Safety-Critical Java SCJ introduces a new programming paradigm for applications that must be certified. The SCJ specificationi¾?JSR 302 is an Open Group Standard, but it does not include verification techniques. Previous work has addressed verification for SCJ Leveli¾?1 programs. We support the much more complex SCJ Leveli¾?2 programs, which allows the programming of highly concurrent multi-processor applications with Java threads, and wait and notify mechanisms. We present a formal model of SCJ Leveli¾?2 that captures the state and behaviour of both SCJ programs and the SCJ API. This is the first formal semantics of the SCJ Leveli¾?2 paradigm and is an essential ingredient in the development of refinement-based reasoning techniques for SCJ Leveli¾?2 programs. We show how our models can be used to prove properties of the SCJ API and applications.
Older versions of the SCJ specification define annotations for specifying compliance level, behavioural, or memory restrictions. Previous approaches to ensuring the safety of SCJ programs have used these annotations to provide run-time checks @cite_18 or to specify checkable program constraints @cite_15 . However, the memory annotations have been moved to an appendix of the standard as they were judged not ready for standardisation.
@cite_18 @cite_15
1988156923 2145899516
The Safety Critical Java Specification intends to support the development of programs that must be certified. The specification includes a number of annotations used to constrain the behavior of programs written against it. This paper describes and motivates the design of these annotations and the rules used to check statically that programs respect their intended semantics. We report on a prototype implementation with the Java Checker Framework and initial experiments annotating a 24KLoc application. Safety-Critical Java (SCJ) is a dialect of Java that allows programmers to implement safety-critical systems, such as software to control airplanes, medical devices, and nuclear power plants. SafeJML extends the Java Modeling Language (JML) to allow specification and checking of both functional and timing constraints for SCJ programs. When our design of the SafeJML is implemented, it will help check the correctness of detailed designs, including timing for real-time systems written in SCJ.