## An Executable Formal Java Virtual Machine Thread Model (2001)

### Cached

### Download Links

Citations: | 7 - 1 self |

### BibTeX

@MISC{Moore01anexecutable,

author = {J Strother Moore and George M. Porter},

title = {An Executable Formal Java Virtual Machine Thread Model },

year = {2001}

}

### OpenURL

### Abstract

We discuss an axiomatic description of a simple abstract machine similar to the Java Virtual Machine (JVM). Our model supports classes, with fields and bytecoded methods, and a representative sampling of JVM bytecodes for basic operations for both data and control. The GETFIELD and PUTFIELD instructions accurately model inheritance, as does the INVOKE-VIRTUAL instruction. Our model supports multiple threads, synchronized methods, and monitors. Our current model is inadequate or inaccurate

### Citations

1615 | The Java Language Specification - Team, Gosling, et al. - 1996 |

530 |
A computational logic
- Boyer, Moore
- 1979
(Show Context)
Citation Context ...rder mathematical logic, and a mechanical theorem prover. ACL2 was written by Matt Kaufmann and J Strother Moore (an author of this paper) and is the successor of the Boyer-Moore theorem prover Nqthm =-=[3, 5]-=-. As a programming language, ACL2 is a version of Common Lisp. It provides the familiar Lisp data objects, including numbers, strings, symbols and lists, along with if-then-else and function applicati... |

262 |
Computer-Aided Reasoning: An Approach
- Kaufmann, Manolios, et al.
- 2000
(Show Context)
Citation Context ... from the ROM of that microprocessor were mechanically proved correct. These applications, and others, are described in [12]. All were modeled and veried using one theorem proving system, ACL2. ACL2 [=-=13] stan-=-ds for \A Computational Logic for Applicative Common Lisp." It is a functional programming language, asrst-order mathematical logic, and a mechanical theorem prover. ACL2 was written by Matt Kauf... |

145 | Yellim F.: Java Virtual Machine Specification Second Edition - Lindholm - 2004 |

89 |
The Java Language Speci
- Gosling, Joy, et al.
- 1996
(Show Context)
Citation Context ...and is an essential step toward the specication and verication of the Java bytecode verier. Both Cohen's model and ours are based largely on the Sun Microsystems documentation for Java and the JVM [14=-=, 9]-=-, informed by private conversations with experts and experience with Java and the JVM. Also of special interest is the fact that the JEM1 microprocessor, the world'ssrst silicon JVM, built by Rockwell... |

78 | Automated proofs of object code for a widely used microprocessor
- Boyer, Yu
- 1996
(Show Context)
Citation Context ...he expected results. Furthermore, Yu formally specied what these 21 programs were supposed to do and used the Boyer-Moore theorem prover to prove mechanically that the binaries met the specications [6=-=]-=-. For an introduction to the modeling and proof methods used in these projects, see [4]. We merely hint at the techniques as we brie y describe our model of the JVM. Of particular historical importanc... |

31 | Defining the Java virtual machine as platform for provably correct Java compilation
- BĂ¶rger, Schulte
- 1998
(Show Context)
Citation Context ...thers at 2 Compaq Systems Research Center on the \Extended Static Checker" for Java, which is formal, practical and mechanized. See http://research.compaq.com/SRC/esc/. The work of Borger and Sch=-=ulte [2]-=- on Java exceptions is quite formal and accurate, but not supported by mechanized proofs. Mechanically checked proofs about simple Java programs have been constructed with several theorem provers, inc... |

28 | Mechanized formal reasoning about programs and computing machines
- Boyer, Moore
- 1996
(Show Context)
Citation Context ...osed to do and used the Boyer-Moore theorem prover to prove mechanically that the binaries met the specications [6]. For an introduction to the modeling and proof methods used in these projects, see [=-=4]-=-. We merely hint at the techniques as we brie y describe our model of the JVM. Of particular historical importance to the present work is Rich Cohen's ACL2 model of a single-threaded JVM [7]. The so-c... |

20 | A Type-Theoretic Memory Model for Verification of Sequential Java Programs - Berg, Huisman, et al. - 1999 |

19 |
A computational logic handbook. Second edition
- Boyer, Moore
- 1998
(Show Context)
Citation Context ...rder mathematical logic, and a mechanical theorem prover. ACL2 was written by Matt Kaufmann and J Strother Moore (an author of this paper) and is the successor of the Boyer-Moore theorem prover Nqthm =-=[3, 5]-=-. As a programming language, ACL2 is a version of Common Lisp. It provides the familiar Lisp data objects, including numbers, strings, symbols and lists, along with if-then-else and function applicati... |

18 | A verified implementation of an applicative language with dynamic storage allocation
- Flatau
- 1992
(Show Context)
Citation Context ...such a logic have been developed over a long period of time in the Boyer-Moore community. A tour de force of the method is presented in the so-called CLI Stack (produced by Computational Logic, Inc.) =-=[1, 8, 18-=-] which is a hierarchy of veried components including a microprocessor, loader, linker, assembler, two compilers, an operating system and some applications programs, all quite simple but also actually... |

