sota.io
2026-04-02·9 min read·sota.io team

Deploy Lustre to Europe — Nicolas Halbwachs 🇫🇷 (IMAG Grenoble), the Synchronous Language That Flies Airbus and Powers French Nuclear on EU Infrastructure in 2026

Every time an Airbus A320 adjusts its ailerons, every time a TGV applies its brakes at 300 km/h, every time a French nuclear reactor's safety system responds to a sensor reading, a synchronous reactive program executes. In the majority of these cases, that program was either written in Lustre or generated from a tool whose mathematical foundations are Lustre's semantics. The language that makes this possible was designed at a research institute in Grenoble, France, in 1984. The people who designed it set out to answer a question with direct physical consequences: how do you write a program that is provably correct when the program controls a machine that can kill people if it fails?

Lustre is a synchronous dataflow language for reactive systems. A reactive system is one that continuously interacts with its environment — reading sensor inputs, computing outputs, writing to actuators — rather than computing a single result and terminating. Flight control systems, railway signalling systems, industrial process controllers, and nuclear safety systems are all reactive systems. They must respond to inputs at the rate they arrive, without delays, without non-determinism, and without bugs. Lustre was designed to make writing such programs tractable, verifiable, and certifiable.

The language was created at IMAG — the Institut d'Informatique et de Mathématiques Appliquées de Grenoble — by Nicolas Halbwachs 🇫🇷 and Paul Caspi 🇫🇷, with contributions from Daniel Pilaud and others in the VERIMAG laboratory. IMAG is part of the Joseph Fourier University in Grenoble, a city in the French Alps that has been a centre of mathematics and physics since the eighteenth century — Fourier himself was born there, as was Stendhal, and the city's industrial trajectory was shaped by the hydroelectric power of the Alpine rivers. In the 1980s, IMAG's computer science groups were building the theoretical foundations for what would become the French Synchronous School: a distinctive approach to reactive programming based on the insight that synchrony — the discipline of making all parts of a reactive program execute at the same instant — provides the basis for formal verification.

The French Synchronous School: Lustre, Esterel, Signal

Lustre did not emerge in isolation. It was one of three synchronous languages developed simultaneously in three French research laboratories in the early 1980s, each with a slightly different approach to the same fundamental problem.

Esterel was created by Gérard Berry 🇫🇷 at INRIA Sophia-Antipolis (and the CMA École des Mines de Paris). Where Lustre is a dataflow language — programs are networks of equations relating output streams to input streams — Esterel is an imperative control-flow language. Esterel programs are sequences of statements that can be paused, preempted, and restarted. The two languages are complementary: Esterel is better for control-dominated systems, Lustre for data-dominated ones.

Signal was created by Paul Le Guernic 🇫🇷 at IRISA (Institut de Recherche en Informatique et Systèmes Aléatoires) in Rennes, Brittany. Signal handles polychronous systems — systems with multiple independent clocks — which neither Lustre nor Esterel addressed directly.

The three laboratories — IMAG Grenoble, INRIA Sophia-Antipolis, IRISA Rennes — represent the French national research infrastructure for computer science. They are all funded by the French government and the CNRS (Centre National de la Recherche Scientifique), the national scientific research centre. The Synchronous School that emerged from them is a distinctly European contribution to computer science: formal methods, mathematical rigour, and safety-critical applications, developed in state-funded institutions for use in state-funded industries like aviation (Airbus), railways (SNCF), and nuclear energy (EDF).

Nicolas Halbwachs 🇫🇷 studied mathematics and computer science in Grenoble and spent his entire academic career at IMAG and subsequently VERIMAG — the verification laboratory that grew out of IMAG's work on synchronous languages. VERIMAG (Vérification et Modélisation) is the institution that produced many of the most important results in formal verification of reactive systems over the past four decades. Halbwachs remains one of the central figures in the community. His 1993 textbook Synchronous Programming of Reactive Systems (Kluwer Academic Publishers) is the definitive introduction to the field.

Paul Caspi 🇫🇷 co-designed Lustre's semantics and compiler from the beginning. He worked at IMAG and VERIMAG alongside Halbwachs, contributing to the mathematical foundations of clock calculus and the formal semantics of Lustre programs. Caspi's contributions to the theory of synchronous languages — particularly the formal treatment of clocks, which are the mechanism by which Lustre handles different temporal rates — shaped how the language handles systems with multiple sampling frequencies.

