SCADE Suite Research Articles

Equation-Directed Axiomatization of Lustre Semantics to Enable Optimized Code Validation

Model-based design tools like SCADE Suite and Simulink are often used to design safety-critical embedded software. Consequently, generating correct code from such models is crucial. We tackle this challenge on Lustre, a dataflow synchronous language that embodies the concepts that base such tools. Instead of proving correct a whole code generator, we turn an existing compiler into a certifying compiler from Lustre to C, following a translation validation approach. We propose a solution that generates both C code and an attached specification expressing a correctness result for the generated and optionally optimized code. The specification yields proof obligations that are discharged by external solvers through the Frama-C platform.

Mechanized semantics and verified compilation for a dataflow synchronous language with reset

Specifications based on block diagrams and state machines are used to design control software, especially in the certified development of safety-critical applications. Tools like SCADE Suite and Simulink/Stateflow are equipped with compilers that translate such specifications into executable code. They provide programming languages for composing functions over streams as typified by Dataflow Synchronous Languages like Lustre. Recent work builds on CompCert to specify and verify a compiler for the core of Lustre in the Coq Interactive Theorem Prover. It formally links the stream-based semantics of the source language to the sequential memory manipulations of generated assembly code. We extend this work to treat a primitive for resetting subsystems. Our contributions include new semantic rules that are suitable for mechanized reasoning, a novel intermediate language for generating optimized code, and proofs of correctness for the associated compilation passes.

Алгоритмы формирования индикационного кадра авионики с использованием системы автоматизированного проектирования SCADE

In this article the problem of designing of indication pictures in avionics with the use of SCADE integrated design environment is considered. The SCADE design environment includes such implemented tools as SCADE Suite, SCADE LifeCycle, SCADE System and SCADE Display with broad functional capabilities, which are to be used by the developers of the indication pictures for an automated code generation of the functional software, which ensures displaying of the navigation information on a liquid crystal panel of the onboard indication equipment. The authors propose a structural scheme of an automated workstation for the developers of the indication pictures. The workstation includes software components, technical and information support tools. The following results are offered: an algorithm for formation of a static indication frame with the use of SCADE Display and an algorithm for formation of a dynamic indication frame using SCADE Suite tool. The static indication frame is a picture with a set of frozen graphic primitives (lines, symbols, circles, etc.) placed within the field of a liquid-crystal display. The dynamic indication frame, i.e., the changing numeric values of the navigation parameters corresponding to the movement of the aircraft, displayed on a screen, is implemented by the tools of SCADE System software. In the SCADE System software components a user can have access to the virtual address space, in which it is necessary to specify the addresses of the physical i/o devices of the on-board indication equipment and also to set parameters of the communication protocol, which is supported by the subscribers within the avionic equipment. Specification of the addresses of i/o devices and parameters of protocols in SCADE Display and SCADE Suite components is necessary for establishment of a logical link between each displayed navigation parameter and its corresponding source within the onboard equipment, which generates the code of a physically measured value.

Observations on formal safety analysis in practice

We report on the application of formal verification in the safety analysis of two level crossing controllers that were industrially designed using Scade Suite. Although the theoretical grounds for formalizing safety analysis have been developed in recent years, we faced numerous and intense complexity problems even with these medium-sized industrial case studies. The complexity problems constricted formal verification and even remained after employing different heuristics based on abstraction and introducing environmental models. In addition, we found that the modeling style has a significant impact on the complexity of the verification tasks. We finally succeeded to formally classify all relevant fault combinations as either critical or uncritical by identifying a crucial, design-specific liveness property.

Embedded Software on High-Performance Powertrain Assisted Design

This paper presents a robust embedded control algorithm to the powertrain model of an automotive application where VHDL-AMS descriptive language is used to develop the models representing the integrated components into the system. ANSYS Simplorer system simulation package is used for complete system integration and co-simulation whereas embedded software design implying the c-code generation is developed by Esterel Scade Suite environment.

Experience report

High-level tools have become unavoidable in industrial software development processes. Safety-critical embedded programs don't escape this trend. In the context of safety-critical embedded systems, the development processes follow strict guidelines and requirements. The development quality assurance applies as much to the final embedded code, as to the tools themselves. The French company Esterel Technologies decided in 2006 to base its new SCADE SUITE 6TM certifiable code generator on Objective Caml. This paper outlines how it has been challenging in the context of safety critical software development by the rigorous norms DO-178B, IEC 61508, EN 50128 and such.