Verifying the Lustre modular reset Timothy Bourke 1,2 Llio Brun 1,2 - PowerPoint PPT Presentation

Infinitely unrolling the recursion r F F T F F T F T F · · · count r 0 0 1 1 1 2 2 3 3 · · · 0 5 10 15 20 25 30 35 40 · · · i mask 0 r i 0 5 – – – – – – – · · · nat (mask 0 r i ) 0 1 – – – – – – – · · · mask 1 r i – – 10 15 20 – – – – · · · nat (mask 1 r i ) – – 10 11 12 – – – – · · · nat ( i ) every r 0 1 10 11 12 25 26 35 36 · · · 7 / 22

Infinitely unrolling the recursion r F F T F F T F T F · · · count r 0 0 1 1 1 2 2 3 3 · · · 0 5 10 15 20 25 30 35 40 · · · i mask 0 r i 0 5 – – – – – – – · · · nat (mask 0 r i ) 0 1 – – – – – – – · · · mask 1 r i – – 10 15 20 – – – – · · · nat (mask 1 r i ) – – 10 11 12 – – – – · · · mask 2 r i – – – – – 25 30 – – · · · nat ( i ) every r 0 1 10 11 12 25 26 35 36 · · · 7 / 22

Infinitely unrolling the recursion r F F T F F T F T F · · · count r 0 0 1 1 1 2 2 3 3 · · · 0 5 10 15 20 25 30 35 40 · · · i mask 0 r i 0 5 – – – – – – – · · · nat (mask 0 r i ) 0 1 – – – – – – – · · · mask 1 r i – – 10 15 20 – – – – · · · nat (mask 1 r i ) – – 10 11 12 – – – – · · · mask 2 r i – – – – – 25 30 – – · · · nat (mask 2 r i ) – – – – – 25 26 – – · · · nat ( i ) every r 0 1 10 11 12 25 26 35 36 · · · 7 / 22

Infinitely unrolling the recursion r F F T F F T F T F · · · count r 0 0 1 1 1 2 2 3 3 · · · 0 5 10 15 20 25 30 35 40 · · · i mask 0 r i 0 5 – – – – – – – · · · nat (mask 0 r i ) 0 1 – – – – – – – · · · mask 1 r i – – 10 15 20 – – – – · · · nat (mask 1 r i ) – – 10 11 12 – – – – · · · mask 2 r i – – – – – 25 30 – – · · · nat (mask 2 r i ) – – – – – 25 26 – – · · · mask 3 r i – – – – – – – 35 40 · · · nat ( i ) every r 0 1 10 11 12 25 26 35 36 · · · 7 / 22

Infinitely unrolling the recursion r F F T F F T F T F · · · count r 0 0 1 1 1 2 2 3 3 · · · 0 5 10 15 20 25 30 35 40 · · · i mask 0 r i 0 5 – – – – – – – · · · nat (mask 0 r i ) 0 1 – – – – – – – · · · mask 1 r i – – 10 15 20 – – – – · · · nat (mask 1 r i ) – – 10 11 12 – – – – · · · mask 2 r i – – – – – 25 30 – – · · · nat (mask 2 r i ) – – – – – 25 26 – – · · · mask 3 r i – – – – – – – 35 40 · · · nat (mask 3 r i ) – – – – – – – 35 36 · · · nat ( i ) every r 0 1 10 11 12 25 26 35 36 · · · 7 / 22

Infinitely unrolling the recursion r F F T F F T F T F · · · count r 0 0 1 1 1 2 2 3 3 · · · 0 5 10 15 20 25 30 35 40 · · · i mask 0 r i 0 5 – – – – – – – · · · nat (mask 0 r i ) 0 1 – – – – – – – · · · mask 1 r i – – 10 15 20 – – – – · · · nat (mask 1 r i ) – – 10 11 12 – – – – · · · mask 2 r i – – – – – 25 30 – – · · · nat (mask 2 r i ) – – – – – 25 26 – – · · · mask 3 r i – – – – – – – 35 40 · · · nat (mask 3 r i ) – – – – – – – 35 36 · · · . . . nat ( i ) every r 0 1 10 11 12 25 26 35 36 · · · 7 / 22

