/
Inductive Invariant Generation via Abductive Inference Isil Dillig Department of Computer Inductive Invariant Generation via Abductive Inference Isil Dillig Department of Computer

Inductive Invariant Generation via Abductive Inference Isil Dillig Department of Computer - PDF document

pamella-moone
pamella-moone . @pamella-moone
Follow
530 views
Uploaded On 2015-01-19

Inductive Invariant Generation via Abductive Inference Isil Dillig Department of Computer - PPT Presentation

wmedu Thomas Dillig Department of Computer Science College of William Mary tdilligcswmedu Boyang Li Department of Computer Science College of William Mary bli01emailwmedu Ken McMillan Microsoft Research kenmcmilmicrosoftcom Abstract This paper pres ID: 33230

wmedu Thomas Dillig Department

Share:

Link:

Embed:

Download Presentation from below link

Download Pdf The PPT/PDF document "Inductive Invariant Generation via Abduc..." is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.


Presentation Transcript

parametersa;b;c.Incontrast,ourtechniqueautomaticallyinferstheshapeoftherequiredinvariantswithoutrequiringhintsorannotationfromtheuser.1.1OverviewoftheApproachThekeyideaunderlyingourapproachtoloopinvariantinferenceistoperformabacktrackingsearchthatcom-binesHoare-styleprogramreasoningwithlogicalabduction,whichistheinferenceofmissinghypothesesforagivenconclusion.Startingwiththeweakestpossiblebutalwayscorrectloopinvarianttrue,ourtechniquesetsupverica-tionconditionswhosevalidityguaranteesthecorrectnessoftheprogram.Ifavericationcondition(VC)isinvalid,ourtechniqueemploysabductiveinferencetoxthisin-validVC,whichcorrespondstothespeculationofanewloopinvariant.Thecurrentspeculationisusedtostrengthentheexistinginvariants,andnewVCsaresetuptocheckthecorrectnessofthespeculation.ThisprocesscontinuesuntileitheralltheVCsbecomevalidorwederiveacontradiction.Theformeroutcomemeansthatwehavefoundinductiveloopinvariantsstrongenoughtoshowthecorrectnessoftheprogramandouralgorithmterminates.Thelatteroutcomemeansthatwehavemadeawrongspeculation;therefore,webacktrackandtryadifferentinference.Inourapproach,thegeneratedvericationconditionsareconjunctionsofclausesoftheform) ,assertingtheinductivenessofloopinvariantsandcorrectnessofassertionsintheprogram.Specically,therighthandside oftheimplicationisagoalwewanttoshow,suchasalooppost-condition.Ontheotherhand,theleft-hand-sideencodesknownfactsabouttheprogram,suchasalreadyinferredloopinvariants.Now,givenaninvalidclause) oftheVC,ourtechniquetriestoxthis“broken”clausebystrengtheningtheleft-handsideoftheimplication.Inparticular,wewanttoinferastrengthening ofthecurrentloopinvariantsuchthat:1:j=(^ )) 2:SAT(^ )Here,condition(1)statesthatthestrengthening issuf-cienttomakeaparticularclauseoftheVCvalid.Condition(2)statesthatthestrengthening mustbeconsistentwiththeleft-handside,sinceencodesknown(orspeculated)invariantsabouttheprogram.Theinferenceofaformula satisfyingthesetworequirementsisaninstanceoflogi-calabduction,asdenedbyPeirce[15].Therefore,amaininsightunderlyingourapproachisthatlogicalabductionisusefulforndingsuitablestrengtheningsofloopinvariantsthataresufcientformakingtheprogram'svericationcon-ditionvalid.Now,whileourinferredstrengthening