Symbolic Simulation of Dataflow Synchronous Programs with Timers - PowerPoint PPT Presentation

Symbolic Simulation of Dataflow Synchronous Programs with Timers Guillaume Baudart 1 Timothy Bourke 2 , 3 Marc Pouzet 4 , 3 , 2 1. IBM Research 2. Inria Paris 3. DI, École normale supérieure 4. Univ. Pierre et Marie Curie FDL 2017, Verona, Italy—18–20 September 2017 1 / 26

The synchronous language Lustre [ ] Caspi, Pilaud, Halbwachs, and Plaice (1987): “Lustre: A Declarative Language for Program- ming Synchronous Systems” • Ideal for programming an important class of embedded controllers. – Academic foundation of Scade Suite tool for critical industrial systems. • Based on a discrete-time abstraction. R 1 R 2 R 3 R 4 R 5 every trigger: read inputs; compute; model: R 1 , R 2 , R 3 , R 4 , R 5 , . . . write outputs 2 / 26

The synchronous language Lustre [ ] Caspi, Pilaud, Halbwachs, and Plaice (1987): “Lustre: A Declarative Language for Program- ming Synchronous Systems” • Ideal for programming an important class of embedded controllers. – Academic foundation of Scade Suite tool for critical industrial systems. • Based on a discrete-time abstraction. R 1 R 2 R 3 R 4 R 5 every trigger: read inputs; compute; model: R 1 , R 2 , R 3 , R 4 , R 5 , . . . write outputs But, ‘physical’ timing constraints are often required. 2 / 26

The synchronous language Lustre [ ] Caspi, Pilaud, Halbwachs, and Plaice (1987): “Lustre: A Declarative Language for Program- ming Synchronous Systems” • Ideal for programming an important class of embedded controllers. – Academic foundation of Scade Suite tool for critical industrial systems. • Based on a discrete-time abstraction. R 1 R 2 R 3 R 4 R 5 every trigger: read inputs; compute; model: R 1 , R 2 , R 3 , R 4 , R 5 , . . . write outputs But, ‘physical’ timing constraints are often required. Timed (Safety) Automata [ ] [ Checking for Real-Time Systems” ] Henzinger, Nicollin, Sifakis, and Alur and Dill (1994): Yovine (1994): “Symbolic Model “A Theory of Timed Automata” • Model the passage of time and timing non-determinism – (tolerances in requirements / uncertainties in implementations). • Verification and Symbolic Simulation in Uppaal [ (2006): A tutorial on Uppaal 4.0 ] Behrmann, David, and Larsen 2 / 26

Dataflow synchronous language basics x average let average(x, y) = (x + y) / 2 y 3 / 26

Dataflow synchronous language basics x average let average(x, y) = (x + y) / 2 y 0 1 2 5 4 5 6 x ⋯ 4 3 4 2 0 2 2 y ⋯ 2 2 3 3 2 3 4 x + y / 2 ⋯ 3 / 26

Dataflow synchronous language basics x average let average(x, y) = (x + y) / 2 y 0 1 2 5 4 5 6 x ⋯ 4 3 4 2 0 2 2 y ⋯ 2 2 3 3 2 3 4 x + y / 2 ⋯ let h = 10.0 let node euler(x0, x') = x where x0 x euler rec nx = x +. (h *. x') x’ and x = x0 fby nx 3 / 26

Dataflow synchronous language basics x average let average(x, y) = (x + y) / 2 y 0 1 2 5 4 5 6 x ⋯ 4 3 4 2 0 2 2 y ⋯ 2 2 3 3 2 3 4 x + y / 2 ⋯ let h = 10.0 let node euler(x0, x') = x where x0 x euler rec nx = x +. (h *. x') x’ and x = x0 fby nx 0 1 2 3 4 5 6 x0 ⋯ 2 1 2 0 2 3 1 x' ⋯ 20 30 50 50 70 100 110 ⋯ nx 0 20 30 50 50 70 100 ⋯ x • Node: set of causal equations (variables at left). • Semantic model: synchronized streams of values. • A node defines a function between input and output streams. 3 / 26

