EB4EB, standing for Event-B for Event-B , is a framework that supports the formalisation of Event-B models using first-order logic and set-theory, so that it becomes possible to manipulate them as first-class objects. This framework relies on an Event-B algebraic theory, which serves as a meta-theory formalising, explicitly, all of the features of an Event-B machine. States, events, invariants, variants, etc... are formalised through data-types and operators. When this meta-theory is instantiated, an Event-B model becomes a first-order logic and set-theoretic formula, described in an Event-B context. Because it can handle machine elements as terms in formulas, the EB4EB framework enables the definition of new specific proof obligations and analyses . Such analyses may then be applied to any EB4EB machines in order to establish advanced properties, not natively present in the Event-B method, such as deadlock-freeness or liveness requirements. These analyses are non-intrusive since they do not require to alter the machine in order to be performed. In the previous formalisation of the EB4EB framework only states and events were handled, limiting the expressive reasoning power of the framework. This paper presents an extension of the EB4EB framework to support parameterised events, an important feature of Event-B. This extension is not straightforward in EB4EB. Indeed, the typing system supported by Event-B theories is not rich enough to describe such extension in a constructive manner as for the other Event-B features formalised in EB4EB. The proposed solution, described in this paper, consists in defining an axiomatic formalisation of event parameters definitions. We also show that the proof obligations and model analyses we have defined scale to handle event parameters. The approach is illustrated on different case studies we have developed.

The Event-B method enables correct by construction modeling of systems. It relies on set theory and first-order logic, to describe a series of refined system models expressed as a set of events modifying state variables. Invariants and theorems are introduced to express system properties submitted to the proof system associated with Event-B. While Event-B has proven its efficiency for the proof of this type of property, it does not offer powerful means allowing the explicit description of properties other than safety and specific forms of reachability. Checking other properties such as deadlock-freeness, liveness, or event scheduling requires ad hoc modeling techniques and external tools such as model checkers or other proof systems. This article presentsEB4EB, a new modeling framework offering the capability to introduce formally defined Event-B extensions, in particular new proof obligations corresponding to new properties. It is based on metamodeling techniques. It includes a theory (a metatheory) modeling Event-B and offers means for explicit manipulation of Event-B features and an extension mechanism to explicitly formalize and prove other properties. This reflexive framework relies on a trace-based semantics of Event-B and introduces a set of Event-B theories defining data types, operators, well-defined conditions, theorems, and proof rules to define Event-B constructs and their semantics. Deep and shallow instantiation mechanisms are set up to instantiate the obtained metatheory. The EB4EB framework and its instantiation mechanisms are developed in Event-B using the Rodin platform ensuring correctness and internal consistency of the defined theories. Lamport's clock example, instantiating EB4EB in both shallow and deep mechanisms, is used to evaluate the proposed approach.

For years, formal methods have been successfully applied in the railway domain to formally demonstrate safety of railway systems. Despite that, little has been done in the field of formal methods to address the cyber-physical nature of modern railway signalling systems. In this article, we present an approach for a formal development of cyber-physical railway signalling systems that is based on a refinement-based modelling and proof-based verification. Our approach utilises the Event-B formal specification language together with a hybrid system and communication modelling patterns to developing a generic hybrid railway signalling system model that can be further refined to capture a specific railway signalling system. The main technical contribution of this article is the refinement of the hybrid train Event-B model with other railway signalling sub-systems. The complete model of the cyber-physical railway signalling system was formally proved to ensure a safe rolling stock separation and prevent their derailment. Furthermore, the article demonstrates the advantage of the refinement-based development approach of cyber-physical systems, which enables a problem decomposition and in turn reduction in the verification and modelling effort.

