This document summarizes presentations given by Eric Perlade on using Ada 2012 and SPARK 2014 for safety-critical drone and railway signaling software. It describes reimplementing the stabilization system of the Crazyflie drone firmware in SPARK to prove absence of runtime errors. It also outlines plans to reimplement the entire drone firmware without C using Ada 2012 and SPARK. Additionally, it discusses a demonstration of using SPARK 2014 to model a railway signaling system and prove absence of collisions.

2. Ada 2012 and SPARK
Crazyflie and Railway demos
Eric Perlade
2015/10/01

3. CrazyFlie 2.0
• 27g ready to fly drone
• Ideal for indoor use
• Android and iOS app (Bluetooth LE)
• Python client using a radio dongle
• Based on STM32F4 (ARM Cortex M4) and NRF5181 (radio chip)
• Firmware entirely written in C
• 5900 lines of code (without including drivers, HAL and external
libs)
• Based on FreeRTOS (tasking)

4. Why ?
• Drones security and safety becoming an important issue
• Stricter certification regime for drones coming in Europe
• AdaCore is partnering with Squadrone Systems to build open-
source certifiable drone in Ada/SPARK
• Will show the feasibility of this project

5. First Steps … towards safety
Q1 ) What code parts are the most critical in a drone firmware?
Answer: the parts related to the stabilization system
Action Items:
– Re-implementing stabilization system in SPARK 2014
– Proving absence of runtime errors

6. Stabilization system
Stabilization system

7. Issues with original source code
• The C code was not designed to be formally proved
• Stabilization system in C uses C predefined types (float, int etc.)
• Absence of runtime errors can’t be proved on calculations with general
types
• Example:
float calculateError(float measured, float desired)
{
return desired – measured;
}
// Will cause an obvious overflow if called with
// FLT_MIN and FLT_MAX…

8. Solution with SPARK 2014
• Each module of the stabilization system transformed into a SPARK
package
• Use of constrained types and subtypes (ex: defining a type
T_Angle instead of using the general Ada type Float)
• Genericity for sharing code
• Insert saturation when needed
Result
• Proof of absence of runtime errors on every package
• Discovery of one bug related to overflows, corrected by the
Bitcraze team later

9. Next Steps … towards more safety
Q2) What code parts are critical in a drone firmware?
Answer: whole!
Action Items:
Re-implementing the whole firmware in Ada 2012 and SPARK
• Replacing the OS by Ravenscar runtime
• Rewriting other modules and drivers

10. SPARK 2014 and C
SPARK 2014
High-Level C code
Low-Level C code

11. Runtime and Drivers
• Replace FreeRTOS by a Ravenscar based runtime targeting the
STM32F4
• Replace all the FreeRTOS tasks using the Ravenscar tasking
model (tasks, protected objects)
• Rewrite the Crazyflie drivers using ST Peripheral Drivers in Ada

12. SPARK 2014, Ada 2012 and no C
SPARK 2014
High-Level Ada 2012 code
Low-Level Ada 2012 code

13. Goal achieved ?
• Crazyflie with a 100% Ada and SPARK firmware in 5 months
without any previous Ada nor fomal methods experience
• But still not easy to pilot
One last question, what code part would be critical in a drone
firmware?
Answer: A secret recovery feature
Action Item:
Implementing free fall recovery mode

14. Free Fall detection
When placed on a flat surface Free-fall detected

15. Recovery and Landing
• Set desired angles to 0.0 for roll and pitch
• High thrust applied after a free-fall
• Thrust slowly decreased until a minimum that permits the drone to
land properly
• Calculate the acceleration variance when the drone is in the
descending phase
• If variance is high, the drone has landed, recovery is over !

16. Real life validation
Action Item:
Dropping the flie

17. Railway safe signaling Demo

18. Why ?
• To prove the absence of collision using SPARK 2014
• To get closer to customer experience
• And mainly to play with our new Raspberry Pi 2 port !

19. Hardware
• Electrical railway modelling kit
• On-off power relay to control trains
• Hall effect sensors to detect trains
• Turnout motors to control switches
• Raspberry Pi 2

20. One way track model
Controlled
section
On/Off
Uncontrolled
section
always on
Sensor

21. Slow train coming

22. Slow train going on

23. Slow train detected

24. Slow train still going

25. Slow train detected again

26. Slow train going away

27. Turnout the tricky part

28. Turnout the tricky part

29. Railway layout

30. Software design
with SPARK_Mode
Signaling Manager
(protected object)
Sensor monitoring
(Task)
SDL Graphical Interface
(task)
Train Simulator
(Task)
HW interface
Raspberry Pi 2 GPIO

31. SPARK proof

32. Real life validation
Action Item:
Dropping the train

33. Conclusion
• It works!
• Ada 2012 mixed with SPARK 2014 are ready for the industry
• Easy to access and learn technology
• Demo sources will be available on GitHub
• Have a look at AdaCore University
• http://university.adacore.com/