While formal methods offer the highest level of confidence that software behaves as intended, they are notoriously difficult to use. The Java Modeling Language and the associated OpenJML tool aim to make formal specification ...