Formal semantics Node application eqn ⇀ x = f ( ⇀ ⊢ e ) 8 / 22

Formal semantics Node application exp ⇀ e ⇓ ⇀ ⊢ es eqn ⇀ x = f ( ⇀ ⊢ e ) 8 / 22

Formal semantics Node application exp ⇀ e ⇓ ⇀ node f ( ⇀ es ) ⇓ ⇀ ⊢ ⊢ es xs eqn ⇀ x = f ( ⇀ ⊢ e ) 8 / 22

Formal semantics Node application exp ⇀ e ⇓ ⇀ node f ( ⇀ es ) ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ ⊢ ⊢ es xs xs eqn ⇀ x = f ( ⇀ ⊢ e ) 8 / 22

Formal semantics Node application exp ⇀ e ⇓ ⇀ node f ( ⇀ es ) ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ ⊢ ⊢ es xs xs eqn ⇀ x = f ( ⇀ ⊢ e ) Modular reset eqn ⇀ x = f ( ⇀ ⊢ e ) every r 8 / 22

Formal semantics Node application exp ⇀ e ⇓ ⇀ node f ( ⇀ es ) ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ ⊢ ⊢ es xs xs eqn ⇀ x = f ( ⇀ ⊢ e ) Modular reset exp ⇀ e ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ ⊢ es xs eqn ⇀ x = f ( ⇀ ⊢ e ) every r 8 / 22

Formal semantics Node application exp ⇀ e ⇓ ⇀ node f ( ⇀ es ) ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ ⊢ ⊢ es xs xs eqn ⇀ x = f ( ⇀ ⊢ e ) Modular reset ⊢ var r ⇓ rs exp ⇀ e ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ ⊢ es xs eqn ⇀ x = f ( ⇀ ⊢ e ) every r 8 / 22

Formal semantics Node application exp ⇀ e ⇓ ⇀ node f ( ⇀ es ) ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ ⊢ ⊢ es xs xs eqn ⇀ x = f ( ⇀ ⊢ e ) Modular reset ⊢ var r ⇓ rs rk = boolof rs exp ⇀ e ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ ⊢ es xs eqn ⇀ x = f ( ⇀ ⊢ e ) every r 8 / 22

Formal semantics Node application exp ⇀ e ⇓ ⇀ node f ( ⇀ es ) ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ ⊢ ⊢ es xs xs eqn ⇀ x = f ( ⇀ ⊢ e ) Modular reset ⊢ var r ⇓ rs rk = boolof rs exp ⇀ e ⇓ ⇀ reset f ( ⇀ es ) ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ rk ⊢ ⊢ es xs xs eqn ⇀ x = f ( ⇀ ⊢ e ) every r 8 / 22

Formal semantics Node application exp ⇀ e ⇓ ⇀ node f ( ⇀ es ) ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ ⊢ ⊢ es xs xs eqn ⇀ x = f ( ⇀ ⊢ e ) Modular reset ⊢ var r ⇓ rs rk = boolof rs exp ⇀ e ⇓ ⇀ reset f ( ⇀ es ) ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ rk ⊢ ⊢ es xs xs eqn ⇀ x = f ( ⇀ ⊢ e ) every r reset f ( ⇀ xs ) ⇓ ⇀ rk ⊢ ys 8 / 22

Formal semantics Node application exp ⇀ e ⇓ ⇀ node f ( ⇀ es ) ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ ⊢ ⊢ es xs xs eqn ⇀ x = f ( ⇀ ⊢ e ) Modular reset ⊢ var r ⇓ rs rk = boolof rs exp ⇀ e ⇓ ⇀ reset f ( ⇀ es ) ⇓ ⇀ var ⇀ x ⇓ ⇀ ⊢ rk ⊢ ⊢ es xs xs eqn ⇀ x = f ( ⇀ ⊢ e ) every r Use of an universally quantified relation as a constraint: node f (mask k rk ⇀ xs ) ⇓ mask k rk ⇀ ∀ k , ⊢ ys reset f ( ⇀ xs ) ⇓ ⇀ rk ⊢ ys 8 / 22

