Synchronous Languages and System Design with Esterel Ellen Sentovich Cadence Berkeley Laboratories.
-
Upload
vincent-lines -
Category
Documents
-
view
222 -
download
0
Transcript of Synchronous Languages and System Design with Esterel Ellen Sentovich Cadence Berkeley Laboratories.
Synchronous Languagesand System Design with Esterel
Ellen Sentovich
Cadence Berkeley Laboratories
Outline
• Context : Reactive Systems• Principles : Synchronous languages• Esterel in-depth
– Language, Compilation– Causality– Optimization and Verification
• New applications: ECL• Implementing Esterel on CFSM networks
System Design• Systems produce a steady sequence of input/output
sequences• Inconvenient to specify sequences; need models and
languages• Model
– Simple and intuitive– Accurate enough model of physical reality
– Mathematically efficient– General enough to allow different implementation styles
• Language– Accurate expression of the model– Convenient and efficient expression of the design
• Analysis• Implementation
– compilation to hardware, software
Reactive Systems
control
data
signals
sensors
signals
values
EsterelStatechartsArgosEsterelStudio
LustreSCADESignal
Applications• Software and hardware controllers
– process control, embedded systems,data-path control
• Communication Protocols– software protocols,bus interfaces,cache
coherence
• Drivers– man-machine interface,systems
drivers,pipeline logic
Concurrency + Determinism
Reactive System Characteristics
• Reactivity– continually react at a speed determined by the
environment
• Concurrency– at least between system and environment
• Strict time and reliability requirements• Deterministic• Mixed hardware/software implementations
Synchronous SystemsCycle based read inputs compute reaction produce outputs
Synchronous within the same cycle at the same time (0-delay)
(must be checked on implementation)
Synchronous control propagation signal broadcastingEquivalent FSM implementation
(good analysis techniques)
Synchronous Languages
• Invented for the design of reactive kernels– not the interactive interface or data management
• Programmer views system as an instantaneous reactor to events
• Program behavior is completely deterministic• Attempt to resolve concurrency and non-
determinism (in other models)
Esterel: Background• Esterel is one of a set of synchronous
languages developed in France:– Esterel: reactive control– Lustre, Signal: data flow– Argos, SyncCharts: graphical
• Esterel development goal: natural expression of control– Specific statements to deal with time, preemption– Departure from concurrency as interleaving and rendez-vous
to concurrency as instantaneous propagation of control
Esterel: Background• Synchronous programming environment...
– Language:• For control-dominated, reactive systems• Constructs for sequencing, concurrency, preemption
– Compiler:• Produces sorted Boolean equations• Causality checking, symbolic debugging, verification• Implementation as C-code or digital circuits
Esterel: Basic Principles• Synchronous hypothesis : instantaneous
communication• Communication via broadcast signals (event)
– signals, sensors, variables– pure, valued– Boolean and arithmetic operators
• Modularity : program = collection of modules• Concise programs : write things once !!• Concurrency, sequencing, preemption• Well-defined semantics
Overview of Syntax• Signal reading/writing
emit S emit S(value) present S then p else q
• Basic control and looping:
halt loop p end run module• Sequencing, concurrency
p ; q p || q• Preemption
suspend p when S abort p when Sweak abort when S abort when immediate S
Syntax : await statement• Most basic signal control statement
await S
• Equivalent toabortloop
haltend
when S
• Note: “Await” always stops– consider await S; await S– versus await immediate S; await immediate S
Variables and Ordering
• Variable manipulation (local)V := value if V=value then p else q
• Variable computations : orderedV := 5;V := V+1;Y := V;emit S(V)
• Signal emissions (communication) : unorderedLegal: emit S; emit SIllegal: emit S(3); emit S(5) (non-deterministic)
• Signal computations : orderedWell-defined: emit S; present SUndefined: present S then emit S
The ABRO Example
• “Wait until both A and B have occurred, then output O, unless the reset R occurs”
A B
B/0 A/O
AB/O
R
R
R
Number of states is exponential in inputs
The ABRO Example in Esterel
• Wait until both A and B concurrency
• Unless R preemption
[await A || await B] ;
emit O
abort
when R
loop
end
Write things ONCE !!
