dafny | Dafny is a verification-aware programming language | Runtime Evironment library

The tutorial is slightly out of date. Thank you for reporting it. I have filed an issue on GitHub to update the tutorial and fix this.

Here is an explanation of what's going on.

As you have learned in the tutorial, Dafny makes a strong distinction between "specification contexts" (such as requires/ensures clauses, assert statements, and other annotations) and "real code" (any method that is not declared ghost). Certain features of Dafny are only available in specification contexts.

In older versions of Dafny, the user had to explicitly declare each variable to be ghost in a method if they wanted that variable to have access to specification-context-only features.

In modern Dafny, if the right-hand side of a variable assignment requires a specification context, then the variable is automatically declared ghost.

Thus, in Exercise 5, the code works fine because c is automatically declared ghost by Dafny. Since c is only used inside an assertion, everything is fine.

In Exercise 6, you are trying to return abs from the method. This is not inside an annotation but is instead "real code". (We might want to compile and run it!) Since y is the return parameter for Abs, it is not a ghost variable, since its value must exist at run time. So when you assign y := abs(x), the right-hand side of the assignment is in a "real code" context, where it is not allowed to call functions like abs.

The fix for Exercise 6 is to declare abs a function method.

The invariants are not the problem, it's the postcondition (thanks @JamesWilcox)

You are running afoul of the curse of nonlinear arithmetic. Any time you rely on nontrivial properties of multiplication, Dafny will have a hard time with your program.

Here is one way to fix your specific proof. Sorry that it is so messy. I'm sure it can be cleaned up, but I just hacked something together to show you the idea.

The issue is that Dafny analyzes each method in isolation, using only the specifications of the other methods. See the Dafny FAQ for more information.

You need to add more postconditions to guarantee that certain things aren't changed by insertValues, and you need to also add more postconditions to the constructor so that callers know the initial state. Here is a version that verifies:

There are several issues with your code.

(1) What is the purpose of the TreeADT class? In Dafny, classes are usually used to represent mutable objects, but your class has no fields or mutator methods, and you use a datatype to hold the data, so you can just get rid of the class altogether.

(2) Your definition of isBST is wrong. Here is an example:

Adding

Sets are immutable, unordered collections.

1. There is no such thing as the "first" element of the set. You can choose an arbitrary element like this:

There's not supposed to be any difference between the two. Please report this problem on https://github.com/dafny-lang/dafny/issues.

There is problem in how divides is being called. I think in ensures clauses you meant divides(k, a) instead of divides(a, k) similarly for divides(b, k) and divides(gcd(a, b), k).

One way to go about this after recursive call to dividesLemma(a, b - a) is to use postcondition of method. Here we know forall k such that k divides a and k divides b - a implies k divides gcd(a, b-a). Using this information we try to prove required postcondition (code or proof is straightforward to follow)