xesaninvalidclauseoftheVC,itisnonethelessaspeculationandmayormaynotcorrespondtoacorrectloopinvariant.There-fore,toensurethesoundnessofourapproach,ourtechniquegeneratesnewVCsateverystepencodingthecorrectnessofallinvariants,including .Therefore,if isanincorrectspeculation,thenewVCwillcontainaninvalidclausethatneedstobexed.IfthealgorithmreachesapointwhereagivenVCclausecannolongerbexedthroughabductivestrengthening(forinstance,when) isunsatisable),thismeanswehavemadeawrongspeculationandwemustbacktrack.Ontheotherhand,ifallVCclausesbecomevalid,thismeansallofourspeculationsarecorrect.Thus,whenthealgorithmterminates,wehaveidentiedcorrectinductiveloopinvariantsthatarestrongenoughtoshowthecorrect-nessoftheprogram.However,ourtechniquedoesnothaveterminationorcompletenessguarantees;itisindeedpossibleforthealgorithmtodivergeinaninnitechainofspecula-tions.Inprinciple,thiscombinationofHoare-styleVCgener-ationandlogicalabductioncanbeusedtoinferanyclassofinvariants.However,sinceouralgorithmforperformingabductionisbasedonquantierelimination,thispaperfo-cusesonlyontheinferenceofloopinvariantsexpressibleinPresburgerarithmetic.1.2OrganizationandContributionsTherestofthispaperisorganizedasfollows:Section2walksthereaderthroughasmallexampleillustratinghowourtechniqueinfersloopsinvariants.Section3presentsasmallimperativelanguagethatweusefortheformaldevel-opment,andSection4presentsthemaininvariantinferencealgorithm.Section5discussesextensionstothebasicalgo-rithmanddescribesourimplementation.Section6presentsanexperimentalevaluationofourapproach,comparingourtoolHOLAwiththreeotherloopinvariantgenerationtools.Finally,Sections7and8discussrelatedworkandhighlightfutureresearchdirections.Tosummarize,thispapermakesthefollowingkeycontri-butions:Wepresentanovelalgorithmbasedonbacktrackingsearchforautomaticallyinferringinductiveloopinvari-antsthatareexpressibleasbooleancombinationsoflin-earintegerconstraints.WeshowhowHoare-styleprogramreasoningandalog-icalabductionprocedurebasedonquantiereliminationcanbecombinedforlinearinvariantgeneration.Tothebestofourknowledge,thisistherstapplicationoflog-icalabductionforautomaticgenerationofnumericloopinvariants.WehaveimplementedtheproposedtechniqueinatoolcalledHOLAandpresentacomparisonbetweenHOLAandotheravailablestate-of-the-artinvariantgenerationtools,namelyBLAST,InvGen,andInterproc.Ourexper-imentsonasetofloopinvariantgenerationbenchmarksshowthatourapproachispromisingforadvancingthestate-of-the-artinnumericloopinvariantgeneration. procedureINVGEN():input:programoutput:mappingfromeachplaceholderitoaconcreteloopinvariant i(1)let=[i7!trueji2invs()](2)0=VERIFY(;)(3)return0procedureVERIFY(;):input:programandmappingoutput:newmapping0fromeachplaceholderitoaconcreteloopinvariant i(4)(;')=VCGEN(;)(5)if6j=return;(6)ifj=elim(')return(7)let'i2clauses(')suchthat6j=elim('i)(8)(;S)=ABDUCE('i)(9)foreach i2S(10) =()^ i(11)0=VERIFY(;[7! ])(12)if06=;return0(13)done(14)return; Figure2.ThemaininvariantgenerationalgorithmInthislanguage,programsconsistofoneormorestate-ments.Statementsincludeskip,assignments,sequencing,choosestatements(whichnon-deterministicallyexecutes1ors2),whileloops,assertions,andassumptions.Expressionsincludevariablesv,integerconstantsint,addition(e1+e2),linearmultiplication(eint),andmodexpressionse%int.Fi-nally,conditionalscanbecomparisonsbetweenexpressionsaswellaslogicalconjunction,disjunction,andnegation.Loopsinthislanguagearedecoratedwithuniqueplace-holderformulaswhichrepresentunknownloopinvariantsbuthavenoeffectontheprogramsemantics.Foreachplace-holder,thegoalofourtechniqueistoinferaconcretelog-icalformula suchthat isbothinductiveaswellasstrongenoughtoimplythelooppostcondition.Intheremainderofthepaper,weusethenotationinvs()torefertoallplace-holdersusedin.4.AlgorithmforGeneratingInductiveLoopInvariantsOuralgorithmINVGENforgeneratinginductiveloopinvari-antsisshowninFigure2.Ittakesasinputaprogramthatwewanttoverifyandoutputsamappingfromeachplace-holderinvariantintoaninductiveloopinvariant .Ifwecannotverifytheprogram,thenthealgorithmreturnstheemptymapping;.AsmentionedinSection1,ouralgorithmstartsbyinitial-izingeachtotrueanditerativelystrengthensloopinvari-antsuntiltheybecomeinductiveandstrongenoughtoverifytheprogram.Thus,atline1,weinitializebymappingallplaceholdersitotrue.TheiterativestrengtheningofloopinvariantsinisperformedbytherecursiveVERIFYpro-cedure,alsogiveninFigure2.IntheVERIFYprocedure,theinputrepresentsourcur-rentsetofspeculatedloopinvariants.Usingthesecandidateinvariants,wetheninvokeaVCGENproceduretocom-putetheweakestpreconditionofprogramaswellasitsVC'(line4).WedeferdiscussionoftheVCGENproce-duretoSection4.1.ThegeneratedVC'assertsthateachcandidateinvariant inisinductiveandthatitimpliesthelooppostcondition.Specically,thegeneratedVC'sareconjunctionsofclausesoftheform( ^)) .Here,isaplaceholderforapotentialstrengtheningofthecurrentloopinvariant.Formulas and donotcontainanyplacehold-ersandaregeneratedusingthecandidateinvariantsgivenby.IftheVC'withallplaceholdersreplacedbytrueisvalid,thismeansthecurrentisasolutiontoourverica-tionproblem.Line5ofVERIFYchecksthevalidityoftheprogram'sweakestprecondition.Ifisnotvalid,thismeansourcan-didateinvariantsgivenbyarenotcorrect.Inthiscase,wereturn;toindicatefailure,whichcausesbacktrackingintheoverallalgorithm.Next,atline6,wecheckwhetherthecur-rentVC'isvalid.Asmentionedbefore,'containsplace-holdervariables,whichrepresentpotentialstrengtheningsofthecurrentloopinvariants.Therefore,tocheckthevalid-ityoftheVC,weneedtoreplaceallplaceholderswithtrue.Forthispurpose,weusethenotationelim(')toindi-catethesubstitutionofwithtruein'.Ifelim(')isvalid,wehavefoundasetofinductiveloopinvariantsstrongenoughtoverifytheprogram,andwethereforereturnasoursolution.Ontheotherhand,ifelim(')isnotvalid,thismeansourcurrentloopinvariantsarenotstrongenough,andweneedtostrengthenthemfurther.Forthispurpose,weselectoneinvalidclause'ioftheVCcontainingoneplaceholdervariableandattempttoxit.Specically,recallthat'iisoftheform( ^)) where and donotcontainanyplaceholders.Toxclause'i,wecalltheprocedureABDUCEtondasetSofsuitablestrengtheningsfortheleft-handside.AswewillseeinSection4.2,each i2Sisguaranteedtomake'ivalid,but imayormaynotbeavalidinvariant.Therefore,atline11,werecursivelyinvokeVERIFYtocheckthecorrectnessofthespeculatedinvariant.Intherecursiveinvocation,weaddourcurrentspeculation