Using Larch to specify Avalon/C++ objects

A formal specification of three base Avalon/C++ classes recoverable, atomic, and subatomic - is given. Programmers derive from class recoverable to define persistent objects, and from either class atomic or class subatomic to define atomic objects. The specifications, written in Larch, provide the means for showing that classes derived from the base classes implement objects that are persistent or atomic and thus exemplify the applicability of an existing specification method to specifying nonfunctional properties. Writing these formal specifications for Avalon/C++'s built-in classes has helped to clarify places in the programming language where features interact, to make unstated assumptions explicit, and to characterize complex properties of objects