Syntax-driven partitioning for model-checking of Esterel programs Eric Vecchié - INRIA Aoste

Motivation Build the Reachable State Space… …following the syntax abort P when S; Q Reachable State Space allows –Model-checking –Code optimization –Test sequence generation –…–…

R ← INIT new ← R while ( new ≠ ø ) do new ← Image(new) \ R R ← R U new end while Reachable State Space Breadth First Search algorithm Symbolic methods (BDDs)

What is done

Size of Computations Solution : Rely on program structural syntax BDD size states reached non-saturated states set

What we do

Example : Wristwatch display watch time_setalarm_set stopwatch

Example : Wristwatch

How to partition ? According to program blocks –Separated by frontiers –Synthesized from signal receptions Build a control flow graph –Encoding frontiers –Guiding the RSS computation

Preemption / if-then-else P Q P1P1 P2P2 Q S S

abort P when S; present T then Q1 else Q2 end; R P Q2 R Q1 Partitioning Example

Parallel Constructs Avoid cartesian product –{P 1, P 2 }  {Q 1, Q 2 } Use signal information || P1P1 Q1Q1 P2P2 Q2Q2

Parallel and signals || P1P1 Q1Q1 R1R1 P2P2 Q2Q2 Q3Q3 R2R2 S1 S2

Only increasing  Avoid the cross product Can be not satisfying on loops –…but on rare cases Parallel and signals

Loops P Q

pause pause loopend || abort when S present T then else end ; Control Flow Graph construction || pause ;

Symbolic methods Boolean functions Sets (in a finite universe) Partitioned Transition Relations Binary Decision Diagrams (BDDs) allow to represent :

Cofactoring Given a domain D, reduce the BDD of a function f : f ↑D (x) = f(x) if x belongs to D Cofactoring is used 2 ways –Reduce the domain according to our frontiers –Transition function applied on new states

Experiments A medium-sized design : sequencer A big design : cabin

BDD sizes in “sequencer”

A big design : “cabin” Default methodPartitioning 534 states states 3 steps (11.85s)123 steps (35h40)

Conclusion Program verification following program syntax Preemptions, if-then-else Signals in parallels Smaller intermediate BDDs Lighter transition functions Lighter image computations  Less memory required

The End

Motivation Model-checking Code optimization Test sequence generation … Reachable State Space (RSS)

R ← INIT new ← R while ( new ≠ ø ) do new ← Image(new) \ R R ← R U new end while Reachable State Space (RSS) Breadth First Search algorithm Symbolic methods (BDDs)

Introduction Esterel Synchronous reactive structural programming –sequence, if-then-else –Parallelism, preemption Circuit translation (model-checking level)

Partitioning - detail