Vélus: 3 a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization Implemented in Coq and (some) OCaml Obc generation Clight compilation CompCert Assembly printing 3 Bourke, Brun, Dagand, Leroy, Pouzet, and Rieg (2017): “A Formally Verified Compiler for Lustre” 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization • Validated parsing ( menhir –coq ) a Obc generation Clight compilation CompCert Assembly printing a Jourdan, Pottier, and Leroy (2012): “Validating LR(1) parsers” 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization • Validated parsing ( menhir –coq ) Obc • Elaboration to get clock and type information generation Clight compilation CompCert Assembly printing 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization • Validated parsing ( menhir –coq ) Obc • Elaboration to get clock and type information generation • Not yet implemented: normalization a Clight compilation CompCert Assembly printing a Auger (2013): “Compilation certifiée de SCADE/LUSTRE” 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization • Validated parsing ( menhir –coq ) Obc • Elaboration to get clock and type information generation • Not yet implemented: normalization • Scheduling of dataflow equations Clight compilation CompCert Assembly printing 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization • Validated parsing ( menhir –coq ) Obc • Elaboration to get clock and type information generation • Not yet implemented: normalization • Scheduling of dataflow equations Clight • Translation to intermediate Obc code compilation CompCert Assembly printing 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization node e u l e r ( y0 , y ’ : r e a l ) c l a s s e u l e r { r e t u r n s ( y : r e a l ) memory i n i t : bool ; Obc var h , y1 : r e a l ; memory y1 : r e a l ; i n i t : bool ; generation l e t step ( y0 , y ’ : r e a l ) h = 2; r e t u r n s ( y : r e a l ) y = i f i n i t var h : r e a l Clight then y0 { e l s e y1 ; h := 2; i n i t = t r u e fby f a l s e ; i f ( s t a t e ( i n i t ) ) { y := y0 } compilation CompCert y1 = 0 fby ( y + y ’ ∗ h ) ; e l s e { y := s t a t e ( y1 ) }; t e l s t a t e ( i n i t ) := f a l s e ; s t a t e ( y1 ) := y + y ’ ∗ h Assembly } printing r e s e t ( ) { s t a t e ( i n i t ) := t r u e ; s t a t e ( y1 ) := 0 } } 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization node e u l e r ( y0 , y ’ : r e a l ) c l a s s e u l e r { r e t u r n s ( y : r e a l ) memory i n i t : bool ; Obc var h , y1 : r e a l ; memory y1 : r e a l ; i n i t : bool ; generation l e t step ( y0 , y ’ : r e a l ) h = 2; r e t u r n s ( y : r e a l ) y = i f i n i t var h : r e a l Clight then y0 { e l s e y1 ; h := 2; i n i t = t r u e fby f a l s e ; i f ( s t a t e ( i n i t ) ) { y := y0 } compilation CompCert y1 = 0 fby ( y + y ’ ∗ h ) ; e l s e { y := s t a t e ( y1 ) }; t e l s t a t e ( i n i t ) := f a l s e ; s t a t e ( y1 ) := y + y ’ ∗ h Assembly } printing r e s e t ( ) { s t a t e ( i n i t ) := t r u e ; s t a t e ( y1 ) := 0 } } 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization node e u l e r ( y0 , y ’ : r e a l ) c l a s s e u l e r { r e t u r n s ( y : r e a l ) memory i n i t : bool ; Obc var h , y1 : r e a l ; memory y1 : r e a l ; i