openjml-more

JML specifications define preconditions, postconditions, and invariants for Java methods. You write them using JML syntax directly in your Java code to specify expected behavior and verify program correctness.

OpenJML ESC performs Extended Static Checking at compile time to prove specifications, while RAC inserts Runtime Assertion Checks that monitor assertions dynamically during execution. ESC finds errors statically; RAC catches them at runtime.

Debug OpenJML ESC failures by analyzing the generated counterexamples and refining your JML specifications. Check preconditions, postconditions, and loop contracts to ensure they accurately model the implementation's behavior.

Use JML model fields to abstractly represent concrete implementation state for specification purposes, and ghost fields for specification-only variables that do not correspond to program state. Both help keep specs aligned with implementation.

Write JML loop contracts by specifying loop invariants, variants, and decreases clauses. These contracts allow OpenJML to verify loops modularly without unrolling them, ensuring termination and state preservation across iterations.

JML visibility rules ensure specifications only refer to elements visible to the client. Following these rules during modular verification prevents information leakage and maintains soundness when checking individual program modules in isolation.