Specifying and Checking Method Call Sequences in JML

In a pre- and post-conditions style specification, it is difficult to specify allowed sequences of method calls, often called protocols. However, the protocols are essential properties of reusable object-oriented classes and application frameworks, and the approaches based on the pre- and post-conditions, such as design by contracts (DBC) and formal behavioral interface specification languages (BISL), are being accepted as a practical and effective way of describing precise interfaces of (reusable) program modules. We propose a simple extension to JML, a BISL for Java, to specify protocol properties in an intuitive and concise manner. We also define a formal semantics of our extension and provide runtime checks. We believe that our approach can be easily adopted for other BISLs