A million of thanks for your verified version, but let me insists that I would like to figure out what is the cause of the issue related in the second fact of my question: Why Dafny is not able to prove the assertion perm(a[..i+1],old(a[..i+1])); after the method call step(a,i)? Note that it is in the ensures of the method contract. Not so importantly, I also found odd that properties a[..a.Length] == a[..]; old(a[..a.Length]) == old(a[..]); should be asserted as help for Dafny. Best, Paqui
↧