Safety-critical systems depend on the fact that their software components provide services that behave correctly (i.e. satisfy their requirements). Additionally, in many cases, these systems have to be adapted or reconfigured in case of failures or when changes in requirements or in quality of service occur. When these changes appear at the software level, they can be handled by the notion of substitution. Indeed, the software component of the source system can be substituted by another software component to build a new target system. In the case of safety-critical systems, it is mandatory that this operation enforces that the new target system behaves correctly by preserving the safety properties of the source system during and after the substitution operation. In this thesis, the studied systems are modeled as state-transition systems. In order to model system substitution, the Event-B method has been selected as it is well suited to model such state-transition systems and it provides the benefits of refinement, proof and the availability of a strong tooling with the Rodin Platform. This thesis provides a generic model for system substitution that entails different situations like cold start and warm start as well as the possibility of system degradation, upgrade or equivalence substitutions. This proposal is first used to formalize substitution in the case of discrete systems applied to web services compensation and allowed modeling correct compensation. Then, it is also used for systems characterized by continuous behaviors like hybrid systems. To model continuous behaviors with Event-B, the Theory plug-in for Rodin is investigated and proved successful for modeling hybrid systems. Afterwards, a correct substitution mechanism for systems with continuous behaviors is proposed. A safety envelope for the output of the system is taken as the safety requirement. Finally, the proposed approach is generalized, enabling the derivation of the previously defined models for web services compensation through refinement, and the reuse of proofs across system models.

Les systèmes critiques dépendent du fait que leurs composants logiciels fournissent des services aux comportements corrects (c'est-à-dire satisfaisant leurs exigences). De plus, dans de nombreux cas, ces systèmes doivent être adaptés ou reconfigurés en cas de pannes ou quand des évolutions d'exigences ou de qualité de service se produisent. Quand ces évolutions peuvent être capturées au niveau logiciel, il devient possible de les traiter en utilisant la notion de substitution. En effet, le composant logiciel du système source peut être substitué par un autre composant logiciel pour construire un nouveau système cible. Dans le cas de systèmes critiques, cette opération impose que le nouveau système cible se comporte correctement en préservant, autant que possible, les propriétés de sécurité et de sûreté du système source pendant et après l'opération de substitution. Dans cette thèse, les systèmes étudiés sont modélisés par des systèmes états-transitions. Pour modéliser la substitution de systèmes, la méthode Event-B a été choisie car elle est adaptée à la modélisation de systèmes états-transitions et permet de bénéficier des avantages du raffinement, de la preuve et de la disponibilité d'un outil puissant avec la plate-forme Rodin.Cette thèse fournit un modèle générique pour la substitution de systèmes qui inclut différentes situations comme le démarrage à froid et le démarrage à chaud, mais aussi la possibilité de dégradation ou d'extension de systèmes ou de substitution équivalente. Cette approche est d'abord utilisée pour formaliser la substitution dans le cas de systèmes discrets appliqués à la compensation de Services Web. Elle permet de modéliser la compensation correcte. Par la suite, cette approche est mise en œuvre dans le cas des systèmes caractérisés par des comportements continus comme les systèmes hybrides. Pour modéliser des comportements continus avec Event-B, le plug-in Theory pour Rodin est examiné et s'avère performant pour modéliser des systèmes hybrides. Cela nous permet de proposer un mécanisme de substitution correct pour des systèmes avec des comportements continus. L'exigence de sûreté devient alors le maintien de la sortie du système dans une enveloppe de sûreté. Pour finir, l'approche proposée est généralisée, permettant la dérivation des modèles précédemment définis pour la compensation de Services Web par le raffinement et la réutilisation de preuves entre des modèles de systèmes. / Safety-critical systems depend on the fact that their software components provide services that behave correctly (i.e. satisfy their requirements). Additionally, in many cases, these systems have to be adapted or reconfigured in case of failures or when changes in requirements or in quality of service occur. When these changes appear at the software level, they can be handled by the notion of substitution. Indeed, the software component of the source system can be substituted by another software component to build a new target system. In the case of safety-critical systems, it is mandatory that this operation enforces that the new target system behaves correctly by preserving the safety properties of the source system during and after the substitution operation.In this thesis, the studied systems are modeled as state-transition systems. In order to model system substitution, the Event-B method has been selected as it is well suited to model such state-transition systems and it provides the benefits of refinement, proof and the availability of a strong tooling with the Rodin Platform.This thesis provides a generic model for system substitution that entails different situations like cold start and warm start as well as the possibility of system degradation, upgrade or equivalence substitutions. This proposal is first used to formalize substitution in the case of discrete systems applied to web services compensation and allowed modeling correct compensation. Then, it is also used for systems characterized by continuous behaviors like hybrid systems. To model continuous behaviors with Event-B, the Theory plugin for Rodin is investigated and proved successful for modeling hybrid systems. Afterwards, a correct substitution mechanism for systems with continuous behaviors is proposed. A safety envelope for the output of the system is taken as the safety requirement. Finally, the proposed approach is generalized, enabling the derivation of the previously defined models for web services compensation through refinement, and the reuse of proofs across system models.