Abstract. Adaptation is important in dependable embedded systems to cope with changing environmental conditions. However, adaptation significantly complicates system design and poses new challenges to system correctness. We propose an integrated model-based development approach facilitating intuitive modelling as well as formal verification of dynamic adaptation behaviour. Our modelling concepts ease the specification of adaptation behaviour and improve the design of adaptive embedded systems by hiding the increased complexity from the developer. Based on a formal framework for representing adaptation behaviour, our approach allows to employ theorem proving, model checking as well as specialised verification techniques to prove properties characteristic for adaptive systems such as stability.

This article presents the very first effective design of higherorder modules in the synchronous programming language Esterel. Higher-order modules, together with the robust separate compilation scheme that implements it, allow us to address a yet unexplored application spectrum ranging from rapid prototyping of embedded functionality to hot reconfiguration of embedded software within the formal modeling framework of the "synchronous hypothesis". While extensions of data-flow synchronous languages had already been proposed for Lustre [11] and Signal [25], the adaptation of similar programming concepts to imperative synchronous frameworks like Esterel has long posed major technical challenges, due to the specificity of its model of computation. We present a framework including a formal semantics, a type system, and a modular code generator, that tackle this challenge. We consider a specific stack-based module call convention and a simple event pooling protocol ; in consequence signals can refer to modules and modules can be transmitted and instantiated by referencing a signal. We define a type system that computes the potential emissions of a module and prove it sound. Our type system seamlessly fits an extension of Esterel's constructive semantics with higher-order modules.

We present a new compilation technique for generating efficient code from synchronous programs. The main idea of our approach consists of computing for each program location an instantaneous statement (called a job) that has to be executed whenever the corresponding program location is active. Given the computed jobs, the overall execution scheme is highly flexible, very efficient, but nevertheless very simple: At each instant, it essentially consists of executing the set of active jobs according to their dynamic dependencies. Besides the required outputs, the execution of the jobs additionally yields the set of active threads for the next instant. As our translation directly follows the structure of the source code, the correctness of the translation can be easily checked by theorem provers. Furthermore, our translation scheme offers new potential for multi-processor execution, modular compilation, and multi-language code generation.

No abstract