ito.Specically,since iisastrengtheningforthecurrentloopinvariant(),weconjoin iwiththeexisting()whenmakingtherecursivecalltoVERIFY.IfVERIFYdoesnotreturn;,thismeanswehavefoundasuitablesetofinductiveloopinvariantsandreturn0asthesolution. Hence,inoursetting,theabductivesolution correspondstostrengtheningthecurrentloopinvariantIwithitsweakestpreconditionwp(s;I).However,ingeneral,wp(s;I)istooweakofastrengtheningandtypicallyleadstodivergence.Infact,startingwiththelooppostconditionIandrepeatedlyconjoiningitwithwp(s;I)isequivalenttounrollingtheloopbody!Therefore,weareinterestedinsolutionstotheabductionproblemthatarelogicallystrongerthanjusttheweakestpre-conditionofthecurrentinvariant.Themainstrengtheningmechanismwewillusehereisquantierelimination.Toseehowwecanusequantiereliminationtosolveourabductionproblem,werstobservethattheentailmentj=(^ )) canberewrittenas: j=) Now,consideranysubsetofthefreevariablesVoftheformula) .Clearly,wehave:8V:) j=) Therefore,anyformula'thatislogicallyequivalentto8V:) andthatdoesnotcontradictisasolutiontoourabductionproblem.DEFINITION1.(Universalsubset)WecallasetofvariablesVauniversalsubset(US)ofwithrespectto iftheformula(8V:)^ issatisable.Hence,ifVisauniversalsubsetof)withrespectto,wecanobtainasolutiontoourabductionproblembypro-jectingoutvariablesVfromtheformula)throughuni-versalquantiereliminationinPresburgerarithmetic.Fur-thermore,empirically,itturnsoutthatsolutionsobtainedinthiswaythroughquantiereliminationareveryusefulcan-didatesforauxiliaryloopinvariants.Intuitively,quantiereliminationisusefulbecauseitallowsustoprojectoutvari-ablesthatareirrelevantandpreventtheinvariantfrombeinginductive.EXAMPLE1.Togetsomeintuitionaboutwhyquantiereliminationisusefulforgeneratinginductiveinvariants,considerthefollowingcodeexample:intx=0;inty=0;while(xn)fx=x+1;y=y+2;gassert(y&#x]TJ/;གྷ ; .96;& T; 10;&#x.24 ;� Td;&#x [00;=n);Assumingtheinitialloopinvariantistrue,thegeneratedVCisxn)yn,whichdoesnotcorrespondtoanin-ductiveinvariant.Now,ifweprojectoutnfromthisformulaprocedureABDUCE('):input:formula'oftheform^) output:(;S)suchthatj=^ i) forevery i2S(1)let=(^)) (2)let=fg(3)letS=[](4)whiletrue(5)V=MUS() ;)(6)ifV=;thenbreak(7) =QE(8V:) )(8)S=S:: (9)=[f: g(10)done(11)return(;S) Figure4.AlgorithmforcomputinganorderedlistSofsolutionstoabductionproblem^) .TheprocedureMUS(;)computesamaximumuniversalsubsetofwithrespectto.byuniversallyquantifyingnandapplyingquantierelimi-nation,weobtainyx,whichisindeedaninductiveloopinvariant.Intuitively,here,quantiereliminationallowsustogeneralizethelastiterationofthelooptoaninductiveassertion.Basedonthisobservation,Figure4summarizesthefullabductionalgorithmthatweuseforgeneratingcandidatestrengtheningsofthecurrentloopinvariant.Effectively,thisalgorithmgeneratesallpossibleuniversalsubsetsof) withrespecttoandinfersacandidatestrengtheningbyprojectingoutallvariablesinthatuniversalsubsetfromourvericationcondition.Animportantconsiderationinthisalgorithmiswhichuniversalsubsettoconsiderrst.Specically,sincetheinvariantgenerationalgorithmfromFigure2performsadepth-rstsearch,candidatestrengtheningsthataretooweakcancauseouralgorithmtoeithertaketoolongor,worse,divergeinaninnitechainofspeculations.Ontheotherhand,ifwersttryastrengtheningthatistoostrong,thisisoftennotaproblembecausethealgorithmcanquicklyderiveacontradictionandbacktrack.Now,observethatforapairofuniversalsubsetsU;U0ofsomeformula,ifUU0,then8U:logicallyimplies8U0:.Hence,togeneratestrongerauxiliaryinvariantsbe-foreweakerones,ourabductionalgorithmconsidersuniver-salsubsetsindecreasingorderoftheircardinality.DEFINITION2.(Maximumuniversalsubset)AuniversalsubsetUofisamaximumuniversalsubset(MUS)ifjUjjU0jforanyotheruniversalsubsetU0of.Analgorithmforcomputingmaximumuniversalsubsetsofformulasisdescribedinourearlierwork[16]. Name LOC BLAST Time(s) InvGen Time(s) Interproc Time(s) HOLA Time(s) Benchmark1 21 4 0.10 4 0.14 4 0.01 4 0.03 Benchmark2 26 8 0.08 8 0.05 8 0.01 4 0.32 Benchmark3 22 4 0.46 4 0.20 8 0.01 4 0.04 Benchmark4 21 4 1.22 8 0.07 8 0.01 4 0.03 Benchmark5 27 8 — 4 0.21 4 0.01 4 0.06 Benchmark6 28 8 0.08 8 0.06 8 0.01 4 0.25 Benchmark7 27 8 3.09 4 0.22 4 0.01 4 0.56 Benchmark8 30 8 5.68 4 0.23 8 0.01 4 0.59 Benchmark9 49 8 — 4 0.34 4 0.01 4 0.06 Benchmark10 30 8 0.08 8 0.06 8 0.01 4 0.18 Benchmark11 24 8 — 4 0.16 4 0.01 4 0.20 Benchmark12 34 8 7.94 8 — 8 0.01 4 3.52 Benchmark13 25 4 0.38 8 0.20 4 0.01 4 0.38 Benchmark14 26 4 1.14 4 0.15 4 0.01 4 1.31 Benchmark15 28 4 0.30 4 0.15 4 0.01 8 — Benchmark16 23 8 1.13 4 0.13 4 0.01 4 0.12 Benchmark17 22 4 0.32 4 0.19 4 0.01 4 0.05 Benchmark18 23 8 — 8 12.05 8 0.01 4 3.64 Benchmark19 24 4 1.06 8 0.08 8 0.01 8 — Benchmark20 33 4 2.11 8 0.20 8 0.01 4 2.29 Benchmark21 39 8 0.93 8 0.04 4 0.01 4 1.55 Benchmark22 26 8 0.10 8 0.07 8 0.01 4 0.23 Benchmark23 20 8 — 4 0.16 8 0.01 4 0.03 Benchmark24 18 4 0.08 4 0.22 4 0.01 4 0.07 Benchmark25 33 4 0.51 4 4.63 8 0.01 4 0.07 Benchmark26 24 8 0.07 8 0.07 8 0.01 4 0.08 Benchmark27 23 4 0.14 4 0.21 4 0.01 4 0.08 Benchmark28 25 8 — 4 0.17 4 0.01 4 0.05 Benchmark29 32 8 0.08 8 0.05 8 0.01 4 0.37 Benchmark30 22 8 0.55 4 0.12 8 0.01 4 0.03 Benchmark31 29 4 0.13 4 0.25 8 0.01 4 0.25 Benchmark32 24 4 0.11 8 0.07 8 0.01 4 0.64 Benchmark33 36 4 0.50 8 — 8 0.01 4 0.10 Benchmark34 23 8 1.12 8 0.05 8 0.01 8 — Benchmark35 17 4 0.15 8 0.10 8 0.01 4 0.09 Benchmark36 71 8 1.01 8 0.09 8 0.01 4 1.00 Benchmark37 21 4 0.62 8 0.14 8 0.01 4 0.87 Benchmark38 20 8 0.14 8 0.05 8 0.01 4 0.32 Benchmark39 62 4 0.27 4 0.28 4 0.01 4 0.40 Benchmark40 30 8 0.86 8 0.06 8 0.01 4 0.94 Benchmark41 25 8 2.69 4 0.16 8 0.01 4 0.53 Benchmark42 37 8 0.08 4 0.07 4 0.01 4 0.07 Benchmark43 27 4 0.08 4 0.18 4 0.01 4 0.05 Benchmark44 35 4 0.36 8 0.22 8 0.01 4 1.25 Benchmark45 44 8 0.30 8 0.11 8 0.01 4 0.65 Benchmark46 24 8 0.12 8 0.05 8 0.01 4 0.18 Figure5.Experimentalresults Name Strengthenings Iterations Backtracks #Invariants Disjunctive? Avg.Inv.Size Benchmark1 2 3 0 1 no 2.0 Benchmark2 3 4 0 1 no 5.0 Benchmark3 0 1 0 3 yes 1.7 Benchmark4 1 6 4 1 yes 2.0 Benchmark5 2 3 0 1 no 2.0 Benchmark6 4 5 0 2 yes 5.0 Benchmark7 2 14 11 1 yes 4.0 Benchmark8 3 14 10 1 no 3.0 Benchmark9 6 8 0 4 no 1.0 Benchmark10 2 3 1 1 yes 5.0 Benchmark11 2 14 12 1 yes 4.0 Benchmark12 7 74 68 2 yes 5.0 Benchmark13 2 28 