Zélus: synchronous language + ODEs [ Synchronous Language with ODEs” ] Bourke and Pouzet (2013): “Zélus: A 3 6 9 0 let node nat(v) = y where t rec y = v fby (y + 1) x − 1 . 5 let hybrid sawtooth(x', x0) = o where rec init o = 0 and der x = x' init x0 reset z → x0 and z = up(x) o 3 and present z → do o = nat(1) done 2 1 0 let hybrid main = sawtooth(0.5, -1.5) t • Combine discrete-time and continuous-time behaviours – A type system ensures that compositions are well-defined. – Align discrete behaviours on ‘zero-crossing’ events. • Source-to-source compilation for simulation with a numeric solver. • Research focus on hybrid programming languages – E.g., Simulink/Stateflow, Modelica, Ptolemy. . . • Manual and compiler: http://zelus.di.ens.fr 4 / 26

Example: quasi-periodic nodes [ Approach to Distributed Control Systems ] Caspi (2000): The Quasi-Synchronous c 1 c 2 P 1 P 2 Two network nodes activated on clock inputs c 1 and c 2 • Each node is periodically triggered by a local clock. • The difference between ticks i and i + 1 is bounded: T min ≤ t i + 1 − t i ≤ T max Vaandrager and Groot (2006): • Easy to model a clock as a Timed Automaton: [ Protocol with Uppaal and PVS” ] “Analysis of a Biphase Mark t <= t_max c! T0 t >= t_min t := 0 • What about combining with discrete controller code? 5 / 26

Clock in Zélus? t <= t_max let hybrid clock(t_min, t_max) = c where c! rec der t = 1.0 init 0.0 reset c() → 0.0 T0 t >= t_min t := 0 and present up(t - t_min) → do emit c done Programming Timed Automaton in Zélus • Very restricted ODEs ( ˙ x = 1): no need for a numeric solver. • Cannot express ‘timing non-determinism’. • Very appealing to ‘embed’ discrete programs in continuous time. • The discrete/continuous type system rejects meaningless compositions. 6 / 26

let hybrid clock(t_min, t_max) = c where t <= t_max c! rec timer t init 0.0 reset c() → 0.0 T0 t >= t_min and emit c when {t ≥ t_min} t := 0 and always {t ≤ t_max} 7 / 26

let hybrid clock(t_min, t_max) = c where t <= t_max c! rec timer t init 0.0 reset c() → 0.0 T0 t >= t_min and emit c when {t ≥ t_min} t := 0 and always {t ≤ t_max} let hybrid scheduler(t_min, t_max) = c1, c2 where rec c1 = clock(t_min, t_max) and c2 = clock(t_min, t_max) c 1 c 2 P 1 P 2 let hybrid quasinodes(t_min, t_max) = o1, o2 where rec c1, c2 = scheduler(t_min, t_max) and o1 = present c → node1(channel(o2)) init oi and o2 = present c → node2(channel(o1)) init oi 7 / 26

Zsy: syntax • A program is a list of declarations. d let hybrid f ( p ) = e ∶∶ = ∣ let node f ( p ) = e • A node is defined by an expression. ∣ let f ( p ) = e • Expressions refer to sets of equations. ∣ d d New features x ∣ v ∣ op ( e ) e ∶∶ = ∣ • Timers (time elapsing) ( e , e ) ∣ f ( e ) • Invariants (must) ∣ e fby e • Guards (may) ∣ e where rec E E x = e ∶∶ = ∣ x ∣ ( p , p ) E and E p ∶∶ = ∣ x = present h init e ∣ h e → e | ⋯ | e → e ∶∶ = x = present h else e ∆ ∼ e ∣ c && c ∣ c ∶∶ = timer x init e reset h x ∣ x − x ∣ ∆ always { c } ∶∶ = < ∣ ≤ ∣ ≥ ∣ > ∣ ∼ ∶∶ = emit x when { c } 8 / 26

