This article describes a fully automated, credible autocoding chain for control systems. The framework generates code, along with guarantees of high level functional properties which can be independently verified. It relies on domain specific knowledge and fomal analysis to address a context of heightened safety requirements for critical embedded systems and ever-increasing costs of verification and validation. The platform strives to bridge the semantic gap between domain expert and code verification expert. First, a graphical dataflow language is extended with annotation symbols enabling the control engineer to express high level properties of its control law within the framework of a familiar language. An existing autocoder is enhanced to both generate the code implementing the initial design, but also to carry high level properties down to annotations at the level of the code. Finally, using customized code analysis tools, certificates are generated which guarantee the correctness of the annotations with respect to the code, and can be verified using existing static analysis tools. While only a subset of properties and controllers are handled at this point, the approach appears readily extendable to a broader array of both.A wide range of today's real-time embedded systems, especially their most critical parts, relies on a control-command computation core. The control-command of an aircraft, a satellite, a car engine, is processed into a global loop repeated forever, or at least during the activity of the controlled device. This loop models the acquisition of new input values via sensors: either from environment mesures (wind speed, acceleration, engine RPM, . . . ) or from the human feedback via the brakes, the accelerator, the stick or wheel control.The cost of failure of such systems is tremendous, and examples of such failures abound, in spite of increasingly high certification requirements. Current

No abstract