Abstract This paper proposes a unified formal framework, Formal Framework For FLUID (F3FLUID), for the development of safety‐critical interactive systems. This framework is based on the Formal Language of User Interface Design (FLUID) pivot modeling language defined in the FORMEDICIS project, which enables high‐level system requirements for interactive systems to be specified in the FLUID language. This modeling language is specifically designed for handling concepts of safety‐critical interactive systems, including domain knowledge. A FLUID model is used as a source model for the generation of several target models in different modeling languages to support the formal verification methods, such as theorem proving and model checking. In this paper, we use the Event‐B modeling language for checking functional behaviors, user interactions, safety properties, and domain properties. A FLUID model is transformed into an Event‐B model, and then, the Rodin tool is used to check the internal consistency with respect to the given safety properties. We illustrate the operational semantics of the FLUID language, and the transformation strategy of FLUID models into Event‐B models, including the tool development. We use the ProB model checker to analyze the temporal properties and to animate the formalized specification. In addition, an interactive cooperative objects (ICOs) model is derived from the Event‐B model for animation, visualization and validation of dynamic behaviors, visual properties, and task analysis. Finally, an industrial case study, complying with the ARINC 661 standard, Multi‐Purpose Interactive Applications (MPIA), is used to illustrate the effectiveness of our F3FLUID framework for the development of safety‐critical interactive systems.

System engineering advocates a thorough under-standing of the engineering domain or certification standards (aeronautics, railway, medical, etc.) associated to the system under design. In this context, engineering domain knowledge plays a predominant role in system design and/or certification. Furthermore, it is a prerequisite to achieve the effectiveness and performance of the designed system. This article proposes a formal method for describing and setting up domain-specific behavioural analyses. It defines a formal verification technique for dynamic properties entailed by engineering domain knowledge where Event-B formal models are annotated and analysed in a non-intrusive way, i.e. without destructive alteration. This method is based on the formalisation of behavioural properties analyses relying on domain knowledge as an ontology on the one hand and a meta-theory for Event-B on the other hand. The proposed method is illustrated using a critical interactive system.

Event-B is a correct-by-construction rigorous state-based method offering features for formal modelling and proof automation. An inductive proof schema allows to prove system properties, in particular invariants. In the current setup, verifying other properties such as deadlock-freeness, reachability, event scheduling, liveness, etc., requires adhoc modelling. These prop-erties can be established partially using model checkers or by using third party interactive provers. Other crucial aspects, such as deadlock-freeness, are difficult to express. The availabilty of a meta-modelling mechanism for explicit manipulation of Event-B concepts would allow to deal with higher order modelling concepts and to define generic properties and associated proof obligations. In this paper, we propose EB4EB, an Event-B based modelling framework allowing to manipulate Event- B features explicitly based on meta modelling concepts. This framework relies on a set of Event-B theories defining data-types, operators, well-defined conditions, theorems and proof rules. It preserves the core logical foundation, including semantics, of original Event- B models. Based on the instantiation of the introduced features at meta level, deep and shallow modelling approaches are proposed to exploit this framework. In addition, a case study is developed to demonstrate the use of our framework applying the deep and shallow embedding approaches. The whole framework is supported by the Rodin platform handling Event- B models and proofs.

Abstract The decentralised railway signalling systems have a potential to increase capacity, availability and reduce maintenance costs of railway networks. However, given the safety-critical nature of railway signalling and the complexity of novel distributed signalling solutions, their safety should be guaranteed by using thorough system validation methods. To achieve such a high-level of safety assurance of these complex signalling systems, scenario-based testing methods are far from being sufficient despite that they are still widely used in the industry. Formal verification is an alternative approach which provides a rigorous approach to verifying complex systems and has been successfully used in the railway domain. Despite the successes, little work has been done in applying formal methods for distributed railway systems. In our research we are working towards a multifaceted formal development methodology of complex railway signalling systems. The methodology is based on the Event-B modelling language which provides an expressive modelling language, a stepwise development and a proof-based model verification. In this paper, we present the application of the methodology for the development and verification of a distributed protocol for reservation of railway sections. The main challenge of this work is developing a distributed protocol which ensures safety and liveness of the distributed railway system when message delays are allowed in the model.

Abstract This editorial introduces the special issue of Interacting with Computer on Heterogeneous Models and Modelling Approaches for Engineering of Interactive Systems. This special issue was proposed to gather the best contributions from a series of workshops organized alongside conferences such as FM’19 (3rd World Congress on Formal Methods) and EICS’19 (11th ACM SIGCHI Symposium on Engineering Interactive Computing Systems). It also encompasses papers submitted directly to this special issue.

