An overview of JML tools and applications

Burdy, Lilian; Cheon, Yoonsik; Cok, David R.; Ernst, M.; Kiniry, Joseph R.; Leavens, Gary T.; Leino, K. Rustan M.; Poll, Erik

doi:10.1007/s10009-004-0167-4

Cited by 494 publications

(454 citation statements)

References 55 publications

Supporting

Mentioning

454

Contrasting

Order By: Relevance

“…It was first used in the programming language Eiffel, and subsequently has also been applied to many other programming languages. For example, JML [14] is one of the most popular specification languages for Java and supports Design by Contract. JML also supports unbounded quantification, though assertions containing unbounded quantifiers are not checked by the JML run-time assertion checker.…”

Section: Run-time Checking Of Object-oriented Programsmentioning

confidence: 99%

“…This methodology allows the developer of client code to abstract from irrelevant implementation details. Combined with the design by contract principle [53], programming by interfaces is one of the main approaches to mastering the complexity of software today.One of the main formal behavioral interface specification languages for Java, the Java Modeling Language (JML) [14], is inherently state-based ; i.e., JML mainly provides support for the specification of classes in terms of their fields, including so-called model fields that represent certain aspects of the data structures underlying the implementation. JML does not provide explicit support for the specification of the interaction between objects, in contrast to other formalisms such as message sequence charts and UML sequence diagrams [23,41].…”

mentioning

confidence: 99%

See 1 more Smart Citation

Combining Monitoring with Run-Time Assertion Checking

Boer

Gouw

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. According to a study in 2002 commisioned by a US Department, software bugs annually costs the US economy an estimated $59 billion 1 . A more recent study in 2013 by Cambridge University estimated that the global cost has risen to $312 billion globally 2 .There exists various ways to prevent, isolate and fix software bugs, ranging from lightweight methods that are (semi)-automatic, to heavyweight methods that require significant user interaction. Our own method described in this tutorial is based on automated run-time checking of a combination of protocol-and data-oriented properties of object-oriented programs. Run-Time Checking of Object-Oriented ProgramsGiven a program and a specification, a run-time verifier inserts checks in the code that determine whether the specification is satisfied. The checks are triggered during an actual execution of the program. In contrast to static verification, where properties are checked with respect to all executions (possibly there are infinitely many), run-time checkers only consider a single execution of the program. There is a wide range of specification languages used in run-time verification. They can be partitioned into two categories: languages that focus on the control-flow (these approaches are also called "monitoring"), and those focussing on data-flow.As an example, one can use regular expressions to specify the order in which functions or methods in a program should be called [18]. Such specifications describe the control-flow of the program. Other formalisms for specifying controlflow are temporal logics, various kinds of automata and context-free grammars. For these formalisms, checking whether a given property holds of the current execution involves parsing a word (where the word is some representation of the trace of method calls in the current execution) in an automata. Generally only formalisms are chosen with a decidable parsing problem (in particular, this is the case for regular expressions, context-free grammars and most automata), so Approaches that specify data-flow usually do so by annotating the source code with assertions: logical formulas that must be true whenever control passes them. The formulas constrain the values of the program variables. If assertions are expressed in first-order logic with arithmetic, it is in general undecidable due to unbounded quantification (i.e. ranging over an infinite number of values) whether the assertion is true, thus usually the assertions are restricted in some way. For instance, Java contains an assert-statement which restricts to quantifier-free formulas (i.e. Boolean expressions). Design by Contract [53] provides a systematic way of using assertions to specify classes, interfaces and methods with respectively class invariants and pre-and postconditions. It was first used in the programming language Eiffel, and subsequently has also been applied to many other programming languages. For example, JML [14] is one of the most popular specification languages for Java and supports Design by Contract. JML...

show abstract

Section: Run-time Checking Of Object-oriented Programsmentioning

confidence: 99%

mentioning

confidence: 99%

Combining Monitoring with Run-Time Assertion Checking

Boer

Gouw

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…The Sleek tool has played a very important role in our analysis. The PALE system [40] transforms constraints in the pointer assertion logic (PAL) into monadic second-order logic (MSO) and discharge them with MONA.JML [41] uses model/ghost fields and model methods to specify/model Java program properties. Hob [42] is a modular program verification tool for shape properties.…”

Section: Related Workmentioning

confidence: 99%

Automatically refining partial specifications for heap-manipulating programs

Qin

Luo

et al. 2014

Science of Computer Programming

View full text Add to dashboard Cite

Automatically verifying heap-manipulating programs is a challenging task, especially when dealing with complex data structures with strong invariants, such as sorted lists and AVL/red-black trees. The verification process can greatly benefit from human assistance through specification annotations, but this process requires intellectual effort from users and is error-prone. In this paper, we propose a new approach to program verification that allows users to provide only partial specification to methods. Our approach will then refine the given annotation into a more complete specification by discovering missing constraints. The discovered constraints may involve both numerical and multi-set properties that could be later confirmed or revised by users. We further augment our approach by requiring partial specification to be given only for primary methods. Specifications for loops and auxiliary methods can then be systematically discovered by our augmented mechanism, with the help of information propagated from the primary methods. Our work is aimed at verifying beyond shape properties, with the eventual goal of analysing full functional properties for pointer-based data structures. Initial experiments have confirmed that we can automatically refine partial specifications with non-trivial constraints, thus making it easier for users to handle specifications with richer properties.

show abstract

“…In this project, the oracle is provided by an executable specification, written in JML (Java Modeling Language [9,4,7]). A JML specification is made up of assertions (invariants, history constraints, pre-and post-conditions) which express the properties of the classes and constrain their behaviour.…”

Section: Automated Oraclementioning

confidence: 99%

“…The test architecture is composed of a tool called Tobias [10] that generates a large number of test cases from a scenario, JUnit [8] to execute these test cases and JML assertions (Java Modelling Language [9,4,7]) to produce automatically the verdict of test cases. The major interest of this architecture is that it fully supports the testing process: it allows testers to generate many test cases that are automatically evaluated by an oracle.…”

Section: Introductionmentioning

confidence: 99%

Test of the ICARE Platform Fusion Mechanism

Dupuy-Chessa¹,

Bousquet²,

Bouchet³

et al. 2006

Interactive Systems. Design, Specification, and Verification

View full text Add to dashboard Cite

Abstract. Multimodal interactive systems offer a flexibility of interaction that increases their complexity. ICARE is a component-based approach to specify and develop multimodal interfaces using a fusion mechanism in a modality independent way. ICARE being reused to produce several multimodal applications, we want to ensure the correctness of its fusion mechanism. So we validate it using a test architecture based on Java technologies. This paper presents our validation approach, its results, its advantges and its limits.

show abstract

An overview of JML tools and applications

Cited by 494 publications

References 55 publications

Combining Monitoring with Run-Time Assertion Checking

Combining Monitoring with Run-Time Assertion Checking

Automatically refining partial specifications for heap-manipulating programs

Test of the ICARE Platform Fusion Mechanism

Contact Info

Product

Resources

About