A.3 C++ constructs
A.3.1 while Loop
A.3.1.1 Generated Automaton
The algorithm for the generation of automaton for thewhileloop has been described in section6.2.2.
FigureA.2shows the generated automaton for the processmodule while::computedeclared line 35.
Plain arrows are normal edges. Arrows are bold when they are the only outgoing edge from a control point, and dashed arrows are for edges whose guard is a default condition.
initial st32 trans ns19
only state st17 trans ns18
while dcompute auto au7
end incr st19
incr tr tr15
wait st21 wait trans tr17
!wait si11
end write st31
exit while tr30
trans ns17
after wait st24 to fin tr21
final st33 end thread tr31
!end sig si17
else start trans tr29
then initial st26 then trans tr23
write trans tr28
!while udport 0 si16(...)
trans ns20
Figure A.2: Translation of awhileloop
A.3.1.2 GeneratedLUSTRECode
The generated LUSTREcode is provided in FiguresA.3,A.4andA.5. The automaton is transformed into a LUSTREnode taking as inputs the input signals emitted by other automata (with the suffix siNNand the unknown values used in this automaton (wu timewhile dcompute un2). The outputs are the output signals. We declare one statefull variable per state and perHPIOMvariables, and one stateless variable per transition.
The process computes the condition ++x <= 42 on transition incr tr tr15. This incre-ment appears line 79 in the generated code. Then, the test to choose between entering the loop (wait trans tr17, line 25) and exiting the loop (exit while tr30, line 35) is performed in state
Matthieu Moy Ph.D Thesis 159/190
Appendix A. Example of translation intoHPIOM:switchandwhilestatement
1 node while__dcompute_state_au1 (time_elapse_si10: bool;
2 elect_si2: bool;
3 end_sig_si17: bool;
4 wait_si11: bool;
5 wu_timewhile__dcompute_un2: bool)
6 returns (eligible_0_st3, run_0_st5, sleeping_wait_st22, ended_st34: bool;
7 wait_si4: bool);
8 var
9 election_trans_tr1: bool;
10 trans_ns13: bool;
11 trans_ns14: bool;
12 wait_trans_tr18: bool;
13 wake_up_tr19: bool;
14 trans_ns15: bool;
15 trans_ns16: bool;
16 end_trans_tr32: bool;
17
Figure A.3: Generated LUSTREcode for awhileloop (header)
end incr st19. Thewaitstatement line 38 corresponds to statewait st21, and theifstatement is executed between stateafter wait st24andonly state st17.
A.3.1.3 GeneratedSMVCode
As a comparison, we provide the generatedSMVcode too. FigureA.6shows the header of the module, while FigureA.7gives the body. The encoding of the state machine is much more straightforward than the LUSTREversion. The module contains oneSMVswitch statement, with one case for each control point of the automaton, and anif - then - elsestatement to choose between the outgoing transitions of this state.
HPIOMvariables and states are assigned with thenextconstruct (line 30 in FigureA.7for example), while signals are instantaneous values emitted on transitions (line 37 for a pure signal, 64 and 65 for a valued signal). If another automaton needs use thein stateconditional on a state, the presence of the automaton in the state is exported through a booleanSMVvariable, like line 30 in the example.
A.3.2 switch Statement
The processmodule switch::compute declared line 9 is transformed into the automaton of Fig-ureA.8. We can see theswitchstatement itself on stateonly state st35, thecasestatements in the statesto label stNN. Stateto break st57corresponds to the piece of dead code line 20.
A.3.2.1 GeneratedLUSTRECode
We won’t give the complete LUSTREcode here, but the portions of FigureA.9illustrate some interesting concepts that didn’t appear in the transformation of thewhileloop:
Lines 9 to 20 show the equations for the outgoing transitions from stateonly state st35. Since this state has more than one transition with a non-default condition, it may have been the case that more than one transition is enabled at a time. LUSSYhas therefore added a non-deterministic choice to those transitions to make this choice unique. The choice has to be done betweenswitch jmp tr65,switch jmp tr62 andswitch jmp tr63, andswitch jmp tr64will be taken if none of the other is enabled. To chose between 3 transitions, we need⌊log2(3)⌋= 2Boolean variables (make choice unique nd11 un16 andmake choice unique nd11 un17).
