Model Checking Real-time Java

The main challenges in model checking real-time Java programs are scalability and compliance with the Real-time Specification for Java (RTSJ) semantics. A model checker for RTSJ programs has to support the notion of thread periods and priority-preemptive scheduling as well as understand the region-based memory model introduced by the specification. We present the RJ model checker for multi-threaded RTSJ programs, which is based on Java PathFinder. RJ explores execution paths that correspond to priority-preemptive schedules and involve valid sequences of thread releases with respect to their periods and priorities. The other novel features of our work are an abstraction of time based on thread periods, and a model of RTSJ memory regions and API. We evaluated our approach on real-time benchmark that models an aircraft collision detection algorithm implemented in real-time Java. Thanks to our precise account of RTSJ semantics, RJ was able to verify the application and reported no spurious errors.