n i t : bool ; generation l e t step ( y0 , y ’ : r e a l ) h = 2; r e t u r n s ( y : r e a l ) y = i f i n i t var h : r e a l Clight then y0 { e l s e y1 ; h := 2; i n i t = t r u e fby f a l s e ; i f ( s t a t e ( i n i t ) ) { y := y0 } compilation CompCert y1 = 0 fby ( y + y ’ ∗ h ) ; e l s e { y := s t a t e ( y1 ) }; t e l s t a t e ( i n i t ) := f a l s e ; s t a t e ( y1 ) := y + y ’ ∗ h Assembly } printing r e s e t ( ) { s t a t e ( i n i t ) := t r u e ; s t a t e ( y1 ) := 0 } } 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization node main ( x0 , x ’ : r e a l ) c l a s s main { Obc r e t u r n s ( x : r e a l ) i n s t a n c e i : e u l e r ; l e t generation x = e u l e r ( x0 , x ’ ) ; step ( x0 , x ’ : r e a l ) t e l r e t u r n s ( x : r e a l ) { Clight x := e u l e r ( i ) . step ( x0 , x ’ ) } compilation CompCert r e s e t ( ) { e u l e r ( i ) . r e s e t () } Assembly } printing 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization node main ( x0 , x ’ : r e a l ) c l a s s main { Obc r e t u r n s ( x : r e a l ) i n s t a n c e i : e u l e r ; l e t generation x = e u l e r ( x0 , x ’ ) ; step ( x0 , x ’ : r e a l ) t e l r e t u r n s ( x : r e a l ) { Clight x := e u l e r ( i ) . step ( x0 , x ’ ) } compilation CompCert r e s e t ( ) { e u l e r ( i ) . r e s e t () } Assembly } printing 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization • Validated parsing ( menhir –coq ) Obc • Elaboration to get clock and type information generation • Not yet implemented: normalization • Scheduling of dataflow equations Clight • Translation to intermediate Obc code compilation CompCert • Optimization of intermediate Obc code Assembly printing 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization node main ( x0 , x ’ : r e a l ; ck : bool ) step ( x0 , x ’ : r e a l ; ck : bool ) Obc r e t u r n s ( x : r e a l ) r e t u r n s ( x : r e a l ) var v , w: r e a l when ck ; var v , w: r e a l l e t { generation v = f i l t e r ( x ’ when ck ) ; i f ( ck ) { v := f i l t e r ( i ) . step ( x ’ ) }; w = e u l e r ( x0 when ck , v ) ; i f ( ck ) { w := e u l e r ( j ) . step ( x0 , v ) } ; x = merge ck w ( − 1); i f ( ck ) { x := w } e l s e { x := − 1 } Clight t e l } compilation CompCert Assembly printing 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization step ( x0 , x ’ : r e a l ; ck : bool ) step ( x0 , x ’ : r e a l ; ck : bool ) Obc r e t u r n s ( x : r e a l ) r e t u r n s ( x : r e a l ) var v , w: r e a l var v , w: r e a l { { generation i f ( ck ) { v := f i l t e r ( i ) . step ( x ’ ) }; i f ( ck ) { i f ( ck ) { w := e u l e r ( j ) . step ( x0 , v ) }; v := f i l t e r ( i ) . step ( x ’ ) ; i f ( ck ) { x := w } e l s e { x := − 1 } w := e u l e r ( j ) . step ( x0 , v ) ; Clight } x := w } e l s e { x := − 1 } compilation } CompCert Assembly printing 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization • Validated parsing ( menhir –coq ) Obc • Elaboration to get clock and type information generation • Not yet implemented: normalization • Scheduling of dataflow equations Clight • Translation to intermediate Obc code compilation CompCert • Optimization of intermediate Obc code • Generation of Clight code Assembly printing 9 / 22