160/190 Verimag/STMicroelectronics — 9 d´ecembre 2005 Matthieu Moy
A.3. C++ constructs
18 let
19
20 -- Transitions:
21 incr_tr_tr15 = false -> (pre(only_state_st17) and true);
22 -- > end_incr_st19
23 wait_trans_tr17 = false -> (pre(end_incr_st19) and
24 (((pre x_va1_va10) + 1) <= 42)); -- > wait_st21 25 trans_ns17 = false -> (pre(wait_st21) and (not elect_si2));
26 -- > wait_st21
27 to_fin_tr21 = false -> (pre(wait_st21) and elect_si2);
28 -- > after_wait_st24
29 then_trans_tr23 = false -> (pre(after_wait_st24) and
30 ((pre x_va1_va10) <> 13)); -- > then_initial_st26 31 write_trans_tr28 = false -> (pre(then_initial_st26) and true);
32 -- > only_state_st17
33 else_start_trans_tr29 = false -> (pre(after_wait_st24) and 34 (not ((pre x_va1_va10) <> 13))); -- > only_state_st17 35 exit_while_tr30 = false -> (pre(end_incr_st19) and
36 (not (((pre x_va1_va10) + 1) <= 42))); -- > end_write_st31 37 trans_ns18 = false -> (pre(initial_st32) and elect_si2);
38 -- > only_state_st17
39 trans_ns19 = false -> (pre(initial_st32) and (not elect_si2));
40 -- > initial_st32
41 end_thread_tr31 = false -> (pre(end_write_st31) and true);
42 -- > final_st33
43 trans_ns20 = false -> (pre(final_st33) and true);
44 -- > final_st33
62 final_st33 = not(only_state_st17 or end_incr_st19 or
63 wait_st21 or after_wait_st24 or
64 then_initial_st26 or end_write_st31 or
65 initial_st32);
Figure A.4: Generated LUSTREcode for awhileloop (transitions and states)
Matthieu Moy Ph.D Thesis 161/190
Appendix A. Example of translation intoHPIOM:switchandwhilestatement
66 -- Pure signals
67 end_sig_si17 = false -> end_thread_tr31;
68 wait_si11 = false -> wait_trans_tr17;
69
70 -- Valued Signals
71 while__udport_0_si16_present = false -> write_trans_tr28;
72 while__udport_0_si16_value = true ->
73 if write_trans_tr28 then true else true;
74
75 -- Continuous signals 76
77 -- Variables
78 x_va1_va10 = 0 -> (
79 if incr_tr_tr15 then (((pre x_va1_va10) + 1)) else 80 pre (x_va1_va10));
81 tel.
Figure A.5: Generated LUSTREcode for awhileloop (signals and variables)
1 module while__dcompute_auto_au7(elect_si2, wait_si11, end_sig_si17,
2 while__udport_0_si16_present,
3 while__udport_0_si16_value) {
4 INPUT elect_si2: boolean;
5 OUTPUT wait_si11: boolean;
6 OUTPUT end_sig_si17: boolean;
7 OUTPUT while__udport_0_si16_present: boolean;
8 OUTPUT while__udport_0_si16_value: boolean;
9 -- States:
10 state : {only_state_st17, end_incr_st19, wait_st21, 11 after_wait_st24, then_initial_st26,
12 end_write_st31, initial_st32, final_st33};
13 -- Variables:
14 removed_int_un11 : boolean;
15 removed_int_un12 : boolean;
16 init(state) := initial_st32;
17
18 default {
19 wait_si11 := 0;
20 end_sig_si17 := 0;
21 while__udport_0_si16_present := 0;
22 while__udport_0_si16_value := 0;
23 } in
Figure A.6: GeneratedSMVcode for awhileloop
162/190 Verimag/STMicroelectronics — 9 d´ecembre 2005 Matthieu Moy
A.3. C++ constructs
Figure A.7: GeneratedSMVcode for awhileloop (transitions and states)
Matthieu Moy Ph.D Thesis 163/190
Appendix A. Example of translation intoHPIOM:switchandwhilestatement
initial st64 trans ns12
only state st35
trans ns11
switch dcompute auto au8
end affect st55 switch jmp tr62
to label st47 switch jmp tr63
to label st61 switch jmp tr64
to label st39
switch jmp tr65
end affect st63
break tr tr55
else start trans tr49 then initial st49 then trans tr46
affect tr61 end trigg st41 next trigger tr38
!next trigger si18
break tr tr42
end thread tr66
!method end si20
trans tr48
!is this emitted si19 to break st57
affect tr57
Figure A.8: Translation of aswitchstatement
A.3.2.2 GeneratedSMVCode
We provide the equivalent section in theSMV code for comparison: Figure A.10. The imperative style makes it a bit more readable, and the boolean log encoding of the choice is replaced by a native SMV
non-deterministic variable, with three values.