower bound; real |
| 99 | + characterization may require larger margins. |
| 100 | +3. **VCD header sections** vary across tools (some emit `$date` on one line, |
| 101 | + others across multiple lines). Header handling will be best-effort for the |
| 102 | + most common variants. |
| 103 | +4. **Analog CSV voltage columns** have no standard format; the parser will |
| 104 | + support the Saleae/DSView single-channel layout and document the expected |
| 105 | + column names. |
| 106 | +5. **Standalone Lean integration test** depends on `lake` being available in |
| 107 | + the test environment. CI must have Lean 4 installed. |
| 108 | + |
| 109 | +--- |
| 110 | + |
| 111 | +## Competitor scan |
| 112 | + |
| 113 | +- **Sparkle HDL / Verilean:** formal Verilog-to-Lean/Coq verification; no public |
| 114 | + instrument-to-Lean bridge or PVT-aware timing envelope for flash boot. |
| 115 | +- **SymbiYosys / Yosys formal:** bounded property checking on RTL; no link to |
| 116 | + logic-analyzer measurements. |
| 117 | +- **Koika / Kami:** processor-model verification in Coq; unrelated to 7-series |
| 118 | + boot timing. |
| 119 | +- **OpenFPGALoader / prjxray:** bitstream/JTAG tooling; no formal proof pipeline. |
| 120 | +- **TinyTapeout / Efabless:** silicon-shuttle flow; relies on PDK |
| 121 | + characterization, not user-captured proofs. |
| 122 | +- **OpenSTA / vyges-sta-si:** gate-level STA with PVT/OCV derating, but no |
| 123 | + instrument capture and no theorem-prover output. |
| 124 | +- **t27 differentiation:** still the only open pipeline converting instrument |
| 125 | + exports (CSV/VCD) into Lean 4 proofs of flash timing compliance, now with an |
| 126 | + explicit, falsifiable PVT uncertainty envelope, envelope monotonicity proofs, |
| 127 | + per-OSCFSEL transaction theorems, and an integration-test path. |
| 128 | + |
| 129 | +--- |
| 130 | + |
| 131 | +## Verification checklist |
| 132 | + |
| 133 | +- [ ] `cargo test -p tri fpga::tests` passes (new + existing tests). |
| 134 | +- [ ] `lake build Trinity.TernaryFPGABoot` passes from `proofs/lean4/`. |
| 135 | +- [ ] `./scripts/tri test` passes parse/typecheck/gen/seal-verify. |
| 136 | +- [ ] For Variant A: at least one generated `.lean` file builds standalone. |
| 137 | +- [ ] For Variant B: real relay port produces a non-mock boot log. |
| 138 | +- [x] For Variant C: PVT-envelope regression test, VCD header/analog CSV tests, |
| 139 | + and standalone Lean integration test land. |
| 140 | + |
| 141 | +--- |
| 142 | + |
| 143 | +## Acceptance criteria |
| 144 | + |
| 145 | +- The chosen variant is fully implemented and verified. |
| 146 | +- All invariant checks pass. |
| 147 | +- Report + evidence + W419 cooperation variants are produced. |
| 148 | +- PR closes #1353. |
| 149 | + |
| 150 | +--- |
| 151 | + |
| 152 | +*φ² + φ⁻² = 3 | TRINITY* |
0 commit comments