Synchronous Methodology for Hardware, Software, and Mixed Embedded Systems

G. Berry, VLSI'2004 synchronous tutorial, 2 - 1© Esterel Technologies, 2003

Chief Scientist

www.esterel-technologies.comGerard.Berry@esterel-technologies.com

Gérard Berry

Part 2: designing in Esterel v7

Synchronous Methodology for Hardware, Software, and Mixed Embedded Systems


Agenda - Part 2Designing in Esterel v7

• The Esterel principle: Write Things Once

• Pure signals and basic control

• General signals and datapath equations

• Program units

• Esterel v7 examples

• Comparison with HDLs


Agenda - Part 2The Esterel Language




• Program units




Emit O as soon has A and B have arrived.Reset behavior each R

A? B?

A? O!B? O!

A? B? O!

R?

R?

R?R?

Imperative specification


A? B?

A? O!B? O!

A? B? O!

R?

R?

R?R?

multiple copies => explosion

Imperative specification


loop [ await A || await B ] ; emit Oeach R

• concurrency• sequencing• preemption• full orthogonality

The key idea: Write Things Once


A? B?

A? O!B? O!

A? B? O!

R?

R?

R?R?


A? B?

A? O!B? O!

A? B? O!

[ await A || await B ] ;emit O

A? B?

A?B?

A? B?[ await A || await B ]



• concurrency• sequencing• preemption• full orthogonality

The key idea: Write Things Once


loop [ await A || await B || await C ] ; emit Oeach R

scales linearlyvs. exponential automata blowup

N-way Concurrency


Esterel synchronous semantics

SyncCharts (C. André)Synchronous Hierarchical Automata






• Program units




Standard (Mealy) pure signals

input I;output O;signal S in ... end

• Emitted and received in the same cycle (broadcast)• signal present if and only if emitted (default absent)• pre(S) operator yields status at previous cycle

=> sequential expressions• Multiple drivers allowed

emit S;if I and not pre(I) then ... // rising edge


Basic control and expressions

• Signal emission– emit S– sustain S

• Sequential control flow – pause– await S– every S do p end

• Combinational control flow– sequence: “;”– concurrency: “||”– abort p when S– if S then p else q end– loop p end

• Sequential expressions– if pre(S)– await S and not pre(S)


Sequencing

emit A ; emit B ; pause ; emit C


Sequencing


A


Sequencing


AB


Sequencing


AB

wait for a cycle


Sequencing


AB

C


Looping

loop emit A ; emit B ; pause ; emit C end loop

AB

C


Looping


AB

C


Looping


AB

C


Looping


AB

CA


Looping


AB

CAB

• Loop back in the same cycle

• Non-instantaneous body

• Loop invariant: cannot reenter if the body still executes


Decision

emit A ; emit B ; pause ;loop if C then emit D else emit Q end if; if pre(E) then emit F end if; pauseend loop

AB

D QF

D

EC

EC

F


Concurrency

{ await A ; emit C || await B ; emit D } ; emit E

C DE

BA

• Start parallel statements in the same cycle

• Terminate parallel block once all branches terminated

D CE

AB

C

ED

BA


Preemption

abort pause ; pause ; emit A when B ;emit C

A C

C

BC

B

• Normal termination

• Aborted termination

• Aborted termination; emit A preempted


When to react?

• Non-immediate (default) form does not react to signals arrived during the initial instance (before the first tick)

await A ; emit B

B

A

await immediate A ; emit B

A

A

B

A

B

A

B

A


When to kill?

• Strong abort (default) kills all emissions during the abort cycle • Weak abort gives signal emissions the last will

abort pause; emit A ; pause; emit Bwhen C; emit D

C

D

C

DA

weak abort pause; emit A ; pause; emit Bwhen C; emit D

C

AD

C

BD

A


Four (react, kill) possibilities

when to kill P

abort p when immediate S

when to react to S

weak abort p when immediate S

weak abort p when Sabort p when S

now nextnow

next


abort loop abort run Slowly when 100 Meter ; abort every Step do run Jump || run Breathe end every when 15 Second ; run FullSpeed each Lapwhen 2 Lap

The Esterel Runner


trap HeartAttack in every Morning do abort loop abort run Slowly when 100 Meter ; abort every Step do run Jump || run Breathe || <CheckHeart> end every when 15 Second ; run FullSpeed each Lap when 2 Lap end everyhandle HeartAttack do run RushToHospitalend trap

exit HeartAttack

defines exit point


module SPEED : % computes exact speed

input Centimeter, Second;output Speed : integer;

loop var Distance := 0 : integer in abort every Centimeter do Distance := Distance + 1 end every when Second; emit Speed(Distance) end varend loopend module