Abstract This paper presents a formal development approach for designing interactive applications using a correct-by-construction approach. In this work, we propose a refinement strategy using model-view-controller (MVC) to structure and design Event-B formal models of the interactive application. The proposed MVC-based refinement strategy facilitates the development of an abstract model and a series of refined models by introducing the possible modes, controller’s behaviour and visual components of the interactive application while preserving the required interaction-related safety properties. To demonstrate the effectiveness, scalability, reliability and feasibility of our approach, we use a small example (from automotive domain) and real-life industrial case studies (from aviation). The entire development is realized in Event-B and the associated Rodin tool is used to analyse and verify the correctness of the formalized model. Finally, the developed Event-B models are used to generate source code using EB2ALL tool for going from the specification to the implementation of the interactive application.

Hybrid systems are complex systems where a software controller interacts with a physical environment, usually named a plant, through sensors and actuators. The specification and design of such systems usually rely on the description of both continuous and discrete behaviours. From complex embedded systems to autonomous vehicles, these systems became quite common, including in safety critical domains. However, their formal verification and validation as a whole is still a challenge. To address this challenge, this article contributes to the definition of a reusable and tool supported formal framework handling the design and verification of hybrid system models that integrate both discrete (the controller part) and continuous (the plant part) behaviours. This framework includes the development of a process for defining a class of basic theories and developing domain theories and then the use of these theories to develop a generic model and system-specific models. To realise this framework, we present a formal proof tool chain, based on the Event-B correct-by-construction method and its integrated development environment Rodin, to develop a set of theories, a generic model, proof processes, and the required properties for designing hybrid systems in Event-B. Our approach relies on hybrid automata as basic models for such systems. Discrete and continuous variables model system states and behaviours are given using discrete state changes and continuous evolution following a differential equation. The proposed approach is based on refinement and proof using the Event-B method and the Rodin toolset. Two case studies borrowed from the literature are used to illustrate our approach. An assessment of the proposed approach is provided for evaluating its extensibility, effectiveness, scalability, and usability.

When interactive systems allow users to interact with critical systems, they are qualified as Critical Interactive Systems, CIS for short. Their design requires the support of different activities and tasks to achieve user goals. Examples of such systems are cockpits, nuclear plant control panels, medical devices, etc. Such critical systems are very difficult to model due to the complexity of the offered interaction capabilities. This paper presents a formal framework, F3FLUID (Formal Framework For FLUID), for designing safety-critical interactive systems. It relies on FL UID as core modelling language. FL UID enables the modelling and use of interactive systems domain concepts and supports an incremental design of such systems. Formal verification, validation and animation of the designed models are supported through different transformations of FLUID models into target formal verification techniques: Event-B for formal verification, ProB model checker for animation and Interactive Cooperative Objects for user validation. The Event-B models are generated from FLUID while ICO and ProB models are produced from Event-B. We exemplify the real-life case study TCAS (Traffic alert and Collision Avoidance System) to demonstrate our framework.

Abstract Contemporary interaction‐based complex systems are often built by reusing existing distributed peers, which have to coordinate with each other to fulfill the client, system, and environment requirements. In this paper, we address the design of distributed systems composed of peers (state‐transitions systems) communicating through message exchanges. We consider choreographies as the formal model, allowing a developer to describe and specify peers coordination as a set of conversations; ie, all sequences of messages exchanged between the communicating peers. Proceeding this way requires building neither the individual peers nor their composition as they may be obtained by the choreography projection. The correctness of the preservation of such messages exchanges by each peer obtained after projection is a key issue, known as the realizability problem. Checking choreography realizability is mandatory to build third‐party applications with no coordination error, eg, absence of deadlocks, missing messages, and erroneous messaging order. In our previous work, we have proposed a set of composition operators, allowing designers to build realizable choreographies that are represented by conversation protocols (CPs). In this work, realizability is guaranteed by construction. We rely on the correct‐by‐construction Event‐B method to prove that each CP constructed using our operators is realizable. In this paper, we show how our approach applies and scales to a set of use cases borrowed from the literature and used by the research community. We also show that our approach allows to detect failures and failure recovery in case realizability does not hold.

