![](bga.png)
semantics for LTL formulas in order to avoid cycle detection. We share with them the
idea of using of the model checker to process the stream of states produced by Java.
However, our use of Spin allows us to check infinite execution traces.
JPF [10] is a complete model checker for Java programs that performs a complete
coverage of a program. In contrast, TJT analyzes each trace in isolation without check-
ing if several traces share already visited states. However due to the implementation
approach, we still can take some advantages of reusing the well known model checker
Spin instead of building a new one from scratch. Some realistic Java examples of
reactive software are not well suited to be verified by JPF. For instance, we tried ana-
lyzing our elevator problem with JPF, but it ran out of memory after 58 minutes. The
verification of LTL with JPF-LTL in JPF is still under development and has a limited
visibility of the program elements to write the formula. According to the information
in the JPF-LTL web site, the tool only considers entry to methods in the propositions,
and it requires the user to explicitly declare whether the formula should be evaluated
for infinite or finite traces. TJT allows a richer set of propositions to be used in the
formulas and, due to the stuttering semantics used by Spin, the user does not need to
declare whether the trace is finite.
Full-state on-the-fly explicit model checking, as implemented in Spin, requires two
main data structures to manage global states. The stack is used to store states to support
the whole state space exploration using with backtracking, and to find cycles. The hash
table is used to store all unique states produced when executing instructions in order to
prevent wasting computational resources when exploring the state space. The standard
distribution of Spin and recent extensions implement many optimizations for these data
structures. Our tool TJT inherits these optimizations in the context of Java programs,
but we still do not take advantages of the hash table. As our hash projection method
produces an almost univocal abstraction, in further works we plan to employ this re-
duced representation of the Java states in Spin’s hash table in order to avoid revisiting
previously explored states. So, TJT could be considered as a first step towards the whole
verification of Java with Spin avoiding the transformation of Java into Promela neces-
sary in tools like Bandera. It is worth noting that our method to produce the stream of
states from the real Java execution can be also employed for other programming lan-
guages, so the same approach could be useful to extend Spin in order to verify other
programming languages apart from the current support for C programs.
6 Conclusions and Future Work
We have presented TJT, a tool for checking temporal logic properties on Java programs.
This tool is useful to test functional properties expressed as LTL on both sequential and
concurrent programs with finite and infinite execution traces. The formalization of the
abstraction approach guarantees the preservation of the results, and the experimental re-
sults confirm the applicability to realistic software. Our tool chain includes well known
software packages, like the model checker Spin, the JDI API and the well known de-
velopment environment Eclipse.
Future work will focus on two directions. The first one is to increase the amount of
information stored in the Spin’s hash table of visited states and the control of scheduling
46