Introducing Software Verification with Dafny Language: Proving Program Correctness 1st Edition Boro Sitnikovski 2024 scribd download
Introducing Software Verification with Dafny Language: Proving Program Correctness 1st Edition Boro Sitnikovski 2024 scribd download
com
https://ebookmeta.com/product/introducing-software-
verification-with-dafny-language-proving-program-
correctness-1st-edition-boro-sitnikovski/
OR CLICK BUTTON
DOWNLOAD NOW
https://ebookmeta.com/product/introduction-to-dependent-types-with-
idris-encoding-program-proofs-in-types-1st-edition-boro-sitnikovski-2/
ebookmeta.com
https://ebookmeta.com/product/introduction-to-dependent-types-with-
idris-encoding-program-proofs-in-types-1st-edition-boro-sitnikovski/
ebookmeta.com
https://ebookmeta.com/product/death-of-an-earl-a-golden-age-mystery-
catherine-tregowyn-5-1st-edition-g-g-vandagriff/
ebookmeta.com
Kindred Tales 46 Finding his Goddess 1st Edition Anderson
Evangeline
https://ebookmeta.com/product/kindred-tales-46-finding-his-
goddess-1st-edition-anderson-evangeline/
ebookmeta.com
https://ebookmeta.com/product/next-in-line-uk-edition-jeffrey-archer/
ebookmeta.com
https://ebookmeta.com/product/an-international-humanitarian-
organisation-a-united-nations-of-the-people-1st-edition-james-david-
parker/
ebookmeta.com
https://ebookmeta.com/product/art-and-the-city-worlding-the-
discussion-through-a-critical-artscape-1st-edition-jason-luger-editor/
ebookmeta.com
Citrus Criminal Juiced Around The Corner Cozy Mystery 2
Gretchen Allen Et El
https://ebookmeta.com/product/citrus-criminal-juiced-around-the-
corner-cozy-mystery-2-gretchen-allen-et-el/
ebookmeta.com
Introducing Software
Verification with
Dafny Language
Proving Program Correctness
Boro Sitnikovski
Introducing Software Verification with Dafny Language: Proving Program
Correctness
Boro Sitnikovski
Skopje, North Macedonia
Chapter 1: O
ur First Program���������������������������������������������������������������1
Chapter 2: L ogic�����������������������������������������������������������������������������������7
2.1. Propositional Logic�����������������������������������������������������������������������������������������7
2.2. Predicate Logic and Quantifiers�������������������������������������������������������������������14
Chapter 3: C
omputation����������������������������������������������������������������������19
3.1. Variables and Assertions������������������������������������������������������������������������������20
3.2. Methods and Functions��������������������������������������������������������������������������������22
3.3. Predicates (Triggers) and Lemmas��������������������������������������������������������������25
3.4. Loops�����������������������������������������������������������������������������������������������������������26
3.5. Types and Pattern Matching�������������������������������������������������������������������������30
Chapter 4: M
athematical Foundations�����������������������������������������������37
4.1. Set Theory����������������������������������������������������������������������������������������������������37
4.2. Type Theory��������������������������������������������������������������������������������������������������43
v
Table of Contents
Chapter 5: P
roofs��������������������������������������������������������������������������������47
5.1. Proofs by Truth Tables����������������������������������������������������������������������������������49
5.2. Three-Column Proofs�����������������������������������������������������������������������������������51
5.3. Formal Proofs�����������������������������������������������������������������������������������������������53
5.4. Sequent Calculus Notation���������������������������������������������������������������������������56
5.5. Example: Proving a Mathematical Property�������������������������������������������������58
Chapter 6: S
pecifications�������������������������������������������������������������������61
6.1. Hoare Logic��������������������������������������������������������������������������������������������������61
6.2. Z3 and Dafny������������������������������������������������������������������������������������������������65
6.3. Preconditions and Postconditions����������������������������������������������������������������67
6.4. Invariants�����������������������������������������������������������������������������������������������������68
6.5. Arrays�����������������������������������������������������������������������������������������������������������70
6.6. Termination��������������������������������������������������������������������������������������������������72
6.7. Example: Finding a Maximum Number in an Array��������������������������������������74
Chapter 7: M
athematical Induction����������������������������������������������������77
7.1. Induction in Dafny����������������������������������������������������������������������������������������79
7.2. Manually Proving Induction in Dafny�����������������������������������������������������������81
Chapter 8: V
erification Exercises�������������������������������������������������������85
8.1. An Odd Implementation��������������������������������������������������������������������������������85
8.2. Sunday���������������������������������������������������������������������������������������������������������87
8.3. Mathematical Properties������������������������������������������������������������������������������88
8.4. Algebra���������������������������������������������������������������������������������������������������������89
8.5. Miscellaneous Algorithms����������������������������������������������������������������������������90
8.6. Prime Numbers��������������������������������������������������������������������������������������������97
8.7. Formal Proofs�����������������������������������������������������������������������������������������������98
8.8. Solutions����������������������������������������������������������������������������������������������������100
vi
Table of Contents
Conclusion����������������������������������������������������������������������������������������123
Bibliography�������������������������������������������������������������������������������������125
Index�������������������������������������������������������������������������������������������������127
vii
About the Author
Boro Sitnikovski has over 10 years of experience working professionally
as a software engineer. He started programming using the Assembly
programming language on an Intel x86 at the age of 10. While in high
school, he won several prizes in competitive programming, ranging from
fourth to third and first places.
