Giotto provides an abstract programmer's model for the implementation of embedded control systems with hard real-time constraints. A typical control application consists of periodic software tasks together with a mode switching logic for enabling and disabling tasks. Giotto speci es timetriggered sensor readings, task invocations, and mode switches independent of any implementation platform. Giotto can be annotated with platform constraints such as task-to-host mappings, and task and communication schedules. The annotations are directives for the Giotto compiler, but they do not alter the functionality andtiming of a Giotto program. By separating the platform-independent from the platform-dependent concerns, Giotto enables a great deal of exibility inchoosing control platforms as well as a great deal of automation in the validation and synthesis of control software. The timetriggered nature of Giotto achieves timing predictability, which makes Giotto particularly suitable for safety-critical applications.

This paper studies the semantics of hierarchical finite state machines (FMS's) that are composed using various concurrency models, particularly dataflow, discrete-events, and synchronous/reactive modeling. It is argued that all three combinations are useful, and that the concurrency model can be selected independently of the decision to use hierarchical FSM's. In contrast, most formalisms that combine FSM's with concurrency models, such as Statecharts (and its variants) and hybrid systems, tightly integrate the FSM semantics with the concurrency semantics. An implementation that supports three combinations is described.

This paper addresses the design of reactive real-time embedded systems. Such systems are often heterogeneous in implementation technologies and design styles, for example by combining hardware ASICs with embedded software. The concurrent design process for such embedded systems involves solving the specification, validation, and synthesis problems. We review the variety of approaches to these problems that have been taken.

Linear Relation Analysis [CH78] is an abstract interpretation devoted to the automatic discovery of invariant linear inequalities among numerical variables of a program. In this paper, we apply such an analysis to the verification of quantitative time properties of two kinds of systems: synchronous programs and linear hybrid systems.

This paper is a survey of our specification and verification techniques, in a very general, language independent, framework. Section 1 introduces a simple model of synchronous input/output machines, which will be used throughout the paper. In section 2, we show how such a machine can be designed to check the satisfaction of a safety property, and we discuss the use of such an observer in program verification. In section 3, we use an observer to restrict the behavior of a machine. This is the basic way for representing assumptions about the environment. Applications to modular and inductive verification are considered. In modular verification, one has to find, by intuition, a property of a subprogram that is strong enough to allow the verification of the whole program without fully considering the subprogram. In section 4, we consider the automatic synthesis of such a property, and in section 5, we investigate the possibility of deducing the subprogram from such a synthesized specification.

Although detractors of functional programming sometimes claim that functional programming is too difficult or counterintuitive for most programmers to understand and use, evidence to the contrary can be found by looking at the popularity of spreadsheets. The spreadsheet paradigm, a first-order subset of the functional programming paradigm, has found wide acceptance among both programmers and end users. Still, there are many limitations with most spreadsheet systems.

The Embedded Machine is a virtual machine that mediates in real time the interac36) between software proc esses and physicV proc esses. It separates thecA51CP)OC3 of embedded programs into two phases. The first, platform-independent c6AC6)O phase generates E c de (c de exec633 by the Embedded Mac hine), whic h supervises the timing --- not thesc heduling--- ofapplic)OCP tasks relative to external events, suc h asc loc ktic ks and sensor interrupts. Ec ode is portable and exhibits, given an input behavior, predic)OCV (i.e., deterministicFA3)c and output behavior. Thesec ond, platform-dependentcAFFF5) phasec hec ks the time safety of the E c de, that is, whether platform performanc (determined by the hardware and platform utilization (determined by the sc heduler of the operating system enable its timely exec5P)OS We have used the Embedded Mac hine toc)3PVA and execCS high-performance control applications written in Giotto, such as the flight control system of an autonomous model helicopter.

Reactive systems involve communication, concurrency and preemption. Few models support these three concepts, even less can correctly deal with their coexistence. The synchronous

Traditionally, circuits with combinational loops are found only in asynchronous designs. However, combinational loops can also be useful for synchronous circuit design. Combinational loops can arise from high-level language behavioral compiling, and can be used to reduce circuit size. We provide a symbolic algorithm that detects if a sequential circuit with combinational loops exhibits standard synchronous behavior, and if so, produces an equivalent circuit without combinational loops. We present applications to hardware and software synthesis from the Esterel synchronous programming language.

Modularity is advocated as a solution for the design of large systems, the mathematical translation of this concept is often that of compositionality. This paper is devoted the issues of compositionality aiming at modular code generation, for dataflow synchronous languages. As careless storing of object code for further reuse in systems design fails to work, we first concentrate on what are the additional features needed to abstract programs for the purpose of code generation: we show that a central notion is that of scheduling specification as resulting from a causality analysis of the given program. Then we study separate compilation for synchronous programs, and we discuss the issue of distributed implementation using an asynchronous medium of communication; for both topics we provide a complete formal study. Corresponding algorithms are currently under development in the framework of the DC+ common format for synchronous languages.