Developing Verified Programs with Dafny

Abstract

Abstract. Dafny [2] is a programming language and program verifier. The language is type-safe and sequential, and it includes common imperative features, dynamic object allocation, and inductive datatypes. It also includes specification constructs like pre-and postconditions, which let a programmer record the intended behavior of the program along with the executable code that is supposed to cause that behavior. Because the Dafny verifier runs continuously in the background, the consistency of a program and its specifications is always enforced.Dafny has been used to verify a number of challenging algorithms, including Schorr-Waite graph marking, Floyd's "tortoise and hare" cycle-detection algorithm, and snapshotable trees with iterators. Dafny is also being used in teaching and it was a popular choice in the VSTTE 2012 program verification competition. Its open-source implementation has also been used as a foundation for other verification tools.In this tutorial, I will give a taste of how to use Dafny in program development. This will include an overview of Dafny, basics of writing specifications, how to debug verification attempts, how to formulate and prove lemmas, and some newer features for staged program development.

Proving Calculational Proofs Correct

“…Several systems inspired by Mizar have been developed since, including Isabelle/Isar [30] and Leino et. al's poC extension to Dafny [17]. These systems typically follow Mizar's format in not requiring the user to explicitly state the proof context.…”

Dafny: Statically Verifying Functional Correctness

“…The main types are: int for integers, nat for natural numbers, bool for booleans, set<T> and seq<T> for immutable sets and sequences of values of the generic type T, respectively, array<T>,array2<T>,...,arrayn <T> for n-dimensional arrays, and user-defined classes and inductive datatypes [2]. The built-in object type is a supertype of all class types, and, one of the major features of the latest release is the added support for char and string types [5].…”

“…One must however keep in mind that a lot of progress has been made on Dafny since 2008, and some of the statements in [7] no longer hold. For example, at the time of writing of [7], Dafny had no support for higherorder functions, but these have now been included as a new language feature in Dafny 1.9.1 [5]. Similarly, Dafny's current type system is very different from that presented in [7]; it now supports a much larger set of types, as can be seen from the latest version's type system documentation at http://research.microsoft.com/en-us/um/people/leino/papers/krml243.html [9].…”

Finding Bugs with Specification-Based Testing is Easy!

“…For languages with first-class specifications (e.g. JML [32,33,50,59,85]) prior work has considered both static verification [11,12,22,31,40,52,57,61,68,86] and random testing [16,18,24,92,101,104]. An important question often raised here is: why test when you could statically verify?…”