一句话:提出三值证明覆盖率模型,通过证明依赖分析诊断 Dafny 规格质量,揭示弱前置条件与空洞证明。
演绎验证能保证实现满足规格,但验证成功并不意味着规格本身质量良好:弱规格与冗余不变式会让人对“已验证”代码产生过度自信。作者提出 ProofPulse,一个面向 Dafny 的规格质量诊断工具,其核心是三值证明覆盖率模型。该模型分析证明依赖关系,将规格与程序元素区分为三类:真正贡献于规格意图的、仅用于辅助检查的、以及对任何证明义务都无关的。在来自 dafny-synthesis 基准的 252 个程序构成的 oracle 上评估,ProofPulse 对规格弱点(尤其是不必要的前置条件与空洞证明)给出高精度信号;结合 unsat core 最小化后,前置条件分类达到完美精度,并在所有评估类别上减少了误报。结果表明证明覆盖率是验证的实用补充:虽无法完全刻画语义意图,但能在看似完全验证的程序中暴露薄弱的证明耦合。
Deductive verification ensures that an implementation satisfies its specification, but successful verification does not guarantee the quality of the specification. As such, weak specifications and redundant invariants may create overconfidence in "verified" code. We present ProofPulse, a tool for Dafny that diagnoses specification quality using a three-valued proof coverage model. By analyzing proof dependencies, ProofPulse distinguishes between elements that contribute to specification intent, those used only for auxiliary checks, and those irrelevant to any proof obligation. Evaluated against an oracle of 252 programs from the dafny-synthesis benchmark, ProofPulse provides a high-precision signal for specification weaknesses, particularly unnecessary preconditions and vacuous proofs. With unsat-core minimization, ProofPulse achieves perfect precision for precondition classification and reduces false positives across all evaluated categories. These results show that proof coverage is a practical complement to verification. Although it cannot fully capture semantic intent, it can reveal weak proof coupling in programs that otherwise appear fully verified. Just as a pulse check distinguishes vitality from the mere absence of symptoms, ProofPulse exposes weaknesses in proofs that technically verify successfully but still suffer from inadequate or redundant code and specifications. Demo: https://www.youtube.com/watch?v=8pO3NAodjoQ Code: https://github.com/VeriFixer/ProofPulse Prebuilt Docker image: https://doi.org/10.5281/zenodo.21174686