Cyrille Comar slides show the objectives and results of the Couverture project (http://www.open-do.org/projects/couverture/) and the corresponding products that have been developed.

1. From Couverture to GNATcoverage The path from the original Idea to the final Product(s) CyrilleComar

3. Challenges along the way

5. Open source Coverage Tools exist but are not usable in a HI context

6. Proprietary Tools exist but do not support all versions of Ada

7. Complete the GNAT Pro Toolset for the High Integrity Market

9. Provide Support for Agile/Lean Development

10. In particular: Continuous Integration/Certification

11. Open-DO initiative

13. 4 partners (AdaCore, Openwide, Telecom PT, Paris 6)

14. Effort of 160 man-month (2,23 M€) over 2 years

15. 45% Financed by the city of Paris, IdFregion, DGE This project gave us the capability to meet the unexpected challenges we were faced with

17. Which one is the most Accurate / Appropriate ?

19. usually works by instrumenting the code

20. can be done on fast native platforms

22. on final hardware

23. not language specific

25. Object Coverage Statement Coverage

26. Object Branch Coverage  Decision Coverage

28. Accurate Source Coverage Info Sources Sources Executable Sources Sources GNAT Pro GNATemulator Exec traces Exec traces decorated sources Exec traces decorated sources decorated sources GNATcoverage

29. Accurate Source Coverage Info Not accurate enough to locate precise statements, decisions, or conditions boundaries Sources Sources Executable Sources Sources GNAT Pro Debug info GNATemulator Exec traces Exec traces decorated sources Exec traces decorated sources decorated sources GNATcoverage

30. Accurate Source Coverage Info Source Coverage Information (Static analysis) -fpreserve-control-flow Executable Sources Sources Sources Enhanced GNAT Pro Sources Debug info SCOs GNATemulator Exec traces Exec traces decorated sources Exec traces decorated sources decorated sources GNATcoverage

31. Challenge 2 OBC does not imply MC/DC We Need better theoretical foundations

32. Object Branch Coverage ≠ MC/DC function P (A, B, C : Boolean) return Boolean is begin if( A and then B ) or else C then return True; end if; end P; Conditions A Decision C B MC / DC OBC 3 tests are sufficient At least n+1 tests n = number of conditions

34. Express OBC and MC/DC in this model

35. Find counter-examples

36. Find precise perimeter where the equivalence can be proven

37. Formally prove this resultUse Open Source Model Checker Alloy

38. Counter-Examples A function P (A, B, C : Boolean) return Boolean is begin if( A and then B ) or else C then return True; end if; end P; T F B F C T F T BDD OBC = covering paths in the BDD C0 T F C1 function P (C0, C1, C2, C3, C4 … : Boolean) return Boolean is begin if ((((…(C0 and thenC1) or else C2) and then C3) or else C4 … then return True; end if; end P; C2 F T F T C3 C4 F T F T 3 tests sufficient instead of N+1, for any N

40. How to translate this in “User Terms” ?

41. No easy formulation… the best we found is

42. Transform Boolean expression in “Negative Normal Form”

43. No “and then” in left operand of a “or else”

45. GNATcoverage takes advantage of the theoretical results to:

46. Implement properly MC/DC in the complex case

47. Optimize the simple case by using OBC

48. Creation of “open source” qualif material as part of Open-DO

50. Existing Open-Source technologies have played a key role:

51. Qemu is the base of GNATemulator

52. Alloy helped a lot for the mathematical proofs

53. As a result, new industrial-ready Open Source tools are now available for the HI developers’ community