Skip to article frontmatterSkip to article content

Of Dafny, and the Noble Quest for Certainty in Programs

In the year of our Lord two thousand and nine, there emerged from the learned halls of Microsoft Research a most singular creation, fashioned by the hand of one Rustan Leino, a master craftsman of verification arts. This marvel, which men call Dafny, was wrought not of common metal, but upon the foundations of an elder work known as [Boogie](todo: link)—itself an intermediate tongue of verification, forged in those same hallowed chambers of MSR. And lo, Boogie in its turn drew power from the mystic oracles called SMT solvers, chief among them the great Z3, which serveth as the engine of proof itself.

The architecture of this enterprise may be thus understood: when a program written in the Dafny tongue is presented for judgment, it is first transmuted into Boogie’s intermediate representation, as base ore is refined in the furnace. Thence, Boogie doth generate verification conditions—questions of logic most profound—which the oracle Z3 must attempt to prove, employing arts automatic and most wondrous.

Now, this language Dafny possesseth many excellent qualities and integrations with the kingdom of .NET. It may compile itself to the C# tongue, and there existeth even an extension for Visual Studio, that knights-errant of code might employ it in their daily labors. But here the marvel multiplieth: Dafny doth also extract verified code to sundry target realms—to C#, to Java, to JavaScript, to Go, and to Python. Thus may a programmer compose and verify their program once in Dafny, prove it correct through rigorous demonstration, and then extract it to production code in their chosen tongue, carrying forth the sacred guarantees of correctness as a knight bears his sworn oath across many lands.

As for its employment in the world’s affairs, the usage of Dafny hath been somewhat limited, though not without notable triumphs. The great merchant house of [AWS did employ Dafny to verify certain components of their S3 encryption client](TODO: link), that repository of infinite scrolls in the cloud. Microsoft itself hath [used it internally](TODO: evidence) for sundry verification quests. And it is spoken throughout the land that [a new Dafny textbook](todo: link) of recent vintage doth serve most excellently to bring novices into the mysteries of formal methods, though this humble chronicler confesses he hath not yet perused its pages. In these latter days, Dafny hath become a favored target for the new art of verified code synthesis, as evidenced in the trials of DafnyBench and other scholarly treatises.