简体中文
EnglishWebsite review
This review may include AI-generated content and is not individually verified. Domain, certificate and other facts come from the observed data on this page.
What is Astrée?
Astrée is a static program analyzer for C software, developed to prove the absence of run-time errors (RTEs) before a program is ever executed. It was created at the École Normale Supérieure and is associated with CNRS and INRIA; its name is short for Analyseur statique de logiciels temps-réel embarqués (static analyzer for real-time embedded software). Rather than testing inputs and observing failures, it examines the source code and attempts to establish, for all possible executions, that operations such as arithmetic overflow, division by zero, out-of-bounds array access and invalid pointer use cannot occur.
Its design targets a specific class of software: structured C programs with complex memory usage, but without dynamic memory allocation or recursion. That restriction is deliberate. It matches many synchronous, time-triggered control programs found in aerospace, aeronautics, nuclear energy, medical instrumentation and earth transportation — the kind of embedded code where a run-time fault can be far more serious than a desktop crash.
What it is used for
Astrée is aimed at safety-critical embedded software, especially automatically generated or carefully structured control code. The best-known result is from November 2003, when it automatically proved the absence of run-time errors in the primary flight-control software of the Airbus A340 fly-by-wire system — 132,000 lines of C analyzed in about 1 hour 20 minutes on a 2.8 GHz 32-bit PC using 300 MB of memory. From January 2004 it was extended to electric flight-control code under development and test for the A380 series.
That example shows the practical value: a proof of RTE-freedom can support certification and review of software that is difficult or impossible to exhaustively test.
Who should consider it
- Embedded software engineers who need evidence about all executions, not just sampled test cases.
- Safety and certification teams working on control software where run-time faults are unacceptable.
- Researchers interested in abstract interpretation, the theoretical foundation behind the analyzer.
Trade-offs to weigh
The precision that makes Astrée useful comes with constraints. Programs using dynamic memory allocation or recursion fall outside its intended scope. Analysis can also require substantial memory and time on large codebases, though the A340 result shows it can remain practical at industrial scale. Finally, Astrée is a specialized tool: it proves run-time properties of C programs, not general functional correctness, and it should be understood alongside testing and review rather than as a replacement for them.
A useful next step is to check whether your codebase matches the supported profile — structured C, no dynamic allocation, no recursion — and to look at the project's own material on which run-time properties it proves and how it is licensed for industrial use.
How does Astrée prove the absence of run-time errors in C programs?
Astrée proves the absence of run-time errors (RTEs) by performing abstract interpretation–based static analysis of C source code: it computes an over-approximation of all possible executions and checks whether any execution can reach an error state. If the analysis proves that no execution reaches such states, the absence of those RTEs is established without running the program.
What it proves
Astrée targets run-time errors in structured C programs, including those with complex memory usage. The site lists the class of programs it handles as excluding dynamic memory allocation and recursion, which covers many synchronous, time-triggered embedded control programs. Typical properties include invalid arithmetic (such as division by zero), out-of-bounds array accesses, and other undefined or erroneous operations that would cause a run-time failure.
How the analysis works
The analyzer uses abstract interpretation: instead of enumerating concrete program states, it propagates abstract descriptions of sets of states through the control-flow graph. Each abstract domain captures a different property (for example, intervals, relational constraints, or memory-shape information), and the results are combined to refine the approximation. The analysis iterates to a fixed point, so loops and recursive control flow are handled by widening and narrowing rather than by unrolling. Because the abstraction is sound, any reported absence of an error holds for every possible input and execution path—not just for tested inputs.
Why it is sound and precise enough
Soundness comes from the abstract semantics being a superset of the concrete semantics: if the abstract analysis finds no error state, none exists concretely. Precision comes from the choice and combination of abstract domains, which the project tailored to the numerical and memory patterns of embedded control software. This is what allowed Astrée to prove the absence of RTEs in the primary flight control software of the Airbus A340 fly-by-wire system—132,000 lines of C analyzed in about 1 hour 20 minutes on a 2.8 GHz 32-bit PC with 300 MB of memory, and in about 50 minutes on a 64-bit AMD Athlon 64 with 580 MB. The site also notes the analysis was extended from January 2004 to electric flight control code under development and test for the A380 series.
Practical implications
- No test vectors required: the proof covers all inputs and paths, which matters for safety-critical embedded software where exhaustive testing is impossible.
- Assumptions matter: the guarantee depends on the analyzed program matching Astrée's supported subset (structured C, no dynamic allocation, no recursion) and on the environment model supplied to the analyzer.
- False alarms are possible: soundness does not guarantee that every warning is a real error; imprecision in the abstraction can produce alarms that require manual inspection or domain tuning.
A useful next step is to check whether your code fits the supported subset and to read the site's section on which run-time properties are proved, so you can map your own safety requirements to the analyzer's guarantees. For background on the research group and related tools, see École Normale Supérieure and INRIA.
Can Astrée analyze my embedded C code if it uses dynamic memory allocation or recursion?
No. Astrée is designed for structured C programs that do not use dynamic memory allocation or recursion. The analyzer's stated scope is embedded, synchronous control/command software, so code built around malloc/free or recursive functions falls outside the class of programs it is meant to prove free of run-time errors.
What it does cover
- Structured C with complex memory usage, such as arrays, pointers and aliasing, as long as the memory layout is statically bounded.
- Safety-critical, time-triggered, real-time embedded code, including automatically generated C.
- Proof of the absence of run-time errors (RTE), for example out-of-bounds accesses, division by zero, invalid pointer dereferences and arithmetic overflow.
