• Write simple, high-level specifications using a stream-based language.

• Produce hard real-time C99 runtime monitors that run in constant memory and time.

• Catch errors in specifications early using expressive static type system.

• Prove properties about specifications using theorem proving extensions.

• Interpret specifications for testing and debugging purposes.

• Obtain proofs of correctness of the generated code.

• Installation
  • Linux installation
  • Mac installation
  • Troubleshooting
• Examples
• Related projects
• Documentation
  • API documentation and tutorials
  • Publications
  • Website
• Contributions
• Acknowledgements
  • The Copilot team
  • Institutional support

^{(Back to top)}

^{(Back to top)}

On Debian Bookworm / Ubuntu 23.04 or newer, Copilot can be installed directly from the package repositories with:

$ sudo apt-get install libghc-copilot-dev

To test that Copilot is available, execute the following:

$ ghci <<< 'import Language.Copilot'

It should end with a line like the following and not print any error messages:

ghci> ghci> Leaving GHCi.

On Fedora 40 or newer, Copilot can be installed directly from the package repositories with:

$ sudo dnf install ghc-copilot-devel

To test that Copilot is available, execute the following:

$ ghci <<< 'import Language.Copilot'

It should end with a line like the following and not print any error messages:

ghci> ghci> Leaving GHCi.

On other Linux distributions or older Debian-based distributions, to use Copilot you must install a Haskell compiler (GHC) and the package manager Cabal. We currently support all versions of GHC from 8.6.5 to modern versions (9.8 as of this writing). You can install the toolchain using ghcup or, if you are on Debian/Ubuntu, directly with apt-get:

$ sudo apt-get install ghc cabal-install

Once the compiler is installed, install Copilot from Hackage with:

cabal v2-install --lib copilot

To test that Copilot is available, execute the following:

$ ghci <<< 'import Language.Copilot'

It should end with a line like the following and not print any error messages:

ghci> ghci> Leaving GHCi.

^{(Back to top)}

To use Copilot you must have a Haskell compiler (GHC) and the package manager Cabal. We currently support all versions of GHC from 8.6.5 to modern versions (9.6 as of this writing). You can install the toolchain using ghcup, as well as with Homebrew:

$ brew install ghc cabal-install

Once the compiler is installed, install Copilot from Hackage with:

$ cabal v2-install --lib copilot

To test that Copilot is available, execute the following:

$ ghci <<< 'import Language.Copilot'

It should end with a line like the following and not print any error messages:

ghci> ghci> Leaving GHCi.

^{(Back to top)}

Feel free to open an issue if you are unable to install Copilot following these instructions.

There is a TravisCI file at the root of the repository that may help with troubleshooting the installation. Our issues often include comments with Dockerfiles listing the steps necessary to install Copilot from scratch.

^{(Back to top)}

Here follows a simple example of a heating system. More examples can be found in the examples directory of the main repository.

-- This example implements a simple home heating system. The system heats
-- when the temperature gets too low, and stops when it is high enough. It read
-- temperature as a byte (range -50C to 100C) and translates this to Celsius.

module Heater where

import Language.Copilot
import Copilot.Compile.C99

import Prelude hiding ((>), (<), div)

-- External temperature as a byte, ranging from -50C to 100C.
temp :: Stream Word8
temp = extern "temperature" Nothing

-- Temperature in Celsius.
--
-- We need to cast the Word8 to a Float. This is an unsafeCast, as there
-- is no direct relation between Word8 and Float.
ctemp :: Stream Float
ctemp = (unsafeCast temp) * (150.0 / 255.0) - 50.0

spec = do
  -- Triggers that fire when the ctemp is too low or too high,
  -- pass the current ctemp as an argument.
  trigger "heaton"  (ctemp < 18.0) [arg ctemp]
  trigger "heatoff" (ctemp > 21.0) [arg ctemp]

-- Compile the spec
main = reify spec >>= compile "heater"

If you save this example in a file Heater.hs and run:

$ runhaskell Heater.hs

it will produce the files heater.c, heater.h and heater_types.h, containing, respectively, the implementation of the monitors, the interface, and a declaration of any types declared in the specification (empty in this case).

