Pascal Raymond

The synchronous data flow programming language LUSTRE

The authors describe LUSTRE, a data flow synchronous language designed for programming reactive systems-such as automatic control and monitoring systems-as well as for describing hardware. The data flow aspect of LUSTRE makes it very close to usual description tools in these domains (block-diagrams, networks of operators, dynamical sample-systems, etc.), and its synchronous interpretation makes it well suited for handling time in programs. Moreover, this synchronous interpretation allows it to be compiled into an efficient sequential program. The LUSTRE formalism is very similar to temporal logics. This allows the language to be used for both writing programs and expressing program properties, which results in an original program verification methodology. >

Synchronous Observers and the Verification of Reactive Systems

Synchronous programming [20, 14] is a useful approach to design reactive systems. A synchronous program is supposed to instantly and deterministically react to events coming from its environment. The advantages of this approach have been pointed out elsewhere [20]. Synchronous languages are simple and clean, they have been given simple and precise formal semantics, they allow especially elegant programming style. They conciliate concurrency (at least at the description level) with determinism. They can be compiled into a very efficient sequential code, by means of a specific compiling technique: The control structure of the object code is a finite automaton which is synthesized by an exhaustive simulation of a finite abstraction of the program.

Verification of linear hybrid systems by means of convex approximations

We present a new application of the abstract interpretation by means of convex polyhedra, to a class of hybrid systems, i.e., systems involving both discrete and continuous variables. The result is an efficient automatic tool for approximate, but conservative, verification of reachability properties of these systems.

Automatic testing of reactive systems

The paper addresses the problem of automatizing the production of test sequences for reactive systems. We particularly focus on two points: (1) generating relevant inputs, with respect to some knowledge about the environment in which the system is intended to run; (2) checking the correctness of the test results, according to the expected behavior of the system. We propose to use synchronous observers to express both the relevance and the correctness of the test sequences. In particular, the relevance observer is used to randomly choose inputs satisfying temporal assumptions about the environment. These assumptions may involve both Boolean and linear numerical constraints. A prototype tool called LURETTE has been developed and experimented with, which works on observers written in the LUSTRE programming language.

Minimal state graph generation

Abstract We address the problem of generating a minimal state graph from a program, without building the whole state graph. Minimality is considered here with respect to bisimulation. A generation algorithm is derived and illustrated. Applications concern program verification and control synthesis in reactive program compilation.

Generating efficient code from data-flow programs

This paper presents the techniques applied in compiling the synchronous data-flow language Lustre. The most original technique consists in synthesising an efficient control structure, by simulating the behavior of boolean variables at compile-time. Here, the techniques are explained on a small subset of Lustre.

Dynamic Partitioning in Analyses of Numerical Properties

We apply linear relation analysis [CH78, HPR97] to the verification of declarative synchronous programs [Hal98]. In this approach, state partitioning plays an important role: on one hand the precision of the results highly depends on the fineness of the partitioning; on the other hand, a too much detailed partitioning may result in an exponential explosion of the analysis. In this paper, we propose to dynamically select a suitable partitioning according to the property to be proved.

Virtual execution of AADL models via a translation into synchronous programs

Architecture description languages are used to describe both the hardware and software architecture of an application, at system-level. The basic software components are intended to be developed independently, and then deployed on the described architecture. This separate development of the architecture and of the software raises the problem of early validation of the integrated system. In this paper, we propose to solve this problem by translating the architecture into an executable model, which can be simulated and validated together with the software components. More specifically, we consider the case where the architecture is described in the AADL language, and the software components are developed in some synchronous language like Scade or Lustre. We show how the architecture can be automatically translated into a non-deterministic synchronous model, to which the actual software component can be integrated. The result is an executable integrated synchronous model, which can be validated with tools available for synchronous programs. The approach is illustrated on an industrial case study extracted from an actual spatial system.

Validation of Synchronous Reactive Systems: From Formal Verification to Automatic Testing

This paper surveys the techniques and tools developped for the validation of reactive systems described in the synchronous data-flow language Lustre [HCRP91]. These techniques are based on the specification of safety properties, by means of synchronous observers. The modelchecker Lesar [RHR91] takes a Lustre program, and two observers -- respectively describing the expected properties of the program, and the assumptions about the system environment under which these properties are intended to hold --, and performs the verification on a finite state (Boolean) abstraction of the system. Recent work concerns extensions towards simple numerical aspects, which are ignored in the basic tool. Provided with the same kind of observers, the tool Lurette [RWNH98] is able to automatically generate test sequences satisfying the environment assumptions, and to run the test while checking the satisfaction of the specified properties.

A multiparadigm language for reactive systems

A system is said to be reactive if it interacts continuously with an environment, at a speed imposed by the environment. The system deals with inputs and outputs and the languages for programming reactive systems aim at describing the complex ordering and causality relations between the inputs and the corresponding outputs. The synchronous approach, based upon the assumption that a system reacts in zero time, allows the definition of compositional semantics for various kinds of language constructs, in data-flow frameworks as well as in imperative frameworks. We take advantage of this compositionality property to define the mixing of data-flow constructs with automaton compositions in a single language. We apply the results to Lustre and Argos, and discuss some implementation issues.<<ETX>>