The Dafny Integrated Development Environment

Abstract

In recent years, program verifiers and interactive theorem provers have become more powerful and more suitable for verifying large programs or proofs. This has demonstrated the need for improving the user experience of these tools to increase productivity and to make them more accessible to nonexperts. This paper presents an integrated development environment for Dafny-a programming language, verifier, and proof assistant-that addresses issues present in most state-of-the-art verifiers: low responsiveness and lack of support for understanding non-obvious verification failures. The paper demonstrates several new features that move the state-of-the-art closer towards a verification environment that can provide verification feedback as the user types and can present more helpful information about the program or failed verifications in a demand-driven and unobtrusive way. IntroductionProgram verifiers and proof assistants integrate three major subsystems. At the foundation of the tool lies the logic it uses, for example a Hoare-style program logic or a logic centered around type theory. On top of the logic sits some mechanism for automation, such as a set of cooperating decision procedures or some proof search strategies (e.g., programmable tactics). The logic and automation subsystems affect how a user interacts with the verification system, as is directly evident in the tool's input language. The third subsystem is the tool's integrated development environment (IDE), which in a variety of ways tries to reduce the effort required by the user to understand and make use of the proof system.In this paper, we present the IDE for the program verifier Dafny [15,13]. The IDE is an extension of Microsoft Visual Studio (VS). It goes beyond what has been done in previous IDEs (for Dafny and other verification systems) in several substantial ways.continuous processing The IDE runs the program verifier in the background, thus providing designtime feedback. The user does not need to reach for a "Verify now" button.Design-time feedback is common in many tools. For example, the spell checker in Microsoft Word is always on in this way. Anyone who remembers from the 1980s having to invoke the spell checker explicitly knows what a difference this can make in how we think about the interaction with the tool; the burden of having to go through separate spelling sessions was transformed into the interaction process that is hardly noticeable. Parsing and type checking in many programming-language IDEs is done this way, enabling completion and other kinds of IntelliSense context-sensitive editing and documentation assistance. The Spec# verifier was the first to integrate design-time feedback for a verifier [0]. The jEdit editor for Isabelle [23] also provides continuous processing in the background by running both a proof search and the Nitpick [2] checker which searches for counterexamples to the proof goal.non-linear editing The text buffer can be edited anywhere, just like in usual programming-language editors. Any change in the buffe...

Specification and Proof of High-Level Functional Properties of Bit-Level Programs

“…The source language, C or Ada, is not important, although the choice between signed versus unsigned types in the source makes a difference: in Ada their semantics are significantly different. The Boogie [2] verifier and its front-ends VCC [13] and Dafny [19] also use the built-in bit vector support of Z3, to model machine words. We are not aware of any work, in this context, about the problem of mixing bit vectors with high-level specifications.…”

“…These are called verification conditions because if one proves they are all tautologies, then the program is guaranteed to respect its specification. In program verification environments like Dafny [19] and Why3 [7], verification conditions are discharged using theorem provers, in particular those of the Satisfiability Modulo Theories (SMT) family such as AltErgo [6], CVC4 [3], and Z3 [22]. The SMT approach is very promising for one who seeks to verify programs operating at the level of bits, because, in this context, theories for fixed-size bit vectors have been investigated for quite a long time and efficient decision procedures are known [12,4,10].…”

Verification by abstract interpretation, soundness and abstract induction

“…The first work-around is to ask the programmer to provide the inductive argument (such as all loop invariants [45]). This is a trivial widening to the proposed solution and to unknown if it is not valid.…”

The KeYmaera X Proof IDE - Concepts on Usability in Hybrid Systems Theorem Proving

“…Auto-active verifiers (e. g., Dafny [17,18], AutoProof [30]) put the model or code first and hide the verification engine, but support user guidance through annotations in the code. The basic idea is to make verification an integral part of (software) development that should be performed in the background by an IDE, much like background compilation.…”