  This article describes a fully automated, credible autocoding chain for
control systems. The framework generates code, along with guarantees of high
level functional properties which can be independently verified. It relies on
domain specific knowledge and fomal methods of analysis to address a context of
heightened safety requirements for critical embedded systems and
ever-increasing costs of verification and validation. The platform strives to
bridge the semantic gap between domain expert and code verification expert.
First, a graphical dataflow language is extended with annotation symbols
enabling the control engineer to express high level properties of its control
law within the framework of a familiar language. An existing autocoder is
enhanced to both generate the code implementing the initial design, but also to
carry high level properties down to annotations at the level of the code.
Finally, using customized code analysis tools, certificates are generated which
guarantee the correctness of the annotations with respect to the code, and can
be verified using existing static analysis tools. Only a subset of properties
and controllers are handled at this point.
