Safety-Critical Java SCJ introduces a new programming paradigm for applications that must be certified. The SCJ specificationi¾?JSR 302 is an Open Group Standard, but it does not include verification techniques. Previous work has addressed verification for SCJ Leveli¾?1 programs. We support the much more complex SCJ Leveli¾?2 programs, which allows the programming of highly concurrent multi-processor applications with Java threads, and wait and notify mechanisms. We present a formal model of SCJ Leveli¾?2 that captures the state and behaviour of both SCJ programs and the SCJ API. This is the first formal semantics of the SCJ Leveli¾?2 paradigm and is an essential ingredient in the development of refinement-based reasoning techniques for SCJ Leveli¾?2 programs. We show how our models can be used to prove properties of the SCJ API and applications.
Safety-Critical Java (SCJ) is a restriction of the Real-Time Specification for Java to support the development and certification of safety-critical applications. The SCJ technology specification is the result of an international effort from industry and academia. In this paper, we present a formalisation of the SCJ Level 1 execution model, formalise a translation strategy from SCJ into a refinement notation, and describe a tool that largely automates the generation of the formal models. Our modelling language is part of the Circus family; at the core, we have Z, CSP, and Morgan’s calculus, but we also use object-oriented and timed constructs from the OhCircus and Circus Time variants. Our work is an essential ingredient for the development of refinement-based reasoning techniques for SCJ.