Programs mean what they say


module REGUL :

function Regfun (integer, integer) : integer;

input Centimeter, Second;input value GasPedal : integer;output Regul : integer;

signal Speed : integer in run SPEED || await Speed; sustain Regul (Regfun(?Speed, ?GasPedal))end signalend module


abort sustain DmaReq when DmaOk;abort abort every ByteIn do emit ByteOut (?ByteIn) end every when DmaEndwhen 10 times MilliSecond do emit TimeOutend abort


abort sustain DmaReq when DmaOk;abort trap ParityError in abort every ByteIn do emit ByteOut (?ByteIn) end every || every 4 ByteIn do if BadParity (?ByteIn) then exit ParityError end end every when DmaEnd handle ParityError do ...... end trapwhen 10 MilliSecond do emit TimeOutend abort


Programming Concepts Summary

• Signals to communicate with the environment or within the program

• Expressions are sequential because of pre• Control is explicit and sequential• Waiting and preemption statements give

behavior desctiption power

no need to separate combinational and sequential part






• Program units




Extensions in Esterel v7 language

• Mix of Esterel imperative and Lustre equational styles• Better modularity, (mild) object orientation

data, interface, and module units

data and interface inheritance

• Structured ports, arrays, more signal kinds value, temp, registered, etc.

• Static code replication (for ... dopar)• Support for Moore machines• Numerical encodings

binary, onehot, Gray, etc.

• 100% synthesizable to RTL/C/System-C, modular optimization

Goal: remove the current limitations of Esterel v5much more expressive, but very same semantics


Signal arrays

input I [10];output O [N]signal S [256] in ... end

• Composed of independent individual components • S[i] yields status at current cycle for component i pre(S[i]) yields status at previous cycle

emit S[i];if S[i] then ... if pre(S[i]) then ...emit O <= I and S // pointwise extension


Registered (Moore) pure signals

output O : reg;signal S [10] : reg1 in ... end

• Emitted at one cycle and and received in the next cycle • S yields status at current cycle, next(S) yields status at next cycle => sequential expressions• Initial status 0 for reg, 1 for reg1

emit next S;if S then ... if next(S[3]) then ...


Valued signals

input I : integer; output O : integer;signal S [10] : integer in ... end

• status reactive (not persistent), as for pure signal• value is persistent, ?S returns the value• value changes only when status present (enable)• no multiple emitters by default

emit ?S <= 2if S then emit O(?S+1)


Combined valued signals

output O [10] : integer combine +;signal S : integer combine * in ... end

• mutiple emitters allowed • combination function combines emitted values

{ signal S ; integer combine + in emit ?S <= 2 || emit ?S <= 3; end signal|| emit ?O[1](?S+1) }

// ?O[1] = (2+3)+1 = 6


output O : reg integer; // Moore valuedoutput O : reg integer combine +; // combined Moore valued

output O [10] : value integer; // value-only, persistentoutput O : temp integer; // temporary, non-persistent

Advanced Signals

Allow fine-grain control over hardware implementationin particular register allocation


Data-path equations

emit { A[1], B <= I or I if (?I > 0) ?X <= 2 if B next ?Y[2] <= pre(?X) + 1 if B and not pre(B)}

• equations are concurrent and unordered• dependencies must be combinationally acyclic• semantics = solution (no delta-cycles, etc)






• Program units




Data units

• data units defined host data objects and parameters• data units are generic and extensible

data D1 : constant N : integer = 4; type Time; // host (defined in host language

constant Noon : Time; // host

end data

data D2 : extends D1; // inherits all objects from D1

function Next (Time) : Time; // host

end data


Interfaces• Group logically related signals• Can be extended and mirrored

interface Intf1 : input I, J;end interface

interface Intf2 : extends Intf1; // imports I, J output O;end interface

module M :extends mirror Intf2; // input O, output I,J


Ports

• A port is a group of signals typed by an interface• Component accessed through dot notation

module M : port P : Intf2; if pre(P.O) then emit P.I endend module


Modules• A module has an interface and an executable behavior• It can extend interfaces and data units and declare local objects• It can be instantiated in another module

module M : extends data D; extends interface Intf1; extends mirror interface Intf2; port P : Intf3; every P.Reset do ... end every ... run SubMod[constant 4 / N, X / I, Y / O]end module

data binding

signal binding






• Program units




Dual-port memory interface

data MemData : type T; // generic

constant Size : integer = 4;end data

interface MemWriteIntf : extends data MemData; input WriteAddress : integer; // address bus

input DataIn : value T; // data bus

end interface

interface MemReadIntf : extends data MemData; input ReadAddress : integer; // address bus

output DataOut : value T; // data bus

end interface


interface DualMemIntf : port WritePort : MemWriteIntf; port ReadPort : MemReadIntf;end interface

interface DualMemIntf : extends interface WriteIntf; extends interface ReadIntf;end interface