Code size is linear in inputs; efficient circuit
Compilation• Esterel program extended finite state machine
– finite # inputs, deterministic reaction finite program– FSM + data computations
• Can be compiled to a single automata - EXPENSIVE!!– exhaustive exploration of set of control states– Esterel v3
• Can be translated to sorted Boolean equations– Esterel v5
• State machine is represented implicitly
Translation to Boolean Circuits
• Structural translation• Network of interconnected cells• Implementation of control:
– control signal runs through the circuit– boot signal : latch, initially 1, thereafter 0
• Each cell contains– signal input/output; control input/output– suspend, kill, resume signals– return codes (nested preemption)
• One register per halting statement
Translation to Boolean Circuits
•present S then p else q
S
control
control for q
control for p
control
Causality
• Cycles occur naturally in Esterel specifications– Cyclic dependency between variables– Some are harmful, some not
• The Causality Problem is analyzing these cycles and deciding which to accept– It is related to analyzing hardware in circuits– Combinational cycles
• How do we define a causally correct program?– We want a unique, comprehensible solution– All present signals must be emitted somewhere– A solution is a set of consistent assignments to all signals– Need to be able to express program in a non-cyclic way
Constructive causality
Harmful Cycles
No Boolean solution (non-reactive),or several solutions (non-deterministic)
Electrically unstable
Useless !
X = XX
X = not XX
present X then emit X end
present X else emit X end
Harmless Cycles
Unique Boolean solutionElectrical stabilization in bounded time
=> behaves as if acyclic
Natural in Esterel programmingNatural in high-level hardware synthesisPossible exponential saving in space!
present I then present X then emit Y endelse present Y then emit X endend
Y
X
I
X
Y
I
J
X = I and not YY = J and not X
OK unless I = J = 1
1
0
X
Y
The non-constructive state (1,1) is unreachable => reachability analysis needed
Combinational Cycles in Sequential Circuits
Y = if C then G(F(X)) else F(G(X))
F
G
01
10
10
C
C
C
X Y
Naturally occurring harmless cycles:Operator sharing (S. Malik)
Causality: A Real Example• Bus arbitration
TokenOut GrantOut
TokenIn GrantInReqIn AckOutCell 1
TokenOut GrantOut
TokenIn GrantInReqIn AckOut
Cell n
TokenOut
AckOut
T
ReqIn
GrantOut
GrantInTokenIn
GrantOut
GrantIn
Strange Cycles
Unique Boolean solution
But electrically unstable !
=> Electricity = Boolean calculus/
X
Y
X = XY = X and not Y
X = 0X = 1 ?
Want to build a theory with stable solutions.Also cheaper for compiler
(interpretation possible)
present ToBe then emit ToBe else emit ToBeend
ToBe
Hamlet : ToBe = ToBe or not ToBe
Constructive Causality in Esterel
Step through programAnalyze what must be done (emit) what cannot be done (no possible emit) what can be done
Set a signal present iff it must be emittedSet a signal absent iff it cannot be emitted
Constructive causality permits interpretation
Executing Constructive Causality
module P1:input I;output O;signal S1, S2 in
present I then emit S1 end||
present S1 else emit S2 end||
present S2 then emit O endend signalend module
Circuits are Boolean proof builders
Trace values from inputs to outputs, neverguessing a value
Analysis equivalent to electron flow in a circuitA causal program is equivalent to an electrically
stable circuit, acyclic circuit
0
00 0
0
Analogy: constructive circuits
Derive facts from facts
E=0E and F = 0
F=0E and F = 0
E=1 F=1E and F = 1
E=0not E = 1
E=1not E = 0
X=E E=bX=b
Constructive Boolean Logic
Cannot determine E or not E unless E is known!
