We propose an automatic parallelization method for applications featuring fine-grain internal parallelism. Our method adds the needed overheads to the WCET values, ensuring safety by construction without the need for subsequent schedulability analysis. It is aimed at applications with fine-grain parallelism where excessive per-task overheads would result in poor parallelization gains. To keep overheads under control, we make strong hypotheses on the target execution platform, on the form of generated code, and on the integration of the various tools of the back-end. These hypotheses allow our tool-flow to perform a full-fledged timing and schedulability analysis incrementally during allocation and scheduling. Allocation and scheduling are performed jointly, using scalable compilation-like heuristics. The resulting schedule and code are correct by construction. By covering all aspects of resource allocation and code generation, our work belongs to the compilation realm. What fundamentally differentiates it from previous compilation work is the choice of performing a safe, worst-case timing analysis incrementally during compilation around which are integrated parallelization, real-time scheduling, and memory allocation. This method is suitable for very large-scale applications, as it uses low-complexity mapping heuristics, which guarantees scalability. We also propose a language, named InteLus, for the description of parallel multi-threaded implementations of dataflow specifications. It is a sub-set of Lustre extended with annotations representing mapping and code generation choices. While such extensions are common in literature, our language and modeling approach go further in one fundamental way: implementation models specified in InteLus are strictly richer than the multi-threaded C code we want to generate. InteLus allows the representation of all mapping decisions needed for multi-threaded code generation in our context. InteLus' representation of threads and thread synchronization is a sub-case of the C11/pthread concurrency model. Therefore, C code can be obtained by selectively putting elements of the InteLus program into C and linker script syntax without making any further mapping decision. Annotations are covered by the operational semantics of InteLus. This allows us to formally define the correctness of implementation models. To facilitate the definition of the correctness properties, implementation models are endowed with not one, but two semantics: the synchronous semantics of Lustre (which simply discards mapping annotations) and the machine semantics, which interprets the program and its annotations as a multi-threaded imperative program. This dual semantic nature of our implementation models enables us to envision an original approach to proving implementation correctness.