Which Program Run-Time Properties Can Astrée Prove?

Updated

Astrée is a static program analyzer that aims to prove the absence of Run Time Errors (RTE) in programs written in the C programming language. It targets structured C programs with complex memory usage, but it does not handle dynamic memory allocation or recursion. This makes it applicable to many embedded programs—particularly synchronous control/command software such as electric flight control or space vessel maneuvers—where run-time errors can have graver consequences than on personal computers.

What Astrée proves

The core property Astrée establishes is the absence of run-time errors (RTE). On a personal computer, such errors typically produce error messages and terminate the application, and sometimes crash the system. In embedded applications, the consequences can be more serious, which is why a proof of their absence matters.

What kinds of programs it accepts

Astrée analyzes structured C programs with complex memory usages. The documented boundary conditions are:

  • Supported: structured C programs, including complex memory usage
  • Not supported: dynamic memory allocation
  • Not supported: recursion

This scope covers many embedded programs found in earth transportation, nuclear energy, medical instrumentation, aeronautic, and aerospace applications—in particular synchronous control/command software.

Evidence from industrial use

The project's documented results show the scale of programs Astrée has handled:

  • In November 2003, Astrée completely automatically proved the absence of any RTE in the primary flight control software of the Airbus A340 fly-by-wire system—a program of 132,000 lines of C, analyzed in 1 h 20 on a 2.8 GHz 32-bit PC using 300 Mb of memory (and 50 minutes on a 64-bit AMD Athlon 64 using 580 Mb of memory).
  • From January 2004 on, Astrée was extended to analyze the electric flight control codes then in development and test for the A380 series.

How to decide whether it fits your code

Use these conditions as a checklist:

Question If yes If no
Is your code written in C? Within scope Outside Astrée's stated target
Is it a structured program? Within scope Outside scope
Does it use dynamic memory allocation? Outside scope Within scope
Does it use recursion? Outside scope Within scope
Is it synchronous control/command embedded software? Typical target domain Evaluate against the scope above

If your program relies on dynamic memory allocation or recursion, Astrée's documented scope does not cover it. If your goal is to prove the absence of run-time errors in a structured, embedded C program, that is exactly the property Astrée is designed to establish.