Formal verification of timed synchronous dataflow graphs using Lustre
Introduction
A dataflow diagram is a graphical representation of the “flow” of tokens between parallel processes (also called actors). Nodes are associated with processes, and arcs connect nodes to represent the flow of information between processes. Synchronous dataflow graph (SDFG) is a model proposed by Lee and Messerschmitt [1]. The original SDFG model was untimed; later, for timing analysis purposes, it was annotated with execution times for each actor [2]. An example of a timed SDFG is shown in Fig. 1(a). The label on an input (output) edge represents the static number of tokens consumed (produced) during each firing of the actor, the black dots on an edge represent the initial number of tokens, and the label on a vertex represents the execution time of the actor. To enhance the expressiveness of the SDFG model, a number of extensions have been proposed over the years: the cyclo-static dataflow (CSDF) model [3], which allows the numbers of tokens produced and consumed to vary between actor firings as long as the variation forms a periodic pattern; the static dataflow with access patterns (SDFAP) model [4], which captures the timing of data accesses (for both token production and consumption); a multitude of dynamic dataflow models [5] such as Boolean Dataflow (BDF) where an actor may have a Boolean input port that conditionally controls the read/write operations on other ports, Parameterized Dataflow (PDF) which allows variability in the numbers of tokens produced and consumed by actors, and Scenario-Aware Dataflow (SADF) which combines SDF with stochastic models to capture distinct modes of operation of processes in a streaming application.
As a model of computation, the timed SDFG model offers strong compile-time analyzability of many useful predefined properties, such as absence of deadlock, channel boundedness and throughput bounds [6], [7], [8]. These properties make the model suitable for various design tasks, such as computing the buffer requirements of streaming applications [9], [10], scheduling tasks in single-processor or multiprocessor architectures [11], [12], [13], [14], analyzing the performance of a system under certain constraints [15], [16], [17], [18], [19], modeling resource-sharing arbiters [20], [21], [22], [23], and modeling hardware-software codesign [24]. While the algorithms for the analysis of SDFG's predefined properties are well established and integrated into graph analysis tools such as the SDF3 tool [25], there is still a lack of support for the formal verification of user-defined properties and model equivalence. This lack of formal verification support makes it difficult to manually verify user-defined properties even for a simple SDFG; addressing this shortcoming will further enhance the benefits of the SDFG model. This paper reports on the use of the Lustre formal language to validate safety properties of SDFGs. Lustre [26], [27] is a language developed to model and verify reactive systems. It is a declarative synchronous language from the same family as Esterel and Signal. The choice of Lustre is motivated by a number of factors: it allows both a design and its properties to be described in the same language; it is dedicated to verifying safety properties; its temporal operators facilitate the expression of user-defined properties and assertions; its functional paradigm allows model composability; and it is supported by a set of formal validation tools such as Lesar [28], [27], a model checker based on BDDs (binary decision diagram), and Kind_2 [29], [30], a multi-engine and parallel model checker based on SMT (satisfiability modulo theories).
This paper presents a transformation of timed SDFGs into Lustre models. The transformation targets a specific semantic of SDFGs called the self-timed execution mode. This mode is of high practical value because it maximizes the throughput of the system. The user-defined properties and the assumptions regarding the environmental inputs are expressed directly in Lustre. We present two Lustre models: one that captures each time unit step individually and one that considers progress in time in larger steps. Each model offers a different scalability depending on the structure of the SDFG model. The SDFG-to-Lustre translator is implemented as a Java program that takes an XML file modeling the SDFG as input and produces the corresponding Lustre code. The assertions and the target properties are then added to the generated code. The software is available in GitHub [31].
The remainder of this paper is structured as follows. The next section presents previous work on the use of formal methods for verifying SDFGs. Section 3 gives a preliminary background on the SDFG model of computation, on its formal semantics and on the Lustre language. Section 4 presents the two transformation schemes and their correctness proofs. An overview of the verifiable properties of SDFGs and their expression in Lustre is given in Section 5. Section 6 details the modeling and verification of a set of embedded system designs. Section 7 concludes the paper.
Section snippets
Previous work
The use of model-checking in the analysis of synchronous DF has been addressed in [32], [33] using the model checker SPIN [34], in [35] using the model checker NuSMV [36], in [37] using max-plus algebra [38], and in [39], [40], [41] using UPPAAL [42]. Model-checking has also been used to analyze dynamic DF [43], [44], but we limit the scope of our review to its use for synchronous DF.
