2026-04-05·10 min read·sota.io team

Deploy Java PathFinder to Europe — Klaus Havelund 🇩🇰 (Aalborg / DLR Oberpfaffenhofen 🇩🇪), the NASA JVM Model Checker, on EU Infrastructure in 2026

In 1997, the Pathfinder spacecraft landed on Mars. Two years later, a different kind of pathfinder — one designed not to explore Martian terrain but to explore the state space of Java programs — emerged from a collaboration between a Danish researcher at NASA Ames and his colleagues at the German Aerospace Center (DLR) in Oberpfaffenhofen. Java PathFinder (JPF) became one of the most influential model checkers ever built: the first tool to treat the Java Virtual Machine itself as a model checking engine, and the first formal verification tool proven in actual spaceflight software.

JPF does something conceptually elegant and practically powerful: it executes Java bytecode not on a standard JVM, but on a custom JVM that systematically explores all possible execution paths of a program, backtracks when it reaches a state it has seen before, detects errors such as deadlocks, race conditions, assertion violations, and uncaught exceptions, and produces counterexample traces that reproduce the exact sequence of thread interleavings that caused the fault. For concurrent Java programs — inherently non-deterministic — this is a capability no testing framework can match.

Klaus Havelund and the European Foundation of JPF

The intellectual foundation of Java PathFinder is European. Its primary creator, Klaus Havelund 🇩🇰, is Danish — educated at the Technical University of Denmark (DTU) 🇩🇰 and completing research at Aalborg University 🇩🇰, one of Europe's leading institutions for computer science and formal methods. Before joining NASA Ames Research Center, Havelund worked as a research scientist at DLR — Deutsches Zentrum für Luft- und Raumfahrt (German Aerospace Center), Oberpfaffenhofen 🇩🇪.

DLR Oberpfaffenhofen, near Munich in Bavaria, is Germany's — and one of Europe's — primary aerospace research institutions. It is the centre of German space robotics, mission operations, and aerospace software research, operating under German federal law with no US institutional dependency. Havelund's work at DLR on formal methods for spacecraft software directly shaped the ideas that became JPF.

The paper that introduced JPF to the research community — "Model Checking Programs Using Java PathFinder" by Havelund and Pressburger, presented at the SPIN Workshop (TACAS/ETAPS 1999, Amsterdam 🇳🇱) and the International Journal on Software Tools for Technology Transfer (STTT) in 2000 — described how a standard Java interpreter could be augmented with state storage, backtracking, and systematic thread scheduling to become a model checker. The SPIN workshop itself is Europe's premier venue for explicit-state verification: founded by Gerard Holzmann 🇳🇱 (Bell Labs/NASA JPL), it has been hosted primarily at European venues for its entire history.

Peter Mehlitz 🇩🇪 is another key figure with direct DLR connections. German by background, Mehlitz worked at DLR before joining NASA Ames, where he became one of JPF's core architects, designing major components of the listener framework, the class file inspection infrastructure, and JPF's extensibility architecture. The DLR→NASA Ames pipeline — Havelund and Mehlitz both moving from German aerospace research to JPF development — is not coincidence. DLR and NASA have maintained formal research cooperation agreements for decades; JPF is a product of that transatlantic research bridge with European intellectual leadership.

Cyrille Artho 🇨🇭 is a Swiss computer scientist who was a researcher at VERIMAG (Grenoble 🇫🇷) — the same INRIA/CNRS joint laboratory where Joseph Sifakis (2007 ACM Turing Award, model checking co-inventor) worked — before moving to KTH Royal Institute of Technology 🇸🇪 (Stockholm). Artho contributed major components to JPF's concurrency analysis, co-developing jRATS (Java Race And Thread Safety) and contributing to JPF's partial order reduction implementation. His work spans the European formal methods axis: VERIMAG FR → KTH SE.

Corina Pasareanu 🇷🇴 (Romanian, NASA Ames) developed Symbolic PathFinder (SPF) — an extension of JPF that combines model checking with symbolic execution, replacing concrete values with symbolic variables and using constraint solvers to reason about all possible inputs. SPF is used for test generation, worst-case input discovery, and software security analysis. Pasareanu later joined Carnegie Mellon University Silicon Valley while maintaining her NASA Ames affiliation.

