 enforcement. In: [*Proceedings of 34th IEEE Symposium on Security and Privacy*]{}, 2013, 415-429.

Ramirez A, Schmaltz J, Verbeek F, Langenstein B, and Blasum H. On two models of noninterference: Rushby and greve, wilding, and vanfleet. In: [*Proceedings of Computer Safety, Reliability, and Security*]{}, 2014, 246–261.

Craig I. . Springer, 2006.

Craig I. . Springer, 2007.

Abrial JR, Schuman S, and Meyer B. Specification language. In: [*On the Construction of Programs*]{}, Cambridge University Press, 1980, 343–410.

Velykis A and Freitas L. Formal modelling of separation kernel components. In: [*Proceedings of the 7th International colloquium conference on Theoretical aspects of computing*]{}, 2010, 230–244.

Velykis A. Formal modelling of separation kernels. Master’s thesis, Department of Computer Science, University of York, 2009.

Jones C, O’Hearn P, and Woodcock J. Verified software: A grand challenge. , 2006, 39(4):93–95.

Woodcock J and Davies J. . Prentice-Hall, 1996.

Abrial JR. . Cambridge University, 1996.

André P. Assessing the formal development of a secure partitioning kernel with the b method. In: [*Proceedings of ESA Workshop on Avionics Data, Control and Software Systems*]{}, 2009.

Leuschel M and Butler M. Prob: A model checker for b. In: [*Proceedings of International Symposium of Formal Methods Europe*]{}, 2003, 855–874.

Kawamorita K, Kasahara R, Mochizuki Y, and Noguchi K. Application of formal methods for designing a separation kernel for embedded systems. , 2010, 506–514.

Zhao Y, Yang Z, Sanan D, and Liu Y. Event-based formalization of safety-critical operating system standards: An experience report on arinc 653 using event-b. In: [*Proceedings of IEEE 26th International Symposium on Software Reliability Engineering*]{}, 2015, 281–292.

Abrial JR and Hallerstede S. Refinement, decomposition, and instantiation of discrete models: Application to event-b. , 2007, 77(1-2):1–28.

Verbeek F, Tverdyshev S, Havle O, Blasum H, Langenstein B, et al. Formal specification of a