Vélus: a verified compiler parsing elaboration normalization scheduling Unannotated Lustre N-Lustre SN-Lustre Lustre dataflow translation imperative fusion optimization • Validated parsing ( menhir –coq ) Obc • Elaboration to get clock and type information generation • Not yet implemented: normalization • Scheduling of dataflow equations Clight • Translation to intermediate Obc code compilation CompCert • Optimization of intermediate Obc code • Generation of Clight code Assembly • Rely on CompCert a for compilation printing a Blazy, Dargaye, and Leroy (2006): “Formal verification of a C compiler front-end” 9 / 22

First issue: naive compilation y = f ( x ) every r ; i f ( ck_r ) { i f ( r ) { f ( i ) . r e s e t () }; }; y := f ( i ) . step ( x ) 10 / 22

First issue: naive compilation y = f ( x ) every r ; i f ( ck_r ) { i f ( r ) { f ( i ) . r e s e t () }; }; y := f ( i ) . step ( x ) Problem with fusion optimization: node main ( x0 , x ’ : r e a l ; ck , r : bool ) r e t u r n s ( x : r e a l ) var v , w: r e a l when ck ; l e t v = f i l t e r ( x ’ when ck ) ; w = e u l e r (( x0 , v ) when ck ) ev er y r ; x = merge ck w 0; t e l 10 / 22

First issue: naive compilation y = f ( x ) every r ; i f ( ck_r ) { i f ( r ) { f ( i ) . r e s e t () }; }; y := f ( i ) . step ( x ) Problem with fusion optimization: node main ( x0 , x ’ : r e a l ; ck , r : bool ) step ( x0 , x ’ : r e a l ; ck , r : bool ) r e t u r n s ( x : r e a l ) r e t u r n s ( x : r e a l ) var v , w: r e a l when ck ; var v , w : r e a l l e t { v = f i l t e r ( x ’ when ck ) ; i f ( ck ) { v := f i l t e r ( i ) . step ( x ’ ) }; w = e u l e r (( x0 , v ) when ck ) ev er y r ; i f ( r ) { e u l e r ( j ) . r e s e t () }; x = merge ck w 0; i f ( ck ) { w := e u l e r ( j ) . step ( x0 , v ) }; t e l i f ( ck ) { x := w } e l s e { x := 0 } } 10 / 22

First issue: naive compilation y = f ( x ) every r ; i f ( ck_r ) { i f ( r ) { f ( i ) . r e s e t () }; }; y := f ( i ) . step ( x ) Problem with fusion optimization: node main ( x0 , x ’ : r e a l ; ck , r : bool ) step ( x0 , x ’ : r e a l ; ck , r : bool ) r e t u r n s ( x : r e a l ) r e t u r n s ( x : r e a l ) var v , w : r e a l var v , w: r e a l when ck ; { l e t i f ( r ) { e u l e r ( j ) . r e s e t () }; v = f i l t e r ( x ’ when ck ) ; i f ( ck ) { w = e u l e r (( x0 , v ) when ck ) ev er y r ; v := f i l t e r ( i ) . step ( x ’ ) ; x = merge ck w 0; w := e u l e r ( j ) . step ( x0 , v ) ; t e l x := w } e l s e { x := 0 } } 10 / 22

Second issue: proof of correctness N-Lustre ⇀ V ω × ⇀ “easy”: ∃ M V ω too weak for a direct N-Lustre proof by induction “hard” V ω × M × ⇀ ⇀ M V ω Obc x i v 0 · · · v ω M’ S × ⇀ V → S × ⇀ V 11 / 22

Second issue: proof of correctness N-Lustre ⇀ V ω × ⇀ “easy”: ∃ M V ω too weak for a direct N-Lustre proof by induction “hard” V ω × M × ⇀ ⇀ M V ω Obc x i v 0 · · · v ω M’ S × ⇀ V → S × ⇀ V 11 / 22

Second issue: proof of correctness N-Lustre ⇀ V ω × ⇀ “easy”: ∃ M V ω too weak for a direct N-Lustre proof by induction “hard” V ω × M × ⇀ ⇀ M V ω Obc x i v 0 · · · v ω M’ S × ⇀ V → S × ⇀ V 11 / 22

Second issue: proof of correctness N-Lustre ⇀ V ω × ⇀ “easy”: ∃ M V ω too weak for a direct N-Lustre proof by induction “hard” V ω × M × ⇀ ⇀ M V ω Obc x i v 0 · · · v ω M’ S × ⇀ V → S × ⇀ V 11 / 22

Second issue: proof of correctness What about the reset? • It is possible to give a semantics in the intermediate semantics model as well 11 / 22

Second issue: proof of correctness What about the reset? • It is possible to give a semantics in the intermediate semantics model as well • The “easy” proof can be done 11 / 22

Second issue: proof of correctness What about the reset? • It is possible to give a semantics in the intermediate semantics model as well • The “easy” proof can be done • The “hard” one cannot 11 / 22

Second issue: proof of correctness The granularity of the intermediate model is not precise enough! 11 / 22