The Synchronous Hypothesis

Lustre's key design decision is the synchronous hypothesis: all computations within a reactive instant are assumed to take zero time. When a set of inputs arrives, all computations triggered by those inputs execute instantaneously, and the outputs are produced before the next set of inputs can arrive. This is a mathematical abstraction — real hardware does not compute instantaneously — but it is a safe abstraction if the actual computation time is small relative to the input rate. For most safety-critical systems, this holds: a flight control computer running at 80 Hz has 12.5 milliseconds per control cycle, which is far more than enough time for the computations involved.

The synchronous hypothesis has a crucial consequence: it eliminates non-determinism. A synchronous program is deterministic — for any sequence of inputs, it produces exactly one sequence of outputs. This is not the case for general concurrent programs, which can interleave in many different ways depending on scheduling. The synchronous hypothesis makes scheduling irrelevant: there is one execution, and its result is determined by the inputs alone.

This determinism is the foundation of formal verification. A Lustre program can be reasoned about mathematically: given a formal specification of what the program should do, one can prove that the program satisfies that specification. The Lustre compiler itself performs a form of verification — it checks that the equations defining the program are consistent, that every output can be computed from the available inputs at each instant, and that no cyclic dependencies exist that would make the computation undefined.

Lustre Semantics: Streams, Equations, Clocks

In Lustre, every variable denotes a stream — an infinite sequence of values, one per execution instant. A Lustre program is a set of equations relating output streams to input streams through operators.

node add(x, y : real) returns (z : real);
let
  z = x + y;
tel

This defines a node (the Lustre term for a function on streams) that takes two real-valued streams and produces their element-wise sum. At every instant, the output z is the sum of the current x and y.

The pre operator gives access to the previous value of a stream:

node running_sum(x : real) returns (s : real);
let
  s = x + (0.0 -> pre s);
tel

pre s is the value of s at the previous instant. 0.0 -> pre s is 0.0 at the first instant and pre s thereafter. This node computes the running sum of a stream. The initialisation operator -> (followed-by) is Lustre's mechanism for handling the undefined initial state of pre.

Clocks allow different nodes to run at different rates:

node sample_when(x : real; cond : bool) returns (y : real when cond);
let
  y = x when cond;
tel

x when cond is a sub-stream of x containing only the values present when cond is true. The type real when cond expresses that y has the clock cond — it only exists when cond is true. The Lustre type system (the clock calculus) ensures that streams are combined only when their clocks are compatible. This prevents the programmer from accidentally combining a stream sampled at 80 Hz with one sampled at 400 Hz.

A complete flight control example:

node pitch_control(
  sensor_pitch : real;   -- pitch angle from IMU (radians)
  target_pitch : real;   -- commanded pitch (radians)
  dt : real              -- time step (seconds)
) returns (
  elevator_cmd : real    -- elevator deflection command (-1.0 to 1.0)
);

const Kp : real = 2.5;  -- proportional gain
const Ki : real = 0.8;  -- integral gain
const Kd : real = 0.3;  -- derivative gain

var
  error : real;
  integral : real;
  derivative : real;
  prev_error : real;

let
  error     = target_pitch - sensor_pitch;
  prev_error = 0.0 -> pre error;
  integral  = (0.0 -> pre integral) + error * dt;
  derivative = (error - prev_error) / dt;
  elevator_cmd = Kp * error + Ki * integral + Kd * derivative;
tel

This PID controller computes an elevator deflection command from pitch error. Every variable is a stream. pre error is the error at the previous control cycle. The equations are evaluated at every control instant — for an Airbus fly-by-wire system, that is every 12.5 milliseconds.

SCADE: Lustre in Production

The industrial form of Lustre is SCADE (Safety-Critical Application Development Environment), originally developed by Esterel Technologies 🇫🇷 (founded in Sophia-Antipolis, 2000, by alumni of the French Synchronous School) and now maintained by Ansys (which acquired Esterel Technologies in 2012).

SCADE is a qualified tool under DO-178C (the aviation software certification standard used for all commercial aircraft) at the highest assurance levels. The SCADE KCG (Kernel Code Generator) is certified as a DO-178C Level A tool, meaning that C code generated by KCG can be included in flight-critical software without additional testing of the generated code — the qualification of the generator itself provides the assurance. This is a very small class of tools; most software development tools are not qualified and cannot substitute for conventional testing.

Every Airbus aircraft produced since the A320 uses Lustre/SCADE in its flight control system. The A320's fly-by-wire system, first flown in 1987, was one of the earliest civilian aircraft to use computer-controlled flight surfaces without mechanical backup. The A380 (first flight 2005) and A350 XWB (first flight 2013) continue this tradition — their flight control computers run SCADE-generated code. Airbus is headquartered in Toulouse, France 🇫🇷, with major manufacturing in Toulouse, Hamburg 🇩🇪, and Seville 🇪🇸. It is entirely EU-headquartered, employing more than 130,000 people across Europe.