The modern radio-based railway signalling systems aim to increase network's capacity by enabling trains to run closer to each other. At the core of such systems is train's on-board computer (discrete) responsible for computing and controlling the speed (continuous) of the train. Such systems are best captured by hybrid models, which capture discrete and continuous system's aspects. Hybrid models are notoriously difficult to model and verify, in our research we address this problem by applying hybrid systems' modelling patterns and stepwise refinement for developing hybrid train speed controller model.

Because verification and validation are important activities in model driven engineering (MDE), verifying interfaces preservation is considered an interesting step to understand the evolution of data models by analyzing their interfaces.The interfaces defined on a data model can be used to define model evolution correctness using observational semantics.In this paper, we propose an approach that supports rigorous analysis, verification and validation of behavioral re-factoring.Our work addresses the problem of data model evolution in a formal modelling and verification setting.We focus on data conservation in the specific context of space engineering, where data models may involve thousands of concepts, relationships and each concept has a number of fields or attributes and each relationship has a number of properties.

Cyber-physical systems (CPS) are taking a crucial role in various areas of our society and industry. Yet, because of their hybrid nature (i.e. the integration of both continuous and discrete features), their design and verification are not easy to handle, in particular when they are part of a critical system. Their certification requires to exhibit a formal argumentation that formal methods should be able to provide. This paper addresses the formal development of CPS using correct-by-construction refinement and proof based approaches. It relies on the Event-B formal method. In addition to modeling both the discrete and continuous parts of a CPS, this paper presents a novel approach in two steps. First it shows that the generic formal model we have defined, integrating both discrete and continuous behaviors, can be instantiated by various kinds of CPS. Fundamentally, continuous behaviors modeled by differential equations mingle with discrete transition systems (mode automaton), which model discrete behaviors. Here, refinement is used as a decomposition mechanism. Second, it expands the refinement operation, well mastered in the discrete world, to cover continuous behaviors. We show that different levels of abstraction of continuous aspects can be glued in a refinement chain. The proposed approach has been completely formalized using Event-B on the Rodin platform and a case study based on water tanks is used to illustrate it.

To check the correctness of heterogeneous models of a complex critical system is challenging to meet the certification standard. Such guarantee can be provided by embedding the heterogeneous models into an integrated modelling framework. This work is proposed in the B-PERFect project of RATP (Parisian Public Transport Operator and Maintainer), it aims to apply formal verification using the PERF approach on the integrated safety-critical software related to railway domain expressed in a single modelling language: HLL. This paper presents a certified translation from B formal language to HLL. The proposed approach uses HOL as a unified logical framework to describe the formal semantics and to formalize the translation relation of both languages. The developed Isabelle/HOL models are proved in order to guarantee the correctness of our translation process. Moreover, we have also used weak-bisimulation relation to check the correctness of translation steps. The overall approach is illustrated through a case study issued from a railway software system: onboard localization function. Furthermore, it discusses the integrated verification at system level.

In this paper, we address the design of distributed systems composed of peers (state-transitions systems) communicating through message exchanges. We consider choreographies as the ground formal model allowing a developer to describe and specify peers coordination as a set of conversations, i.e., all sequences of messages exchanged between the communicating peers. Proceeding this way does not require building the individual peers, nor their composition; they may be obtained by choreography projection. The correctness of the preservation of such messages exchanges by each peer obtained after projection is a key issue, known as the realizability problem. In our previous work [1], we have proposed a set of composition operators allowing designers to build realizable choreographies that are represented by conversation protocols (CPs). We rely on the correct-by-construction Event-B method to prove that each CP constructed using our operators is realizable. In this paper, we show how our approach applies and scales to a set of use cases borrowed from the literature and used by the research community. We also show that our approach allows to detect failures and failure recovery in case realizability does not hold

Refactoring, successfully used in the field of programming, can be used in maintenance and restructuring of the large and complex models. In this paper, we present a novel approach for model refactoring and a set of modelling patterns that are applicable for refinement-based formal development. In order to carry out this study, we investigate the previously developed large and complex model and required ontology to develop a domain model and a refactored system model. Further, we use the Rodin tools to check the internal consistency with respect to the desired functional behaviour and the required safety properties. Our main contributions are: to develop a refactoring technique related to the correct by construction approach; to use the domain specific knowledge in a system model explicitly; to define a set of modelling patterns; and to define a restructuring mechanism in the formal development. Finally, this proposed approach is evaluated through a complex medical case study: ECG clinical assessment protocol.