Second issue: proof of correctness The granularity of the intermediate model is not precise enough! step reset Obc | | N-Lustre ? Indeed, because of the reset, the memory can reach 2 different states within the same synchronous instant 11 / 22

Second issue: proof of correctness The granularity of the intermediate model is not precise enough! step reset Obc | | N-Lustre ? Indeed, because of the reset, the memory can reach 2 different states within the same synchronous instant → Transient states 11 / 22

SyBloc • Problems with the compilation scheme • Problems with the semantics models 12 / 22

SyBloc • Problems with the compilation scheme • Problems with the semantics models Propose a new intermediate language • Declarative, like N-Lustre 12 / 22

SyBloc • Problems with the compilation scheme • Problems with the semantics models Propose a new intermediate language • Declarative, like N-Lustre • Where the reset construct is treated as a separate “equation” 12 / 22

SyBloc • Problems with the compilation scheme • Problems with the semantics models Propose a new intermediate language • Declarative, like N-Lustre • Where the reset construct is treated as a separate “equation” • Mimicking the intermediate memory model of N-Lustre 12 / 22

SyBloc • Problems with the compilation scheme • Problems with the semantics models Propose a new intermediate language • Declarative, like N-Lustre • Where the reset construct is treated as a separate “equation” • Mimicking the intermediate memory model of N-Lustre scheduling fusion optimization translation translation SyBloc N-Lustre Obc 12 / 22

N-Lustre SyBloc node e u l e r ( y0 , y ’ : r e a l ) returns ( y : r e a l ) var h : r e a l ; l e t y = y0 fby ( y + y ’ ∗ h ) ; h = 2; t e l node main ( x0 , x ’ : r e a l ) returns ( x : r e a l ) var r : bool ; l e t x = e u l e r ( x0 , x ’ ) every r ; r = ( x ’ > 42); t e l 13 / 22

N-Lustre SyBloc node e u l e r ( y0 , y ’ : r e a l ) block e u l e r ( y0 , y ’ : r e a l ) returns ( y : r e a l ) returns ( y : r e a l ) var h : r e a l ; var h : r e a l ; l e t l e t y = y0 fby ( y + y ’ ∗ h ) ; y = y0 fby ( y + y ’ ∗ h ) ; h = 2; h = 2; t e l t e l node main ( x0 , x ’ : r e a l ) block main ( x0 , x ’ : r e a l ) returns ( x : r e a l ) returns ( x : r e a l ) var r : bool ; var r : bool ; l e t instance i : e u l e r ; x = e u l e r ( x0 , x ’ ) every r ; l e t r = ( x ’ > 42); () = i . reset_on r ; t e l x = i . e u l e r ( x0 , x ’ ) ; r = ( x ’ > 42); t e l 13 / 22

N-Lustre SyBloc node e u l e r ( y0 , y ’ : r e a l ) block e u l e r ( y0 , y ’ : r e a l ) returns ( y : r e a l ) returns ( y : r e a l ) var h : r e a l ; var h : r e a l ; l e t l e t y = y0 fby ( y + y ’ ∗ h ) ; y = y0 fby ( y + y ’ ∗ h ) ; h = 2; h = 2; t e l t e l node main ( x0 , x ’ : r e a l ) block main ( x0 , x ’ : r e a l ) returns ( x : r e a l ) returns ( x : r e a l ) var r : bool ; var r : bool ; l e t instance i : e u l e r ; x = e u l e r ( x0 , x ’ ) every r ; l e t r = ( x ’ > 42); () = i . reset_on r ; t e l x = i . e u l e r ( x0 , x ’ ) ; r = ( x ’ > 42); t e l 13 / 22

