Java Goes TLA+

This paper introduces the Inverse Implementation method, that augments classical software development processes by a step of formal conformity verification. Our method is based on a formal model of the machine that executes programs of the chosen programming language. The model can automatically be combined with the code of a concrete program to gain a model of the execution of that program. The execution model is expressed in the same language that the program is specified in. This reduces the task of verifying the conformity of the program to finding and proving a refinement relation between two models within the same formalism. We introduce the Inverse Implementation method, show how it fits into classic software engineering processes and discuss how the choice of a suitable formalism can allow to combine manual and automated proof techniques. We further show a prototypical formalization of the Java Virtual Machine in TLA⁺ and demonstrate how it can be used within an Inverse Implementation workflow to verify the adherence of a simple - yet multithreaded - Java program to a TLA⁺ specification.