UP | HOME
../../

Java Modeling Language JML

Table of Contents

1 Overview

  1. JML is a behavioral (functionality) interface specification language
  2. Annotation language captures programmer design decisions
  3. JML is contained in annotations
    1. //@ JML annotation
    2. /*@ JML annotation @*/
    3. javac will ignore these
  4. JML annotation is a Java boolean expression …
    1. without any side effects
    2. extended with \old, \result
    3. extended with \forall, \exists
    4. JML keywords: requires, ensures, invariant
    5. JML keywords: pure, nonnull, assignable, signals
  5. JML annotation includes model fields

1.1 No Side Effects

  1. No use of =, ++, --, …
  2. Can only call pure methods.

1.2 Java Extended Syntax in JML

  1. a ==> b stands for a implies b
  2. a <==> b stands for a iff b
  3. a <=!=> b stands for !(a <==> b)
  4. \old(E) stands for the value of E in pre-state
  5. \result stands for the result of method

1.3 Quantifiers

  1. Universal ∀ JML \forall and existential ∃ JML \exists
  2. General quantifiers (\sum, \product, \min, \max)
  3. Numeric quantifier (\num_of)
  4. Ex: (\forall Student s; juniors.contains(s); s.getAdvisor() != null)

1.4 Java Example Source Code Files with JML Annotations

  1. ./jml-one-page-ex-1.pdf
  2. ./jml-one-page-ex-2.pdf

1.5 Non-Null

  1. To state that some references must not be null …
  2. private /*@ non null @*/ File[] files;
  3. void createSubdir(/*@ non null @*/ String name) { ... }

1.6 Java assert

  1. assert Expression1 ; where Expression1 is a boolean expression. When the system runs the assertion, it evaluates Expression1 and if it is false throws an AssertionError with no detail message.
  2. assert Expression1 : Expression2 ; where Expression1 is a boolean expression. Expression2 is an expression that has a value. The AssertionError constructor uses the string value of Expression2 to generate a detailed message.

1.7 JML assert

  1. //@ assert i > 0 && 0 < j && j < 5;
  2. //@ assert (\forall int i; 0 <= i && i < n; a[i] != null);
  3. keyword assert also in Java (since Java 1.4)
  4. assert in JML is more powerful

1.8 assignable

  1. Frame properties limit possible side-effects of methods.
  2. //@ requires amount >= 0;
  3. //@ assignable balance;
  4. //@ ensures balance == \old(balance) - amount;
  5. public int debit(int amount) { ... }
  6. debit can only assign to the field balance.
    NB this does not follow from the post-condition.
  7. //@ assignable \everything
  8. //@ assignable \nothing

1.9 pure

  1. A method without side-effects is said to be pure
  2. public /*@ pure @*/ int getBalance() { ... }
  3. Pure methods have implicitly assignable \nothing
  4. Pure methods, and only pure methods, can be used in specifications:
  5. //@ invariant 0 <= getBalance() && getBalance() <= MAX_BALANCE

1.10 Model Variables

  1. variables to be used only in specifications
  2. Given value only by represents clauses

2 Tools for JML

2.1 JML Compiler

  1. perform JML checks at runtime;
  2. low overhead;
  3. jmlrac http://www.eecs.ucf.edu/~leavens/JML2/docs/man/jmlrac.html
  4. jmlc http://www.eecs.ucf.edu/~leavens/JML2/docs/man/jmlc.html
  5. OpenJML (Command Line Tool) http://www.openjml.org/downloads/
  6. OpenJML uses SMT solvers as logic checkers, bundled with the OpenJML release.

2.2 ESC/Java2

  1. http://kindsoftware.com/products/opensource/ESCJava2/
    1. Improve the current software engineering process
    2. Can prove JML assertions at compile time.
    3. Effort must be made by the developer
    4. So far, only possible for small programs
  2. Input: a Java program annotated with JML assertions
  3. Powered by program semantics and automatic theorem proving
  4. Automatically check if the assertions are always true;
  5. Statically without any user interaction
  6. Reason about non-trivial properties (not just type-correctness)
  7. Its warnings are intended to be interpreted by the author of the program
  8. It does not find all the errors, but reduces the cost of finding some of them early

2.3 JACK: Java Applet Correctness Kit

  1. http://www-sop.inria.fr/everest/soft/Jack/jack.html

3 JML Readings

  1. https://www.openjml.org/; older site: http://www.eecs.ucf.edu/~leavens/JML/index.shtml
  2. Gary T. Leavens and Yoonsik Cheon, "Design by Contract with JML", http://www.jmlspecs.org/jmldbc.pdf, 2006. Compare with Meyers paper. Recommended Reading
  3. https://www.cs.ru.nl/E.Poll/talks/jml_basic.pdf 30+ slides
  4. https://www.tu-braunschweig.de/Medien-DB/isf/sse/09_jml_vl.pdf 95+ slides, Part I; https://www.tu-braunschweig.de/Medien-DB/isf/sse/10_jml_druck.pdf 45+ slides, , Part II.
  5. There are several JML plugins that you can discover through a web search.

4 End

Copyright © 2018 pmateti@wright.edu • www.wright.edu/~pmateti 2018-09-14