Java access modifiers and packages provide a mechanism to restrict the access to members and types as additional means of information hiding beyond the pure object oriented concept of classes. In this paper we clarify the semantics of access modifiers and packages by adding them to our formal model of Java in the theorem prover Isabelle/HOL. We analyse which properties we can rely on at runtime, provided that the static accessibility tests have been passed.

Abstract. Executable interface speci cation languages allow for expressive documentation and e cient testing and debugging. Since they are based on expressions of the underlying programming language, they can easily be applied by programmers without requiring mathematical skills. In this paper, we present the core of an executable interface speci cation language for Java. Its main contributions are an extensive coverage of side-e ects on object structures, and a clean semantics. The presented techniques can be implemented without modi cations to the Java compiler or the virtual machine. 1