Abstract:Automatic verification of concurrent programs faces state explosion due to the exponential possible interleavings of its sequential components coupled with large or infinite state spaces. An alternative is deductive verification, where given a candidate invariant, we establish inductive invariance and show that any state satisfying the invariant is also safe. However, learning (inductive) program invariants is difficult. To this end, we propose a data-driven procedure to synthesize program invariants, where it is assumed that the program invariant is an expression that characterizes a (hopefully tight) over-approximation of the reachable program states. The main ideas of our approach are: (1) We treat a candidate invariant as a classifier separating states observed in (sampled) program traces from those speculated to be unreachable. (2) We develop an enumerative, template-free approach to learn such classifiers from positive and negative examples. At its core, our enumerative approach employs decision trees to generate expressions that do not over-fit to the observed states (and thus generalize). (3) We employ a runtime framework to monitor program executions that may refute the candidate invariant; every refutation triggers a revision of the candidate invariant. Our runtime framework can be viewed as an instance of statistical model checking, which gives us probabilistic guarantees on the candidate invariant. We also show that such in some cases, our counterexample-guided inductive synthesis approach converges (in probability) to an overapproximation of the reachable set of states. Our experimental results show that our framework excels in learning useful invariants using only a fraction of the set of reachable states for a wide variety of concurrent programs.

Automatic Invariant Synthesis for Arrays in Simple Programs

Invariant Synthesis for Programs Manipulating Arrays with Unbounded Data

A Framework for Array Invariants Synthesis in Induction-Loop Programs.

Loop invariant synthesis in a combined abstract domain

Beyond the elementary representations of program invariants over algebraic data types

Infer Precise Program Invariant Using Abstract Interpretation with Recurrence Solving.

Post-condition-Directed Invariant Inference for Loops over Data Structures.

Probabilistic Program Verification Via Inductive Synthesis of Inductive Invariants.

A simple abstraction of arrays and maps by program translation

Using Dynamic Analysis to Generate Disjunctive Invariants

Automatic Inference of Relational Object Invariants

Synthesizing invariants by solving solvable loops

Automatic Synthesis of Piecewise Linear Quadratic Invariants for Programs

Invariant Checking for SMT-based Systems with Quantifiers

Automatic Program Instrumentation for Automatic Verification (Extended Technical Report)

Data-Driven Template-Free Invariant Generation

Ilinva: Using Abduction to Generate Loop Invariants

Invariant Generation through Strategy Iteration in Succinctly Represented Control Flow Graphs

Regular Abstractions for Array Systems

Verifying spatial properties of array computations

Permission Inference for Array Programs