Aliasing is endemic in object oriented programming. Because an object can be modified via any alias, object oriented programs are hard to understand, maintain, and analyse. Flexible alias protection is a conceptual model of inter-object relationships which limits the visibility of changes via aliases, allowing objects to be aliased but mitigating the undesirable effects of aliasing. Flexible alias protection can be checked statically using programmer supplied aliasing modes and imposes no runtime overhead. Using flexible alias protection, programs can incorporate mutable objects, immutable values, and updatable collections of shared objects, in a natural object oriented programming style, while avoiding the problems caused by aliasing.

The synthesis of formal specification and object orientation is particularly relevant to rigorous software development, as required in critical applications. However, formalising concepts arising from the object paradigm is not straightforward. In particular, the issue of how to model object identity semantically has provoked much debate. In this paper we define the semantic domains for object identity in the object-oriented formal specification language Object-Z.

Encapsulation is a founding principle of object-oriented programming: to this end, there have been a number of recent of proposals to increase programming languages' support for encapsulation. While many of these proposals are similar in concept, it is often difficult to describe their effects in practice, or to evaluate clearly how related proposals differ from each other. We are developing a general topological model of encapsulation for object-oriented languages, based on a program's object graph. Using this model, we can characterise a range of confinement, ownership, and alias protection schemes in terms of their underlying encapsulation function. This analysis should help programmers understand the encapsulation provided by programming languages, assist students to better compare and contrast the features of different languages, and help language designers to craft the encapsulation schemes of forthcoming programming languages.

This paper presents a method of reasoning about Object-Z specifications. The approach utilises the modularity inherent in Object-Z specifications to simplify proofs. Properties proved for a class in isolation can be used when that class is either inherited by another class or instantiated as part of a system of interacting objects. Proofs using structural induction and the notion of object integrity are discussed.

Object-oriented programming languages allow inter-object aliasing to represent linked data structures and networks of interacting objects. Aliasing complicates formal reasoning about programs, as it can occur anywhere in a program. In our mode system programs are annotated with modes that indicate object ownership and control the extent of object aliases. By localising aliases, our mode system provides a context for formal reasoning about object systems. Being statically checkable our system offers a practical target for the formal refinement of object-based specifications. 1