Development of Safety-Critical Reconfigurable Hardware with Esterel

Demands for higher flexibility in aerospace applications has led to increasing deployment of FPGAs. Clearly, analysis of safety-related properties of such components is essential for their use in safety-critical subsystems. The contributions of this paper are twofold. First, we illustrate a development process, using a language with formal semantics (Esterel) for design, formal verification of high-level design and automatic code generation down to VHDL. We argue that this process reduces the likelihood of systematic (permanent) faults in the design, and still produces VHDL code that is of acceptable quality (size of FPGA, delay). Secondly, we show how the design model can be modularly extended with fault models that represent random faults (e.g. radiation) leading to bit flips in the component under design (resembling FMEA), and transient or permanent faults in the rest of the environment (corrupting inputs to the component or jeopardising the effect of output signals that control the environment). The set-up is then used to formally determine which (single or multiple) fault modes cause violation of the top-level safety-related property, much in the spirit of fault-tree analyses. An aerospace hydraulic monitoring system is used to illustrate the results.