What industrial applications has Astrée been used for?

Astrée's best-documented industrial use is in avionics: in November 2003 it automatically proved the absence of run-time errors (RTEs) in the primary flight control software of the Airbus A340 fly-by-wire system, and from January 2004 it was extended to the electric flight control code then in development and test for the A380 series. These results apply to synchronous, time-triggered, real-time, safety-critical embedded software written or automatically generated in C — the class of programs Astrée was built to handle.

The A340 result in detail

The A340 analysis is the reference point for what Astrée can do at industrial scale:

• Program size: 132,000 lines of C.
• Result: complete automatic proof of the absence of any RTE — no manual intervention or annotation of the proof was required.
• Cost: about 1 h 20 on a 2.8 GHz 32-bit PC using 300 MB of memory, or about 50 minutes on a 64-bit AMD Athlon 64 using 580 MB.

Two things are worth separating here. The first is the soundness claim: Astrée proves the absence of RTEs, it does not merely test for them. The second is the automation claim: the analysis ran without a human guiding it, which is what makes the result meaningful for a program of that size.

From A340 to A380

From January 2004, Astrée was extended to analyze the electric flight control codes then in development and test for the A380 series. The extension matters because the A380 work pushed the analyzer beyond the single proven case: it had to handle code that was still changing, not just a frozen flight-control program.

Which domains this covers

Astrée targets structured C programs with complex memory usage but without dynamic memory allocation and recursion. That restriction is not incidental — it is what makes the analysis tractable, and it happens to match a large share of embedded code. The domains the project lists are:

• Earth transportation
• Nuclear energy
• Medical instrumentation
• Aeronautics and aerospace
• In particular, synchronous control/command software such as electric flight control and space vessel maneuvers

If your program allocates memory dynamically or uses recursion, it falls outside the analyzed class, regardless of domain.

What to check before assuming Astrée fits your case

Practical takeaway

If you are working on safety-critical embedded C in avionics, space, nuclear, medical, or ground transport, and your code avoids dynamic allocation and recursion, Astrée's track record — a 132,000-line flight control program proven RTE-free in roughly an hour — is direct evidence that the approach scales to real production code. If your code depends on dynamic allocation or recursion, the documented results do not transfer, and you should treat the tool as out of scope rather than as an untested option.

For licensing and the theoretical background behind these results, see the corresponding sections of the Astrée site.