Why3 — Where Programs Meet Provers

Abstract

Abstract. We present Why3, a tool for deductive program verification, and WhyML, its programming and specification language. WhyML is a first-order language with polymorphic types, pattern matching, and inductive predicates. Programs can make use of record types with mutable fields, type invariants, and ghost code. Verification conditions are discharged by Why3 with the help of various existing automated and interactive theorem provers. To keep verification conditions tractable and comprehensible, WhyML imposes a static control of aliases that obviates the use of a memory model. A user can write WhyML programs directly and get correct-by-construction OCaml programs via an automated extraction mechanism. WhyML is also used as an intermediate language for the verification of C, Java, or Ada programs. We demonstrate the benefits of Why3 and WhyML on nontrivial examples of program verification.

How to Get an Efficient yet Verified Arbitrary-Precision Integer Library

“…WhyML is used as an intermediate language for verification of C, Java, and Ada programs [12,18], and is also intended to be comfortable as a primary programming language [13]. WhyML function definitions are annotated with pre-and postconditions both for normal and exceptional termination, and loops are annotated with invariants.…”

The Matrix Reproved (Verification Pearl)

“…It comes with a programming language, WhyML [6], an ML dialect with some restrictions in order to get simpler proof obligations. This language offers some features commonly found in functional languages, like pattern-matching, algebraic types and polymorphism, but also imperative constructions, like records with mutable fields and exceptions.…”

A Coq Formalization of the Relational Data Model

“…The long term goal of our work is to verify data intensive systems with the Coq proof assistant and the Why3 [4] program verification suite. We shall extend our work in several directions.…”