A Formal Model of the Safety-Critical Java Level 2 Paradigm
This work addresses the problem of certifying safety-critical software for developers and regulators, but it is incremental as it extends prior verification efforts from Level 1 to Level 2.
The paper tackles the lack of verification techniques for Safety-Critical Java Level 2 programs, which handle complex concurrent applications, by presenting the first formal model of this paradigm, enabling property proofs for the API and applications.
Safety-Critical Java (SCJ) introduces a new programming paradigm for applications that must be certified. The SCJ specification (JSR 302) is an Open Group Standard, but it does not include verification techniques. Previous work has addressed verification for SCJ Level~1 programs. We support the much more complex SCJ Level~2 programs, which allows the programming of highly concurrent multi-processor applications with Java threads, and wait and notify mechanisms. We present a formal model of SCJ Level~2 that captures the state and behaviour of both SCJ programs and the SCJ API. This is the first formal semantics of the SCJ Level~2 paradigm and is an essential ingredient in the development of refinement-based reasoning techniques for SCJ Level~2 programs. We show how our models can be used to prove properties of the SCJ API and applications.