Dafny An automatic program verifier for functional correctness