Formal Development of Multi-Purpose Interactive Application (MPIA) for ARINC 661

Abstract

This paper reports our experience for developing Human-Machine Interface (HMI) complying with ARINC 661 specification standard for interactive cockpits applications using formal methods. This development relies on the FLUID modelling language, we have proposed and formally defined in the FORMEDICIS 1 project. FLUID contains essential features required for specifying HMI. To develop the MultiPurpose Interactive Applications (MPIA) use case, we follow the following steps: an abstract model of MPIA is written using the FLUID language; this MPIA FLUID model is used to produce an Event-B model for checking the functional behaviour, user interactions, safety properties, and interaction related to domain properties; the Event-B model is also used to check temporal properties and possible scenario using the ProB model checker; and finally, the MPIA FLUID model is translated to Interactive Cooperative Objects (ICO) using the PetShop CASE tool to validate the dynamic behaviour, visual properties and task analysis. These steps rely on different tools to check internal consistency along with possible HMI properties. Finally, the formal development of the MPIA case study using FLUID and its embedding into other formal techniques, demonstrates reliability, scalability and feasibility of our approach defined in the FORMEDICIS project.

F3FLUID: A formal framework for developing safety‐critical interactive systems in FLUID

“…This paper extends our work presented in Singh et al 7 In this extended paper, our main contribution is to propose a formal framework, F3FLUID, for the development of safety‐critical interactive systems. This framework integrates formal methods to ensure the correctness of interaction behaviors following a rigorous formal reasoning.…”

“…Second PO, guard strengthening (GS) (6), expresses that the refined events may strengthen the abstract guards G A with another guard G C to allow and specify more concrete conditions that may be stronger than abstract ones. In addition, the invariant preservation PO (INV) (7) shall hold in the refined machine as well. More details on POs can be found in Abrial.…”