{'fraction_non_alphanumeric': 0.015424164524421594, 'fraction_numerical': 0.0, 'mean_word_length': 5.303643724696356, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Formalization and Verification of AUTOSAR OS Standard's Memory Protection

AUTOSAR OS is a standard for automotive operating systems, which provides a specification that consists of functionalities such as scheduling services, timing services, and memory protection. In this paper, we focus on memory protection features among them. As the AUTOSAR OS specification is described in natural language, its ambiguity may confuse developers as well as cause the contradiction of the specification, then eventually lead to serious problems of automotive systems such as bugs and errors. These problems in automotive systems relate directly to the safety of human being. Thus, it is very important to ensure the unambiguity and consistency of the specification. Our solution for the problems is formalizing the AUTOSAR OS specification using Event-B specification language which allows us to formally specify the functionalities of AUTOSAR OS and reduce the ambiguity of natural language. We developed a formal specification of the memory protection of AUTOSAR OS and verified its consistency. In this verification, we found the inconsistency of the specification during discharging proof obligations generated by RODIN which is a tool for Event-B. This inconsistency comes from the ambiguity of the original specification, and finding it by reviewing based on natural language description is very hard. In this paper, we explain how we found the inconsistency existed in the AUTOSAR OS standard after showing our approach to formalize and verify it with Event-B.