A short story of Lustre

A short story of Lustre November 23, 2004 ∗ The eighties: favourable historical circumstances In the early eighties, several projects started which were aimed at using computers for critical control and monitoring tasks. For reasons which are unclear, the French industry played a pioneering part in this evolution. Among the most characteristic projects, we can cite: • Merlin Gerin (now Schneider Electric) and the emergency stop of nuclear plants. • Arospatiale (now Airbus) and the computerised flight control of the A320. • Matra-Transport (now Siemens) and driverless subways (Val (Lille, Orly, Toulouse...), Maggaly (Lyon line D), Meteor (Paris line 14) Computer Science and Control The development of such systems clearly required a tight cooperation between computer and control specialists. Unfortunately, the fragmentation of teaching and research into so many communities hardly allowed such a cooperation. As a matter of fact, computer science never payed great attention to control theory. Conversely, control people could not neglect computing as the implementation of control was quickly moving from analog to digital techniques, but they tended to consider it more as a tool (e.g. programming) than as a science on its own. ∗ Also available in html. 1 Lustre and Synchronous Languages At the beginning of the eighties, some rare researchers, control engineers and/or computer scientists, noticed the bad adequacy of languages and software systems, for real-time and control theory: • Milner (Edinburgh) (SCCS), • the Grafcet group • Harel and Pnueli (Weizmann) (Statecharts) • Berry (cole des mines) (Esterel) • Benveniste and Leguernic (Inria) (Signal) • Caspi and Halbwachs (Verimag) ( Lustre) • ... They proposed formalisms and languages to improve this situation. These languages and formalisms were based on the concept of synchronous time, different from the asynchronous tradition of computer science. This was theorised by Milner and then Berry. In general these languages were rigorous and quite well founded from both control theory and computer science points of view. With the encouragement of Berry and Benveniste, a community of French researchers known as the synchronous language school was set up. Lustre Among all these proposals, Lustre was the simplest one: It is based on systems of recurrent equations. This formalism is well understood by users. It allows avoiding over-specifications by expressing what one wants the system to do (declaratively) and not how it should do it (operationally). It has a simple semantics and precise mathematics. In fact, this is a specialisation of the Kahn semantics. At the same time, Lustre is well-founded from a computer science point of view: • it is modular, 2 • strongly typed, • and supports many static checks (definitions, clocks, initialisation, causality loops...) By this time, numerous of developments were being undertaken around Lustre which involved many people mostly from Verimag, but also from other institutions: • Efficient compilers (Pascal Raymond, Marc Pouzet (Paris VI)) • Simulators, automatic tests generators (Pascal Raymond, Erwan Jahier) • Formal verification tools (Pascal Raymond, Bertrand Jeannet (Inria)) – Model-Checkers – Deductive proof systems • Language extensions (Florence Maraninchi, Marc Pouzet) – Arrays, modes, modules • Architecture (Stavros Tripakis, Alain Girault (Inria)) All these developments were favoured by the simplicity and rigour of the language. The Industrial Adventure of Lustre Yet Lustre could have remained an academic achievement (as is the case for many languages developed by academia) if it had not undergone an industrial adventure thanks to favourable circumstances, in which former PhD students of the Lustre team played a prominent part. As early as 1986, Eric Pilaud and then Jean-Louis Bergerand were hired by Merlin Gerin and they used the Lustre concepts to design the Saga tool with which they developed the monitoring and emergency stop system of 1450MW Framatome nuclear plants. This was a success, and in view of this success, Daniel Pilaud, the elder brother of Eric, was hired by Verilog, an Inria start-up, in order to study the possibility of making Saga a commercial product. In the course of this 3 study, he met the people from Arospatiale and discovered that they had developed on their own a very similar tool with which they had developed the fly-by-wire and flight control of the Airbus A320, the first civil aircraft being endowed with such computerised systems. Sao As a matter of fact, Arospatiale in the early eighties had made the same remarks that we did, concerning the poor adequacy of computer science concepts to control problems, when they were looking for a formalism to program the flight commands of the A320. Instead of choosing a computer formalism, they decided to “recycle” their old analog block-diagrams and use them as formal specifications of their control programs! Later, they remarked that they could as well “compile” these diagrams directly into code! This yielded many advantages: • This direct transformation, by compilation, from the control theory models to the code was much safer. • This was a graphic language, close to the culture of aeronautic engineers, test pilots, and most people in the company, their subsidiaries, clients, certification authorities, etc. This eased internal communication, accelerated the development, allowed capitalising on know-how and eased the technology transition. Thus Sao played a strong part in the A320 success. From Sao to Scade But Sao was an internal tool, expensive to maintain, more and more separated from computer science culture and evolution. Under Daniel Pilaud’s influence, Verilog, Merlin Gerin and Arospatiale decided to create a commercial alternative to Sao and Saga which they called Scade. From then on, several events influenced the Scade story: • In 1993, a joint laboratory between Imag (the academic computer science laboratory of Grenoble) and Verilog was created: Verimag. 4 • Verilog was bought by Compagnie des Signaux. Thanks to this, Scade is used to program the Hong-Kong subway signalling system (CseeTransport). • Scade gradually replaced Sao at Airbus (A340-600, A380) and became a de facto standard in European avionics. • Scade was sold to Telelogic, and then to Esterel-Technologies, and has become a major product of this company. Scade • graphic interface • modularity • static checks: • typing, clock, causality loops, initialisation • simulators • qualified DO178B level A code generation • formal semantics 5 • Prover Technologies model-checker • Esterel interface • Simulink interface • RTOS and TTA interfaces 6