X = I and not YY = J and not X
(1) I=0(2) J=1(3) X=0 from (1)(4) not X=1 from (3)(5) Y=1 from (2) and (4)
(1) I=1(2) J=0(3) Y=0 from (2)(4) not Y=1 from (3)(5) X=1 from (2) and (4)
No proof of X and Y if I=J=1
Semantic model : Scott’s 3-valued logic
B = { , 0, 1}
View circuit as fixpoint equation
X = F(X, I)
X=b holds in fixpoint iff provable
TT
Main Theorem (Shiple Berry from Brzozowski - Seger)
Given a circuit and an input :
X=b provable in CBL (proving facts)<=> X=b in the fixpoint (Scott’s view)<=> X stabilizes to b for any delay assignment (circuit view)
Compositionality
Algorithms (Esterel v5)Interpretation
Input-dependent analysislinear time
Compilation (Shiple = Malik + Bourdoncle)Input-independent fixpoint analysis:
Combinational loops are brokenthree-valued simulation performed (BDDs)reachable state computation (BDDs)
Check that all feedback wires are well-defined
Expensive! Interpretation option in Esterel==> equivalent acyclic version
X = I and not YY = J and not X
I=0 . J=1 X : 2 Y : 2
J=1 . X=0 X : 1 Y : 2
X=0 X : 1 Y : 1
X : 1 Y : 0
Y=1 X : 1 Y : 0
X : 0 Y : 0
unknownsfacts
Interpretation Example
X = I and not YY = J and not X
I=1 . J=1 X : 2 Y : 2
J=1 X : 1 Y : 2
X : 1 Y : 1
Deadlock = proof search stops
X = I and not YY = J and not X
X = I and YX = I or YY = J and XY = J or X
X set of inputs that set X to 1 X set of inputs that set X to 0
The circuit is constructive for all inputs such that X or X = 1 for all X
Dual-Rail Encoding to Implement Constructive Analysis
X {
3-valued: 01 = 0, 10 = 1, 00 = unknown
((I and J) or I) and ((J and I) or J))
X = I and YX = I or YY = J and XY = J or X
I = I I = not I
for I input {
not(I and J)
X = 0X = IY = 0Y = J
X = I and JX = IY = J and IY = J
Fixpoint iteration
X = 0X = 0Y = 0Y = 0
Need XX = 0, YY = 0; X + X = 1, Y + Y = 1
Causality Summary
Constructive Boolean logic characterizes delay-independent digital circuits
Solves the causality problem for Esterel Strong user request! Compositional semantics
Good implementation and decision algorithms
• Xes
Graphical Symbolic Debugging
Optimization• Standard logic synthesis techniques can be applied
to generated hardware• Finite state machine optimization and analysis• Esterel state encoding:
– locally group-hot– efficient implementation– far more latches than the minimum
• Latch minimization algorithms– exploit the latch/logic tradeoff– progressively more powerful algorithms
Latch Optimization• Replacement of latches with logic
– compute the reachable state set– compute sets of latches that can be
replaced• single latch removal : Rl Rl’= 0
• 2-for-1 removal : Rij Ri’j’ + Ri’j Rij’ = 0
Reachable statesKarnaugh map
L
L1 … Ln-1
0
1
1
1
1
1
Latch Optimization• Generate decoding logic
–single-latch: remove latch–2-for-1: remove two latches, add logic for
one
• Generate encoding logic–single-latch: E = Rl (dependent on other
latches)
EL’D
LCircuit
In Out
Latch Optimization : Exclusive Sets
• Mutually exclusive latch activityawait s1 || await s2 || await s3;await s4 || await s5 || await s6
• Latch corresponds to each wait• (s1, s2, s3) # (s4, s5, s6)• Replace 6 latches with 3 plus a
multiplexing latch
Latch Optimization : Results
• Esterel encoding maintains the structure of the initial program