Port-based memory interface, 2 ports

Extension-based memory interface, 4 signals

(MemData automatically imported in both cases)


module DualMem :

extends interface DualMemIntf;signal MemArray [MemSize] : T in every ReadAddress do emit ?DataOut = ?MemArray [?ReadAddress] end every|| every WriteAddress do emit ?MemArray [?WriteAddress] = ?DataIn end every|| sustain assert CollisionError = not ((ReadAddress and WriteAddress) and (?ReadAddress = ?WriteAddress))end signalend module

The dual memory module

verificationcondition


Fifo11 specification

• One read port and one write port acting concurrently

• Bypass from write to read if fifo empty

• Uses a circular buffer in memory, the memory having concurrent read / write ports


#include "fifo_data.strl"#include "dualmem.strl"#include "fifo11_ctrl.strl"

module Fifo11 : extends data MemData;

input Write : T; input Read; output DataOut : value T;

output Empty, Full; output EmptyError, FullError;

signal { WriteAddress, ReadAddress } : integer in run Fifo11Ctrl || run DualMem [signal Write / DataIn] end signalend module

explicit signal passing

implicit signal passing

multiple driver foroutput DataOut


// control for the circular fifo with one read and write port// concurrent write and reads on an empty fifo lead to bypass

module Fifo11Ctrl : extends data MemData;

input Read; output ReadAddress : integer; output DataOut : value T;

input Write : T; output WriteAddress : integer;

output Empty; output Full; output EmptyError; output FullError;

signal FifoSize : value integer init 0, DeltaSize : temp integer combine +, ReadEmpty, Bypass in

value-only signal, no status

temporary value, not registered


// compute bypass and error cases

sustain{ ReadEmpty = Read and pre1(Empty), Bypass = ReadEmpty and Write, Empty = :(?FifoSize = 0), Full = :(?FifoSize = MemSize), EmptyError = ReadEmpty and not Write, FullError = pre(Full) and Write }|| // compute size

every DeltaSize do emit FifoSize( pre( ?FifoSize ) + ?DeltaSize ) end||

equational

imperative


// read section

var ReadPointer := 0 : integer in every case EmptyError case Bypass do emit DataOut (?Write ) case Read do // read from memory emit ?ReadAddress = ReadPointer; ReadPointer := (ReadPointer + 1) mod MemSize; emit ?DeltaSize <= -1 end every end var|| // write section var WritePointer := 0 : integer in every Write and not FullError and not Bypass do emit ?WriteAddress = WritePointer; WritePointer := (WritePointer + 1) mod MemSize; emit ?DeltaSize <= 1 end every end var}end module

signal emission

variable assignment


• Two read ports and two write ports, all acting concurrently

• Full bypass from write to read from any write port to any read port according to fifo state and to read / write commands

• Uses a circular buffer in memory, the memory having two read and two write ports, all acting concurrently

Fifo22 specification


% control for the circular fifo with two read and write ports% concurrent write and reads on an empty fifo lead to bypass

module Fifo22Ctrl : extends data FifoData;

input Read [2]; % user read command, indexed by port output DataOut [2] : value T; % user output, indexed by port input Write [2] : T; % user write command, indexed by port

output ReadAddress [2] : integer; % memory read addresses, by port output WriteAddress [2] : integer; % memory write addresses, by port

output Empty [2]; % [0] -> 0 item at beginning of cycle % [1] -> 1 item at beginning of cycle output Full [2]; % [0] -> MemSize items at beg. of cycle % [1] -> MemSize-1 items at beg. of cycle output EmptyError [2]; % empty errors, by port output FullError [2]; % full errors, by port


static replication loop % compute empty and full predicates

for i < 2 dopar sustain { Full [i] = (?Entries = MemSize - i), Empty [i] = (?Entries = i) } end for|| % compute read and write auxiliaries

sustain { ARead = Read [0] or Read [1], OneRead = Read [0] xor Read [1], AllRead = Read [0] and Read [1], AWrite = Write [0] or Write [1], OneWrite = Write [0] xor Write [1], AllWrite = Write [0] and Write [1], Write1Only = not Write [0] and Write [1], }


|| % who reads from empty fifo?