Why the restriction matters
Astrée works by abstract interpretation: it computes an over-approximation of every reachable program state and checks that no error state is included. Dynamic allocation and recursion can create unbounded or input-dependent state spaces, which breaks the finiteness assumptions that make such a proof tractable. Rather than silently reporting false alarms or unsound results, the tool defines them out of its input language.
If your code uses them
You have three practical routes:
| Situation | Practical option |
|---|---|
| Recursion can be rewritten iteratively with an explicit stack | Refactor, then analyze with Astrée |
| Allocation is confined to a fixed pool with known bounds | Replace with static or bounded buffers, then analyze |
| The program genuinely needs unbounded allocation or recursion | Use a different analyzer or a bounded model checker; Astrée is not the right fit |
A useful first step is to run a simple check for malloc, calloc, realloc, free and self-calling functions in your translation units. If those appear only in initialization or non-flight code, you may be able to isolate the safety-critical core into a separate, allocation-free compilation unit and analyze just that part. The Astrée project publishes its objectives and proved properties at The Astrée Static Analyzer, which is the most reliable place to confirm the exact input restrictions before committing to a toolchain.
What results has Astrée achieved on Airbus flight control software?
Astrée's headline result is a fully automatic proof of the absence of run-time errors in the primary flight control software of the Airbus A340 fly-by-wire system, achieved in November 2003. According to the project's own account, the program comprised 132,000 lines of C and was analyzed in 1 hour 20 minutes on a 2.8 GHz 32-bit PC using 300 MB of memory, or in about 50 minutes on a 64-bit AMD Athlon 64 using 580 MB. The analysis was complete without manual intervention, which is the unusual part: the point was that the tool, not a human proof engineer, discharged the verification.
The work did not stop at the A340. From January 2004 onward, Astrée was extended to analyze the electric flight control code then under development and test for the A380 series. The A340 result is therefore best read as the demonstration that made the later industrial use credible, rather than as an isolated benchmark.
What was actually proved
The property in question is the absence of run-time errors — the class of faults that on a desktop machine produce a crash message but in embedded control software can have graver consequences. Astrée targets structured C programs with complex memory usage but without dynamic memory allocation or recursion, which covers a large share of synchronous, time-triggered control code in aerospace, rail, nuclear, and medical instrumentation.
How to read these numbers
Two cautions are worth keeping in mind when citing this result. First, the figures describe one specific program and one specific tool configuration, so they are evidence of feasibility on that class of code, not a general performance guarantee for other software. Second, the analysis is sound for the stated semantics of the analyzed program; it proves the absence of certain errors, not the presence of correct functional behavior.
If you are weighing a similar verification effort, the practical decision criterion is whether your code fits the analyzable subset — no dynamic allocation, no recursion, structured control flow. Code that violates those assumptions needs rewriting or a different technique before an analyzer of this kind can say anything definitive. For background on the underlying abstract-interpretation methods, the project page at The Astrée Static Analyzer is the primary reference.
Which industries use Astrée for safety-critical embedded software verification?
Astrée is used mainly in industries where embedded C software must be proven free of run-time errors before deployment: earth transportation, nuclear energy, medical instrumentation, aeronautics, and aerospace. The site highlights synchronous control/command software in particular, such as electric flight control and spacecraft manoeuvre systems.
Where it has been applied
- Aeronautics: The primary flight control software of the Airbus A340 fly-by-wire system was analysed automatically, and Astrée was later extended to electric flight control code under development and test for the A380.
- Aerospace: Space vessel manoeuvre software is cited as a target application.
- Nuclear energy, medical instrumentation, and earth transportation: These are listed among the embedded domains the analyzer is designed to cover.
What makes a program a fit
Astrée targets structured C programs with complex memory usage but without dynamic memory allocation or recursion — a profile common in time-triggered, safety-critical embedded control software, including automatically generated code.
If you are assessing whether Astrée suits a project, check three things first: the code is C, it avoids dynamic allocation and recursion, and the property you need to prove is absence of run-time errors. For background on the analyzer's design and proof techniques, see The Astrée Static Analyzer.
How can I obtain an exploitation license for Astrée?
Astrée is not distributed as a self-serve download; the project page describes an "Exploitation license of Astrée" as a separate topic, indicating that commercial or operational use is handled through a licensing arrangement rather than a public package. The practical route is to contact the Astrée team directly using the contact address published on The Astrée Static Analyzer and explain your intended use.
What to prepare before you make contact
A licensing discussion moves faster if you can describe your situation concretely:
- The program under analysis — Astrée targets structured C programs, including complex memory usage, but not dynamic memory allocation or recursion. Confirm your code fits that profile.
- Your goal — proving absence of run-time errors in safety-critical embedded software is the analyzer's stated objective, so say whether you need a one-off verification or an ongoing part of a development process.
- Deployment context — whether the analysis runs on your own machines or in a service arrangement, and who will operate it.
- Organizational status — academic, industrial, or public-sector use can affect the terms offered.
How to judge the options you are given
If you are comparing Astrée against other static analyzers, the decision usually turns on the property you need proved, the language subset your code uses, and whether the tool must run unattended on large codebases. Astrée's documented strength is fully automatic proof of run-time error freedom on synchronous, time-triggered embedded C, so weigh any alternative against whether it can deliver that same guarantee without manual annotation effort. Ask for a trial analysis on a representative slice of your own code; that is more informative than a feature list.
Paris, Paris Department, France
User reviews (0)