N-Lustre SyBloc node e u l e r ( y0 , y ’ : r e a l ) block e u l e r ( y0 , y ’ : r e a l ) returns ( y : r e a l ) returns ( y : r e a l ) var h : r e a l ; var h : r e a l ; l e t l e t y = y0 fby ( y + y ’ ∗ h ) ; y = y0 fby ( y + y ’ ∗ h ) ; h = 2; h = 2; t e l t e l node main ( x0 , x ’ : r e a l ) block main ( x0 , x ’ : r e a l ) returns ( x : r e a l ) returns ( x : r e a l ) var r : bool ; var r : bool ; l e t instance i : e u l e r ; x = e u l e r ( x0 , x ’ ) every r ; l e t r = ( x ’ > 42); () = i . reset_on r ; t e l x = i . e u l e r ( x0 , x ’ ) ; r = ( x ’ > 42); t e l 13 / 22

SyBloc formal semantics: memory A tree with instances as nodes and the values of the fbys together with a boolean reset flag at the leaves : { values: stream val ; reset: stream bool } M x i � � values := v 0 v 1 v 2 · · · mv = M’ reset := r 0 r 1 r 2 · · · Notation: instance M [ i ] = M ′ register M ( x ) = mv 14 / 22

SyBloc formal semantics: fby M ⊢ eqn x = c 0 fby e 15 / 22

SyBloc formal semantics: fby ⊢ const c 0 ⇓ v 0 M ⊢ eqn x = c 0 fby e 15 / 22

SyBloc formal semantics: fby ⊢ const c 0 ⇓ v 0 ⊢ exp e ⇓ vs M ⊢ eqn x = c 0 fby e 15 / 22

SyBloc formal semantics: fby ⊢ const c 0 ⇓ v 0 ⊢ exp e ⇓ vs ⊢ var x ⇓ xs M ⊢ eqn x = c 0 fby e 15 / 22

SyBloc formal semantics: fby ⊢ const c 0 ⇓ v 0 ⊢ exp e ⇓ vs ⊢ var x ⇓ xs mfby x v 0 vs M xs M ⊢ eqn x = c 0 fby e 15 / 22

SyBloc formal semantics: fby ⊢ const c 0 ⇓ v 0 ⊢ exp e ⇓ vs ⊢ var x ⇓ xs mfby x v 0 vs M xs M ⊢ eqn x = c 0 fby e mfby x v 0 vs M xs 15 / 22

SyBloc formal semantics: fby ⊢ const c 0 ⇓ v 0 ⊢ exp e ⇓ vs ⊢ var x ⇓ xs mfby x v 0 vs M xs M ⊢ eqn x = c 0 fby e M ( x ) = mv mfby x v 0 vs M xs 15 / 22

SyBloc formal semantics: fby ⊢ const c 0 ⇓ v 0 ⊢ exp e ⇓ vs ⊢ var x ⇓ xs mfby x v 0 vs M xs M ⊢ eqn x = c 0 fby e M ( x ) = mv mv . values 0 = v 0 mfby x v 0 vs M xs 15 / 22

SyBloc formal semantics: fby ⊢ const c 0 ⇓ v 0 ⊢ exp e ⇓ vs ⊢ var x ⇓ xs mfby x v 0 vs M xs M ⊢ eqn x = c 0 fby e M ( x ) = mv mv . values 0 = v 0 ∀ n , fbyspec n v 0 ( vs n ) mv ( xs n ) mfby x v 0 vs M xs 15 / 22

SyBloc formal semantics: fby ⊢ const c 0 ⇓ v 0 ⊢ exp e ⇓ vs ⊢ var x ⇓ xs mfby x v 0 vs M xs M ⊢ eqn x = c 0 fby e M ( x ) = mv mv . values 0 = v 0 ∀ n , fbyspec n v 0 ( vs n ) mv ( xs n ) mfby x v 0 vs M xs fbyspec n v 0 v mv ( mv . values n ) 15 / 22

SyBloc formal semantics: fby ⊢ const c 0 ⇓ v 0 ⊢ exp e ⇓ vs ⊢ var x ⇓ xs mfby x v 0 vs M xs M ⊢ eqn x = c 0 fby e M ( x ) = mv mv . values 0 = v 0 ∀ n , fbyspec n v 0 ( vs n ) mv ( xs n ) mfby x v 0 vs M xs next n mv v 0 v fbyspec n v 0 v mv ( mv . values n ) � v 0 if mv . reset ( n + 1) , next n mv v 0 v := mv . values ( n + 1) = v otherwise . 15 / 22