- AdaCore is a software company that helps customers build critical software. It has expertise in Ada compilation and provides tools like SPARK and CodePeer for verification. - The company has locations in France and the US. It is committed to openness, customer support, and research to strengthen its tools and help more customers. - QGen is a code generator that takes Simulink and Stateflow models and generates code in SPARK or MISRA C. It includes model checking and has been qualified for safety standards. The goal is for QGen to support multiple modeling languages and be extensible like GCC.

1. AdaCore Directions
Who are we? Where are we going?
Cyrille Comar
Paris, October 1st

2. Agenda of the talk
- Mission
- Location & People
- Values
- Strategy: Strengthening & Opening
- Research Activities
- QGen
- Conclusion

3. We help
people build
software that
matters.

4. - Expertise on critical software development
- Maintain & evolve (Ada) compilation toolchain with pedigree
- Emphasis on customer support

5. Locations

7. Robert Dewar
(1945-2015)

9. Some of us in the US
Hristian, frontend
Ben, newsletterSteve, static analysisTucker, qgen
Nicolas, gps Doug, cross

12. We actively and creatively evolve our product
line, operations, and organization to help our
customers and teammates. We are passionate
about what we do and are committed to
learning, researching and creating.

13. We build long-term relationships with our
teammates, customers, and partners.
Acting as a team, we debate, cooperate,
and help each other grow.

14. We share our plans, practices and
technologies with our teammates, partners
and customers. This is strengthened by our
participation in relevant open-source and
professional communities, and the open-
source licensing of our products.

15. We organize our work to meet all our
commitments. We provide customers,
partners and teammates unrestricted
access to our expertise, making support
our number one priority. Our rigor ensures
that our products can be used to build the
most demanding software systems.

16. Strengthening & Opening

17. - Enhance our Ada offering (new targets, new tools, new optims…)
- Make SPARK+CodePeer « the » best game in town for
- complementing testing with static verifications
- industrial use of program proving
- higher level of reliability
- lower cost of verification
- stop (some) security attacks
Help people build software that matters… even more
Strengthening & Opening

18. - Unexplored markets
- Software that matters in C
- Code generation from “models” that matter
Help more people build software that matters…
Strengthening & Opening

19. Unexplored Markets

20. Software that matters in C
- Toolset that can be used for critical development:
- Manage pedigree of the C compiler (e.g. KP entries)
- Active long term maintenance (e.g. sustained branches)
- Set of verification tools (e.g. gnatcov)
- Better controlled build system (gprbuild)

21. Research Activites
- Dashboarding: AdaSquore (DGA-Rapid)
- Formal methods:
- ProofInUse (LabCom with INRIA): enhance proving capabilities
- Vecolib (ANR): loop invariants
- Soprano (ANR): improve SMT solvers
- CAP2018 (FUI) with Sogilis & Squadrone
- SPARK in legacy C for FFI

22. Code generation from “models” that matter

23. What is QGen?
A qualifiable and
customizable code
generator
from Simulink® and
Stateflow® to SPARK and
MISRA C
A formal model
verifier
for runtime errors and
functional properties
An open and
extensible
framework
to integrate heterogeneous
models

24. QGen Main Features
Support for a large subset of Simulink®
- Around 120 blocks, optional checks for MISRA Simulink®
- Stateflow® also supported, since early 2015

25. QGen Main Features
Support for a large subset of Simulink®
Code generation producing MISRA C and SPARK (formally provable
language)
- Readable and traceable code, no performance penalty

26. QGen Main Features
Support for a large subset of Simulink®
Code generation producing MISRA C and SPARK (formally provable
language)
Integrated with compilation and testing frameworks
- Integration with GNAT Pro compiler for qualified, end-to-end tool chain
- Integration with GNATemulator and GNATcoverage for structural coverage analysis (up
to MC/DC) without code instrumentation executing embedded object code

27. QGen Main Features
Support for a large subset of Simulink®
Code generation producing MISRA C and SPARK (formally provable
language)
Integrated with compilation and testing frameworks
Includes a static model verifier
- Focus on safety-critical systems
- Run-time errors (divisions by zero, overflows, …)
- Logical errors (dead execution paths)
- Functional/safety properties (Simulink® assertions blocks)

28. QGen Main Features
Support for a large subset of Simulink®
Code generation producing MISRA C and SPARK (formally provable
language)
Integrated with compilation and testing frameworks
Includes a static model verifier
Qualification material
- Including validation against Simulink® simulation
- DO-178C, EN 50128, ISO-26262 TCL3

29. QGen An open and extensible framework

30. QGen An open and extensible framework
“The gcc for modeling languages”
- QGen is designed to accept multiple languages in input, including in-house DSLs
- A single code generation style/strategy for all of your modeling languages
- XML-based model import at different abstraction levels
- Design model: blocks, signals, states, transitions, ….
- Code model: variables, statements
Selective model compilation
- QGen is composed of multiple model compilation steps
- It is possible to execute them selectively
- It is possible to import/export XML at any step

31. Roadmap
Feb 2015
QGen
commercial
availability
Spring 2015
Stateflow® support
2016
Tool Qualification
Planning
Documents
2017
QGen Debugger
2018
QGen TQL1
qualification
completed

32. Conclusion
- World of critical software development is evolving…
- You are the main source of AdaCore evolution
So let’s talk… even more