< technology corner > newsflash What’s New in SPARK 2014? SPARK and GNAT Help Guide The SPARK language has a long history of successful usage in safety-critical and high-security software, since it NASA-sponsored CubeSat supports statically proving properties such as freedom from run-time errors or compliance with a formal specification A student team from Vermont Technical of a program’s requirements. And because SPARK is a subset of Ada, SPARK programs can be compiled by any College has used the SPARK language/ an AdaCore Publication standard Ada compiler. A major new version of the language, known as SPARK 2014, preserves these benefits while toolset and GNAT technology to develop introducing several significant innovations. the navigation and control software for a Autumn/Winter 2013–2014 insider Lunar CubeSat project sponsored by NASA’s www.adacore.com Consistency with Ada 2012 and Hybrid Verification ELaNa IV program (Educational Launch of Since Ada 2012 provides contract-based programming features (e.g., pre-/post-conditions, and quantified and Nano-satellites). Measuring 10 cm x 10 cm x conditional expressions) and a uniform framework for aspects, SPARK’s “--#” annotations-as-structured-comments 10 cm and weighing 1.33 kg, the CubeSat is syntax has been replaced by constructs with valid Ada semantics. This is not just a cosmetic change. The new scheduled for a November launch into a newsflash GPS 6.0 Released syntax is at the heart of SPARK 2014’s support for hybrid verification, a novel approach to safely combining formally 500 km earth orbit, where it will remain for verified and traditionally verified code in one program based on run-time checking of contracts at their boundary. For three years to test the systems that will be Astrium Selects GNAT Pro and PolyORB New Major Revision Upgrades IDE’s Look and Feel example, if a formally verified subprogram is called by code that is not subject to formal verification, the precondition used for the eventual lunar mission. Although for International Space Station they had no previous knowledge of SPARK or For this new GNAT Programming Studio (GPS) release, the AdaCore development team has of the called subprogram can be checked when the call is executed. If the precondition fails, then the called EADS’ Astrium subsidiary has selected the Ada, the students came up to speed quickly conducted a complete review of the existing interface and made it cleaner and easier to subprogram’s proofs are inapplicable. Using hybrid verification, developers can selectively apply formal verification GNAT Pro development environment and and were able to produce robust code taking use. Based on customer feedback, the improvements include more space for editing and a to only those portions of a program where it is feasible and cost-effective. Executable contract checking also allows PolyORB middleware toolset for software advantage of SPARK’s statically verified in the Core Ground System (CGS) on the correct contracts to be developed more quickly; this is valuable for both formally and traditionally verified code. number of design changes to bring program-related information within easy reach. This is contracts. For further information about the Columbus laboratory, one of the European supported by a new relational database at the heart of the GPS engine to make searches Larger Language Subset project, please visit www.cubesatlab.org. contributions to the International Space much more efficient. The guidelines underlying the GPS 6.0 revision help the IDE achieve SPARK 2014 supports a richer subset of Ada (now Ada 2012) than did earlier Station. GNAT Pro and PolyORB help achieve its main goal: to serve as a customizable platform for multi-language multi-tool integration, efficient, reliable communication across the versions of SPARK. The fundamental restrictions that the proof technology relies SPARK 2005: usable by developers at all experience levels. -- Ada applications that Astrium developed upon are still enforced (e.g., no access types, no side effects in functions, no procedure Accelerate (Increment : Positive); for Columbus’s ground and onboard The improvements to the IDE’s look and feel take advantage of the latest Gtk+/GtkAda exception handlers, no tasks, no controlled types), but many other restrictions are --# global in out Control _ State; applications, and PolyORB also supplies graphical toolkit and fall into several categories: now relaxed. SPARK 2014 allows discriminated types, dynamic constants, dynamic --# derives Control _ State from *, Incr e m e nt; the interoperability necessary for smoothly 4 subtypes, recursion, and generic packages and subprograms. A predefined SPARK --# pre Control _ State.Mode /= Braking; Interface reorganization integrating components written in Java • More economic usage of screen real estate, for example by placing tabs on top of container library (generic packages implementing maps, sets, vectors, and lists) --# post Control _ State = or C++. The combination of GNAT Pro and provides much of the essential functionality of access types for managing