{"slug": "dafny", "name": "Dafny", "category": "other", "category_name": "Other software", "description": "", "recommenders": 4, "commenters": 7, "warners": 0, "score": 3.693, "rising": 0.02, "first": "2025-11-02", "latest": "2026-09-18", "why": "SPARK/Ada and Dafny work similarly, and have good documentation", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 3, "compare": 1, "warn": 0}, "spark": [0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "SPARK/Ada and Dafny work similarly, and have good documentation", "kind": "", "icon": true, "domain": "dafny.org", "github_repo": null, "official_url": "https://dafny.org", "pricing": "", "aliases": ["Dafny"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 795777506, "item_id": 49736094, "url": "https://news.ycombinator.com/item?id=49736094", "by": "Jtsummers", "date": "2026-09-17", "version": null, "stance": "recommend", "quote": "SPARK/Ada and Dafny work similarly, and have good documentation", "excerpt": "https://verus-lang.github.io/verus/publications-and-projects/ - The papers here go into their implementation. They take the proof statements and information about the program and turn it into an SMT problem (and run it through Z3 if I read correctly) and then they use that to prove the properties of the program. SPARK/Ada and Dafny work similarly, and have good documentation if you want to try your hand at something ", "context": "", "use_case": "", "switched_from": "", "story": "Developing provably correct Rust code with Verus"}, {"id": 776461680, "item_id": 48528855, "url": "https://news.ycombinator.com/item?id=48528855", "by": "awinter-py", "date": "2026-06-14", "version": null, "stance": "recommend", "quote": "dafny + iris are the closest to being industrial I think.", "excerpt": "See previous kleppmann post https://martin.kleppmann.com/2025/12/08/ai-formal-verification.html, and yes, obviously anything that you can put in the typesystem or the linter, you should weigh doing so. Hopefully we get more ergonomic ways to do this? Like of the tools listed in the post, dafny + iris are the closest to being industrial I think. And amzn S3 has a history of TLA use in-house I think. But we probably ha", "context": "", "use_case": "", "switched_from": "", "story": "Formal Methods and the Future of Programming"}, {"id": 772304928, "item_id": 48269058, "url": "https://news.ycombinator.com/item?id=48269058", "by": "rramadass", "date": "2026-05-25", "version": null, "stance": "recommend", "quote": "See the Dafny language for some background", "excerpt": "I am afraid you have not understood what i wrote. I mainly pointed out some of the important Software Engineering methodologies/techniques to be studied and adapted for use with AI. Earlier, they were encompassed/expressed-by specific software tools (CASE/Formal Method tool etc.) which may/may-not be used alongside AI. You study and extract the principles/concepts/ideas behind those tools and adapt them for use with ", "context": "", "use_case": "", "switched_from": "", "story": "There's Never Been a Better Time to Study Computer Science"}, {"id": 753105360, "item_id": 47069085, "url": "https://news.ycombinator.com/item?id=47069085", "by": "nextos", "date": "2026-02-18", "version": null, "stance": "recommend", "quote": "Dafny is really approachable and practical", "excerpt": "If verification is the goal, but you don't want to learn theorem proving yet, Dafny is really approachable and practical [1]. F* is also worth considering as a proof-oriented alternative to Isabelle that is focused on software verification [2]. Why3, Rocq and Agda are other obvious contenders. [1] https://dafny.org/latest/OnlineTutorial/guide [2] https://fstar-lang.org/tutorial", "context": "", "use_case": "software verification", "switched_from": "", "story": "Learning Lean: Part 1"}]}], "caveats": [], "who": [{"by": "dwohnitmok", "context": "has done work in formal verification", "url": "https://news.ycombinator.com/item?id=49756577", "date": "2026-09-18"}], "tags": [], "use_cases": ["formal verification", "software verification"], "compared": [{"slug": "rocq", "name": "Rocq", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "z3", "name": "Z3", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "isabelle", "name": "Isabelle", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "lean", "name": "Lean", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "verus", "name": "Verus", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49700153", "title": "Developing provably correct Rust code with Verus", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49753179", "title": "Bend 2 and the Vibe-Coding Trap", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48526633", "title": "Formal Methods and the Future of Programming", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48261753", "title": "There's Never Been a Better Time to Study Computer Science", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47955118", "title": "Vera: a programming language designed for machines to write", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47411457", "title": "I formally verified AI-generated code. All 4 bugs were in the integration layer", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {"recommend": 1}, "2026-03": {"neutral": 1}, "2026-04": {"compare": 1}, "2026-05": {"recommend": 1}, "2026-06": {"recommend": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {"recommend": 1, "neutral": 1}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "quotes": [{"id": 796105234, "item_id": 49756577, "url": "https://news.ycombinator.com/item?id=49756577", "by": "dwohnitmok", "date": "2026-09-18", "version": null, "stance": "neutral", "quote": "my main toolbox of formal verification tools in the past have been Rocq, Idris, Dafny, and TLA+", "excerpt": "I would encourage you to think more deeply about the assertions you're making here. I've done a fair amount of work in this space as well, specifically my main toolbox of formal verification tools in the past have been Rocq, Idris, Dafny, and TLA+, and I can say that I've come away with roughly the same set of tradeoffs as what LightMachine describes in his comment. Current formal verification tools are often very sl", "context": "has done work in formal