Using and Building an Automatic Program Verifier

K. Rustan M. LeinoResearch in Software Engineering (RiSE)Microsoft Research, Redmond

Lecture 2LASER Summer School 2011Elba, Italy7 September 2011

TerminationA variant function is an expression whose values goes down (in some well-founded ordering) with every iteration/call

while (B){ S;}

At the time a loop back-edge is taken, the value of the variant function must be less than at the beginning of the iteration

method M(){ P();}

At the time of the call, the callee’s variant function must be less than the caller’s

Proving termination

Termination

demo

Motivation for using lemmas

FindZero

demo

Lemmas, induction

Gauss2

demo

ExercisesMcCarthy

http://rise4fun.com/Dafny/6bq Coincidence

http://rise4fun.com/Dafny/WvG Saddleback search

http://rise4fun.com/Dafny/U5hMax is transitive

http://rise4fun.com/Dafny/z9J Reverse-Reverse

http://rise4fun.com/Dafny/1g

LinksDafny

research.microsoft.com/dafnyrise4fun.com/Dafny/tutorial/guide

rise4funrise4fun.com

Verification Cornerresearch.microsoft.com/verificationcorner