Willem Visser 🇿🇦 (South African, NASA Ames, later Stellenbosch University 🇿🇦) was a central JPF developer who shaped the tool's verification model and its application to NASA flight software. Together, Havelund, Mehlitz, Artho, Pasareanu, and Visser built JPF into the comprehensive model checking platform it became.

How Java PathFinder Works

The JVM as a Model Checker

Standard Java Virtual Machines execute bytecode sequentially, maintaining a runtime state — heap (all objects), thread stacks (local variables, program counters), and the current scheduling — without any mechanism to backtrack or explore alternative executions. Java PathFinder replaces this execution model with a model checking JVM (MJava).

The key insight: a running Java program's complete state can be captured as a snapshot — the contents of all heap objects, all thread stack frames, and all program counters. JPF intercepts every bytecode instruction, monitors all memory accesses and synchronisation operations, and at each scheduling choice point (where multiple threads could legitimately proceed), systematically explores all possible thread interleavings by saving the current state, executing one choice, possibly backtracking, and trying the next choice. This is depth-first state space exploration with state storage to detect already-visited states (avoiding infinite loops in state space traversal).

State Storage and Backtracking

JPF's state storage is the technical heart of the system. To backtrack from state s2 (reached by executing thread T1 from state s1) to s1 and then try thread T2, JPF must restore the complete JVM state to what it was at s1. This requires serialising every heap object, thread stack frame, and program counter into a compact representation.

JPF uses serialisation-based state matching: each state is hashed into a compact numeric representation using a hash function over the JVM state. Before executing a new transition, JPF computes the hash of the current state and checks whether this hash appears in its visited state table. If yes, the state has been seen — JPF backtracks. If no, JPF records the state and continues exploration. For detected errors, JPF records the path that led to the error as an execution trace, enabling exact reproduction outside JPF.

The state space is bounded by the number of distinct JVM states reachable from the initial state — which can be exponential in the number of threads and shared memory accesses, but is finitely bounded for programs without unbounded recursive data structures or unbounded loops. For programs with bounded loops and finite data domains, JPF provides complete exploration — a verified absence certificate, not just a test.

Scheduling Choice Points

The primary source of non-determinism in concurrent Java programs is thread scheduling. The standard JVM can schedule threads in any order at any point where a thread releases or requests synchronisation (a synchronized block entry, Object.wait(), Thread.sleep(), Lock.lock(), etc.) or performs a shared memory access. JPF intercepts these points and treats them as non-deterministic choice points where the state space branches.

At each choice point with k runnable threads, JPF branches into k execution paths — one for each thread that could be scheduled next. It executes each branch to completion or to the next choice point, recursively exploring the full tree of all possible thread interleavings. For n synchronisation points with k threads each, the state space has up to kⁿ paths — infeasible to test exhaustively, but manageable via state-space reduction techniques.

Partial Order Reduction (POR)

JPF implements partial order reduction — an optimisation that prunes state space without losing verification completeness. The key observation: if two transitions (by different threads) access independent memory locations (no shared read/write conflict), their relative ordering cannot affect the observable behaviour or error detection. POR identifies such independent transition pairs and explores only one representative ordering, reducing the effective branching factor substantially.

Combined with on-the-fly LTL model checking (monitoring LTL properties as JPF explores, terminating as soon as a violation is found), POR makes JPF tractable for programs that would otherwise be too large for exhaustive exploration.

Error Detection: What JPF Finds

JPF detects the following error classes natively, without any user-provided specifications:

Deadlocks: a cycle of threads waiting on each other's monitors — thread T1 holds lock L1 and waits for L2; thread T2 holds L2 and waits for L1. JPF detects all deadlocks reachable under any thread scheduling.

Race conditions: concurrent accesses to a shared field where at least one access is a write, with no synchronisation ordering them. JPF detects data races by monitoring every field read/write and checking whether concurrent threads hold any common lock that orders the accesses.

Assertion violations: assert condition statements in Java code are monitored. Any reachable execution path that violates an assertion produces a counterexample trace.

Uncaught exceptions: NullPointerException, ArrayIndexOutOfBoundsException, ClassCastException, and any other uncaught Java exception reachable under any thread scheduling.

