<div align="center">

Copilot

Copilot is a runtime verification framework for hard real-time systems. Programs can be interpreted for testing, or translated into C99 code to be incorporated in a project or standalone application. The C99 code generated is constant in memory and time, making it suitable for systems with hard real-time requirements.

Installation • Examples • Related projects • Documentation • Contributions • Acknowledgements

</div>

Features

• Write simple, high-level specifications using a stream-based language.

• Produce hard real-time C99 runtime monitors that run in constant memory and time.

• Catch errors in specifications early using expressive static type system.

• Prove properties about specifications using theorem proving extensions.

• Interpret specifications for testing and debugging purposes.

• Obtain proofs of correctness of the generated code.

Table of Contents

• Installation
  • Linux installation
  • Mac installation
  • Troubleshooting
• Examples
• Related projects
• Documentation
  • API documentation and tutorials
  • Publications
  • Website
• Contributions
• Acknowledgements
  • The Copilot team
  • Institutional support

Installation

^{(Back to top)}

Linux installation

^{(Back to top)}

Debian Bookworm / Ubuntu 23.04

On Debian Bookworm / Ubuntu 23.04 or newer, Copilot can be installed directly from the package repositories with:

$ sudo apt-get install libghc-copilot-dev

To test that Copilot is available, execute the following:

$ ghci <<< 'import Language.Copilot'

It should end with a line like the following and not print any error messages:

ghci> ghci> Leaving GHCi.

Fedora 40

On Fedora 40 or newer, Copilot can be installed directly from the package repositories with:

$ sudo dnf install ghc-copilot-devel

To test that Copilot is available, execute the following:

$ ghci <<< 'import Language.Copilot'

It should end with a line like the following and not print any error messages:

ghci> ghci> Leaving GHCi.

Other Linux distributions

On other Linux distributions or older Debian-based distributions, to use Copilot you must install a Haskell compiler (GHC) and the package manager Cabal. We currently support all versions of GHC from 8.6.5 to modern versions (9.10 as of this writing). You can install the toolchain using ghcup or, if you are on Debian/Ubuntu, you can use apt-get to install all dependencies as follows:

$ sudo apt-get install ghc cabal-install alex happy pkg-config libz-dev

Once the compiler is installed, install Copilot from Hackage with:

cabal v2-install --lib copilot copilot-core copilot-c99 copilot-language \
    copilot-theorem copilot-libraries copilot-interpreter copilot-prettyprinter

To test that Copilot is available, execute the following:

$ ghci <<< 'import Language.Copilot'

It should end with a line like the following and not print any error messages:

ghci> ghci> Leaving GHCi.

Mac installation

^{(Back to top)}

To use Copilot you must have a Haskell compiler (GHC) and the package manager Cabal. We currently support all versions of GHC from 8.6.5 to modern versions (9.6 as of this writing). You can install the toolchain using ghcup, as well as with Homebrew:

$ brew install ghc cabal-install

Once the compiler is installed, install Copilot from Hackage with:

$ cabal v2-install --lib copilot copilot-core copilot-c99 copilot-language \
    copilot-theorem copilot-libraries copilot-interpreter copilot-prettyprinter

To test that Copilot is available, execute the following:

$ ghci <<< 'import Language.Copilot'

It should end with a line like the following and not print any error messages:

ghci> ghci> Leaving GHCi.

Troubleshooting

^{(Back to top)}

Feel free to open an issue if you are unable to install Copilot following these instructions.

There is a TravisCI file at the root of the repository that may help with troubleshooting the installation. Our issues often include comments with Dockerfiles listing the steps necessary to install Copilot from scratch.

Examples

^{(Back to top)}

Here follows a simple example of a heating system. More examples can be found in the examples directory of the main repository.

-- This example implements a simple home heating system. The system heats
-- when the temperature gets too low, and stops when it is high enough. It read
-- temperature as a byte (range -50C to 100C) and translates this to Celsius.

module Heater where

import Language.Copilot
import Copilot.Compile.C99

import Prelude hiding ((>), (<), div)

-- External temperature as a byte, ranging from -50C to 100C.
temp :: Stream Word8
temp = extern "temperature" Nothing

-- Temperature in Celsius.
--
-- We need to cast the Word8 to a Float. This is an unsafeCast, as there
-- is no direct relation between Word8 and Float.
ctemp :: Stream Float
ctemp = (unsafeCast temp) * (150.0 / 255.0) - 50.0

spec = do
  -- Triggers that fire when the ctemp is too low or too high,
  -- pass the current ctemp as an argument.
  trigger "heaton"  (ctemp < 18.0) [arg ctemp]
  trigger "heatoff" (ctemp > 21.0) [arg ctemp]

-- Compile the spec
main = reify spec >>= compile "heater"

If you save this example in a file Heater.hs and run:

$ runhaskell Heater.hs

it will produce the files heater.c, heater.h and heater_types.h, containing, respectively, the implementation of the monitors, the interface, and a declaration of any types declared in the specification (empty in this case).

If you clone the repository, the examples in the examples/ directory can be run from the root of the project. As a rule of thumb, each example is named after the filename (without extension) in lowercase letters, and directory separators replaced with a '-'. For example:

$ cabal run addmult -f examples
$ cabal run counter -f examples
$ cabal run what4-arithmetic -f examples

Related projects

^{(Back to top)}

Disclaimer: The following projects are not part of Copilot. Their mention here does not constitute any form of endorsement.

• Ogma is a NASA tool to facilitate the integration of safe runtime monitors into other systems, including those built using NASA's Core Flight System or the Robot Operating System (ROS 2).

• arduino-copilot facilitates building copilot applications that run on Arduino.

• sketch-frp-copilot extends Copilot with an FRP-like interface.

• zephyr-copilot facilitates building copilot applications that run on boards supported by the Zephyr project.

Documentation

^{(Back to top)}

API documentation and tutorials

^{(Back to top)}

A tutorial on Copilot can be found here.

The API is documented throughout the different libraries and published on Hackage:

• copilot
• copilot-c99
• copilot-core
• copilot-interpreter
• copilot-language
• copilot-libraries
• copilot-prettyprinter
• copilot-theorem

Publications

^{(Back to top)}

The best introduction to the fundamentals of Copilot apart from the tutorial is:

• Copilot 3

Other relevant papers include:

• Runtime Verification in Real-Time with the Copilot Language: A Tutorial

• Trustworthy Runtime Verification via Bisimulation (Experience Report)

• An Introduction to Copilot

• Assuring the Guardians

• Experience report: a do-it-yourself high-assurance compiler

• Compiling an Haskell EDSL to C: A new C back-end for the Copilot runtime verification framework

• Challenges in High-Assurance Runtime Verification

• [Runtime Monitoring On Hard Real-Time Operating Systems](http://hdl.