If you clone the repository, the examples in the examples/ directory can be run from the root of the project. As a rule of thumb, each example is named after the filename (without extension) in lowercase letters, and directory separators replaced with a '-'. For example:

$ cabal run addmult -f examples
$ cabal run counter -f examples
$ cabal run what4-arithmetic -f examples

^{(Back to top)}

Disclaimer: The following projects are not part of Copilot. Their mention here does not constitute any form of endorsement.

• Ogma is a NASA tool to facilitate the integration of safe runtime monitors into other systems, including those built using NASA's Core Flight System or the Robot Operating System (ROS 2).

• arduino-copilot facilitates building copilot applications that run on Arduino.

• sketch-frp-copilot extends Copilot with an FRP-like interface.

• zephyr-copilot facilitates building copilot applications that run on boards supported by the Zephyr project.

^{(Back to top)}

^{(Back to top)}

A tutorial on Copilot can be found here.

The API is documented throughout the different libraries and published on Hackage:

• copilot
• copilot-c99
• copilot-core
• copilot-interpreter
• copilot-language
• copilot-libraries
• copilot-prettyprinter
• copilot-theorem

^{(Back to top)}

The best introduction to the fundamentals of Copilot apart from the tutorial is:

• Copilot 3

Other relevant papers include:

• Runtime Verification in Real-Time with the Copilot Language: A Tutorial

• Trustworthy Runtime Verification via Bisimulation (Experience Report)

• An Introduction to Copilot

• Assuring the Guardians

• Experience report: a do-it-yourself high-assurance compiler

• Compiling an Haskell EDSL to C: A new C back-end for the Copilot runtime verification framework

• Challenges in High-Assurance Runtime Verification

• Runtime Monitoring On Hard Real-Time Operating Systems

• Design and Testing of an Approach to Automated In-Flight Safety Risk Management for sUAS Operations

• The Essence of Reactivity

• Types that Change: The Extensible Type Design Pattern

• Automated Translation of Natural Language Requirements to Runtime Monitors

• Copilot: A Hard Real-Time Runtime Monitor

• Copilot: monitoring embedded systems

• From Requirements to Autonomous Flight: An Overview of the Monitoring ICAROUS Project

• Integrating FRET with Copilot: Automated Translation of Natural Language Requirements to Runtime Monitors

• Monitoring Distributed Real-Time Systems: A Survey and Future Directions

• Monitoring ROS2: from Requirements to Autonomous Robots

^{(Back to top)}

For further information, including links to more documentation and the tutorial, please visit the Copilot website: https://copilot-language.github.io.

^{(Back to top)}

We'd love to receive your contributions, be it code fixes, new features, bug reports, discussions, or anything else that can help the Copilot project.

If you have any comments, questions, ideas, or other topics that you think may be of interest, start a new discussion here.

If you would like to contribute a fix for an issue, please comment on the issue indicating that you want to fix it so that we can assign it to you and track the status on our end. If the issue does not exist, create it first or ask that an existing discussion be promoted to an issue.

If you are unsure about whether your submission should be filed as an issue or as a discussion, file it as a discussion. We can always move it later.

To facilitate merging any pull requests that you send, please:

• Reference the issue you are addressing with the text Refs #<ISSUENUMBER>. at the end of the subject line of each commit message, in every commit. Replace <ISSUENUMBER> with the number of the specific issue that your pull request is addressing.
• Describe what each commit does individually in the commit's message. It's best to err on the side of being more descriptive than less.
• Update the CHANGELOGs in the last commit(s).

You can take a look at the repository's commit history to better understand the process we follow. Click on each commit to see how we write commit messages.

^{(Back to top)}

^{(Back to top)}

Copilot is currently maintained by:

• Alwyn Goodloe
• Ivan Perez

Past and current team members also include (in alphabetical order):

• Macallan Cruff
• Frank Dedden
• Chris Hathhorn
• Georges-Axel Jolayan
• Jonathan Laurent
• Eli Mendelson
• Robin Morisset
• Sebastian Niller
• Lauren Pick
• Lee Pike
• Will Pogge
• Ryan Spring
• Laura Titolo
• Nis Wegmann

For a complete list of contributors, including external contributors, see: https://github.com/Copilot-Language/copilot/graphs/contributors

^{(Back to top)}

We are grateful for NASA Contract NNL08AD13T to Galois, Inc. and the National Institute of Aerospace, which partially supported this work.

Additionally NASA Langley contracts 80LARC17C0004 and NNL09AA00A supported further development of Copilot.