Non-termination / infinite loops: JPF's state storage detects when execution revisits a state, reporting cycles (potential livelocks or infinite loops).

With user-defined listeners (JPF's extension API), arbitrary properties can be checked: heap usage bounds, call sequence constraints (e.g., "method A is always called before method B"), custom invariants over object state, performance-related assertions.

Symbolic PathFinder (SPF): Beyond Concrete State

Symbolic PathFinder extends JPF's exploration from concrete values to symbolic values. Instead of executing a Java program with specific integer inputs (e.g., x = 42), SPF replaces program inputs with symbolic variables (e.g., x = X_sym) and propagates symbolic expressions through the program, using an SMT solver (Z3, or Coral for non-linear arithmetic) to determine whether branch conditions can be satisfied.

The result is path-sensitive analysis over all possible inputs: SPF generates test inputs that cover each feasible execution path, finds inputs that trigger runtime exceptions, identifies infeasible paths (branches that can never be reached for any input), and computes worst-case input values for resource consumption. SPF is particularly powerful for security analysis: it can find inputs that bypass authentication checks, trigger integer overflows, or reach use-after-free conditions.

JPF in NASA Spaceflight

JPF's origins are not academic exercises — it was built to verify real spacecraft software and has been used in multiple NASA missions.

Deep Space 1 (DS1), 1999: The Remote Agent Experiment (RAE) was an autonomous planning and execution system — one of the first autonomous spacecraft systems deployed in actual spaceflight. JPF was used to verify RAE's concurrent Java implementation for deadlocks and assertion violations before launch. A deadlock in spaceflight software could result in loss of mission.

Mars Exploration Rovers (MER): JPF was used to verify the flight software for Spirit and Opportunity, which operated on Mars from 2004 through 2018.

Mars Science Laboratory (MSL) / Curiosity: JPF's evolution continued through MSL-era software verification, alongside SPIN (Gerard Holzmann 🇳🇱, Bell Labs/NASA JPL).

The NASA JPL Software Reliability group, where Havelund worked, established JPF as a standard tool in NASA's software verification portfolio — alongside the Property Specification Language (PSL) and Java Mission Executive (JMX) runtime monitoring framework that Havelund developed.

The JPF Ecosystem: Extensions and Integrations

JPF's listener API has made it a platform for an entire ecosystem of verification extensions:

jpf-aprop: property specifications using annotations — @NonNull, @Positive, @Ordered — verified during JPF's state space exploration.

jpf-bfs: bounded-exhaustive test generation from JPF's exploration.

jpf-concolic: concolic execution combining concrete JPF execution with SPF symbolic reasoning.

jpf-jdart: JPF-based dynamic analysis and test generation using constraint solving (developed at TU Darmstadt 🇩🇪 and Siemens 🇩🇪 — a direct German EU industry connection).

jpf-awt: GUI model checking for Java Swing applications.

jpf-android: Android application verification extending JPF's JVM to the Android runtime model.

The JPF workshop series (collocated with ISSTA, ASE, and ICSE) has been active for over two decades, with regular contributions from European institutions: TU Darmstadt 🇩🇪, KIT 🇩🇪, TU Delft 🇳🇱, KTH 🇸🇪, University of Bordeaux 🇫🇷, INRIA 🇫🇷.

Regulatory Compliance and EU Standards

EU AI Act Art. 9 (Risk Management for High-Risk AI): Java programs implementing AI inference, decision engines, or ML model serving in high-risk EU AI Act categories require systematic risk assessment and testing under Art. 9. JPF's exhaustive concurrency verification — finding all reachable deadlocks and race conditions — constitutes machine-checked evidence that the concurrent Java AI runtime is free of scheduling-dependent failure modes.

ISO 26262 ASIL D (Automotive Functional Safety): Java is used in AUTOSAR Adaptive Platform (AP) — the next-generation automotive software architecture for autonomous driving, where service-oriented middleware is implemented in C++/Java. AUTOSAR AP processes communicate over SOME/IP and execute in concurrent Java/C++ containers. JPF verification of the Java service layer provides ASIL D software safety evidence under ISO 26262 Part 6 (software unit verification).