Geilen et al. [32] then Liu et al. [33] have used model-checking to find the optimal buffer size for untimed
The model
A timed SDFG is a directed connected graph in which each of the nodes, also called actors, represents a task with a well-defined input/output behavior and an execution time. The edges, also called channels, model dependencies and data that are communicated from one actor to another. Every channel can carry an infinite number of tokens between two actors and may contain some number of initial tokens (which are present on the edges at the start time). A token is a container in which a fixed
Translation of SDFGs into Lustre
The translation process aims to produce Lustre code that matches the self-timed execution semantic of the SDFG model. We present two Lustre models: one that advances clock cycle-by-cycle and one that merges the clock cycles during which the channel state is not changing. Fig. 2 illustrates the simulation steps that will be done by each model in case of the SDFG of Fig. 1(a).
Verifiable SDFG properties
This section illustrates the use of safety properties to encode both generic and user defined properties on SDFG models. The safety properties can be used for deadlock verification, graph analysis (such as channel occupancy and processors sharing), functional behavior verification and model equivalence. Safety properties that are not altered by the durations of actors can be checked on the Lustre model of the untimed SDFG.
- Deadlock-free.
This property is verifiable on the untimed model using the
Application to the modeling of embedded system behaviors
This section presents a set of practical use cases of the verification approach in the context of the modeling of embedded systems.
One of the major challenges in the design of embedded streaming applications is to estimate their performance before final implementation. This operation is part of the process of design space exploration, in which various implementation choices are investigated. SDFGs enable the modeling and analytical estimation, at an early design stage, of the maximal achievable
Conclusions
In this paper, we presented a solution for formally verifying timed SDFGs. The solution consists of a systematic translation of a timed SDFG into Lustre code that mimics the self-timed execution mode of the graph. Two Lustre models were elaborated, one where the code progresses one clock cycle per step and one where the code progresses in time in large steps by merging clock cycles during which the channel state does not change. The second model provides better performance when the duration of
Declaration of Competing Interest
We wish to confirm that there are no known conflicts of interest associated with this publication and there has been no significant financial support for this work that could have influenced its outcome. We confirm that the manuscript has been read and approved by all named authors and that there are no other persons who satisfied the criteria for authorship but are not listed. We further confirm that the order of authors listed in the manuscript has been approved by all of us.
References (54)
- et al.
State-based real-time analysis of SDF applications on MPSoCs with shared communication resources
J. Syst. Archit.
(2015) - et al.
A theory of timed automata
Theor. Comput. Sci.
(1994) - et al.
Static scheduling of synchronous data flow programs for digital signal processing
IEEE Trans. Comput.
(1987) - et al.
Embedded Multiprocessors: Scheduling and Synchronization
(2000) - et al.
Cyclo-static dataflow
IEEE Trans. Signal Process.
(1996) - et al.
Static dataflow with access patterns: semantics and analysis
- et al.
Dynamic dataflow graphs
- et al.
Liveness and boundedness of synchronous data flow graphs
Timing analysis of synchronous data flow graphs
(2008)- et al.
Liveness evaluation of a cyclo-static dataflow graph
Efficient computation of buffer capacities for multi-rate real-time systems with back-pressure
Minimising buffer requirements of synchronous dataflow graphs with model checking
Hierarchical static scheduling of dataflow graphs onto multiple processors
Self-timed scheduling analysis for real-time applications
EURASIP J. Adv. Signal Process.
An efficient and complete approach for throughput-maximal SDF allocation and scheduling on multi-core platforms
Constrained global scheduling of streaming applications on MPSoCs
Exploring trade-offs between performance and resource requirements for synchronous dataflow graphs
Automated bottleneck-driven design-space exploration of media processing systems
Iteration-based trade-off analysis of resource-aware SDF
A hybrid strategy for mapping multiple throughput-constrained applications on MPSoCs
A systematic design space exploration of mpsoc based on synchronous data flow specification
J. Signal Process. Syst.
Timing analysis model for network based multiprocessor systems
Architecture design space exploration for streaming applications through timing analysis
Task-level timing models for guaranteed performance in multiprocessor networks-on-chip
Communication-aware scheduling algorithms for synchronous dataflow graphs on multicore systems
Modeling SW to HW task migration for MPSoC performance analysis
SDF3: SDF for free
Cited by (1)
SMT-based Formal Verification of Synchronous Reactive Model for Zone Controller
2023, Ruan Jian Xue Bao/Journal of Software