Dynamic-frame specifications in Dafny

1. Dynamic-frame specifications in Dafny K. Rustan M. Leino RiSE, Microsoft Research 17 July 2009JML seminarDagstuhl, Germany

2. Dafny • experimental language • sequential, object based (no subclassing) • specifications in the style of dynamic frames • coarse-grained frames (at the level of whole objects, not individual memory locations)

3. Functional-correctness verifications • queue • linked list with head/tail pointers • in-situ list reversal • integer set • binary tree • Schorr-Waite marking algorithm

4. Dafny grammar • Program ::= Class* • Class ::= class C<TypeParam*> { Member* } • Member ::= • Field • Method • Function

5. Dynamic frames • A frame is a set of locations • A dynamic frame (in the sense of Dafny) is an expression that denotes a frame • Methods have modifies clauses • Functions have reads clauses

6. Demo

7. Lessons, 0 • Dynamic-frame specifications are useful and flexible • A language design around dynamic frames can be simple • Thus good in teaching? • Specifications are verbose, but perhaps simplification techniques can be applied (like in Spec# or Chalice) • Currently missing in Dafny: scopes for axioms

8. Lessons, 1 • Pure methods are hard, functions are easy • SMT solvers work better with ghost fields than with functions • Reachability is not always necessary in specifications • Sets and sequences are nice as value types • Generics are a cinch • Decreases bound checks can be more liberal than naïve translation

9. Lessons, 2 • SMT solvers can be used for functional-correctness verification • Inductive predicates seem useful • cases fit nicely with matching triggers • take us in the direction of the input languages of interactive theorem provers • Need: better views/visualizations of program states to clarify error messages and, generally, what’s going on

10. Try it for yourself • Dafny is available as open source:http://boogie.codeplex.com