US AdaCore Tech Days 2015

1. Certification & Qualification
Quentin Ochem
November 4th 2015

2. DO-178C
EN 50128:2011

3. Overall Picture
Architecture
Certifiable Libraries
Certifiable Platforms
Object Oriented
Techniques
Verification
Testing tools
Structural code
coverage
Formal proof
Static Analysis
Development
Environment
Sustained Branches
Design
Formal Specification
Model to Code
Generation

4. [Architecture] Libraries and Platforms
PowerPC / ARM / Leon / AVR…
Bare Board
VxWorks 653 / Cert / 7
Lynx178
PikeOS
Ada
C
Zero Footprint
Cert Profile
Ravenscar profile
EN 50128
SIL 3/4
DO-178
Level A
EN 50128
T3

5. [Architecture] Object Orientation
?
type A380 is new Plane …
procedure Open_Doors(My_Plane : Plane)
with Pre => My_Plane.On_Ground
and My_Plane.Speed = 0.0,
Post => My_Plane.Doors_Opened
and My_Plane.Pressurization_Off;
type Plane is abstract …
procedure Open_Doors (My_Plane : Plane)
with Pre => My_Plane.On_Ground,
Post => My_Plane.Doors_Opened;
type Glider is new Plane …
procedure Open_Doors(My_Plane : Plane)
with Pre => null,
Post => My_Plane.Doors_Unlocked;
procedure Operate(My_Plane : Plane’Class)
is
begin
if My_Plane.On_Ground then
My_Plane.Open_Doors;
My_Plane.Move_Passengers_Out;
end if;
DO-332
OO.6.7

6. [Design] Model to Code Generation
QGen Code Generation
(Ada or C)
EN 50128
SIL3/4
Automatic Translation of
Model Tests to Code Test
DO-178C
TQL-1
Simulink®
StateFlow®
…
Credit sought on code review
Credit sought on code test & coverage
(in
progress)
(in
progress)

7. [Design] Formal Specification
Low Level
Requirements
Software Component
Design Specification
DO-178C EN-50128
type A380 is new Plane …
procedure Open_Doors(My_Plane : Plane)
with Pre => My_Plane.On_Ground
and My_Plane.Speed = 0.0,
Post => My_Plane.Doors_Opened
and My_Plane.Pressurization_Off;
DO-333
FM.6.3.2
EN 50128
D.28

8. [Development] Sustained Branches
2012 2013 2014
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.2.3
7.1.2 7.2.2
7.1.1 7.2.1
7.1 7.2
EN 50128
6.7.4.11
DO-178
4.4.2.f

9. [Verification] Testing Tools
Test Skeleton
Test
Subprogram
under Test
Actual Code
Stub
Stub
Skeleton
calls
calls
calls
GNATtest will generate Test and Stub Skeletons for Units / Subprogra
The developer writes tests and subs in Ada
EN 50128
7.5
DO-178
6.4.3.c

10. [Verification] Structural Code Coverage
HOST
TARGET
Pure
Functional Test
GNATemulator /
Valgrind /
dynamiRIO
Coverage
Data
Executable
Coverage
Information
Pure
Functional Test
Lauterbarch /
iSystems
Sources
Ada 83 / 95 / 05 / 2012
C 99
Statement
Decision
MC/DC
DO-178
TQL-5
EN 50128
T2
(no instrumentation)
Source to Object Traceability Study
DO-178
6.4.4.2.b

11. [Verification] Static Analysis
GNATcheck
Coding
standard check
Metrics check
Ada feature
usage check
CodePeer
Out of range
checks
Overflow
checks
Uninitialized
variables check
GNATstack
Worst case
stack
consumption
DO-178
TQL-5
EN 50128
T2

12. [Verification] Formal Proof
Low Level
Requirements
Software Component
Design Specification
DO-178C EN-50128
type A380 is new Plane …
procedure Open_Doors(My_Plane : Plane)
with Pre => My_Plane.On_Ground
and My_Plane.Speed = 0.0,
Post => My_Plane.Doors_Opened
and My_Plane.Pressurization_Off;
Low Level Test Source Code
Verification
type A380 is new Plane …
procedure Open_Doors(My_Plane : Plane) is
begin
-- code
end Open_Doors;
Formal proof Formal proof
SPARK will formally verify implementation of
subprogram according to the specified contract
SPARK will (also) formally verify absence of run-time
errors and data flow
DO-333
FM.6.3.2
EN 50128
D.28

13. Conclusion
Architecture
Certifiable Libraries
Certifiable Platforms
Object Oriented
Techniques
Verification
Testing tools
Structural code
coverage
Formal proof
Static Analysis
Development
Environment
Sustained Branches
Design
Formal Specification
Model to Code
Generation
Bare Board
VxWorks
Math Library
Ravenscar
PikeOS
Liskov
PowerPCARM
LEON
SPARK
QGEN
GNAT Pro
GNATcheck
CodePeer
GNATstack
GNATcoverage
SPARKGNATtest
EN 50128
Qualifiable
Certifiable
DO-178
Qualifiable
Certifiable