verification", "use_case": "formal verification", "switched_from": "", "story": "Bend 2 and the Vibe-Coding Trap"}, {"id": 795943058, "item_id": 49746441, "url": "https://news.ycombinator.com/item?id=49746441", "by": "Jtsummers", "date": "2026-09-17", "version": null, "stance": "neutral", "quote": "The former, I don't know if anyone actually uses it in production though theoretically you can", "excerpt": "Proof happens before compilation, and doesn't require compilation. You can follow the Verus tutorials for the specifics, but you can use it as a standalone verifier or as a compilation \"stage\" where it'll run its verification and then conditionally continue on to compilation. Their tutorial seems ok: https://verus-lang.github.io/verus/guide/overview.html But if you want a more complete tutorial on this concept using ", "context": "", "use_case": "formal verification", "switched_from": "", "story": "Developing provably correct Rust code with Verus"}, {"id": 795777506, "item_id": 49736094, "url": "https://news.ycombinator.com/item?id=49736094", "by": "Jtsummers", "date": "2026-09-17", "version": null, "stance": "recommend", "quote": "SPARK/Ada and Dafny work similarly, and have good documentation", "excerpt": "https://verus-lang.github.io/verus/publications-and-projects/ - The papers here go into their implementation. They take the proof statements and information about the program and turn it into an SMT problem (and run it through Z3 if I read correctly) and then they use that to prove the properties of the program. SPARK/Ada and Dafny work similarly, and have good documentation if you want to try your hand at something ", "context": "", "use_case": "", "switched_from": "", "story": "Developing provably correct Rust code with Verus"}, {"id": 776461680, "item_id": 48528855, "url": "https://news.ycombinator.com/item?id=48528855", "by": "awinter-py", "date": "2026-06-14", "version": null, "stance": "recommend", "quote": "dafny + iris are the closest to being industrial I think.", "excerpt": "See previous kleppmann post https://martin.kleppmann.com/2025/12/08/ai-formal-verification.html, and yes, obviously anything that you can put in the typesystem or the linter, you should weigh doing so. Hopefully we get more ergonomic ways to do this? Like of the tools listed in the post, dafny + iris are the closest to being industrial I think. And amzn S3 has a history of TLA use in-house I think. But we probably ha", "context": "", "use_case": "", "switched_from": "", "story": "Formal Methods and the Future of Programming"}, {"id": 772304928, "item_id": 48269058, "url": "https://news.ycombinator.com/item?id=48269058", "by": "rramadass", "date": "2026-05-25", "version": null, "stance": "recommend", "quote": "See the Dafny language for some background", "excerpt": "I am afraid you have not understood what i wrote. I mainly pointed out some of the important Software Engineering methodologies/techniques to be studied and adapted for use with AI. Earlier, they were encompassed/expressed-by specific software tools (CASE/Formal Method tool etc.) which may/may-not be used alongside AI. You study and extract the principles/concepts/ideas behind those tools and adapt them for use with ", "context": "", "use_case": "", "switched_from": "", "story": "There's Never Been a Better Time to Study Computer Science"}, {"id": 767407600, "item_id": 47962975, "url": "https://news.ycombinator.com/item?id=47962975", "by": "Taikonerd", "date": "2026-04-30", "version": null, "stance": "compare", "quote": "This reminds me of Dafny: https://dafny.org/", "excerpt": "> The signature declares types, preconditions, postconditions, and effects. The compiler verifies the contract via SMT solver. This reminds me of Dafny: https://dafny.org/ Actually, that would be an interesting question: how good are LLMs at writing Dafny?", "context": "", "use_case": "", "switched_from": "", "story": "Vera: a programming language designed for machines to write"}, {"id": 758584577, "item_id": 47411536, "url": "https://news.ycombinator.com/item?id=47411536", "by": "hnipps", "date": "2026-03-17", "version": null, "stance": "neutral", "quote": "uses Dafny (backed by Z3)", "excerpt": "Author here. I picked this problem because it was assigned to me in Jira. Energy usage attribution logic for smart EV charging incentives in Python/Django. Pure arithmetic, clear postconditions. Best possible case for formal verification. If it couldn't prove its value here, it couldn't prove it anywhere. So I built a Claude Code plugin called Crosscheck that uses Dafny (backed by Z3). Five proof obligations, all dis", "context": "", "use_case": "Formal verification", "switched_from": "", "story": "I formally verified AI-generated code. All 4 bugs were in the integration layer"}, {"id": 753105360, "item_id": 47069085, "url": "https://news.ycombinator.com/item?id=47069085", "by": "nextos", "date": "2026-02-18", "version": null, "stance": "recommend", "quote": "Dafny is really approachable and practical", "excerpt": "If verification is the goal, but you don't want to learn theorem proving yet, Dafny is really approachable and practical [1]. F* is also worth considering as a proof-oriented alternative to Isabelle that is focused on software verification [2]. Why3, Rocq and Agda are other obvious contenders. [1] https://dafny.org/latest/OnlineTutorial/guide [2] https://fstar-lang.org/tutorial", "context": "", "use_case": "software verification", "switched_from": "", "story": "Learning Lean: Part 1"}, {"id": 732730933, "item_id": 45795683, "url": "https://news.ycombinator.com/item?id=45795683", "by": "nextos", "date": "2025-11-02", "version": null, "stance": "neutral", "quote": "Leftpad proofs using Rust Creusot, Dafny, or LiquidHaskell are quite straightforward", "excerpt": "> there is not anything necessarily wrong with dependent types, but that he doesn't believe they are necessary. I think that, at least in software engineering, his point has not been disproven. Isabelle (classical) has a great track record in software verification. I don't see it as something inherently inferior to Rocq (dependently typed), which also has a great track record. Lean doesn't have a great focus (yet?) o", "context": "", "use_case": "", "switched_from": "", "story": "Why don't you use dependent types?"}]}