[Paper Review] Towards a Coq-verified Chain of Esterel Semantics

Gérard Berry, Lionel Rieg|arXiv (Cornell University)|Sep 27, 2019

Embedded Systems Design Techniques4 citations

TL;DR

This paper presents a formally verified chain of operational semantics for the loop-free Kernel Esterel language using the Coq proof assistant. It introduces a novel microstep semantics that eliminates the need for potential function pairs in constructive semantics, proves equivalence between constructive and constructive state semantics, and establishes refinement from state semantics to microstep semantics, forming a foundation for a verified Esterel-to-circuit compiler.

ABSTRACT

This article focuses on formally specifying and verifying the chain of formal semantics of the Esterel synchronous programming language using the Coq proof assistant. In particular, in addition to the standard logical (LBS) semantics, constructive semantics (CBS) and constructive state semantics (CSS), we introduce a novel microstep semantics that gets rid of the Must/Can potential function pair of the constructive semantics and can be viewed as an abstract version of Esterel’s circuit semantics used by compilers to generate software code and hardware designs. The article also comes with formal proofs in Coq of the equivalence between the CBS and CSS semantics and of the refinement of the CSS by the microstep semantics, except for the loop construct of Esterel.

Motivation & Objective

• To formally verify the entire chain of Esterel semantics using Coq, ensuring correctness from high-level semantics to low-level circuit behavior.
• To resolve long-standing gaps in the formalization of Esterel’s semantics by proving equivalence and refinement between key semantic models.
• To bridge the semantic gap between high-level Esterel programs and their compiled circuit representations, enabling a formally verified compiler pipeline.
• To lay the groundwork for a verified Esterel-to-circuit compiler by establishing a sound, machine-checked foundation for semantics and compilation.

Proposed method

• Formal specification of four semantics: logical (LBS), constructive (CBS), constructive state (CSS), and a novel microstep semantics.
• Use of Coq’s dependent types and inductive families to represent proof trees and semantic transitions with precise typing.
• Definition of microstep semantics as an abstract, stateful operational model that avoids potential functions by encoding control flow through explicit state transitions.
• Proof of equivalence between CBS and CSS semantics using bisimulation and inductive reasoning over proof trees.
• Proof of refinement from CSS to microstep semantics via simulation, showing that microstep semantics captures all behaviors of CSS with additional determinism.
• Design of a circuit-like interpretation of microstep semantics, mapping proof-tree nodes and branches to Boolean gates and wires for future compilation verification.

Experimental results

Research questions

• RQ1 How can the chain of Esterel semantics be formally verified in Coq, from logical semantics to executable circuit behavior?
• RQ2 What is the precise relationship between constructive semantics (CBS) and constructive state semantics (CSS), and can their equivalence be proven?
• RQ3 Can a new microstep semantics be defined that eliminates the need for potential function pairs while preserving semantic fidelity?
• RQ4 How does the microstep semantics refine the CSS semantics, and can this refinement be formally proven in Coq?
• RQ5 What is the formal correspondence between the microstep operational semantics and the circuit semantics used in Esterel compilers?

Key findings

• The paper establishes formal equivalence between constructive semantics (CBS) and constructive state semantics (CSS) in Coq, proving they define the same behavioral model.
• A novel microstep semantics is introduced that removes the need for potential function pairs, offering a cleaner, more circuit-like operational model.
• The microstep semantics is formally proven to refine the CSS semantics, ensuring it captures all valid behaviors with additional structural precision.
• The microstep semantics is shown to be isomorphic to the circuit semantics used in Esterel v5 and v7 compilers, enabling a path toward full end-to-end verification.
• The work identifies that finding a suitable Coq representation of circuits remains a critical open challenge for completing the full verified compilation pipeline.