Why3 — Where Programs Meet Provers

  • Jean-Christophe Filliâtre
  • Andrei Paskevich
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7792)


We present Why3, a tool for deductive program verification, and WhyML, its programming and specification language. WhyML is a first-order language with polymorphic types, pattern matching, and inductive predicates. Programs can make use of record types with mutable fields, type invariants, and ghost code. Verification conditions are discharged by Why3 with the help of various existing automated and interactive theorem provers. To keep verification conditions tractable and comprehensible, WhyML imposes a static control of aliases that obviates the use of a memory model. A user can write WhyML programs directly and get correct-by-construction OCaml programs via an automated extraction mechanism. WhyML is also used as an intermediate language for the verification of C, Java, or Ada programs. We demonstrate the benefits of Why3 and WhyML on non-trivial examples of program verification.


Proof Obligation Type Invariant Abstract Data Type Intermediate Language Polymorphic Type 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. 1.
    Why3, a tool for deductive program verification, GNU LGPL 2.1,
  2. 2.
    Guitton, J., Kanig, J., Moy, Y.: Why Hi-Lite Ada? In: Boogie, pp. 27–39 (2011)Google Scholar
  3. 3.
    Barnett, M., Chang, B.-Y.E., DeLine, R., Jacobs, B., Leino, K.R.M.: Boogie: A Modular Reusable Verifier for Object-Oriented Programs. In: de Boer, F.S., Bonsangue, M.M., Graf, S., de Roever, W.-P. (eds.) FMCO 2005. LNCS, vol. 4111, pp. 364–387. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  4. 4.
    Bobot, F., Filliâtre, J.C., Marché, C., Paskevich, A.: Why3: Shepherd your herd of provers. In: Boogie, pp. 53–64 (2011)Google Scholar
  5. 5.
    Bobot, F., Paskevich, A.: Expressing Polymorphic Types in a Many-Sorted Language. In: Tinelli, C., Sofronie-Stokkermans, V. (eds.) FroCoS 2011. LNCS, vol. 6989, pp. 87–102. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  6. 6.
    Knuth, D.E., Morris, J.H., Pratt, V.R.: Fast pattern matching in strings. SIAM Journal on Computing 6, 323–350 (1977)MathSciNetzbMATHCrossRefGoogle Scholar
  7. 7.
    Leino, K.R.M., Moskal, M.: VACID-0: Verification of ample correctness of invariants of data-structures, edition 0. In: VSTTE (2010)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  • Jean-Christophe Filliâtre
    • 1
    • 2
  • Andrei Paskevich
    • 1
    • 2
  1. 1.Lab. de Recherche en InformatiqueUniv. Paris-Sud, CNRSOrsayFrance
  2. 2.INRIA Saclay – Île-de-FranceOrsayFrance

Personalised recommendations