Languages|Denotational semantics, Program analysis.

We show that abstract interpretation-based static program analysis can be made ecient and precise enough to formally verify a class of properties for a family of large programs with few or no false alarms. This is achieved by renement of a general purpose static analyzer and later adaptation to particular programs of the family by the end-user through parametrization. This is applied to the proof of soundness of data manipulation operations at the machine level for periodic synchronous safety critical embedded software. The main novelties are the design principle of static an-alyzers by renement and adaptation through parametriza-tion (Sect. 3 and 7), the symbolic manipulation of expres-sions to improve the precision of abstract transfer functions (Sect. 6.3), the octagon (Sect. 6.2.2), ellipsoid (Sect. 6.2.3), and decision tree (Sect. 6.2.4) abstract domains, all with sound handling of rounding errors in oating point compu-tations, widening strategies (with thresholds: Sect. 7.1.2, delayed: Sect. 7.1.3) and the automatic determination of the parameters (parametrized packing: Sect. 7.2)