Use of formal methods for building qualified code generator for safer automotive systems

In this position paper, we address issues of the development of correct-by-construction components for GeneAuto a qualifiable (according to DO178B-ISO26262 recommendations) automatic code generator. It transforms Simulink, Stateflow and Scicos models to MISRA C code for safety critical systems. This approach which combines classical development process and formal specification and verification using proof-assistants, led to preliminary fruitful exchanges with certification authorities. We have derived formal specifications from classical user and tools requirements, formally implemented and verified the correctness of some components of the code generator. The block sequencer case study has been successfully applied to real-size industrial use cases from various transportation domain partners and led to requirement errors detection and a correct-by-construction implementation with reduction of test effort.