He is an informatics graduate; his bachelor’s thesis was titled
“Programming in Haskell Using Algebraic Data Structures,” and his
master’s thesis was titled “Formal Verification of Instruction Sets in Virtual
Machines.” He has also published papers on software verification. His
other research interests include programming languages, mathematics,
logic, algorithms, and writing correct software.
He is a strong believer in the open source philosophy and contributes
to various open source projects.
In his spare time, he enjoys time with his family.
ix
About the Technical Reviewer
Aleksandar Stankov has over 10 years of experience working
professionally as a software engineer, software architect, and CTO. He
has worked on different projects in the United States, Norway, Germany,
and Macedonia. He is a computer engineer with a bachelor’s in brain–
computer interface and a master's in project management where his thesis
was titled “Quality management in software projects.”
Last year, he was focused on founding a startup for mental health,
called “Relaxifyapp,” that would improve the well-being of people using
the mobile app.
His interests include blockchain, microservices, Web 3.0, and
mobile apps.
xi
Preface
I was always interested in understanding things from first principles. I
believe this interest naturally led to learning mathematics. Writing is a way
for me to clarify my thoughts,1 which resulted in the book you’re reading at
the moment.
Every programmer in their career will run into bugs caused by
themselves, their logic, and reasoning. After the first few bug fixes, it
becomes a rather irritating experience. A programmer will do their best to
avoid introducing bugs in software. However, it’s not just a matter of ego
or avoiding being irritated. Depending on the criticality, some software
systems must be designed in such a way where failure is not an option.
Various tools exist to address this, both software applications and
theoretical concepts. In this book, we will cover some of them, including
algorithms (computation), the English language (and its vagueness), and
the mathematical language (and its preciseness, compared to the English
language).
The English language is also important – we will describe the concepts
in this book using it. This language can be a little bit vague, though; thus,
we will circle back to the first principles (mathematics) and see how we
can be as precise as possible.
We need a framework in order to be able to express mathematical
concepts.2 Dafny is one tool (programming language) that will allow us to
1
“Writing is nature’s way of letting you know how sloppy your thinking is.”
—Dick Guindon
2
“Often people talk about mathematics being useful for programming. It works
both ways. Programming (esp. functional programming) has deepened my
understanding of mathematics in numerous ways.” —Dan Piponi
xiii
Preface
research these and is what we will use throughout the book. It is not the
only tool though, and the concepts that we will introduce in this book will
be easily applicable to other languages that allow for software verification.
There are several platforms for software verification. Formal
verification is based on mathematical proofs, and the software platforms
are categorized into manual provers and automatic provers. Among the
manual ones, some of the most popular are the programming languages
Coq [12] (based on type theory), Idris [14], etc. Automated theorem
provers use algorithms to automatically deduce a given theorem, and
Dafny belongs to this family.
There are already good writings on Dafny, but the purpose of this
book is to be self-contained and not assume a lot of background besides
basic programming skills. Knowing how to program is not a strict
necessity, although it may help in grasping some concepts. The book also
assumes some basic experience with mathematics, such as functions and
elementary algebra.
To get the most of it, the recommended approach for the book is to
follow along and write the code as it’s being explained instead of reading
passively.
Thanks to my family, coworkers, and friends for the support, and thank
you for purchasing this book! I tried to introduce concepts as clearly as I
could, and I added examples and exercises, which I believe are crucial to
understanding. I hope that you will learn new techniques from this book.