The TGV (Train à Grande Vitesse) high-speed rail network uses Lustre for safety-critical aspects of its control software. The TGV operates under EN 50128, the European standard for railway software, at Safety Integrity Level 4 — the highest level. SIL 4 requires formal proofs of correctness: the standard explicitly permits synchronous languages with verified compilers as a means of achieving the required assurance. The TGV network carries more than 100 million passengers per year, connecting Paris to London (via Eurostar), Brussels, Amsterdam, Frankfurt, and dozens of other European cities. It is operated by SNCF 🇫🇷, the French national railway.

EDF (Électricité de France) 🇫🇷 uses Lustre for reactor safety systems in its nuclear power plants. France operates 56 nuclear reactors, generating approximately 70% of French electricity — the highest nuclear share in the world. The safety systems for these reactors are certified under IEC 61511 (functional safety for the process industries) and the French nuclear safety authority (ASN) requirements. Lustre's formal semantics and qualified compiler toolchain make it suitable for demonstrating the required safety integrity levels.

EU Regulatory Compliance: EU AI Act, NIS2, and Beyond

Lustre occupies a unique position in the European regulatory landscape that will intensify under the EU AI Act (Regulation (EU) 2024/1689).

The EU AI Act classifies AI systems that control safety-critical physical infrastructure as high-risk (Annex III) or, when used in civil aviation or railway safety, potentially as systems subject to existing sector-specific regulations (Article 2(3)). For high-risk AI systems, the Act requires:

Lustre-based systems deployed in aviation (DO-178C), railway (EN 50128), and nuclear (IEC 61511) already satisfy these requirements through their sector-specific certifications. An Airbus A380 flight control system is not going to require a new EU AI Act conformity assessment — the DO-178C certification process is explicitly recognised. But for new systems at the intersection of AI and safety-critical control — autonomous vehicles, drone flight management, industrial robot safety systems — Lustre's approach of formal guarantees at compile time provides the documentation trail that Article 13 requires.

NIS2 (Directive (EU) 2022/2555), the Network and Information Security Directive, designates aviation, railways, energy, and water infrastructure as critical entities. Operators of critical infrastructure must implement cybersecurity risk management measures and report significant incidents. The formal verification properties of Lustre programs — determinism, absence of data races, verifiable absence of certain classes of bugs — contribute directly to the security argumentation that NIS2 requires.

IEC 62443 (industrial automation and control systems cybersecurity) increasingly requires formal analysis of safety and security requirements for industrial systems. Lustre's mathematical foundations align with the evidence requirements of IEC 62443-4-1 (product security development life-cycle requirements).

Heptagon: Modern Lustre for Research and EU Academic Deployment

The original Lustre compiler, developed at IMAG and VERIMAG, targets historical platforms. For modern deployments, the primary open-source implementation is Heptagon, developed at INRIA 🇫🇷 (the French national computer science research institute, founded 1967) by the Parkas team (PARallel and reActive Kernel Systems) at the INRIA Paris–Rocquencourt centre and, subsequently, the ENS (École Normale Supérieure) Paris.

Heptagon is an OCaml implementation of a Lustre-like synchronous dataflow language that compiles to C. It includes:

Heptagon is actively maintained and used in EU academic research on embedded systems, cyber-physical systems, and safety-critical software. It is deployable on standard Linux infrastructure:

opam install heptagon

For production deployments, the SCADE toolchain remains the qualified choice. But for research, education, and non-certified applications, Heptagon provides the full Lustre semantic model in an open-source package that deploys on any Linux server — including EU infrastructure on sota.io.

Deploy Lustre/Heptagon on sota.io

Heptagon programs compile to C, which then produces native binaries with standard build tools. A Lustre/Heptagon application deploys on sota.io using Docker with standard Debian tooling:

sota deploy --region eu-west

The platform provisions EU infrastructure (Hetzner, Germany or Scaleway, France), injects managed PostgreSQL credentials as environment variables, configures TLS termination, and assigns a .sota.io subdomain. For a Heptagon service that monitors sensor streams and writes events to a database:

FROM debian:12-slim AS builder

RUN apt-get update && apt-get install -y \
    build-essential git curl \
    libpq-dev ca-certificates \
    opam m4 pkg-config \
    && rm -rf /var/lib/apt/lists/*

# Install OCaml + Heptagon via opam
RUN opam init --disable-sandboxing --yes
RUN opam install --yes heptagon

# Compile Lustre/Heptagon source to C
WORKDIR /src
COPY *.ept ./
RUN eval $(opam env) && heptc -target c controller.ept

# Compile generated C to binary
COPY main.c ./
RUN eval $(opam env) && gcc -O2 -o /app/controller \
    main.c controller.c \
    $(pkg-config --cflags --libs libpq)