Concrete Simulation Trace T min = 30 T max = 45 t 1 t 2 x T max T max t 2 45 30 T min T min t 1 30 45 time 0 15 30 45 60 75 90 9 / 26

Concrete Simulation Trace T min = 30 T max = 45 t 1 t 2 x T max T max t 2 45 30 T min T min t 1 30 45 time 0 15 30 45 60 75 90 wait t 2 45 30 t 1 30 45 9 / 26

Concrete Simulation Trace T min = 30 T max = 45 t 1 t 2 x T max T max t 2 45 30 T min T min 33 t 1 30 45 time 0 15 30 45 60 75 90 wait t 2 t 2 45 45 c2 30 30 t 1 t 1 30 45 30 45 9 / 26

Concrete Simulation Trace T min = 30 T max = 45 t 1 t 2 x T max T max t 2 45 30 T min T min 33 t 1 30 45 time 0 15 30 45 60 75 90 wait t 2 t 2 t 2 45 45 45 c2 wait 30 30 30 t 1 t 1 t 1 30 45 30 45 30 45 9 / 26

Concrete Simulation Trace T min = 30 T max = 45 t 1 t 2 x T max T max t 2 45 30 T min T min 33 43 t 1 30 45 time 0 15 30 45 60 75 90 wait t 2 t 2 t 2 t 2 45 45 45 45 c2 wait c1 30 30 30 30 t 1 t 1 t 1 t 1 30 45 30 45 30 45 30 45 9 / 26

Concrete Simulation Trace T min = 30 T max = 45 t 1 t 2 x T max T max t 2 45 30 T min T min 33 43 t 1 30 45 time 0 15 30 45 60 75 90 wait t 2 t 2 t 2 t 2 t 2 45 45 45 45 45 c2 wait c1 wait 30 30 30 30 30 t 1 t 1 t 1 t 1 t 1 30 45 30 45 30 45 30 45 30 45 9 / 26

Concrete Simulation Trace T min = 30 T max = 45 t 1 t 2 x T max T max t 2 45 30 T min T min 33 43 78 t 1 30 45 time 0 15 30 45 60 75 90 wait t 2 t 2 t 2 t 2 t 2 t 2 45 45 45 45 45 45 c2 wait c1 wait c2 30 30 30 30 30 30 t 1 t 1 t 1 t 1 t 1 t 1 30 45 30 45 30 45 30 45 30 45 30 45 9 / 26

Symbolic Simulation Trace T min = 30 T max = 45 t 1 t 2 x T max T max t 2 45 30 T min T min t 1 30 45 time 0 15 30 45 60 75 90 10 / 26

Symbolic Simulation Trace T min = 30 T max = 45 t 1 t 2 x T max T max t 2 45 30 T min T min t 1 30 45 time 0 15 30 45 60 75 90 wait t 2 45 30 t 1 30 45 10 / 26

Symbolic Simulation Trace T min = 30 T max = 45 t 1 t 2 x T max T max t 2 45 30 T min T min t 1 30 45 time 0 15 30 45 60 75 90 wait t 2 t 2 45 45 wait 30 30 t 1 t 1 30 45 30 45 10 / 26

Symbolic Simulation Trace T min = 30 T max = 45 t 1 t 2 x T max T max t 2 45 30 T min T min t 1 30 45 time 0 15 30 45 60 75 90 wait t 2 t 2 t 2 45 45 45 wait c2 30 30 30 t 1 t 1 t 1 30 45 30 45 30 45 10 / 26

Symbolic Simulation Trace T min = 30 T max = 45 t 1 t 2 x T max T max t 2 45 30 T min T min t 1 30 45 time 0 15 30 45 60 75 90 wait t 2 t 2 t 2 t 2 45 45 45 45 wait c2 c1 30 30 30 30 t 1 t 1 t 1 t 1 30 45 30 45 30 45 30 45 10 / 26