Have fun!
xiv
Languages and Systems
In this chapter, we will cover the most foundational theoretical concepts
(starting from first principles) that will be necessary for our journey to
prove software correctness.
A lot of my programmer friends get scared away whenever they hear
the word “mathematics.” Unfortunately, there’s no getting around it, and
in this chapter, we’ll see why. However, we will try to be as descriptive as
possible, and English will be our friend, so stay a while and read!
Languages provide us a way to transfer some message or information
to someone, or even save some piece of information for our future self, by
writing it down; humans tend to forget easily. There are a lot of different
languages, but that’s the essence of them all – transferring information.
Now, to talk about its structure, a language consists of a finite set
of symbols (A, B, C, …) and a way to combine those so that strings (list
of symbols) can be formed: ABBA, CAB, etc. In addition, it consists of
grammar that tells us how to form valid strings. For example, in the English
language, “Hi, how are you?” is a valid statement, whereas “hi, how” isn’t.1
A language affects how a person thinks, as different languages consist of
different grammars. For example, to pronounce the number 23 in English,
we say “twenty-three.” However, for example, in Slovenian, we say “three
twenty.” This is because the rule to construct numbers is different between
these two languages. Thus, knowing different languages enriches not only
our vocabulary but also the different rules possible to construct statements.
1
The definition of validity varies in different contexts. In this context, we say that
a statement is valid if it makes sense and allows for communication between
parties. For example, if someone said to you “hi, how,” there is a very small chance
of having a useful dialog.
xv
Languages and Systems
But why care about different rules? Well, some languages are good for
some things and not as good for other things; there is no “best” language.
Similarly, in programming, it may be easier for some problems to be solved
in C (one programming language) than in Haskell (another programming
language).
This book is written using the English language; however, this language
has its limitations (as every other language). To see one limitation, note
that in computing, we usually talk about algorithms and numbers, which
are simply logical expressions. Now, consider the statement “There exists a
number such that it’s greater than two and there exists a number such that
it’s greater than three.” There’s some vagueness involved here. First, is the
first number the same as the other one, or must they be different? Second,
are we talking about positive numbers only, or are negative also allowed?
And so on.
It’d be good if we had a framework (language) to express our ideas as
precisely as possible, but also keeping the essence and removing all other
redundant distractions, for example, unnecessary words such as “such
that” in “there exists a number n such that it’s positive.”
It’s okay to be informal (that’s why we use English), but sometimes,
formality is needed, especially when we are to represent our ideas as
computer programs since computers will do exactly what we tell them to.
If languages allow us to transfer some message, then formal systems
(using some language) allow us to transfer some abstract idea. Formal
systems lie at the heart of mathematics, and through them, the foundations
are specified.
Before we can construct a proof of software correctness, we need to
understand what proof is and what it means for a piece of proof to be valid.
The purpose of formal systems is to enable reasoning for logical proof
in terms of their form, rather than their content. This level of abstraction
makes formal systems powerful tools.
xvi
Languages and Systems
xvii
Languages and Systems
1. Formal language
In the inference rules, the symbols M, I, and U are part of the system,
while x and y are variables that represent any list of symbols (string).
For example, rule number 2 can be applied to MI, where x = I, but rule
number 1 for x = M can also be applied. Thus, from MI, one can derive MII
but can also derive MIU, respectively. Another example is MII to which rule
number 2 for x = II and rule number 1 for x = MI can be applied.
The following example shows how to get from MI to MIIU:
1. MI (axiom)
2. MII (rule 2, x = I)
xviii
Other documents randomly have
different content
hänelle ja tuo samassa rosmarinia ja myrtin oksia takkamme
seppelöimiseksi."
Kohta kun hän oli nähnyt Semestren uhrin, oli hän kiiruhtanut
kotiin, ehtiäksensä omallansa ennen häntä ja voittaaksensa
jumalattaren sydämmen ennen kuin hän nuorelle herrallensa.
Suuri ajatus heräsi hänessä ja hän oli ihan varmaan hyvin iloinen
siitä, sillä hänen silmänsä alkoivat loistaa, suunsa rypistyi
muhoilevaisesti ja hän näytti aivan satyrilta, joka lähestytti
huulillensa viinitarhan täysintä ja kypsintä viinirypälettä.
"Niin, se on oikein!"
