Many real-time systems are safety-and security-critical systems and, as a result, tools and techniques for verifying them are extremely important. Simulation and testing such systems can be exceedingly timeconsuming and these techniques provide only probabilistic measures of correctness. There are a number of model-checking tools for real-time systems. Although they provide formal verification for models, we still need to implement these models. To increase the confidence in real-time programs written in real-time Java, this paper proposes a model-based approach to the development of such programs. First, models can be mechanically verified, to check whether they satisfy particular properties, by using current real-time model-checking tools. Then, programs can be derived from the model by following a systematic approach. We introduce a timed automata to RTSJ Tool (TART), a prototype tool to automatically generate real-time Java code from the model. Finally, we show the applicability of our approach by means of four examples: a gear controller, an audio/video protocol, a producer/consumer and the Fischer protocol. N. HAKIMI POUR, P. STROOPER AND A. WELLINGS semantics. The RTSJ provides a type-safe object-oriented programming language, like standard Java. However, it refines some of the semantics for existing Java classes in order to provide more predictable execution times.A real-time model is a simplified representation of a real-time system. Models focus on system behaviour and abstract many details of programs [14]. More importantly, these models can be verified mechanically with real-time model checkers. The contributions of this paper are: introducing a model-based approach to increase the confidence in the correctness of real-time programs written in RTSJ and presenting tool support for this approach. Timed automata [15] are used as the modelling language, since timed automata have well-defined mathematical properties and a simple graphical representation. Moreover, timed automata can capture both qualitative and quantitative features of real-time systems [16]. The next step is to mechanically verify the model using the UPPAAL model checker [6]. UPPAAL has a graphical user interface; it is well-used and wellsupported. After verifying the model, a mapping between the model features and RTSJ is used to derive the RTSJ code from the model. The mapping guarantees that certain properties, such as safety and bounded liveness properties, that hold in the model also hold in the generated code, although timing invariants in the model need to be checked separately. We also introduce our prototype tool to generate RTSJ programs from UPPAAL models.The next section reviews theories and languages that have been proposed for modelling realtime systems and the related work on real-time model checking. An overview of our approach is provided in Section 3. The details of the mapping are presented in Section 4. We introduce the timed automata to RTSJ Tool (TART) in Section 5. Section 6 presents the application of the approach ...