IEC 61508 SIL 3/4 (Industrial Functional Safety): IEC 61508-3 Annex B lists formal methods as a Highly Recommended technique for SIL 3/4 software. JPF's exhaustive exploration of all reachable states satisfies the IEC 61508-3 formal verification requirement when applied to the Java software module under analysis.

IEC 62304 (Medical Device Software): Medical device software in Class C (contributing to serious injury) requires rigorous verification under IEC 62304 §5.5.3 (software unit verification). JPF's deadlock and race condition detection for concurrent medical device Java software (e.g., infusion pump control, patient monitoring systems) provides IEC 62304 Class C verification evidence.

EN 50128 SIL 4 (Railway Software): European railway safety standard EN 50128 requires formal verification for SIL 4 software. Java is used in ETCS/ERTMS onboard and wayside systems (e.g., by Thales 🇫🇷, Alstom 🇫🇷, Siemens 🇩🇪). JPF verification of ETCS Java components provides EN 50128 SIL 4 formal methods evidence.

DO-178C / ED-12C Level A (Avionics): Airbus and other EU aerospace manufacturers use Java in ground support equipment and increasingly in avionics onboard systems. DO-178C Level A requires complete decision coverage and structural coverage. JPF's exhaustive exploration provides state-space coverage of all reachable thread interleavings — a stronger coverage criterion than line or branch coverage.

EU CRA 2027 (Cyber Resilience Act): CRA Article 13 requires that products with digital elements are placed on the EU market with free from known exploitable vulnerabilities. JPF's race condition detection eliminates an entire class of CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) vulnerabilities from Java products sold in the EU.

GDPR Art. 25 (Privacy by Design): Concurrent Java systems processing personal data must prevent race conditions that could expose or corrupt personal data records. JPF verification that all access paths to personal data fields are properly synchronised constitutes GDPR Art. 25 technical evidence of privacy by design.

Why EU Infrastructure for Java PathFinder Verification

Java PathFinder verification workloads are both computationally intensive and intellectually sensitive. A verification run against a Java program explores that program's complete concurrent behaviour: it is functionally equivalent to a comprehensive security and correctness audit. For EU organisations, running JPF on EU infrastructure is not merely a preference — it is a compliance requirement:

GDPR Art. 46: Transfer of Java source code or bytecode to a third-country processor (e.g., a US cloud verification service) requires an adequacy decision or appropriate safeguards. The Schrems II ruling (CJEU 2020) invalidated the Privacy Shield; only Standard Contractual Clauses with transfer impact assessments provide a legal basis, and only where the receiving country does not engage in mass surveillance incompatible with EU fundamental rights. The US Cloud Act (2018) creates exactly this incompatibility for cloud-resident code.

NIS2 Art. 21: Critical infrastructure operators and essential service providers in the EU must apply cybersecurity risk management measures including supply chain security. Running verification tools on EU-sovereign infrastructure eliminates third-country access to verification artefacts — which include complete information about software structure, concurrency model, and identified vulnerabilities.

EU AI Act Art. 9 supply chain: For high-risk AI systems where JPF verification is part of the conformity assessment, verification must be performed on EU-controlled infrastructure to ensure audit trails remain under EU jurisdiction.

sota.io provides EU-sovereign PaaS — German infrastructure, GDPR-compliant by default, zero configuration for PostgreSQL, managed TLS, and automated deployments. Run JPF verification pipelines, store verification results and counterexample traces, and host SPF-based security analysis workflows on infrastructure that never leaves EU jurisdiction.

# Deploy JPF verification pipeline to sota.io
sota deploy --name jpf-verifier --region eu-central

# Dockerfile for JPF + SPF
FROM eclipse-temurin:17-jdk
RUN apt-get update && apt-get install -y maven git
RUN git clone https://github.com/javapathfinder/jpf-core /jpf-core
WORKDIR /jpf-core
RUN ./gradlew buildJars

# Run JPF on Java target
CMD ["java", "-jar", "build/RunJPF.jar", "config.jpf"]

JPF verification on German infrastructure. EU AI Act, ISO 26262, IEC 61508, EN 50128, CRA 2027 compliance. sota.io free tier — no credit card.