Towards a verified Lustre compiler with modular reset Timothy Bourke 1,2 Lélio Brun 1,2 Marc Pouzet 3,2,1 1 Inria Paris 2 DI ENS 3 UPMC SCOPES 2018 — May 30, 2018
Screenshot from ANSYS/Esterel Techologies SCADE Suite 1 / 14
Screenshot from ANSYS/Esterel Techologies SCADE Suite node returns (i_l , i_r : int); controller (joy_v , joy_h , pos_l , pos_r : int) let omega_l = pos_l - (pos_l v_err2 = (2 * v_ref) - (omega_l + omega_r); ... tel fby pos_l); 1 / 14
Context State of the art: Scade • Specification norms (DO-178C), industrial certification 2 / 14
Context State of the art: Scade • Specification norms (DO-178C), industrial certification • Onerous and expensive development process 2 / 14
Context State of the art: Scade • Specification norms (DO-178C), industrial certification • Onerous and expensive development process • No formal proof of correctness 2 / 14
Context State of the art: Scade • Specification norms (DO-178C), industrial certification • Onerous and expensive development process • No formal proof of correctness Goal Develop a formally verified code generator 2 / 14
Context State of the art: Scade • Specification norms (DO-178C), industrial certification • Onerous and expensive development process • No formal proof of correctness Goal Develop a formally verified code generator • formal verification, mechanized proofs, proof assistant (eg. Coq 1 ) 1 The Coq Development Team (2016): The Coq proof assistant reference manual 2 / 14
Context State of the art: Scade • Specification norms (DO-178C), industrial certification • Onerous and expensive development process • No formal proof of correctness Goal Develop a formally verified code generator • formal verification, mechanized proofs, proof assistant (eg. Coq) • Scade • Lighten the qualification to norms • Provide a complete semantics 2 / 14
Lustre: 1 example node euler(y0 , y’: int) euler returns (y: int) y 0 var h: int; let y’ h + z -1 y y = y0 fby (y + y’ * h); h = 2; tel 1 Caspi, Halbwachs, Pilaud, and Plaice (1987): “LUSTRE: A declarative language for programming synchronous systems” 3 / 14
Lustre: example node euler(y0 , y’: int) returns (y: int) var h: int; euler let y 0 y = y0 fby (y + y’ * h); h = 2; y’ h + z -1 y tel y 0 0 y ′ 4 0 y h 2 3 / 14
Lustre: example node euler(y0 , y’: int) returns (y: int) var h: int; euler let y 0 y = y0 fby (y + y’ * h); h = 2; y’ h + z -1 y tel y 0 0 5 y ′ 4 2 0 8 y h 2 2 3 / 14
Lustre: example node euler(y0 , y’: int) returns (y: int) var h: int; euler let y 0 y = y0 fby (y + y’ * h); h = 2; y’ h + z -1 y tel y 0 0 5 10 y ′ 4 2 1 0 8 12 y h 2 2 2 3 / 14
Lustre: example node euler(y0 , y’: int) returns (y: int) var h: int; euler let y 0 y = y0 fby (y + y’ * h); h = 2; y’ h + z -1 y tel y 0 0 5 10 – y ′ 4 2 1 – 0 8 12 – y h 2 2 2 – 3 / 14
Lustre: example node euler(y0 , y’: int) returns (y: int) var h: int; euler let y 0 y = y0 fby (y + y’ * h); h = 2; y’ h + z -1 y tel y 0 0 5 10 – 15 · · · y ′ 4 2 1 – 3 · · · 0 8 12 – 14 y · · · h 2 2 2 – 2 · · · 3 / 14
Lustre: example euler node euler(y0 , y’: int) returns (y: int) y 0 var h: int; let y’ h + z -1 y y = y0 fby (y + y’ * h); h = 2; tel node main(x0 , x’: int) main returns (x: int) x 0 let x euler x’ x = euler(x0 , x’); tel 3 / 14
Scade-like state machines and reset primitive NAV s GPS x x GPS s s x INS x + z -1 h x’ 4 / 14
Scade-like state machines and reset primitive NAV s GPS • Can be compiled into Lustre x x GPS s s x INS x + z -1 h x’ 4 / 14
Scade-like state machines and reset primitive NAV s GPS • Can be compiled into Lustre x x GPS • Reset : • Reset the state of a node, ie. reinitialize the fby s s s x INS x + z -1 h x’ 4 / 14
Scade-like state machines and reset primitive NAV s GPS • Can be compiled into Lustre x x GPS • Reset : • Reset the state of a node, ie. reinitialize the fby s s s x • Useful primitive INS (not only for state machines) x + z -1 h x’ 4 / 14
