Experience report: using objective caml to develop safety-critical embedded tools in a certification framework

ABSTRACT

High-level tools have become unavoidable in industrial software development processes. Safety-critical embedded programs don't escape this trend. In the context of safety-critical embedded systems, the development processes follow strict guidelines and requirements. The development quality assurance applies as much to the final embedded code, as to the tools themselves. The French company Esterel Technologies decided in 2006 to base its new SCADE SUITE 6TM certifiable code generator on Objective Caml. This paper outlines how it has been challenging in the context of safety critical software development by the rigorous norms DO-178B, IEC 61508, EN 50128 and such.

REFERENCES

• 1: Gérard Berry. The Effectiveness of Synchronous Languages for the Development of Safety-Critical Systems. Technical report, Esterel-Technologies, 2003.
• 2: Jean-Louis Camus and Bernard Dion. Efficient Development of Airborne Software with SCADE Suite TM. Technical report, Esterel-Technologies, 2003.
• 3: Jean-Louis Colaço and Marc Pouzet. Clocks as First Class Abstract Types. In Third International Conference on Embedded Software (EMSOFT'03), Philadelphia, Pennsylvania, USA, oct 2003.
• 4: Jean-Louis Colaço, Bruno Pagano, and Marc Pouzet. A Conservative Extension of Synchronous Data-flow with State Machines. In ACM International Conference on Embedded Software (EMSOFT'05), Jersey city, New Jersey, USA, sep 2005.
• 5: P. Cousot, R. Cousot, J. Feret, L. Mauborgne, A. Miné, D. Monniaux, and X. Rival. The astrée analyser. In European Symposium on Programming. LNCS, April 2005.
• 6: ECMA-367: Eiffel analysis, design and programming language. ECMA (European Association for Standardizing Information and Communication Systems), pub-ECMA:adr, June 2005.
• 7: N. Halbwachs, P. Caspi, P. Raymond, and D. Pilaud. The synchronous dataflow programming language lustre. In Proceedings of the IEEE, pages 1305--1320, 1991.
• 8: Kelly J. Hayhurst, Dan S. Veerhusen, John J. Chilenski, and Leanna K. Rierson. A Practical Tutorial on Modified Condition/Decision Coverage. Technical report, NASA/TM-2001-210876, May 2001.
• 9: Xavier Leroy, Damien Doligez, Jacques Garrigue, Didier Rémy, and Jérôme Vouillon. The Objective Caml system, documentation and user's manual - release 3.11. INRIA, December 2008. URL http://caml.inria.fr/pub/docs/manual-ocaml/.
• 10: Bruno Pagano, Olivier Andrieu, Benjamin Canou, Emmanuel Chailloux, Jean-Louis Colaço, Thomas Moniot, and Philippe Wang. Certified development tools implementation in objective caml. In Paul Hudak and David Scott Warren, editors, Tenth International Symposium on Practical Aspects of Declarative Languages (PADL), volume 4902 of Lecture Notes in Computer Science, pages 2--17. Springer, 2008.
• 11: Marc Pouzet. Lucid Synchrone version 3.0 : Tutorial and Reference Manual, 2006. (www.lri.fr/%7Epouzet/lucid-synchrone).
• 12: The Coq Development Team LogiCal Project. The Coq Proof Assistant Reference Manual, 2006. (coq.inria.fr/V8.1beta/refman).
• 13: RTCA/DO-178B. Software Considerations in Airborne Systems and Equipment Certification. Radio Technical Commission for Aeronautics RTCA, pages 31,74, December 1992.

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.1 Requirements/Specifications
          Subjects: Tools

Additional Classification:
  D. Software
  D.1 PROGRAMMING TECHNIQUES
      D.1.1 Applicative (Functional) Programming
  D.2 SOFTWARE ENGINEERING
      D.2.5 Testing and Debugging
          Subjects: Testing tools (e.g., data generators, coverage testing)

General Terms:
Experimentation

Keywords:
DO-178B, SCADE SUITE 6, objective caml, safety critical