Using and Building an Automatic Program Verifier K. Rustan M. Leino Research in Software Engineering (RiSE) Microsoft Research, Redmond Lecture 2 LASER Summer School 2011 Elba, Italy 7 September 2011

A variant function is an expression whose values goes down (in some well-founded ordering) with every iteration/call while (B) { S; } At the time a loop back-edge is taken, the value of the variant function must be less than at the beginning of the iteration method M() { P(); } At the time of the call, the callee’s variant function must be less than the caller’s

Proving termination Termination

Motivation for using lemmas FindZero

Lemmas, induction Gauss 2

McCarthy Coincidence Saddleback search Max is transitive Reverse-Reverse

Dafny research.microsoft.com/dafny rise4fun.com/Dafny/tutorial/guide rise4fun rise4fun.com Verification Corner research.microsoft.com/verificationcorner