FROM debian:12-slim
RUN apt-get update && apt-get install -y libpq5 ca-certificates \
    && rm -rf /var/lib/apt/lists/*

COPY --from=builder /app/controller /usr/local/bin/controller

EXPOSE 8080
CMD ["controller"]

A sample Heptagon node for a monitoring service that detects threshold violations:

(* controller.ept — Heptagon source *)
node threshold_monitor(
  value : float;
  threshold : float
) returns (
  alert : bool;
  above_count : int
);
let
  alert = value > threshold;
  above_count = 0 -> if alert then (pre above_count + 1) else pre above_count;
tel

The generated C code from heptc -target c controller.ept produces a controller.c with a step function that implements the synchronous semantics:

/* Generated by Heptagon compiler — do not edit */
typedef struct {
  float value;
  float threshold;
} threshold_monitor_in;

typedef struct {
  int alert;
  int above_count;
} threshold_monitor_out;

typedef struct {
  int above_count_r;  /* registered state: pre above_count */
} threshold_monitor_mem;

void threshold_monitor_step(
  threshold_monitor_in *in,
  threshold_monitor_out *out,
  threshold_monitor_mem *mem
) {
  int alert_v = in->value > in->threshold;
  int above_count_v = (alert_v) ? (mem->above_count_r + 1) : mem->above_count_r;
  out->alert = alert_v;
  out->above_count = above_count_v;
  mem->above_count_r = above_count_v;
}

The step function takes no hidden state beyond what is in the memory structure. Every execution is deterministic. The memory structure is explicit and bounded — no dynamic allocation, no garbage collector, no runtime surprises. For an EU backend that must demonstrate deterministic behaviour under GDPR Art. 5(1)(f) (integrity and confidentiality), or under EU AI Act Art. 9 (risk management through design), this is the right foundation.

The Grenoble Legacy

IMAG Grenoble, where Lustre was born, sits in a tradition that connects mathematical physics (Fourier), computational mathematics (Jean Kuntzmann, who founded the Institut de Mathématiques Appliquées at Grenoble in 1960), and safety-critical computing (the VERIMAG laboratory, the synchronous school). The city's position — surrounded by the Alps, connected by fast rail to Paris and Lyon, accessible to the nuclear industry at Cruas and Tricastin and the aerospace industry at Toulouse and Bordeaux — made it a natural centre for the mathematics of safety-critical systems.

VERIMAG, founded in 1993 by Gérard Berry, Joseph Sifakis, and others, is the direct institutional successor to the IMAG work on synchronous languages. Joseph Sifakis 🇬🇷 🇫🇷 (Greek-French, University of Grenoble) received the Turing Award in 2007 — alongside Edmund Clarke and E. Allen Emerson — for his foundational work on model checking, the technique of algorithmically verifying that a finite-state system satisfies a temporal logic specification. Model checking is now used routinely to verify Lustre programs and Lustre-based SCADE specifications. The Turing Award work was done at IMAG/VERIMAG Grenoble.

The lineage is direct: Lustre (Halbwachs, Caspi, IMAG 1984) → SCADE (Esterel Technologies 🇫🇷, Sophia-Antipolis, 2000) → every Airbus A320/A380/A350 in commercial service today. The language that Nicolas Halbwachs designed in a research institute in the French Alps is flying 600 million people per year on European aircraft.

See also: Deploy Esterel to Europe — French Synchronous School companion language (Gérard Berry 🇫🇷, INRIA Sophia-Antipolis, 1983), control-flow synchronous model, SCADE A320/A380 fly-by-wire · Deploy SIGNAL to Europe — French Synchronous School third member (Pierre Le Guernic 🇫🇷, IRISA Rennes, 1986), polychronous multi-rate clock algebra, Thales 🇫🇷 + Dassault Aviation 🇫🇷 · Deploy Occam to Europe — CSP concurrency model (Tony Hoare 🇬🇧 Oxford + David May 🇬🇧 Bristol), no shared state, FDR4 formal verification · Deploy Isabelle to Europe — interactive theorem prover (TU Munich 🇩🇪 + Cambridge 🇬🇧), machine-checked proofs for safety-critical systems · All languages on sota.io

sota.io is the EU-native platform-as-a-service for developers who need European infrastructure, GDPR compliance by default, and managed PostgreSQL without the operational overhead. Deploy your Lustre or Heptagon application to EU servers in minutes at sota.io.