Translation validation for stateflow to C

Code generators play a critical role in the Model Based Development of complex software systems. This is particularly true in the automotive domain, where the code auto-generated from Simulink/Stateflow models is directly flashed onto embedded controllers. Testing based approaches are popular for validating the translation of models to code. However, these approaches cannot guarantee the absence of bugs introduced during translation. We use translation validation as an alternative to testing. By checking the equivalence between a Stateflow model and C code, it can provide formal guarantees about the absence of bugs introduced during translation. To the best of our knowledge, this is the first application of translation validation to code generation from hierarchical state-machine modeling languages. Our approach builds upon the significant progress over the last few years in software model-checking: we use a state-of-the-art off-the-shelf software model-checker, CBMC, to make translation validation practical for a complex modeling language like Stateflow. We have applied this approach to Stateflow models from the automotive domain.