This paper presents a formal development process for safety-critical embedded Human-Machine Interface (HMI) systems. This formal approach is centered on the LIDL formal language and the S3 verification toolset. It is aimed at blurring the boundaries between modeling, design, verification and implementation for the development of HMI. From textual requirements to software, the development process integrates the following formal activities: modeling the behavioral aspect of user interfaces (UIs) using LIDL; translating LIDL to Lustre, with which we combine the functional library in Lustre; translating the Lustre design models into the HLL verification models; verifying formal properties expressed in HLL against the HLL model using the S3 toolset, and diagnosing design errors with the help of counterexample scenarios and debug tools. This formal development process is illustrated on a simple use case — part of the display component of an alert management system used in a three-wheeled robot.

One of the key interests in web services is the ability to compose them in order to build more powerful and complex ones running in an interoperable and distributed setting. Several languages, like BPEL, that describe such services have been proposed. Similar to the usual complex systems, web service compositions may exhibit inappropriate behaviors in the presence of failures. Compensation mechanisms are available to express running services recovery in case of failures. This paper addresses the problem of the correct design of web service compositions in case of failures. It presents a novel correct-by-construction formal approach based on refinement using the Event-B method. The proposed approach defines a compensation mechanism to repair failed services at runtime. It addresses not only behavioral aspects but also, functional ones through the introduction of repairing invariants whose persistence is enforced during compensation at runtime. Different compensation scenarios and modes are addressed. A formal model for equivalent, degraded and upgraded service compensations relying on the Event-B formalization is defined. The proposal is illustrated on a case study.

For a long time, formal methods have been effectively applied to design and develop safety-critical systems to ensure safety and the correctness of desired functional behaviors through formal reasoning. The development of high confidence self-adaptive autonomous systems, such as Automatic Rover Protection(ARP), is one of the challenging problems in the area of verified software that needs formal reasoning and proof-based development. In this paper, we propose a methodology that reveals the issues involved in the formal modeling and verification of self-adaptive autonomous systems using correct by construction approach. This work also provides a set of guidelines for tacking the different issues to avoid collision by preserving the local and global properties of an autonomous system. We cater for the specification of functional requirements, timing requirements, spatial and temporal behavior, and safety properties. We present a refinement strategy, modeling patterns to capture the essence of a self-adaptive autonomous system, and a substantial example based approach on an industrial case study: TwIRTee. For developing the formal models of autonomous system, we use the Event-B modeling language and associated Rodin tools to check and verify the correctness of required system behavior and internal consistency under the given safety properties.

This paper presents a formal model to check the interaction plasticity on a user interface (UI). An interaction is seen as an implementation (achievement) of a user task by means of interaction devices and modes of a given platform. The interaction plasticity is the ability of UI to support several interactions to perform the same task. In this work, two task models, containing different sets of interactions, are observed to check if they describe interactions that perform the same task. Each task model is represented by a labelled state-transitions system (lts). Due to the use of different interaction modes and devices, the obtained lts have different set of labels. Weak bi-simulation relationship is revisited to handle these transition systems by defining a relation on labels. This relation is borrowed from an ontology of interaction modes and devices. Model checking techniques are set up to automatically establish such a bi-simulation. A case study is used to illustrate how the approach works.

