# An Empirical Study of the Code Generation of Safety-Critical Software Using LLMs
## 4 Experiments
### Code Generation Based on Overall Software Requirements
#### 4.2.1 Code Generation Based on the NucRate Algorithm's Overall Requirements  
Using the Prompt-simple approach, based on the NucRate algorithm's overall requirements, along with code language constraints, the prompt is as follows in Box 5:  
[] Generate the C code according to the following requirements:  
The reactor protection system receives power range neutron flux rate of positive change signals and an external reset signal from four measurement channels. The high signal of the power range neutron flux rate of positive change from the four channels is passed through a hysteresis threshold comparator to generate a signal action signal. This signal is input to the S terminal of an RS flip-flop, while the external reset signal is input to the R terminal of the flip-flop. The output signal of the RS flip-flop is input to a 4-to-2 voter, and after the 4-to-2 voting process, two shutdown signals are generated. One shutdown signal is output to a dedicated device A, while the other shutdown signal is sent to the shutdown circuit breaker. It should be noted that the RS flip-flop has a priority on the S terminal. The 4-to-2 voter has a quality bit voting degradation function  
Based on this prompt, GPT-4 generates the C code. The entire code is in Appendix A Listing A1.  
We analyze the generated code in relation to the overall requirements: the code defines two struct types: RSFlipFlop and VoterInput. The RSFlipFlop struct represents an RS flip-flop and contains a powerSignal and a resetSignal, which represent the set input signal and the reset signal of the flip-flop, respectively. The VoterInput struct represents the input signals of a voter and includes a qualityBit and a stopSignal, representing the quality of the signal and the validity signal of the channel, respectively. The program also defines two constants: CHANNELS and THRESHOLD, representing the number of channels and the threshold for the power signal, respectively. These constants are defined using macro definitions (#define) for convenient usage throughout the program. The program includes three functions: processPowerSignal, processResetSignal, and processVoterInputs. The processPowerSignal function handles a high signal rate in a channel and sets the powerSignal of the RS flip-flop to 1 if the signal strength is greater than the THRESHOLD. It also sets the stopSignal of that channel to the powerSignal of the RS flip-flop. The processResetSignal function handles the reset signal and sets the resetSignal of the RS flip-flop to the signal parameter. The processVoterInputs function handles the input signals of the voter, counts the number of good and bad input signals, and outputs the corresponding stop signal or action signal based on their quantities. The main function of the program initializes the input signals of the RS flip-flop and the voter and simulates the power signals of CHANNELS channels. It then calls the processResetSignal function to handle the reset signal and finally calls the processVoterInputs function to handle the input signals of the voter and output the corresponding results.  
Although the program is syntactically correct and can be directly executed, upon deeper analysis, the following issues can be identified:  
1. The requirements of the threshold comparator are not understood, resulting in a missing function.
2. The function of the RS flip-flop is not fully implemented.
3. The degradation function of the quality bit in the 4-to-2 voter is still incomplete.
4. The entire algorithm does not form a top-level function.
5. The code lacks sufficient comments.  
In summary, the generated code does not fully meet the software requirements and cannot be used directly.