25 1 yes 8.0 Benchmark14 2 29 26 1 no 5.0 Benchmark15 – – – – – – Benchmark16 1 23 21 1 yes 2.0 Benchmark17 7 7 2 2 no 2.0 Benchmark18 2 234 226 1 no 4.0 Benchmark19 – – – – – – Benchmark20 2 132 129 1 yes 1.5 Benchmark21 2 3 0 1 yes 9.0 Benchmark22 2 3 0 1 no 4.0 Benchmark23 2 3 0 1 no 3.0 Benchmark24 2 3 0 2 no 1.7 Benchmark25 4 5 0 2 no 2.0 Benchmark26 6 8 0 2 yes 5.0 Benchmark27 7 8 0 3 yes 2.7 Benchmark28 2 7 3 2 no 2.0 Benchmark29 2 3 0 2 no 1.0 Benchmark30 2 3 0 1 no 2.0 Benchmark31 2 4 0 3 yes 5.3 Benchmark32 3 27 25 1 yes 11.0 Benchmark33 6 7 0 3 no 1.7 Benchmark34 – – – – – – Benchmark35 1 19 17 1 yes 3.0 Benchmark36 2 7 4 4 no 3.5 Benchmark37 2 94 92 1 yes 2.0 Benchmark38 2 17 14 1 yes 4.0 Benchmark39 0 1 0 1 yes 11.0 Benchmark40 7 57 52 2 yes 3.0 Benchmark41 3 4 0 1 yes 10.0 Benchmark42 2 3 0 1 yes 5.0 Benchmark43 1 2 0 1 no 3.0 Benchmark44 1 46 44 1 yes 6.0 Benchmark45 10 11 0 3 yes 6.0 Benchmark46 2 10 7 1 yes 4.0 Figure6.Statisticsaboutalgorithmandthebenchmarks Tothebestofourknowledge,theonlypreviousapplica-tionofabductiontoinvariantgenerationisinthecontextofresourceinvariantsynthesisusingseparationlogic[46].Foreachlockintheprogram,aresourceinvariantisanasser-tionthatholdswhenevernothreadhasacquiredthatlock.Theworkdescribedin[46]usesbi-abductiveinferenceinseparationlogictoinfersuchresourceinvariants.Thereareseveralkeydifferencesbetweentheworkdescribedin[46]andthispaper.First,here,weconsidertheproblemofinfer-ringPresburgerarithmeticinvariantswhereas[46]considersresourceinvariantsexpressibleinseparationlogic.However,thepresentworkcannotbeviewedassimplyapplyingthatmethodtoarithmeticinvariants.Amongmanydifferences,[46]usesaxedheapabstrationfunctiontocomputebi-abductiveinferencesandgeneratesonlyonerenementforagivencounterexample.Usingaxedabstractionwouldnotworkforourapplicationdomainbecausetheheartofourapproachistogeneratearangeofabductiveinferencesandconstructtheinvariantbybacktrackingsearch.Ourownrecentworkhasappliedabductiveinferencetothediagnosisoferrorreportsgeneratedbyvericationtools[47]andtheconstructionofcircularcompositionalprogramproofs[48].Specically,[47]usesabductiveinfer-encetogeneratequeriesthatareusedtohelpusersdecidewhetherstaticanalysiswarningscorrespondtorealbugsorfalsealarms.Ourrecentworkdescribedin[48]usesabduc-tiontodecomposetheprogram'sproofofcorrectnessintosmalllocallemmas,eachofwhichareprovenbyadiffer-enttoolorabstractioninacircularcompositionalmanner.TheabductionalgorithmwepresentinSection4.2issimi-lartotheabductionalgorithmsusedin[47,48],butadaptedforthepurposeofgeneratingcandidatestrengthenings.Themaincontributionofthepresentpaperistoapplylogicalabductioninthecontextofautomaticnumericinvariantgen-eration.Tothebestofourknowledge,thisistherstpapertodemonstratethatalogicalabductionprocedurebasedonquantiereliminationispowerfulforautomaticallyinferringinterestingnumericloopinvariants.8.ConclusionandFutureWorkInthispaper,wehavepresentedanewmethodforgeneratingloopinvariantsthatareexpressibleinPresburgerarithmetic.OurtechniqueperformsabacktrackingsearchthatcombinesHoare-styleprogramreasoningwithlogicalabductionbasedonquantiereliminationtospeculatecandidateinvariants.Theinferredloopinvariantsareiterativelystrengthenedun-tiltheyarebothinductiveandstrongenoughtoprovepro-gramcorrectness.Experimentsonasetofbenchmarkstakenfromavarietyofexistingandnewsourcesindicatethatourapproachiseffectiveinpracticeandcaninferinvariantsthatcannotbeestablishedbyexistingtools.Infuturework,weplanextendtheapplicabilityoftheapproachdescribedinthispaperbyaddressingtwokeyissues:1.Scalability:Tomaketheproposedapproachusefulforanalyzinglarge,real-worldprograms,webelieveitisnecessarytoreducebacktrackingasmuchaspossible.Forthispurpose,weplantoexploredifferentsearchstrategiesthanthesimpledepth-rststrategyconsideredinthispaper.Furthermore,weplantouseunderapproxi-mationsforquicklyrulingoutwrongabductivespecula-tions.2.Abductioninricherlogicaltheories:Whilethispaperonlyaddressesnumericinvariantgeneration,makingtheproposedapproachpracticalforreal-worldprogramsre-quiresreasoningaboutdatastructureinvariants.Sincesuchinvariantsareonlyexpressibleinricherlogicalthe-oriessuchasthetheoryofuninterpretedfunctionsorthetheoryofarrays,weplantoexploreabductionalgorithmsforricherlogics.Sincesuchlogicsdonotadmitquantierelimination,abductionmustbeperformedeitherthroughsound,butapproximatequantiereliminationproceduressuchas[49]orthroughdomain-specicinferencerulesforaparticulartheory.References[1]Cousot,P.,Halbwachs,N.:AutomaticDiscoveryofLinearRestraintsamongVariablesofaProgram.In:POPL,ACM(1978)84–96[2]Min´e,A.:Theoctagonabstractdomain.Higher-OrderandSymbolicComputation19(1)(2006)31–100[3]Cousot,P.,Cousot,R.:Systematicdesignofprogramanalysisframeworks.In:POPL,ACM(1979)269–282[4]Karr,M.:Afnerelationshipsamongvariablesofaprogram.A.I.(1976)133–151[5]Gupta,A.,Rybalchenko,A.:Invgen:Anefcientinvariantgenerator.In:ComputerAidedVerication,Springer(2009)634–640[6]Col´on,M.,Sankaranarayanan,S.,Sipma,H.:Linearinvariantgenerationusingnon-linearconstraintsolving.In:ComputerAidedVerication,Springer(2003)420–432[7]Henzinger,T.,Jhala,R.,Majumdar,R.,Sutre,G.:SoftwarevericationwithBLAST.In:InternationalconferenceonModelcheckingsoftware.(2003)235–239[8]Ball,T.,Rajamani,S.:Theslamtoolkit.In:Computeraidedverication,Springer(2001)260–264[9]McMillan,K.:Lazyannotationforprogramtestingandver-ication.In:ComputerAidedVerication,Springer(2010)104–118[10]Henzinger,T.,Jhala,R.,Majumdar,R.,McMillan,K.:Ab-stractionsfromproofs.ACMSIGPLANNotices39(1)(2004)232–244[11]McMillan,K.:Interpolationandsat-basedmodelchecking.In:ComputerAidedVerication,Springer(2003)1–13[12]Flanagan,C.,Leino,K.R.M.,Lillibridge,M.,Nelson,G.,Saxe,J.B.,Stata,R.:Extendedstaticcheckingforjava.In:ProceedingsoftheACMSIGPLAN2002ConferenceonPro- [47]Dillig,I.,Dillig,T.,Aiken,A.:Automatederrordiagno-sisusingabductiveinference.In:Proceedingsofthe33rdACMSIGPLANconferenceonProgrammingLanguageDe-signandImplementation.PLDI'12,NewYork,NY,USA,ACM(2012)181–192[48]Li,B.,Dillig,I.,Dillig,T.,McMillan,K.,Sagiv,M.:Synthesisofcircularcompositionalprogramproofsviaabduction.In:Proceedingsofthe19thinternationalconferenceonToolsandAlgorithmsfortheConstructionandAnalysisofSystems.TACAS'13,Springer-Verlag(2013)370–384[49]Gulwani,S.,Musuvathi,M.:CoverAlgorithms.In:ESOP.(2008)193–207