Recently, ontologies have been widely adopted by small, medium and large companies in various domains. These ontologies may contain redundant concepts (computed from primitive concepts). At the beginning of the development of ontologies, the relationship between them and the database was weakly coupled. With the explosion of semantic data, persistent solutions to ensure a high performance of applications were proposed. As a consequence, a new type of database, called semantic database (SDB) is born. Several types of SDB have been proposed and supported by different DBMS, where each one has its architecture and its storage layouts for ontologies and its instances. At this stage, relationship between databases and ontologies becomes strongly coupled. As a consequence, several research studies were proposed on the physical design phase of SDB. To guarantee the similar success that relational databases got, SDB has to be supported by complete design methodologies and tools including the different steps of the database life cycle. Such methodology should identify the redundancy embedded into ontology. In this paper, we propose a design methodology dedicated to SDB including the main phases of the lifecycle of the database development: conceptual, logical, deployment and physical. The conceptual design of SDB can be easily performed by exploiting the similarities between ontologies and conceptual models. The logical design phase is performed thanks to the incorporation of dependencies between concepts and properties in the ontologies. These dependencies are quite similar to the principle of functional dependencies defined in the traditional databases. Due to the diversity of the SDB architectures and the variety of the used storage layouts (horizontal, vertical, binary) to store and manage ontological data, we propose a SDB deployment à la carte. Finally, a prototype implementing our design approach on Oracle 11g is outlined.

With the increasing needs for the world wide enterprises to integrate, share and visualize data from various heterogeneous, autonomous and distributed sources data and Web data covering a given domain, the development of integration and reconciliation solutions becomes a challenging issue. The existing studies on data integration and reconciliation of results have been developed in an isolated way and did not consider the strong integration between these two processes. On one hand, ontologies were largely used for building automatic integration systems due to their ability to reduce schematic and semantic heterogeneities that may exist among sources. On the other hand, reconciliation of results is performed either by considering that all sources use the same identifier for an instance or by means of statistical methods that identify affinities between concepts. These reconciliation solutions are not usually suitable for real-world sensitive-applications where exact results are required and where each source may use a different identifier for the same concept. In this paper, we propose a methodology that simultaneously integrate source data and reconciliate their instances based on ontologies enriched with functional dependencies (FD) in a mediation architecture. The presence of FD gives more autonomy to sources when choosing their primary keys and facilitates the result reconciliation. This methodology is experimented using the Lehigh University Benchmark (LUBM) dataset to show its scalability and the quality of the reconciliation result phase.

The need to manage the complexity of current systems encourages the use of models in Engineering processes. Systems Engineering is a multi-domain discipline which implies a wide variety of heterogeneous design models in the life-cycle of the system. Furthermore, dividing of the work and the advent of collaborative engineering techniques require combination of these heterogeneous models in order to achieve the overall engineering process. In such a context, we propose a methodology making possible to interoperate existing heterogeneous design models. Our approach fastens upon knowledge in order to annotate and homogenize the models. More precisely, we claim that design models can be completed or clarified with shared domain knowledge, i.e. ontologies, which is mastered by the engineers but usually not formalized. Moreover, this methodology is not intrusive since it aims to link models by developing an additional model of relations which allows keeping the traceability to the original models.

The Web services composition defines a process that involves various independent Web services to perform a complex function. This process is described with a standard language (BPEL) and executed by tools supporting this language. This kind of languages describes the behavior of different distributed services together, but it does not support the verification nor the validation of behavioral requirements.In our work, we are interested in the formal validation of Web services composition. Formal models are extracted from BPEL specifications and checked. Most previous work is based on Web services composition formalizations using Petri nets,process algebra or transition systems. The model checking technique is set-up to validate such descriptions.In this paper, we present a proof and refinement based approach for the formal representation, verification and validation of Web services compositions using the Event_B method.

Nowadays, many engineering studies are conducted to securely exploit depleted oil fields for CO2 Storage.These studies follow complex workflows of data processing services described by geologists. If no explicit semantics is applied to describe these workflows, it is not possible to share them between geologists by reusing existing ones or for composing new ones. The focus of our work is to make the semantics explicit in order to facilitate the geologists daily work. In this article, we first explain how geologists operate today. Then, we enrich such workflows with semantic indexes through ontology based characterizations.