17 | Proving Theorems about Java-like Byte Code
- Moore
- 1999
(Show Context)
Citation Context ...e, the user provides an inductive argument and the machine carries out that argument, expanding denitions, applying axioms and basic theorems about the machine. For a discussion of such theorems see [=-=15]-=-. The proof that fact computes factorial takes about 30 seconds (on a 700 MHz machine). In Figure 4 we show a more interesting state, modeled after the Java Apprentice code shown in Figure 3. In this ... |

16 |
A type-theoretic memory model for veri of sequential Java programs
- Berg, Huisman, et al.
- 2000
(Show Context)
Citation Context ... but not supported by mechanized proofs. Mechanically checked proofs about simple Java programs have been constructed with several theorem provers, including HOL, Isabelle, and PVS. See, for example, =-=[17-=-]. However, we are unaware of mechanically checked proofs (other than those reported here) of Java classes that use multi-threading. Our work is distinguished primarily by being cast in a formally den... |

16 | W.D.: Special issue on system verification - Bevier, Hunt, et al. - 1989 |

13 | Transforming the theorem prover into a digital design tool: From concept car to off-road vehicle
- Hardin, Wilding, et al.
- 1998
(Show Context)
Citation Context ...experts and experience with Java and the JVM. Also of special interest is the fact that the JEM1 microprocessor, the world'ssrst silicon JVM, built by Rockwell Collins, was modeled formally with ACL2 =-=[19, 11]-=-. Some proofs were done with the model but its primary use was as a simulator. The ACL2 model executes at about 90% of the speed of a carefully-written C simulator for the same model. The issues invol... |

12 | The defensive Java virtual machine specification version 0.5 - Cohen - 1997 |

9 | Efficient simulation of formal processor models - Wilding, Greve, et al. |

8 |
The Java Virtual Machine Speci (Second Edition
- Lindholm, Yellin
- 1999
(Show Context)
Citation Context ...and is an essential step toward the specication and verication of the Java bytecode verier. Both Cohen's model and ours are based largely on the Sun Microsystems documentation for Java and the JVM [14=-=, 9]-=-, informed by private conversations with experts and experience with Java and the JVM. Also of special interest is the fact that the JEM1 microprocessor, the world'ssrst silicon JVM, built by Rockwell... |

8 | A mechanically verified application for a mechanically verified environment - Wilding - 1993 |

6 |
Practical Java Programming Language Guide
- Haggar
- 1999
(Show Context)
Citation Context ...ysis of what is happening in the heap. (For example, all threads writing to the Container respect the monitor and no thread changes the objrefseld of a running thread.) See, for example, Praxis 56 in =-=[10], whe-=-re Haggar writes \Do not reassign the object reference of a locked object." For details of our proof see [16]. 4 Conclusion This paper is asrst step at developing an executable abstract formal mo... |

5 |
The defensive Java Virtual Machine speci Version 0.53
- Cohen
- 1997
(Show Context)
Citation Context ...ects, see [4]. We merely hint at the techniques as we brie y describe our model of the JVM. Of particular historical importance to the present work is Rich Cohen's ACL2 model of a single-threaded JVM =-=[7]. The-=- so-called \defensive JVM" is an accurate and complete model of a subset of the JVM instruction set. As such, the machine is more complicated than the one discussed here, but does not support thr... |

4 |
Special issue on system veri
- Bevier, Hunt, et al.
- 1989
(Show Context)
Citation Context ...such a logic have been developed over a long period of time in the Boyer-Moore community. A tour de force of the method is presented in the so-called CLI Stack (produced by Computational Logic, Inc.) =-=[1, 8, 18-=-] which is a hierarchy of veried components including a microprocessor, loader, linker, assembler, two compilers, an operating system and some applications programs, all quite simple but also actually... |

4 |
E#cient simulation of formal processor models
- Wilding, Greve, et al.
- 2001
(Show Context)
Citation Context ...experts and experience with Java and the JVM. Also of special interest is the fact that the JEM1 microprocessor, the world'ssrst silicon JVM, built by Rockwell Collins, was modeled formally with ACL2 =-=[19, 11]-=-. Some proofs were done with the model but its primary use was as a simulator. The ACL2 model executes at about 90% of the speed of a carefully-written C simulator for the same model. The issues invol... |

3 |
A mechanically veri application for a mechanically veri environment
- Wilding
- 1993
(Show Context)
Citation Context ...such a logic have been developed over a long period of time in the Boyer-Moore community. A tour de force of the method is presented in the so-called CLI Stack (produced by Computational Logic, Inc.) =-=[1, 8, 18-=-] which is a hierarchy of veried components including a microprocessor, loader, linker, assembler, two compilers, an operating system and some applications programs, all quite simple but also actually... |

2 |
Mechanized reasoning about Java threads via a JVM thread model
- Moore, Porter
- 2000
(Show Context)
Citation Context ...no thread changes the objrefseld of a running thread.) See, for example, Praxis 56 in [10], where Haggar writes \Do not reassign the object reference of a locked object." For details of our proof=-= see [16]-=-. 4 Conclusion This paper is asrst step at developing an executable abstract formal model of threading in the JVM. We have explained how such a model can be built, we have shown that the model can be ... |

1 | Proving properties of java threads - Moore, Porter - 2000 |