array<int> type mapping

method for imperative code

requires preconditions

ensures postconditions

loop bounds invariant

loop progress invariant

modifies clause

preservation invariant in max

helper spec function

struct as class or datatype

distance as function

reads clause on function

modifies clause on mutating method

no malloc in Dafny

no NULL

ensures on mutating method

ensures on create_point

requires on scale_point

unsigned int to nat

float to real

explicit as conversion

multiset permutation postcondition

sorted postcondition

outer loop invariant

inner loop invariant

requires for division

modifies clause