Ilmu Komputer & AI editorial
Open AccessOA2026
ProofPulse: Interactive Proof Coverage Analysis for Dafny
A three-valued proof coverage model that diagnoses specification quality beyond successful verification
Álvaro F. Silva; Ruben Martins; Alexandra Mendes· 2026· DOI 10.48550/arXiv.2608.30818
The core problem
Deductive verification ensures that an implementation satisfies its specification, but successful verification does not guarantee the quality of the specification. Weak specifications and redundant invariants may create overconfidence in "verified" code. The authors present ProofPulse, a tool for Dafny that diagnoses specification quality using a three-valued proof coverage model. By analyzing proof dependencies, ProofPulse distinguishes between elements that contribute to specification intent, those used only for auxiliary checks, and those irrelevant to any proof obligation. The tool is evaluated against an oracle of 252 programs from the dafny-synthesis benchmark, providing a high-precision signal for specification weaknesses, particularly unnecessary preconditions and vacuous proofs. With unsat-core minimization, ProofPulse achieves perfect precision for precondition classification and reduces false positives across all evaluated categories. These results show that proof coverage is a practical complement to verification. Although it cannot fully capture semantic intent, it can reveal weak proof coupling in programs that otherwise appear fully verified. Just as a pulse check di
Innovation
ProofPulse was evaluated against an oracle of 252 programs from the dafny-synthesis benchmark. The results demonstrate that ProofPulse provides a high-precision signal for specification weaknesses, particularly unnecessary preconditions and vacuous proofs. With unsat-core minimization, ProofPulse achieves perfect precision for precondition classification, meaning all identified unnecessary preconditions were indeed unnecessary. Additionally, the tool reduces false positives across all evaluated categories compared to without minimization. The evaluation metrics include precision, recall, and false positive rates for each of the three coverage classes. The high precision indicates that ProofPulse is reliable in flagging genuine specification issues, minimizing the risk of false alarms. The reduction in false positives across categories suggests that unsat-core minimization effectively refines the classification by eliminating spurious dependencies. These results are consistent across the benchmark, demonstrating the robustness of the approach. The authors note that while ProofPulse cannot fully capture semantic intent, it successfully reveals weak proof coupling in programs that oth
Deductive verification ensures that an implementation satisfies its specification, but successful verification does not guarantee the quality of the specification. Weak specifications and redundant invariants may create overconfidence in "verified" code. The authors present ProofPulse, a tool for Dafny that diagnoses specification quality using a three-valued proof coverage model. By analyzing proof dependencies, ProofPulse distinguishes between elements that contribute to specification intent, those used only for auxiliary checks, and those irrelevant to any proof obligation. The tool is evaluated against an oracle of 252 programs from the dafny-synthesis benchmark, providing a high-precision signal for specification weaknesses, particularly unnecessary preconditions and vacuous proofs. With unsat-core minimization, ProofPulse achieves perfect precision for precondition classification and reduces false positives across all evaluated categories. These results show that proof coverage is a practical complement to verification. Although it cannot fully capture semantic intent, it can reveal weak proof coupling in programs that otherwise appear fully verified. Just as a pulse check distinguishes vitality from the mere absence of symptoms, ProofPulse exposes weaknesses in proofs that technically verify successfully but still suffer from inadequate or redundant code and specifications.
ProofPulse introduces a three-valued proof coverage model to classify specification elements based on their role in proof obligations. The model analyzes proof dependencies to categorize elements into three classes: (1) elements that contribute to specification intent, (2) elements used only for auxiliary checks, and (3) elements irrelevant to any proof obligation. This classification is achieved by examining the dependencies between proof obligations and specification constructs. To improve precision, the tool employs unsat-core minimization, which identifies minimal unsatisfiable cores to pinpoint unnecessary preconditions and vacuous proofs. The methodology is implemented as a tool for Dafny, leveraging its verification infrastructure. The evaluation uses an oracle of 252 programs from the dafny-synthesis benchmark, comparing ProofPulse's classifications against ground truth to measure precision and false positive rates. The three-valued model can be formalized as follows: for each specification element , ProofPulse assigns a coverage value , where indicates contribution to specification intent, indicates auxiliary use, and indicates irrelevance. The tool then computes precision metrics for each category, with unsat-core minimization applied to refine classifications. The overall workflow is depicted in the Mermaid diagram below, illustrating the process from proof dependency analysis to coverage classification and minimization.
Why it matters
The analysis focuses on the implications of proof coverage as a complement to deductive verification. The authors argue that successful verification alone is insufficient to guarantee specification quality, as weak specifications and redundant invariants can create overconfidence. ProofPulse addresses this by providing a three-valued coverage model that distinguishes between elements contributing to specification intent, auxiliary checks, and irrelevant elements. The perfect precision for precondition classification with unsat-core minimization highlights the effectiveness of the approach in identifying unnecessary preconditions. However, the tool has limitations: it cannot fully capture semantic intent, meaning some specification weaknesses may remain undetected if they do not manifest as proof dependencies. Nevertheless, ProofPulse reveals weak proof coupling in programs that technically verify successfully but suffer from inadequate or redundant code and specifications. The authors compare the tool to a pulse check, which distinguishes vitality from the mere absence of symptoms. This analogy underscores the value of proof coverage as a diagnostic tool. Future work may involve extending the model to capture more semantic aspects and integrating it into development workflows to improve specification quality. The discussion also touches on the taxonomy candidates: Architecture, Cybersecurity, Network, and Cryptography, suggesting potential applications in these domains where specification quality is critical.
Who should read this
CS practitioners and researchers
Opening member content…