Dafny: An Automatic Program Verifier for Functional Correctness
Lecture Notes in Computer Science, 2010 · paper · Computer science
A tour of Dafny, a language and automatic verifier that uses an SMT solver to check the functional correctness of programs. It describes the language's features with small examples and presents a full specification of the Schorr-Waite algorithm as a case study.
Checked: PDF from microsoft.com, fetched 4 Oct 2026. Page numbers are those of that PDF.
0 findings
None that passed a second check.
10 minor (typos and the like; most checked by the judge only)
Wording "SMT solvers obtain an important kind of user extensionality by supporting quantifiers" probably means "user extensibility".
- p. 1 Introduction, paragraph 3
user extensionality by supporting quantifiers
Only the authors can say what is right here.
Judge's note: The crop of p.1 reads "user extensionality". In context, quantifiers let users add their own axioms, i.e. extend the solver. That is extensibility. The paper uses "extensionality" in its technical sense elsewhere (maps, Sec. 1.7), so the word as printed misdescribes the point. Only the author can confirm which word was meant.
Second check: another model agreed
Report a problem with this finding
Typo "presented in Marktoberdorf lectures notes [33]" should read "lecture notes".
- p. 2 Sec. 0 Introduction, para 2
Marktoberdorf lectures notes [33]
- p. 2
presented in Marktoberdorf lectures notes [33]
Judge's note: The page 2 image reads "lectures notes". The very next sentence and p.9 have "lecture notes".
Second check: none (judge only)
Report a problem with this finding
Typo "By default, function are “ghost”" should read "functions are".
- p. 4 Sec. 1.4 Functions, para 3
By default, function are “ghost”
- p. 6 Sec 1.4
justified by reads check that
Judge's note: The page 4 crop confirms "function are". The second location in this cluster ("reads check that", p.6) is the same defect as C005 and is judged there.
Second check: none (judge only)
Report a problem with this finding
Typo "all references o, and all fields names f of type Field α" should read "field names".
- p. 6 Sec. 1.4, first line of page
and all fields names f of
Judge's note: The first line of the page 6 image reads "all fields names f".
Second check: none (judge only)
Report a problem with this finding
Typo "is justified by reads check that are part of the function body’s consistency check" should read "reads checks".
- p. 6 Sec. 1.4, last paragraph
is justified by reads check that
- p. 6 Sec. 1.4, last paragraph
is justified by reads check that are part of the function body’s consistency check
- p. 6 Sec. 1.4, last paragraph
justified by reads check that
Judge's note: The page 6 image shows "reads check that are part of". The plural "are" calls for "checks".
Second check: none (judge only)
Report a problem with this finding
Typo "When specifying a program built as a layers of modules" has a stray article; it should read "as layers of modules".
- p. 6 Sec. 1.5, first sentence
built as a layers of modules
Judge's note: The first sentence of Sec. 1.5 in the page 6 image reads "built as a layers of modules".
Second check: none (judge only)
Report a problem with this finding
Typo "where the consistency of data structures (that is, object invariants [41, 3]) are specified by validity functions": the head noun "consistency" is singular.
- p. 6 Sec. 1.5, para 1
are specified by validity functions [19, 38, 43]
Judge's note: The text is as quoted in the page 6 image. The verb may have been attracted to the plural parenthetical "object invariants", so this is a minor agreement point that either reading could excuse.
Second check: none (judge only)
Report a problem with this finding
Typo "generic nonempty binaries trees" should read "binary trees".
- p. 9 Sec. 1.9 Algebraic Datatypes, first paragraph
generic nonempty binaries trees
- p. 9 Sec 1.9
nonempty binaries trees
Judge's note: The page 9 crop of Sec. 1.9 reads "binaries trees".
Second check: none (judge only)
Report a problem with this finding
Typo "never before has all necessary specifications and loop invariants been presented": the plural subject needs "have".
- p. 11 Sec. 2, para 2
never before has all necessary
- p. 11 Sec. 2, paragraph 2
never before has all necessary specifications and loop invariants been presented
Judge's note: The page 11 crop confirms the wording.
Second check: none (judge only)
Report a problem with this finding
Typo "their proof of Kaplar and Tarjan’s algorithm for functional double-ended queues [44]": the name is probably "Kaplan".
- p. 16 Sec. 3 Related Work, para 'Others are using SMT solvers'
Kaplar and Tarjan’s algorithm
- p. 16 Sec. 3 Related Work, paragraph 2
Kaplar and Tarjan’s algorithm for functional double-ended queues [44]
- p. 16 Related Work, last section
Kaplar and Tarjan’s algorithm for functional double-ended queues
Only the authors can say what is right here.
Judge's note: Rests on outside knowledge: the functional deque algorithm is by Haim Kaplan and Robert Tarjan. The page 16 image reads "Kaplar". Reference [44] (Régis-Gianas and Pottier) does not give the name, so the files alone cannot settle it.
Second check: none (judge only)