JML reference manual

Abstract

this document. The specification of the method largest is given on lines 7 through 15. Line 7 says that this is a public, normal behavior specification. JML permits several di#erent specifications for a given method, which can be of di#erent privacy levels [Ruby-Leavens00]. The modifier public says that the specification is intended for the use of clients. (If the privacy modifier had been protected, for example, then the specification would have been intended for subclasses.) The keyword normal_behavior tells JML several things. First, it says that the specification is a heavyweight method specification, as opposed to a lightweight method specification like that given on line 17. A heavyweight specification uses one of JML's behavior keywords, Another way to declare a specification-only field is to use the ghost modifier ([[[Add pxref]]])

Full text

JML Reference Manual
DRAFT, $Revision: 1.235 $
$Date: 2008/07/17 20:40:09 $
Gary T. Leavens, Erik Poll, Curtis Clifton, Yoonsik Cheon,
Clyde Ruby, David Cok, Peter M¨uller, Joseph Kiniry,
Patrice Chalin, Daniel M. Zimmerman, Werner Dietl

Copyright c
2002-2008 by the authors
Permission is granted for you to make copies of this manual for educational and scholarly
purposes, and for commercial use in specifying software, but the copies may not be sold or
otherwise used for direct commercial advantage; this permission is granted provided that
this copyright and permission notice is preserved on all copies. All other rights reserved.
Version Information:
@(#) $Id: jmlrefman.texinfo,v 1.235 2008/07/17 20:40:09 wdietl Exp $

i
Table of Contents
1 Introduction..................................... 1
1.1 Behavioral Interface Specifications.............................. 1
1.2 A First Example ............................................... 2
1.3 What is JML Good For? ....................................... 6
1.4 Status and Plans for JML ...................................... 7
1.5 Historical Precedents ........................................... 8
1.6 Acknowledgments .............................................. 9
2 Fundamental Concepts ........................ 11
2.1 Types can be Classes and Interfaces ........................... 11
2.2 Model and Ghost ............................................. 11
2.3 Lightweight and Heavyweight Specifications ................... 12
2.4 Privacy Modifiers and Visibility ............................... 12
2.5 Instance vs. Static ............................................ 14
2.6 Locations and Aliasing ........................................ 15
2.7 Expression Evaluation and Undefinedness ..................... 15
2.8 Null is Not the Default ........................................ 16
2.9 Language Levels .............................................. 16
2.9.1 Level 0 Features .......................................... 18
2.9.2 Level 1 Features .......................................... 20
2.9.3 Level 2 Features .......................................... 22
2.9.4 Level 3 Features .......................................... 23
2.9.5 Level C Features ......................................... 23
2.9.6 Level X Features ......................................... 24
3 Syntax Notation ............................... 25
4 Lexical Conventions ........................... 26
4.1 White Space .................................................. 26
4.2 Lexical Pragmas .............................................. 26
4.3 Comments .................................................... 27
4.4 Annotation Markers........................................... 27
4.5 Documentation Comments .................................... 28
4.6 Tokens ........................................................ 29
5 Compilation Units............................. 35
5.1 Package Definitions ........................................... 36
5.2 Import Definitions ............................................ 36

ii
6 Type Definitions ............................... 37
6.1 Class and Interface Definitions ................................ 37
6.1.1 Subtyping for Type Definitions ........................... 37
6.1.2 Modifiers for Type Definitions ............................ 38
6.1.2.1 Pure Type Definitions ............................... 39
6.1.2.2 Model Type Definitions .............................. 39
6.2 Modifiers ..................................................... 39
6.2.1 Suggested Modifier Ordering ............................. 40
6.2.2 Spec Public .............................................. 41
6.2.3 Spec Protected ........................................... 41
6.2.4 Pure ..................................................... 41
6.2.5 Model .................................................... 41
6.2.6 Ghost .................................................... 41
6.2.7 Instance.................................................. 42
6.2.8 Helper ................................................... 42
6.2.9 Monitored................................................ 42
6.2.10 Uninitialized ............................................ 42
6.2.11 Math Modifiers ......................................... 42
6.2.12 Nullity Modifiers ........................................ 43
7 Class and Interface Member Declarations . . . 44
7.1 Java Member Declarations .................................... 44
7.1.1 Method and Constructor Declarations .................... 44
7.1.1.1 Formal Parameters .................................. 45
7.1.1.2 Model Methods and Constructors .................... 45
7.1.1.3 Pure Methods and Constructors ..................... 45
7.1.1.4 Helper Methods and Constructors ................... 48
7.1.2 Field and Variable Declarations .......................... 48
7.1.2.1 JML Modifiers for Fields ............................ 48
7.1.2.2 Type-Specs .......................................... 49
7.2 Class Initializer Declarations .................................. 49
8 Type Specifications ............................ 51
8.1 Introductory ADT Specification Examples ..................... 51
8.2 Invariants ..................................................... 51
8.2.1 Static vs. instance invariants ............................. 55
8.2.2 Invariants and Exceptions ................................ 55
8.2.3 Access Modifiers for Invariants ........................... 56
8.2.4 Invariants and Inheritance................................ 56
8.3 Constraints ................................................... 56
8.3.1 Static vs. instance constraints ............................ 58
8.3.2 Access Modifiers for Constraints .......................... 59
8.3.3 Constraints and Inheritance .............................. 59
8.4 Represents Clauses ............................................ 59
8.5 Initially Clauses............................................... 60
8.6 Axioms ....................................................... 60
8.7 Readable If Clauses ........................................... 60

iii
8.8 Writable If Clauses............................................ 60
8.9 Monitors For Clause .......................................... 61
9 Method Specifications......................... 62
9.1 Basic Concepts in Method Specification ....................... 62
9.2 Organization of Method Specifications ......................... 62
9.3 Access Control in Specification Cases .......................... 63
9.4 Lightweight Specification Cases................................ 64
9.5 Heavyweight Specification Cases ............................... 66
9.6 Behavior Specification Cases .................................. 66
9.6.1 Semantics of flat behavior specification cases.............. 67
9.6.2 Semantics of non-helper methods ......................... 67
9.6.3 Semantics of non-helper constructors ..................... 70
9.6.4 Semantics of helper methods and constructors ............ 70
9.6.5 Semantics of nested behavior specification cases........... 70
9.7 Normal Behavior Specification Cases .......................... 71
9.8 Exceptional Behavior Specification Cases ...................... 72
9.8.1 Pragmatics of Exceptional Behavior Specifications Cases . . 72
9.9 Method Specification Clauses .................................. 74
9.9.1 Specification Variable Declarations ....................... 74
9.9.1.1 Forall Variable Declarations ......................... 74
9.9.1.2 Old Variable Declarations ........................... 74
9.9.2 Requires Clauses ......................................... 75
9.9.3 Ensures Clauses .......................................... 75
9.9.4 Signals Clauses........................................... 76
9.9.5 Signals-Only Clauses ..................................... 78
9.9.6 Parameters in Postconditions ............................. 79
9.9.7 Diverges Clauses ......................................... 80
9.9.8 When Clauses ............................................ 81
9.9.9 Assignable Clauses ....................................... 82
9.9.10 Accessible Clauses ...................................... 82
9.9.11 Callable Clauses ........................................ 83
9.9.12 Measured By Clauses ................................... 83
9.9.13 Captures Clauses........................................ 83
9.9.14 Working Space Clauses .................................. 84
9.9.15 Duration Clauses........................................ 84
10 Data Groups.................................. 86
10.1 Static Data Group Inclusions................................. 86
10.2 Dynamic Data Group Mappings .............................. 87