A Formal Definition of JML in Coq

The Java Modeling Language (JML) is a very rich specification language for Java. The richness of JML leads to many different interpretations of the same specification constructs in different applications. This work presents a formalization of JML in the theorem prover Coq to provide an exact, unambiguous meaning for JML constructs. The formalization not only gives a mathematically precise definition of the language, but also enables formal meta-reasoning about the language itself, its applications, and proposed extensions. In JML, frame conditions are expressed by the assignable clause. This work highlights the first algorithm that checks assignable clauses at runtime in the presence of dynamic data groups as a means of data abstraction. The algorithm performs very well on realistic and large data structures by lazily computing the locations denoted by the data groups. As an important contribution to runtime assertion checking, the equivalence of the algorithm to the JML semantics has been formally proved in Coq. This shows not only correctness and completeness of the algorithm to check assignable clauses, but also the usefulness and expressiveness of the JML formalization.