1. Syntax-driven partitioning for model-checking of Esterel programs Eric Vecchié - INRIA Aoste

2. Motivation Build the Reachable State Space… …following the syntax abort P when S; Q Reachable State Space allows –Model-checking –Code optimization –Test sequence generation –…–…

3. R ← INIT new ← R while ( new ≠ ø ) do new ← Image(new) \ R R ← R U new end while Reachable State Space Breadth First Search algorithm Symbolic methods (BDDs)

4. What is done

5. Size of Computations Solution : Rely on program structural syntax BDD size states reached non-saturated states set

6. What we do

7. Example : Wristwatch display watch time_setalarm_set stopwatch

8. Example : Wristwatch

10. How to partition ? According to program blocks –Separated by frontiers –Synthesized from signal receptions Build a control flow graph –Encoding frontiers –Guiding the RSS computation

11. Preemption / if-then-else P Q P1P1 P2P2 Q S S

12. abort P when S; present T then Q1 else Q2 end; R P Q2 R Q1 Partitioning Example

13. Parallel Constructs Avoid cartesian product –{P 1, P 2 }  {Q 1, Q 2 } Use signal information || P1P1 Q1Q1 P2P2 Q2Q2

14. Parallel and signals || P1P1 Q1Q1 R1R1 P2P2 Q2Q2 Q3Q3 R2R2 S1 S2

15. Only increasing  Avoid the cross product Can be not satisfying on loops –…but on rare cases Parallel and signals

16. Loops P Q

17. pause pause loopend || abort when S present T then else end ; Control Flow Graph construction || pause ;

18. Symbolic methods Boolean functions Sets (in a finite universe) Partitioned Transition Relations Binary Decision Diagrams (BDDs) allow to represent :

19. Cofactoring Given a domain D, reduce the BDD of a function f : f ↑D (x) = f(x) if x belongs to D Cofactoring is used 2 ways –Reduce the domain according to our frontiers –Transition function applied on new states

20. Experiments A medium-sized design : sequencer A big design : cabin

21. BDD sizes in “sequencer”

22. A big design : “cabin” Default methodPartitioning 534 states135 441 875 states 3 steps (11.85s)123 steps (35h40)

23. Conclusion Program verification following program syntax Preemptions, if-then-else Signals in parallels Smaller intermediate BDDs Lighter transition functions Lighter image computations  Less memory required

24. The End

25. Motivation Model-checking Code optimization Test sequence generation … Reachable State Space (RSS)

26. R ← INIT new ← R while ( new ≠ ø ) do new ← Image(new) \ R R ← R U new end while Reachable State Space (RSS) Breadth First Search algorithm Symbolic methods (BDDs)

27. Introduction Esterel Synchronous reactive structural programming –sequence, if-then-else –Parallelism, preemption Circuit translation (model-checking level)

30. Partitioning - detail