Loops in Esterel: From Operational Semantics to Formally Specified Compilers

Esterel is an imperative concurrent design language for the specification of control-oriented reactive systems. Based on the synchronous paradigm, its semantics relies on a clear distinction of instants of computation. All primitive instructions of the language but one "pause" instruction execute in zero time. Execution is thus a sequence of instantaneous computations separated by explicit pauses. Arbitrary loops in this context are troublesome, potentially leading to a non-termination problem or a schizophrenia issue: first, instantaneous loops may prevent the instant to end; second, program blocks may be traversed several times within the same instant, thus having a "schizophrenic" behavior. Instantaneous loops are forbidden by the semantics. Such errors have to be anticipated, and programs rejected by compilers on this behalf. Moreover, efficient code generation for schizophrenic program patterns is complex. While many existing compilers already generate correct code for loops, the efficient implementations available today are neither generic (i.e. target-independent) nor formally specified or verified. In this work, we thoroughly consider loops in Esterel, starting from the operational semantics of the language, all the way down to a provably correct implementation. We formally characterize the related issues and define efficient static analysis techniques to detect them in Esterel code. In order to get rid of schizophrenic behaviors by source-to-source rewriting - cure schizophrenia - we introduce in Esterel a new primitive instruction, which we call "gotopause". It behaves as a non-instantaneous jump instruction compatible with concurrency. We describe a first program transformation that systematically replaces loops by the mean of gotopause statements, providing a loop-free equivalent program for any correct Esterel program. By combining static analysis and rewriting techniques, we obtain a preprocessor for Esterel that rejects incorrect loops and cure schizophrenia, which we have implemented. Due to our source-to-source transformation methodology, our preprocessor is highly generic; because of static analysis, it is very efficient; thanks to our fully formalized approach, we could formally establish its correctness.