flexible --# Control _ State~[Speed => Control _ State~.Speed PolyORB provide Astrium with a ‘one-shop’ the views data structures, but without the verification problems associated with access Increment; solution for both the Ada development and • Improved toolbar with monochrome icons types in general. --# Mode => Accelerating]; the middleware implementation of the CGS. • Ability to position tabs on the side, for better appearance on wide screens • Better handling of documents, for example with editors and views clearly separated -- SPA RK 2014: Easier Ada-to-SPARK Transition 4Omni-search SPARK 2014 makes it easier to transition from non-SPARK Ada to SPARK. Part of a procedure Accelerate (Increment : Positive) with TOYOTA ITC Japan Selects Global => (In _ Out => Control _ State), • Ability to search in all contexts, including source filenames, file contents, and code subprogram’s contract is the set of global variables that it depends upon (directly SPARK Pro Language and Toolset Depends => (Control _ State =>+ Increment), entities, directly from the main toolbar or via calls to other subprograms) as inputs and outputs. SPARK 2014 offers an -- Outgoing value of Control _ State depends on both TOYOTA InfoTechnology Center (ITC) Japan 4 alternative where data dependencies for a given subprogram are determined -- its incoming value and Increment has selected the SPARK language and Views automatically by analyzing the body. Non-SPARK completions for SPARK interfaces Pre => Control _ State.Mode /= Braking, SPARK Pro toolset for a high-reliability • Ability to directly access view preferences from a local toolbar (e.g., a non-SPARK Ada body for a SPARK subprogram declaration) are also Post => Control _ State = software research project, with the • Support for “compact mode” (specification and body on same line) and “flat mode” for supported. Control _ State'Old'Update goal of demonstrating that software outline view (Speed => Control _ State'Old.Speed + Increment, requirements can be transformed into an 4Colors For more information, please see www.spark-2014.org/about. Mode => Accelerating); implementation that can be proved free of run-time errors. The project is planned • Ability to change the color of many GPS elements, including selection of white as a first step to composing larger ultra- foreground and dark background < For up-to-date information on conferences where AdaCore Conferences / Events October 2013–April 2014 is participating, please visit www.adacore.com/events/ low-defect vehicular systems, using formal • Support for color themes, to switch quickly among preselected settings methods to mathematically assure a variety GPS 6.0 also brings improved performance and new capabilities: 32nd Digital Avionics Systems Conference (DASC) ACM SIGAda’s HILT 2013 Design West of correctness properties and to reduce the October 6–10, 2013 / Syracuse NY, USA High Integrity Language Technology March 31–April 3, 2014 / San Jose CA, USA development and maintenance effort by 4Use of a relational database for a more efficient (and persistent) storage mechanism for Tucker Taft is giving a talk on integrating testing and November 10–14, 2013 / Pittsburgh PA, USA AdaCore is exhibiting at this event - Booth 719. eliminating the need for post-deployment cross reference information proof with SPARK. dasconline.org Tucker Taft is presenting a tutorial on proving safety www.ubmdesign.com/sanjose corrections. of concurrent programs. AdaCore is a Platinum 4Language support for SPARK 2014, plus syntax highlighting and tooltips for Ada 2012 IET International System Safety Conference Sponsor and exhibitor. and SPARK 2014 aspects October 15–17, 2013 / Cardiff, UK www.sigada.org/conf/hilt2013/ AdaCore is a sponsor and exhibitor. 4Several editor enhancements, ranging from completion and autofix to text formatting conferences.theiet.org/system-safety/ Safety-critical Systems Symposium 2014 4A number of additions to the scripting API February 4–6, 2014 / Brighton, UK The GNAT Pro insider is published twice a year ACM SIGPLAN’s SPLASH 2013 AdaCore is a major sponsor of this event. simultaneously in New York and Paris by AdaCore The GPS 6.0 enhancements have received an enthusiastic response from the product’s beta sites. Systems, Programming, Languages and www.safety-club.org.uk/e263 contents An IDE is more than a tool, it is a platform and framework that developers depend on to Applications: Software for Humanity 104 Fifth Avenue, 15th floor 46 rue d’Amsterdam October 26–31, 2013 / Indianapolis IN, USA ERTS2 2014 New York, NY 10011-6901, USA 75009 Paris, France GPS 6.0 Released 1 organize and conduct their daily work. A major effort has thus been invested in improving Tucker Taft is presenting a tutorial and a “tech talk” Embedded Real Time Software and Systems tel +1 212 620 7300 tel +33 1 49 70 67 16 Current Releases 2 the overall usability of GPS based on customer comments, giving it an intuitive and visually on parallel/multi-core programming. February 5–7, 2014 / Toulouse, France fax +1 212 807 0162 fax +33 1 49 70 05 52 attractive look and feel.