• single latch removal is always beneficial• More sophisticated algorithms exploit latch/logic
tradeoff• Cost functions depend on circuit size, BDD size• Typically 2-for-1 is performed until logic becomes
prohibitively expensive• Verification times are improved
Verification
• Simulation and debugging• Synchronous observers
– specify an Esterel module to monitor the system and report errors
– specify an Esterel module to model the environment– perform symbolic reachability analysis
• Temporal logic formulas translated to Esterel modules– TempEst work at U Texas
The Esterel ToolsetLanguage + formal semanticsCompiler to hardware or software (Esterel v5) Automata (explicit FSM) Boolean circuits (implicit FSM) Proved correct w.r.t. the semanticsGraphical simulators / debuggers (xes)Verifier for safety properties Xeve, TempEstEsterelStudio : commercial product, including
graphical input, test generation
ECL Project
• ECL for system design– Done at Cadence Berkeley Laboratories– Many industrial partners– Used in one commercial product
• Language & Compilation
• Status
ECL Summary : Language• ECL = Esterel + C
– ANSI-C plus constructs for reactivity• signal communication: await(sig); emit(sig, value);• pre-emption: abort stmt when sig_exp• concurrency: par stmt; par stmt
– C : standard in embedded software, minimal learning curve, many good compilers, reactivity missing
– Esterel : high-level reactive control, rigorous mathematical semantics (FSM), strong analysis and optimization tools, limited support for data, non-reactive loops
ECL Key Features• Language support for control and data
• Esterel + FSM synthesis technology for– Efficiency : implicit state FSMs– Robust analysis and optimization– Verification– Implementation HW and/or SW
Example : simple C
for (i = 0; i < SIZE; i++) { buf [ i ] = In [ i ];}create_frame_from_buffer(&f, buf);
Example : add reactivity / concurrency
for (i = 0; i < SIZE; i++) { buf [ i ] = IN ;}create_frame_from_buffer(&f, buf);
await ( IN );
emit (frame, f);
while (1) { /* check CRC */ await (frame); for (i = 0; i < HSIZE; i++) crc ^= frame.hdr[i] if (crc != frame.crc) emit (bad_crc);}
while (1) { /* get bytes into frame */
}
par
par
Example : complete ECL module
par while (1) { /* process address (if correct) */ await (frame); do { /* … */; emit (out, frame) } abort (bad_crc); }
typedef { byte hdr[HSIZE]; byte data[DSIZE]; int crc; } frame_t;
module frame_proc (input byte in, input frame_t out)
byte buf[SIZE]; frame_t f; int crc;
{ signal frame_t frame; signal int bad_crc;
}
par while (1) { /* get bytes into frame */ for (i = 0; i < SIZE; i++) {await (in); buf[i] = in;} create_frame_from_buffer(&f, buf); emit_v (frame, f); } par while (1) { /* check CRC */ await (frame); for (i = 0; i < HSIZE; i++) crc ^= frame.hdr[i]; if (crc != frame.crc) emit (bad_crc); }
ECL compilation• Split ECL source: Esterel + C (by compiler capability)
• ECL module compiled to
– FSM (via Esterel) : reactive stmts + some C [Control +]
– C-code residue : functions and non-reactive loops [Data]
• Implementation
– SW (C) or HW (HDL) [Control +]
– C-code residue : SW produced by ECL compiler [Data]
• Trade-off: where exactly to split?