Scade-like state machines and reset primitive NAV s GPS • Can be compiled into Lustre x x GPS • Reset : • Reset the state of a node, ie. reinitialize the fby s s s x • Useful primitive INS (not only for state machines) x + z -1 h • How? x’ 4 / 14
Non-modular reset node euler(y0 , y’: int) node euler(y0 , y’: int; r: bool) returns (y: int) returns (y: int) var h: int; var h: int; let let y = y0 fby (y + y’ * h); y = if r then y0 h = 2; else (y0 fby (y + y’ * h)); tel h = 2; tel node main(x0 , x’: int) node main(x0 , x’: int) returns (x: int) returns (x: int) var r: bool; let let x = euler(x0 , x’); x = euler(x0 , x’, r); tel r = (x’ > 42); tel 5 / 14
Non-modular reset node euler(y0 , y’: int) node euler(y0 , y’: int; r: bool) returns (y: int) returns (y: int) var h: int; var h: int; let let y = y0 fby (y + y’ * h); y = if r then y0 h = 2; else (y0 fby (y + y’ * h)); tel h = 2; tel node main(x0 , x’: int) node main(x0 , x’: int) returns (x: int) returns (x: int) var r: bool; let let x = euler(x0 , x’); x = euler(x0 , x’, r); tel r = (x’ > 42); tel 5 / 14
Vélus: 1 a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization Obc generation Clight compilation Assembly printing 1 Bourke, Brun, Dagand, Leroy, Pouzet, and Rieg (2017): “A Formally Verified Compiler for Lustre” 6 / 14
Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization Implemented in Coq and (some) OCaml Obc generation Clight compilation Assembly printing 6 / 14
Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization • Validated parsing ( menhir –coq ) a Obc generation Clight compilation Assembly printing a Jourdan, Pottier, and Leroy (2012): “Validating LR(1) parsers” 6 / 14
Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization • Validated parsing ( menhir –coq ) Obc • Elaboration to get clock and type information generation Clight compilation Assembly printing 6 / 14
Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization • Validated parsing ( menhir –coq ) Obc • Elaboration to get clock and type information generation • Not yet implemented: normalization a Clight compilation Assembly printing a Auger (2013): “Compilation certifiée de SCADE/LUSTRE” 6 / 14
Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization Obc node euler(y0 , y’: int) node euler(y0 , y’: int) returns (y: int) returns (y: int) generation var h: int; var h, y1: int; let init: bool; y = y0 fby (y + y’ * h); let Clight h = 2; init = true fby false; tel y1 = 0 fby (y + y’ * h); compilation y = if init then y0 else y1; h = 2; Assembly tel printing e 0 fby e � → if (true fby false) then e 0 else (0 fby e ) 6 / 14
Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization • Validated parsing ( menhir –coq ) Obc • Elaboration to get clock and type information generation • Not yet implemented: normalization • Scheduling of dataflow equations Clight compilation Assembly printing 6 / 14
Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization Obc node euler(y0 , y’: int) node euler(y0 , y’: int) returns (y: int) returns (y: int) generation var h, y1: int; var h, y1: int; init: bool; init: bool; let let Clight init = true fby false; h = 2; y1 = 0 fby (y + y’ * h); y = if init then y0 compilation y = if init then y0 else y1; else y1; init = true fby false; h = 2; y1 = 0 fby (y + y’ * h); Assembly tel tel printing 6 / 14
Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization • Validated parsing ( menhir –coq ) Obc • Elaboration to get clock and type information generation • Not yet implemented: normalization • Scheduling of dataflow equations Clight • Translation to intermediate Obc code compilation Assembly printing 6 / 14
Recommend
More recommend
