Towards an Industrial Use of FLUCTUAT on Safety-Critical Avionics Software

Abstract

Abstract. Most modern safety-critical control programs, such as those embedded in fly-by-wire control systems, perform a lot of floating-point computations. The well-known pitfalls of IEEE 754 arithmetic make stability and accuracy analyses a requirement for this type of software. This need is traditionally addressed through a combination of testing and sophisticated intellectual analyses, but such a process is both costly and error-prone. FLUCTUAT is a static analyzer developed by CEA-LIST for studying the propagation of rounding errors in C programs. After a long time research collaboration with CEA-LIST on this tool, Airbus is now willing to use FLUCTUAT industrially, in order to automate part of the accuracy analyses of some control programs. In this paper, we present the IEEE 754 standard, the FLUCTUAT tool, the types of codes to be analyzed and the analysis methodology, together with code examples and analysis results.

Deciding floating-point logic with abstract conflict driven clause learning

“…An orthogonal line of research is to analyse the deviation of a floating-point computation from its real counterpart by studying the propagation of rounding errors [35,37]. Case studies for this approach are given in [27,38]. Abstract interpretation techniques provide a soundness guarantee, but may yield imprecise results.…”

A Formally-Verified C Compiler Supporting Floating-Point Arithmetic

“…This assumption is correct for embedded software such as those used in avionics. For the automatic analysis of C programs, a successful approach is based on abstract interpretation, and tools include Astre [13], [14] and Fluctuat [15]. Another method to specify and prove behavioral properties of FP programs is deductive verification system: specification languages has to take into account FP arithmetic.…”

Precise Interprocedural Analysis in the Presence of Pointers to the Stack

“…We also observe that many established static analyzers avoid this specific problem: Astrée [8] inlines on the fly procedure calls and does not perform an interprocedural analysis. This is also the case for Fluctuat [9]. Caduceus [10], before being embedded in Frama-C, explicitly discarded pointers on the stack.…”

“…The work we present here is a step toward the C language. As mentioned in the introduction, several well-established C analysers like Astrée [8] and Fluctuat [9] that infer sophisticated properties on numerical variables target specific kinds of programs for which they can inline procedures, so they only need to handle intraprocedural use of pointers (eg. see [23] for Astrée).…”