Modeling

One model with five layers: requirements including hazards and safety goals, logical functions, software, hardware and tests. The layers reference each other directly, so there is nothing to synchronize between tools. Each layer has its own diagrams, and the model can be edited in any order.

The modeling language is deliberately narrow. It follows typical embedded control patterns: time-triggered and event-driven activation, signal-based communication, state-dependent execution and explicit hardware mapping. What is handled well elsewhere stays outside: product variants, versioning, the internal logic of software units and test execution.

Code generation

The generator builds the runtime environment around the application: code structure, signals with validation and scaling, activation, memory allocation and protection, error handling and linker description files. Application logic is written in designated blocks of the generated code, which are preserved across regeneration. Requirements and dependencies appear as comments next to the code they concern.

The generated architecture is platform-agnostic. It is bound to bare metal or an RTOS through an OS adapter and scales from single core to multicore.

Analysis and documentation

Before every transformation, a static analyzer checks the model. Errors stop the generation. Warnings cover design, safety, runtime, testing and requirements, including freedom from interference and conflicting integrity levels.

The documentation generator produces an HTML report with every model element, its dependencies and the analyzer findings, in sync with the generated code. In projects it serves as the basis for the safety documentation.

• Example report