– more Esterel more optimization
– more C more predictable compilation process
ECL compilation
Implementationin HW / SW
ECLSpecification
Esterel Code C - code
C functions
non-reactive loops
module calls: get_data (signal IN)reactive statements: await a;concurrency: par await a; par await b;C statements reactive loops
SimulationModel
EsterelCompiler to C
EsterelCompiler to C/FSM
Example : pre-compilationtypedef { byte hdr[HSIZE]; byte data[DSIZE]; int crc; } frame_t;module frame_proc (input byte in, output frame_t out){ signal frame_t frame; signal int bad_crc; byte buf[SIZE]; frame_t f; int crc; par while (1) {/* get bytes into frame */ for (i = 0; i < SIZE; i++) {await (in); buf[i] = in;} create_frame_from_buffer(&f, buf); emit (frame, f); } par while (1) {/* check CRC */ await (frame); for (i = 0; i < HSIZE; i++) crc ^= frame.hdr[i]; if (crc != frame.crc) emit (bad_crc); } par while (1) {/* process address (if correct) */ await (frame); abort{ /* … */; emit (out, frame) } when (bad_crc); }}
Non-reactive loop
Reactive loop
Example : post-compilationtypedef { byte hdr[HSIZE]; data[DSIZE]; int crc } frame_t;void crc_compute(int crc, frame_t frame) { for (i = 0; i < HSIZE; i++) crc ^= frame.hdr[i]; }/* plus interface functions such as set_buffer_i */
module frame_proc:input in : byte;output out : frame_t;signal frame : frame_t, bad_crc:integer invar buf : frame_t, crc:integer in loop % get bytes into frame trap DONE in cnt := 0; loop {await in; set_buffer_i(buffer, i, in); if (cnt < SIZE) else exit DONE end if;} end loop emit frame(?buffer); end trap; end loop|| loop % check CRC await frame; crc_compute(crc, frame); if (crc != get_frame_crc(frame) then emit bad_crc end if; end loop || etc
Compiled to C
Compiled toEsterel
Reactive loop
Non-reactive loop
ECL Summary• ECL smoothly integrates
– C (standard for embedded software development)– Esterel (concurrency, preemption, FSM semantics)
into a single language and development environment • ECL compiler
– generates Esterel and C for embedded SW implementation– permits (partial) hardware implementation
• Opensource : http://www.sourceforge.net/projects/ecl– Java source code, test/tutorial examples, regression
tests, documentation (html, ps, pdf)• Ongoing work:
– ECL for hardware specification– ECL and Esterel in Metropolis
Implementing Esterel Programs in POLIS
• POLIS: system-level design tool created at UCB• Model of computation:
– GALS via communicating CFSMs– Global: asynchronous
• Events can arrive at any time• Different parts of system compute at different rates• Buffering of events for each module
• Goal : implement Esterel programs in a POLIS system while preserving their semantics
POLIS : a GALS modelGlobally Asynchronous Locally Synchronous
CFSM
Input buffer
CFSM: FSM w/data, support for asynch communication
Input Buffer = presence + value
- A CFSM is runnable when an input comes in-Several inputs may come in before actual run- Presence / absence can be tested for each input- Value can be accessed for present signals-Transition in 0-delay-Inputs are consumed during the run- Output broadcast by the network, with delay- 1-place buffers can be overwritten
CFSM
• Synchronous programs- nice semantics / mathematics- concurrency + deterministic - optimization + verification feasible- limited in scope : compact systems
• CFSM networks- POLIS implementation model- good for hardware / software codesign- formal semantics, but can be wild- semantics purely operational (scheduler)
Examplemodule m1:input a, ONE;output TWO;
loop await case [a and ONE] do emit TWO endend loop
module m2:input a, TWO;output ONE, THREE;[loop await case TWO do emit THREE endend loop]||[loop await case a do emit ONE endend loop]
a = 1m1 -> m2 -> m1 -> m2m2 -> m1 -> m2
await case : wait until at least one case is true
Can we implement synchronous languages on CFSM networks?
