A stream DSL for writing embedded C programs.

Copilot is a stream-based runtime verification framework implemented as an embedded domain-specific language (EDSL) in Haskell. Programs can be interpreted for testing, or translated into C99 code to be incorporated in a project, or as a standalone application. The C99 backend output is constant in memory and time, making it suitable for systems with hard realtime requirements.

This package is the main entry-point for using Copilot.

A tutorial, examples, and other information are available at https://copilot-language.github.io.

Features

• Write simple, high-level specifications using a stream-based language.

• Produce hard real-time C99 runtime monitors that run in constant memory and time.

• Catch errors in specifications early using expressive static type system.

• Prove properties about specifications using theorem proving extensions.

• Interpret specifications for testing and debugging purposes.

• Obtain proofs of correctness of the generated code.

Table of Contents

• Installation
  • Linux installation
  • Mac installation
  • Troubleshooting
• Examples
• Related projects
• Documentation
  • API documentation and tutorials
  • Publications
  • Website
• Contributions
• Acknowledgements
  • The Copilot team
  • Institutional support

Installation

^{(Back to top)}

Linux installation

^{(Back to top)}

Debian Bookworm / Ubuntu 23.04

On Debian Bookworm / Ubuntu 23.04 or newer, Copilot can be installed directly from the package repositories with:

$ sudo apt-get install libghc-copilot-dev

To test that Copilot is available, execute the following:

$ ghci <<< 'import Language.Copilot'

It should end with a line like the following and not print any error messages:

ghci> ghci> Leaving GHCi.

Other Linux distributions

On other Linux distributions or older Debian-based distributions, to use Copilot you must install a Haskell compiler (GHC) and the package manager Cabal. We currently support all versions of GHC from 8.6.5 to modern versions (9.8 as of this writing). You can install the toolchain using ghcup or, if you are on Debian/Ubuntu, directly with apt-get:

$ sudo apt-get install ghc cabal-install

Once the compiler is installed, install Copilot from Hackage with:

cabal v2-install --lib copilot

To test that Copilot is available, execute the following:

$ ghci <<< 'import Language.Copilot'

It should end with a line like the following and not print any error messages:

ghci> ghci> Leaving GHCi.

Mac installation

^{(Back to top)}

To use Copilot you must have a Haskell compiler (GHC) and the package manager Cabal. We currently support all versions of GHC from 8.6.5 to modern versions (9.6 as of this writing). You can install the toolchain using ghcup, as well as with Homebrew:

$ brew install ghc cabal-install

Once the compiler is installed, install Copilot from Hackage with:

$ cabal v2-install --lib copilot

To test that Copilot is available, execute the following:

$ ghci <<< 'import Language.Copilot'

It should end with a line like the following and not print any error messages:

ghci> ghci> Leaving GHCi.

Troubleshooting

^{(Back to top)}

Feel free to open an issue if you are unable to install Copilot following these instructions.

There is a TravisCI file at the root of the repository that may help with troubleshooting the installation. Our issues often include comments with Dockerfiles listing the steps necessary to install Copilot from scratch.

Examples

^{(Back to top)}

Here follows a simple example of a heating system. More examples can be found in the examples directory of the main repository.

-- This example implements a simple home heating system. The system heats
-- when the temperature gets too low, and stops when it is high enough. It read
-- temperature as a byte (range -50C to 100C) and translates this to Celsius.

module Heater where

import Language.Copilot
import Copilot.Compile.C99

import Prelude hiding ((>), (<), div)

-- External temperature as a byte, ranging from -50C to 100C.
temp :: Stream Word8
temp = extern "temperature" Nothing

-- Temperature in Celsius.
--
-- We need to cast the Word8 to a Float. This is an unsafeCast, as there
-- is no direct relation between Word8 and Float.
ctemp :: Stream Float
ctemp = (unsafeCast temp) * (150.0 / 255.0) - 50.0

spec = do
  -- Triggers that fire when the ctemp is too low or too high,
  -- pass the current ctemp as an argument.
  trigger "heaton"  (ctemp < 18.0) [arg ctemp]
  trigger "heatoff" (ctemp > 21.0) [arg ctemp]

-- Compile the spec
main = reify spec >>= compile "heater"

If you save this example in a file Heater.hs and run:

$ runhaskell Heater.hs

it will produce the files heater.c, heater.h and heater_types.h, containing, respectively, the implementation of the monitors, the interface, and a declaration of any types declared in the specification (empty in this case).

If you clone the repository, the examples in the examples/ directory can be run from the root of the project. As a rule of thumb, each example is named after the filename (without extension) in lowercase letters, and directory separators replaced with a '-'. For example:

$ cabal run addmult -f examples
$ cabal run counter -f examples
$ cabal run what4-arithmetic -f examples

Related projects

^{(Back to top)}

Disclaimer: The following projects are not part of Copilot. Their mention here does not constitute any form of endorsement.

• Ogma is a NASA tool to facilitate the integration of safe runtime monitors into other systems, including those built using NASA's Core Flight System or the Robot Operating System (ROS 2).

• arduino-copilot facilitates building copilot applications that run on Arduino.

• sketch-frp-copilot extends Copilot with an FRP-like interface.

• zephyr-copilot facilitates building copilot applications that run on boards supported by the Zephyr project.

Documentation

^{(Back to top)}

API documentation and tutorials

^{(Back to top)}

A tutorial on Copilot can be found here.

The API is documented throughout the different libraries and published on Hackage:

• copilot
• copilot-c99
• copilot-core
• copilot-interpreter
• copilot-language
• copilot-libraries
• copilot-prettyprinter
• copilot-theorem

Publications

^{(Back to top)}

The best introduction to the fundamentals of Copilot apart from the tutorial is:

• Copilot 3

Other relevant papers include:

• Automated Translation of Natural Language Requirements to Runtime Monitors

• Copilot: A Hard Real-Time Runtime Monitor

• Copilot: monitoring embedded systems

• From Requirements to Autonomous Flight: An Overview of the Monitoring ICAROUS Project

• Integrating FRET with Copilot: Automated Translation of Natural Language Requirements to Runtime Monitors

• Monitoring Distributed Real-Time Systems: A Survey and Future Directions

• Monitoring ROS2: from Requirements to Autonomous Robots

Website

^{(Back to top)}

For further information, including links to more documentation and the tutorial, please visit the Copilot website: https://copilot-language.github.io.

Contributions

^{(Back to top)}

Copilot cannot accept pull requests or code contributions from developers outside the development team at this point.

If you have a question, find a bug, or would like to request a change, please file an issue adding as much information as you can to help us reproduce the error or identify the use case. Please file the issue with no labels.

Acknowledgements

^{(Back to top)}

The Copilot team

^{(Back to top)}

Copilot is currently maintained by:

• Alwyn Goodloe
• Ivan Perez

Past and current team members also include (in alphabetical order):

• Macallan Cruff
• Frank Dedden
• Chris Hathhorn
• Georges-Axel Jolayan
• Jonathan Laurent
• Eli Mendelson
• Robin Morisset
• Sebastian Niller
• Lauren Pick
• Lee Pike
• Will Pogge
• Ryan Spring
• Laura Titolo
• Nis Wegmann

For a complete list of contributors, including external contributors, see: https://github.com/Copilot-Language/copilot/graphs/contributors

Institutional support

^{(Back to top)}

We are grateful for NASA Contract NNL08AD13T to Galois, Inc. and the National Institute of Aerospace, which partially supported this work.

Additionally NASA Langley contracts 80LARC17C0004 and NNL09AA00A supported further development of Copilot.