Exercises with JML and ESC/Java2

(More teaching material for JML is available in JML sourceforge wiki. In particular, Cormac Flanagan's Quicksort homework exercise might be a nice follow-up exercise to give students.)

Exercises with JML and ESC/Java2

Below are three exercises using the formal specification language JML and the program verification tool ESC/Java2. The exercises can be done by undergraduate students without any prior exposure to formal methods and only basic knowledge of Java.

The exercises all involve making design decisions explicit by means of JML preconditions and invariants, in the Design-By-Contract style. The aim of the exercises is to experience how making implicit assumptions explicit as preconditions and invariants can help us to detect program bugs, in this case using the automated program verification tool ESC/Java2.

The specification language JML

The exercises require only minimal knowledge of JML (of Java, for that matter). The only JML keywords you need to know are These keywords (plus a few more that you won't really need for these exercises) are explained in these slides.

The program verification tool ESC/Java2

ESC/Java2 is an automated program verification tool (aka extended static checker) for Java programs. Information on downloading and installing it is available from the ESC/Java2 webpage. (Thanks to Joe Kiniry for keeping ESC/Java(2) alive!) Students here in Nijmegen can use ESC/Java2 on the department computers.

The exercises

There are three exercises to try:

Some hints to keep you out of trouble with the tool:


Some questions to consider
  1. In the end, do you think that you found all problems? Are you certain now that the code is correct?
  2. Can you think of ways in which the tool or the specification language could be improved?
  3. Instead of the tool we used, can you think of other ways (formal or informal, tool-supported or not) to find the problems that the tool found? If so, would these alternatives