---

The Java Modeling Language (JML) is a very rich specification language for Java. The richness of JML leads to many different interpretations of the same specification constructs in different applications. This work presents a formalization of JML in the theorem prover Coq to provide an exact, unambiguous meaning for JML constructs. The formalization not only gives a mathematically precise definition of the language, but also enables formal meta-reasoning about the language itself, its applications, and proposed extensions. In JML, frame conditions are expressed by the assignable clause. This work highlights the first algorithm that checks assignable clauses at runtime in the presence of dynamic data groups as a means of data abstraction. The algorithm performs very well on realistic and large data structures by lazily computing the locations denoted by the data groups. As an important contribution to runtime assertion checking, the equivalence of the algorithm to the JML semantics has been formally proved in Coq. This shows not only correctness and completeness of the algorithm to check assignable clauses, but also the usefulness and expressiveness of the JML formalization.

---

After studying computer science at ETH Zurich, Hermann Lehner contributed to the European research project Mobius (IST-15905) as research assistant and received his PhD at the Chair of Programming Methodology at ETH Zurich in 2011.

---