• Run large-scale synchronous programs on networks• Maintaining synchronous semantics
• Study classes of “well-behaved” CFSM networks• Study progressive relaxation of synchrony
Previous work : P. Caspi and A. Girault E,. Ledinot et.al., Dassault Aviation
Constructive and not gate as a CFSM - v1
AB
C
input A: boolean, B : boolean;output C : boolean;[ await A; if not ?A then emit C(false) end|| await B; if ?B then emit C(false) end];if ?A and not ?B then emit C(true) end
• Encode facts in CFSM events• Create a logic network of gates representing the Esterel program• Use one CFSM per gate• Create at POLIS network of CFSMs to propagate the facts
POLIS Implementation
Combinational gates -> sequential CFSMsSynchronous cycle -> full network execution
Constructive and not gate as a CFSM - v1
AB
C
input A: boolean, B : boolean;output C : boolean;[ await A; if not ?A then emit C(false) end|| await B; if ?B then emit C(false) end];if ?A and not ?B then emit C(true) end
Problem: C can be emitted twice
signal Caux : combine boolean with and in [ await A; if not ?A then emit Caux(false) end || await B; if ?B then emit Caux(false) end ]; if ?A and not ?B then emit Caux(true) end|| await Caux; emit C(?Caux)end signal
V2 : protecting double emission
Given an input assignment, the network builds a proof
• Each gate buffer is written at most once - no buffer overwriting - bounded time (linear)
• Termination when no more runnable CFSM - #events = #fanins -> constructive - else non-constructive
• Any scheduling gives the right answer!
But works only for one global tick!
Macro-cycles - give synchronous events successively - logical timing by stream ordering
a0 a1 a2 a3 a4 b0 b1 b2 b3 b4 c0 c1 c2 c3 c4
Four basic solutions :
1. Wait long enough (as for circuits)
2. Compute explicit termination signal
3. Let the scheduler report termination
4. Use a flow control protocol
-> pipelining
Flow Control
AB
C
A_Free
B_FreeC_Free
loop signal Caux : combine boolean with and in [ await A; emit A_Free; if not ?A then emit Caux(false) end || await B; emit B_Free; if ?B then emit Caux(false) end ]; if ?A and not ?B then emit Caux(true) end || [ await Caux || await C_Free ] ; emit C(?Caux) end signalend loop
V3 : flow control
A gate resets for next tick when it has received all its input. No additional protocol needed!
A=0 A_FreeC_Free C=0B=1 B_Free loop
A=1 A_FreeC_Free B=0 B_Free C=1 loop
Automatic Gate Reset
Pipelining
Problem : out-of-order data for next cycle
A(0) -> A_FreeC_Free -> C(0)A(1) ->B(1) -> B_Free
3. Tell the scheduler that only arrival of B matters => sensitivity lists
1. Memorize A(1) in the CFSM - heavy!
2. Write back 1 in the A buffer but gate immediately made runnable again!
module AndNot :
% Boolean IOinput A : boolean, B : boolean;output X : boolean;
% Flow control IOoutput A_Free, B_Free;input C_Free;
% Scheduling IOoutput A_Wait, B_Wait;output C_Free_Wait;
loop signal Caux : combine boolean with and in < handle A and B > || < handle C > end signalend loop
[ abort sustain A_Wait when A; emit A_Free; if not ?A then emit Caux(false) end|| abort sustain B_Wait when B; emit B_Free; if ?B then emit Caux(false) end];if ?A and not ?B then emit Caux(true)
[ await Caux|| abort sustain C_Free_Wait when C_Free];emit C(?Caux)
Termination signal
X
Y
I
J
DONE
Too expensiveNon-local
• One can implement a constructive circuit in POLIS by translating each gate into a CFSM
• Therefore, on can implement Esterel by first translating Esterel programs into gates
• Of course, this is inefficient : too fine grain
• But, we did not use compositionality yet!
Using Compositionality
• Any network of gates acts just as a gate• Group gates either synchronously, using v5 algo., or asynchronously, in the network• Adjust grouping according to geographical and performance requirements
Summary
• Constructive logic semantics facts as information quanta• Propagate facts synchronously in CFSM nodes asynchronously in the network• Correct by construction• Applicable to (some) real problems