Pieni sika röhki silloin niin valittavasti, kuin huomaisi se, että siltä
anastettaisiin sen koristus ja tultaisiin liian lähelle sen kauneutta.
Kun Iason kohta sen jäljestä pani pojan avulla nuo nauhat omaan
laihaan porsaasensa, ei se tullut sittenkään kauniimmaksi eikä
näyttänyt ylpeemmältä kuin ennenkään, sillä ei se ollut juuri mikään
onnellinen pieni sika ja oli tajuamaton jaloille lahjoille.
Käynti merelle.
"No?"
Joka kerran kuin Xanthe vaan käytti sitä, pysyi hän lujana
tahdossansa ja teki, mitä itse tahtoi; mutta Semestre, joka ei
tavallisesti koskaan myöntänyt, ett'ei hänen kuulonsa ollut
samanlainen kuin aikaisempina vuosina, käytti mielellään
semmoisissa tilaisuuksissa kuurouttansa hyväksensä, välttääksensä
viisaasti peräytymistä.
Sen sijaan, että olisi astunut alas merelle, kulki hän kokonaan
noitten ristiriitaisten tunteitten hänen rinnassansa riehuessa aivan
suoraan, siksi kuin hän saavutti suuren maatilalle vievän portin.
"Anna anteeksi, jos minä sen tein", vastasi toinen, "mutta minä
tahdoin sinulle sanoa, että minä tietäisin kenties neuvoa sinun
isällesi. Kototienoossani…"
"Kenties."
"Minun kanani."
Hän itse oli silloin vielä kuulunut lasten joukkoon, mutta Phaon oli
silloin jo ollut iso poika.
"Minun oli niin hyvä", oli Xanthe niiskuttanut, mutta hän oli vaan
nyykäyttänyt päätänsä eikä, hyvinkin neljännes-tunnin kuluttua,
mitään muuta sanonut kuin: "Ja minun myös."
"Niin, kuka?"
Kun Phaon silloin yhä jäi samaan asentoon, nousi Xanthe ylös,
lähestyi häntä, veti arasti häntä takista ja sanoi:
Phaon oli niin tottunut aina olemaan käsillä, jos oli kysymys
parantaa jotain tuon pienokaisen leikkikaluissa, että hän seurasi
häntä, ja myöskin seuraavina päivinä antoi tytön käskeä häntä
moniin asioihin, joihin hänen ei olisikaan tehnyt mieli.
Kun hän nyt seisoi hiljaa hautapatsaalla, muisteli hän sitä hetkeä,
jona hän oli lohduttanut Phaonia, ja huolenpitoansa häntä kohtaan,
ja että kaikki oli nyt kuitenkin ollut turhaa, sillä huilunsoittajanaisten
kanssa vietti hän nyt yöt.
Kun hänen oli täytynyt itkeä tänään lähteellä, arveli hän nyt, ett'ei
hän ollut itkenyt tuon vieraan Messeneläisen neidon tähden, ei,
hänen silmiinsä oli muka tunkeutunut ainoastaan semmoisia
kyyneleitä, jommoisia äiti vuodattaa harhateille joutuneen poikansa
tähden.
Kaiken tämän ohessa oli hänellä vaan vähän aikaa ajatella uutta
kosijaa, ensinhän oli kysymys rikkoa vanha jumalankuva, mutta
jokainen vasaranlyönti koski hänelle niin kovin, kuin olisi hän vienyt
sitä itseänsä vastaan.
Vastaus.
Ei.
Se oli Phaon!
Hän olisi sen tiennyt, vaikkapa hän olisi nähnyt vaan kaksi sormea
hänestä!
"En minä tiedä, mikä sinun on", sanoi Phaon silittäessään oikealla
kädellä mustaa tukkaansa, joka peitti puolen hänen otsastansa.
"Joko sinä nyt odotat laivaa Messenestä ja minun isääni?"
"Sinä?"
"Niin."
"Phaon!"
"Ei tuota ainakaan! Jos et sinä olisi ajatellut niin hulluja asioita
minusta, en minä olisi koskaan puhunut vahtimisestani tuolla
ylhäällä. Kenen tehtätä se sitten olisi ollut, ennenkuin Mopsos tulisi
takaisin, joll'ei minun."?
"Ei kukaan, ei kukaan ole sinun vertaisesi! Mutta nyt, nyt tee
kysymyksesi vielä kerran!"