Today, we are more than ever conscious of the pollution that we cause. Actions are undertaken in order to deal with the reduction in CO2 emissions in particular. One of the techniques of handling the CO2 is storing it in old oil fields. Indeed, many engineering studies are conducted by governments and private companies to model the geological structures in order to use them as potential CO2 reservoirs. These studies follow series of complex workflows (business processes) of data processing services. Originally, these workflows are designed and executed by geologists with software products designed for hydrocarbon exploration and production purposes. Today, these workflows follow the experience gained by experts through their previous realizations and the software designers integrate this knowledge in monolithic software products. Then, if a minimum of explicit semantics is not applied to describe these workflows and the services that compose them, it is not possible to share this experience among geologists by reusing existing workflows or by composing new ones. The focus of our work is to evaluate the benefit of making the semantics explicit to facilitate the geologists daily work. In this article, we first explain how geologists operate today. Then, we show how we enrich such complex workflows and the data they manipulate with semantic indexations through ontology-based characterizations (Geological Data and Services Ontologies).

Engineering models are computer-based models that enclose technical data issued from engineering domains. Those models usually implicit many of the details required to understand and interpret the data. In this context, integrating the results of models and querying the heterogeneous information is a challenge.

In previous work, we defined a component oriented framework dedicated to the specification of embedded systems in the aeronautics domain. A component is defined as a formal entity with three internal layers together with a collection of models defined in domain-oriented views. A categorical framework has been proposed to provide a unified representation of the component calculus as well as the various formal models used for the analysis of the system. In this paper, we present an implementation of this categorical framework using the EXPRESS data modelling language. EXPRESS is used to give an operational representation of the formalization, which is quite different from classical implementations of category theory based approaches.

This paper presents a component oriented framework dedicated to the specification of embedded systems in the aeronautics domain. A component is an entity with three internal layers (hardware, operating functions and applicative functions) together with a collection of models in different domain-oriented views. A composition operation allows the expression of composition scenarios, yielding a component calculus for representing composite systems. An institutional framework supports this component calculus, allowing the expression of coherence criteria between heterogeneous views. This framework can be seen as a formal documentation of a system development and analysis, supporting heterogeneous modeling and compositional verification. The approach is illustrated on a non trivial case study.

Avionics embedded systems are confronted to sensors errors or inaccuracies. It is essential to be able to estimate the impact and the propagation of these errors on the system computed outputs. This paper comes from achieved work in the context of an industrial project in the avionics area. It presents a formal approach allowing to analyse the reaction of a LUSTRE program to inaccurate input values. It uses program analysis techniques like abstract interpretation and interval analysis. The approach has been implemented in Java and applied to parts of a flight control system of the AIRBUS aircrafts.

This paper deals with non-functional aspects of software. It presents an approach towards the integration of methods in order to handle properties of numerical programs. We develop a program analysis technique which allows us to formalise, evaluate and check non-functional properties of programs. These property evaluations are used in two main areas. The first one is related to program design to choose data representations and to perform program transformations. The second is related to reverse engineering, and particularly to software reuse and maintenance. As example, a functional language with numerical type only is considered, and the accuracy of the numerical computations is the considered non-functional property.

Transformation systems allow us to support developments leading from an initial specification to a final program in a totally formal way. Transformations use valid properties of input objects to produce new equivalent ones. Most transformations use functional properties to increase the efficiency of programs. In doing so, they affect nonfunctional properties, which are usually not formally expressed. The problem we address is to recognize situations in which transformations can be achieved on the basis of the evaluation of a defined, nonfunctional property, and the aim of the present paper is to relate program transformations to nonfunctional properties evaluations. Indeed, a particular transformation tactic can be applied when a given property does not hold. The DEVA language has been used as a support of our experiments in the development of programs.

Transformation systems allow to support developments leading from an initial specification to a final program in a totally formal way. Transformations use valid properties of input objects to produce new equivalent ones. Most transformations use functional properties to increase the efficiency of programs. Doing so, they affect non nonfunctional properties which, more often, are not formally expressed. The problem the author addresses is to recognize situations in which transformations can be achieved on the basis of the evaluation of a defined nonfunctional property and his aim is to relate program transformations to nonfunctional properties evaluations. Indeed, a particular transformation tactic can be applied when a given property does not hold. The DEVA language has been used as a support of experiments in the development of programs.>