Internship Generic correctness of iterative cirtical software architecture exploration-Saclay-H/F

CEA; Saclay; On-site; EUR 14,000 - 17,000; Full time

Job summary

CEA is seeking an intern to work on the correctness of iterative exploration of critical embedded software architectures at Saclay. You will study the QuaRTOS-DSE model, verify preservation properties, and contribute to extending multicore models for task migration and interference.

Expected to have a Master’s degree in a relevant field, fluent English, and a strong interest in formal verification techniques and model checking.

Qualifications

• Master's degree or equivalent in CS or a related field.
• Knowledge of formal methods (temporal logic, model checking).
• Fluent English and teamwork skills.
• Interest in safety-critical and embedded software.

Responsibilities

• Study QuaRTOS-DSE formal model and TLC models.
• Complete equivalence properties between architectures to reach a sufficient condition.
• Propose a solution or proof for coverage of properties under iterative exploration Mi ≈ Mi+1 ≈ … ≈ Mk.
• Extend the multicore model to account for task migration and interference from shared resources.
• Evaluate proposals on use cases, including an industrial protection relay.

Skills

Embedded software

Formal methods

Fluent English

Teamwork

Curiosity

Education

Master's degree / Bac+5

Job description

Internship Generic correctness of iterative cirtical software architecture exploration-Saclay-H/F

Category

Mathematics, information, scientific, software

Contract

Internship

Job title

Internship Generic correctness of iterative cirtical software architecture exploration-Saclay-H/F

Subject

The internship aims to establish the correctness of the iterative exploration of critical embedded software architectures, whatever the clustering strategy applied.

As an intern at the CEA, you will have the opportunity to work within a world-renowned research environment. Our teams consist of passionate and dedicated experts, providing an ideal setting for learning and collaboration. You will have access to state-of-the-art equipment and top-tier research resources to carry out your assignments. The work conducted may potentially lead to a scientific publication.

Context :

The QuaRTOS-DSE tool explores the design space of a critical application by applying, in sequence, strategies that group its functions into tasks, each producing an architecture Mi+1 from Mi. Recent work (VECoS 2026) defines preservation properties that every correct reclustering must satisfy, checked with TLA+ and the TLC model checker: conservation of the configuration, correspondence of the executions per function and per task, and preservation of the communication. It was extended to partitioned multicore deployments and to the coherence of the data each function reads.

These properties are necessary but not sufficient: a reclustering can satisfy all of them without preserving the behavior of the system. Each architecture is compared only with the one it came from, with no guarantee that the verdicts compose along an exploration. Finally, the multicore model assumes that each task stays on its core, and ignores interference from shared hardware resources.

The internship aims to remove these three limitations.

What do we expect from you?

• Study the existing work: the formal model of QuaRTOS-DSE, the preservation properties and their TLA+ models,
• Complete the necessary equivalence properties between two architectures with new properties, to reach a sufficient condition,
• Propose a solution or a proof for the coverage of the properties with respect to the iterative exploration: establish under which conditions Mi ≈ Mi+1 ≈ … ≈ Mk implies Mi ≈ Mk,
• Extend the multicore model to account for task migration between cores and interference from shared hardware resources,
• Evaluate the proposals on existing use cases, including an industrial protection relay, and measure their verification cost.
• During this internship, the student will gain practical experience with safety-critical systems and formal verification techniques, in particular model checking.

--

#Cea-List

Methods / Means: TLA+/TLC, Python, EMF/xtext
Level required: Master's degree, Bac+5 - Master of Science
Duration: 6 months
Skills: Understanding of critical embedded and real-time software; knowledge of formal methods (temporal logic, model checking) is expected. Fluent English, teamwork, curiosity
~1400€ monthly "salary", depending on whether the intern has a scholarship or not.
In line with CEA's commitment to integrating people with disabilities, this job is open to all.
Location: Site Saclay, France, Ile-de-France, Essonne (91), Palaiseau
Start date: to be defined

Methods / Means

TLA+/TLC, Python, EMF/xtext

Master's degree, Bac+5 - Master of Science

Understanding of critical embedded and real-time software; knowledge of formal methods (temporal logic, model checking) is expected. Fluent English, teamwork, curiosity

Site

Saclay

Location

Saclay

Prepared diploma

Bac+5 - Master of Science

Recommended training

Master's degree in computer science, knowledge of critical embedded software; formal methods

PhD opportunity

Oui

Requester

01/03/2026

Organisation

The French Alternative Energies and Atomic Energy Commission (CEA) is a key player in research, development and innovation in four main areas :

• defence and security,
• nuclear energy (fission and fusion),
• technological research for industry,
• fundamental research in the physical sciences and life sciences.

Drawing on its widely acknowledged expertise, and thanks to its 16000 technicians, engineers, researchers and staff, the CEA actively participates in collaborative projects with a large number of academic and industrial partners.

The CEA is established in ten centers spread throughout France.