always if Read [0] then emit { ReadEmpty [0] = Empty [0], ReadEmpty [1] = Empty [1] and Read [1] } else emit ReadEmpty [1] = Empty [0] and Read [1] end if end always

test performed at each tick


|| % Full errors, different if no read or one read always if case not (ARead) do emit { FullError [0] = Full [0] and Write [0], FullError [1] = (Full [0] and Write [1]) or (Full [1] and AllWrite) } case OneRead do emit FullError [1] = Full [0] and AllWrite end if end always|| % Empty errors, different if no write or one write always if case not(AWrite) do emit { EmptyError [0] = Empty [0] and Read [0], EmptyError [1] = (Empty [0] and Read [1]) or (Empty [1] and AllRead) } case OneWrite do emit EmptyError [1] = Empty [0] and AllRead end if end always


Unit[0]

Unit[1]

Unit[2]

Unit[3]

A

B

O

Aa

Ba

Oa

Done

Parametric architectural design


main module Dopar : extends data Data; input A, Aa : value integer; input B, Ba : value integer; input Oa : value integer; output O; output Done;

signal Ad[N], Bd[N], Od[N] in sustain { Ad[?Aa] = A, Bd[?Ba] = B, O = Od[?Oa] } || for i < N dopar run Unit [signal Ad[i] / A, Bd[i] / B, Od[i] / O] end for; emit Done end signalend module


A CRC Calculator• A generator polynomial of

degree NP = 10011

= x4 + x + 1

• A message to protectM = 1101011011

= x9 + x8 + x6 + x4 + x3 + x + 1

• Compute the remainder of M after appending N zeros by P

R =

• The frame to transmit is M after appending RT = 2N M + R

= PQ + R + R

= PQ

!! T is divisible by P !!

P

Mmainder

N

2Re


Choose a generator polynomial of degree N:

• CRC generationAppend N zeros to the message and compute the

remainder of the division by the polynomial. The frame to transmit is the message after appending

the remainder.

• CRC checkThe remainder of the division of the frame by thepolynomial should be null.


module Shifter :constant N : integer;input In;output Out;

signal Aux[N] in sustain { Aux[0] <= In, Aux[1..N-1] <= pre(Aux[0..N-2]), Out <= pre(Aux[N-1]) }end signalend module

Shift input stream by N ticks


module TerminatingParallelToSerial :constant N : integer;input Parallel[N];output Serial;signal Shifter[N] in emit Shifter <= Parallel; weak abort sustain Serial <= Shifter[N-1] || every tick do // initial delay

emit Shifter[1..N-1] <= pre(Shifter[0..N-2]) end every when N-1 tickend signalend module

Serializes a parallel input array and terminates


Remainder calculation

R[0] R[1] R[N-1]

Divided

Divider[0] Divider[1] Divider[N-1]


module RemainderComputer:

constant DivisorDegree : integer;input Divisor[DivisorDegree];input Dividend; output Remainder[DivisorDegree] : reg;

sustain { next Remainder[0] = Dividend xor (Divisor[0] and Remainder[DivisorDegree-1]), for i < DivisorDegree-1 do next Remainder[i+1] = Remainder[i] xor (Divisor[i+1] and Remainder[DivisorDegree-1]) end for}end module

Compute the remainder of the input stream by a divisor


module CRCComputer:

constant Degree : integer;

input DataIn; output CRCOut[Degree] : reg;

signal Divisor[Degree] in run DivisorSustainer // should sustain divisor coefficients|| run RemainderComputer [constant Degree / DivisorDegree; signal Divisor / Divisor, DataIn / Dividend, CRCOut / Remainder]end signalend module

Compute current CRC at each tick


CRC encoder

0Message

Message CRC

Latency = CRC length

In

Out


module CRCEncoder :constant CRCLength : integer;constant MessageLength : integer;input DataIn;output DataOut;signal CRCComputerIn, CRC[CRCLength] in abort sustain CRCComputerIn <= DataIn || run CRCComputer [constant CRCLength / Degree; CRCComputerIn / DataIn, CRC / CRCOut] || run Shifter [constant CRCLength / N; DataIn / In, DataOut / Out] when MessageLength+ CRCLength tick; // CRC now available, transmit it run TerminatingParallelToSerial [constant CRCLength / N; CRC / Parallel, DataOut / Serial]end signal

