Refinement-Based Specification and Analysis of Multi-Core ARINC 653 Using Event-B

ARINC 653 as the de facto standard of partitioning operating systems has been applied in many safety-critical domains. The multi-core version of ARINC 653, ARINC 653 Part1-4 (Version 4), provides support for services to be utilized with a module that contains multiple processor cores. Formal specification and analysis of this standard document could provide a rigorous specification and uncover concealed errors in the textual description of service requirements. This paper proposes a specification method for concurrency on a multi-core platform using Event-B and a refinement structure for the complicated ARINC 653 Part1-4, provides a comprehensive, stepwise refinement-based Event-B specification with seven refinement layers, and then performs formal proof and analysis in RODIN. We verify that the errors discovered in the single-core version standard (ARINC 653 Part1-3) also exist in the ARINC 653 Part1-4 during the formal specification and analysis.