CRC encode


module CRCEncoderChecker :

extends CRCEncoder;input Check; // if false, encode, if true, decode and flag errorsoutput CRCError;

run CRCEncoder|| if Check then await MessageLength tick; abort sustain CRCError <= DataOut when CRCLength tick end ifend module

CRC encode or CRC check


CRC Testbench

0Message

Message CRC

In

Message 0 expected


data CRC_10_4_Data:

constant CheckCRCLength : integer = 4; constant CheckMessageLength : integer = 10; // in bits

end data

module DivisorSustainer : // x**4+x+1extends CRC_10_4_Data;output Divisor[CheckCRCLength];sustain { Divisor[0], Divisor[1],}end module

Testbench divisor


module CRC_10_4_Testbench :

extends CRC_10_4_Data;

input Message[CheckMessageLength];input InjectError;output DataOut; // the data out of the normal CRC // latency CheckCRCLlength, // length CheckMessageLength + CheckCRCLengthoutput CheckDataOut; // the data out of the CRC checker // latency 2*CheckCRCLlength, // length CheckMessageLength + CheckCRCLength

// comment the following input relation to build a counter-example

input relation not InjectError; // set InjectError always absent

Testbench


signal LocalMessage[CheckMessageLength], DataIn in // keep message in local emit LocalMessage = Message; every tick do emit LocalMessage = pre(LocalMessage) end every|| // CRC generation from initial message

trap EndCRCGeneration in // run ParallelToSerial on message, terminates after N tick

run TerminatingParallelToSerial [constant CheckMessageLength / N; LocalMessage / Parallel, DataIn / Serial]; // stay silent (0) on DataIn for CRCLength ticks, wait CRCLength latency

await (CheckMessageLength + 2*CheckCRCLength) tick; exit EndCRCGeneration || // pass data bit to CRC generator

run GenerateCRC / CRCEncoder [constant CheckCRCLength / CRCLength, CheckMessageLength / MessageLength] // implicit DataIn and DataOut

end trap


|| // CRC generation from encoded message // skip initial latency before starting check await CheckCRCLength tick; signal CheckDataIn in sustain CheckDataIn <= DataOut xor InjectError || // pass data out bits from message encoder to a new CRC generator run GenerateCRC / CRCEncoder [constant CheckCRCLength / CRCLength, CheckMessageLength / MessageLength; CheckDataIn / DataIn, CheckDataOut / DataOut] || // skip message part await CheckMessageLength + CheckCRCLength tick; abort sustain assert OK = not CheckDataOut when CheckCRCLength tick end signalend signalend module


Graphical Programming

• Hierarchical state machines, concurrency / preemption

• Data path equations inside states

• 100% compatible with textual programming

=> often more readable, animation easier to follow (see demos)










Esterel more concise than Verilog

loop await case icu_miss do if not cacheable then await normal_ack or error_ack else abort await 4 times normal_ack when error_ack end end case pcsu_powedown and not jmp_e and not valid_diag_window do await pcsu_powerdown and not jmp_e end end ; pauseend loop

Example from S. Edwards



Write to memory as soon as Addr and Data have arrived. Wait for memory Latency before iterating. Restart behavior each Replay.



A D

A / W()D / W()

A, D / W()

Write to memory as soon as Addr and Data have arrived.

Verilog = explicit FSM Esterel: write things once

{ await Addr || await Data } ; emit ?Write <= funcW(?Addr,?Data) ;



A D

A / W()D / W()

A, D / W()

L=0

Write to memory as soon as Addr and Data have arrived. Wait for memory Latency before iterating.

X := L-1

X > 0 / X:=X-1

X = 0

Verilog = explicit FSMloop { await Addr || await Data } ; emit ?Write <= funcW(?Addr,?Data)) ; await Latency times tick end loop

Esterel: write things once



A D

A / W()D / W()

A, D / W()

R

R

R

L=0 or R

Write to memory as soon as Addr and Data have arrived. Wait for memory Latency before iterating. Restart behavior each Replay.

X := L-1

X > 0 / X:=X-1

X = 0 or R

Verilog = explicit FSM

Global state; state/transition explosion; flat; explicit counters; multiple calls

loop abort { await Addr || await Data } ; emit ?Write = funcW(?Addr,?Data) ; await Latency times tick when Replayend loop

Esterel: write things once

Local events; concurrency/preemption; hierarchy; parameterization of delays; call things once

Documents

Synchronous Methodology for Hardware, Software, and Mixed Embedded Systems