## WING 2009 WORKSHOP ON INVARIANT GENERATION

### BibTeX

@MISC{Proceedings_wing2009,

author = {Working Proceedings and Andrew Irel and Laura Kovács},

title = {WING 2009 WORKSHOP ON INVARIANT GENERATION},

year = {}

}

### OpenURL

### Abstract

Whether working at the level of abstract design models or concrete loop-based code, inductive invariants play a pivotal role in specifying and reasoning about software systems. Inductive invariants capture design intuitions, so not surprisingly their generation represents a significant research challenge. In general, no single technique or approach will adequately address this challenge. Progress will most likely require novel integrations of complementary techniques and approaches. By promoting the exchange of ideas and experiences, the WING workshop series aims to support the development of such integrations. Engagement from across a number of fields is therefore a very important ingredient for a successful workshop. So we are delighted that this, the second WING workshop, has attracted a strong grouping of researchers, each bringing a different perspective on the challenge of invariant generation. This diversity is reflected in the submissions, which include both algorithmic and heuristic approaches to invariant discovery and verification. The use of novel formalisms, new logics and reasoning techniques are also well represented, while a diverse range of applications is good to see. We are delighted to have two excellent keynote speakers, Leonardo de Moura (Microsoft Research) and Andrey Rybalchenko (Max Planck Institute for Software Systems). Both have significant research expertise and insights into the challenges and opportunities for the growing WING community.

### Citations

548 |
A Computational Logic
- Boyer, Moore
- 1979
(Show Context)
Citation Context ...ion of inductive proofs has been a research topic for more than 30 years. Several systems for reasoning about programs in functional programming languages have induction heuristics, most notably ACL2 =-=[8, 7]-=-, Verifun [29, 1], RRL [18], and Rippling [9]. ACL2 has a powerful mechanism for generating induction schemes from recursive definitions. However, the mechanism for induction formula generalisation is... |

409 |
A Computational Logic Handbook
- Boyer, Moore
(Show Context)
Citation Context ...tion is accomplished using an analysis of the spuriousness of counter examples. Also in [7] Das and Dill use the spurious trace in discovering predicates for the predicate abstraction. Das et. al. in =-=[8]-=- introduce Morφ −− which is a prototype for the verification of invariants in predicate abstraction. McMillan et. al. in [14, 19] and Henzinger, et. al. in [11] use interpolation to detect feasibility... |

69 |
The collected papers of Gerhard Gentzen
- Gentzen
- 1969
(Show Context)
Citation Context ...rns and suggesting ways of “patching” the failed proof, which is encapsulated in Proof Critics. We refer to the set of critics built-up for a particularly theory as its library of critics. IsaPlanner =-=[10]-=- is a Proof Planner for the Isabelle proof assistant. The features of the system which are of particular importance for the work in this paper are: • it provides a programatic way to manage the names ... |

66 | A Dynamic Logic for the formal verification of Java Card programs
- Beckert
- 2000
(Show Context)
Citation Context ... our approach. Finally, Section 5 presents concluding remarks and discusses future work. 2 Preliminary Definitions In this section we reiterate the classical definition of timed automata according to =-=[4, 1]-=-. Additional concepts and notations which will be used throughout the paper are also introduced in this section. A timed automaton consists of a finite state automaton together with a finite set of cl... |

47 |
Rippling: Meta-Level Guidance for Mathematical Reasoning
- Bundy, Basin, et al.
- 2005
(Show Context)
Citation Context ...ation ∃. A key step in such a proof, is to find the correct witness for A, known as the refinement mapping [1]. Proof planning has previously been used to find complex witnesses for ∃ bound variables =-=[9, 30]-=-. We believe that due to the similarity between the rules for ∃ and ∃ , a proof planning approach can also be used to find refinement mappings. 8 Conclusion Hume is a Turing-complete programming langu... |

14 |
Ramarathnam Venkatesan. Program analysis as constraint solving
- Gulwani, Srivastava
(Show Context)
Citation Context ...it is not constrained by an existing set of rules. TLA, and the full TLA + specification language [29], which combines TLA with a variant of ZF set theory, has been used both in industry and academia =-=[5, 12, 27]-=-. In [12], Gafni and Lamport illustrate the building of a sufficiently strong invariant by verifying the Disc Paxos algorithm. The algorithm is verified in a bottom-up fashion, where smaller invariant... |

13 |
Jerzy Tiuryn. Dynamic Logic. Foundations of Computing
- Harel, Kozen
- 2000
(Show Context)
Citation Context ...ace in discovering predicates for the predicate abstraction. Das et. al. in [8] introduce Morφ −− which is a prototype for the verification of invariants in predicate abstraction. McMillan et. al. in =-=[14, 19]-=- and Henzinger, et. al. in [11] use interpolation to detect feasibility of the abstract trace and also to extract predicates from the proof for use in the abstraction. McMillan and Amla [20] introduce... |

9 |
Improvements in formula generalization
- Aderhold
- 2007
(Show Context)
Citation Context ...oiding irrelevant predicates [...]” The purpose of our work is to provide support for an automated predicate abstraction technique for dense real-time models according to the timed automaton model of =-=[1]-=- by generating a more useful set of predicates than a manual, ad-hoc process would be able to provide. We analyze the behaviour of the system under verification to discover its local state invariants.... |

8 | Handling Java’s abrupt termination in a sequent calculus for Dynamic Logic
- Beckert, Sasse
- 2001
(Show Context)
Citation Context ...re-injective than R ′ if and only if R̂R ⊆ R ′ ̂ R ′ . To understand this definition, consider that each function partitions its domain into equivalence classes, called the level sets of the function =-=[6]-=-; a more-injective function is one whose level sets define a finer partition of the domain. A total deterministic relation R is said to be injective if and only if it is moreinjective than I. A relati... |

7 | Proof reuse for deductive program verification
- Beckert, Klebanov
- 2004
(Show Context)
Citation Context ...her shape-related domains. The first adds more shape predicates to the domain to increase expressiveness, like doubly linked lists and trees ([13]). The second extension, for example the size domain (=-=[5]-=-), allows us to reason about properties such as length of lists, sortedness, and so forth. With the extended domains, the abstract semantics and analysis algorithm will remain conceivably the same, bu... |

5 | Using a software testing technique to improve theorem proving
- Hähnle, Wallenburg
- 2004
(Show Context)
Citation Context ...orrectness of a loop invariant. We are interested in cases where the loop invariant is not strong enough and must be modified. 2.2 IsaPlanner Proof assistants, such as Isabelle [23], Coq [27] and HOL =-=[13]-=-, provide a framework for formalisation tasks such as software verification and mechanised mathematics. Typically, automation is developed by writing programs, called tactics, that combine operations ... |

4 |
First-order logic
- Giese
(Show Context)
Citation Context ...he predicate abstraction. Das et. al. in [8] introduce Morφ −− which is a prototype for the verification of invariants in predicate abstraction. McMillan et. al. in [14, 19] and Henzinger, et. al. in =-=[11]-=- use interpolation to detect feasibility of the abstract trace and also to extract predicates from the proof for use in the abstraction. McMillan and Amla [20] introduce a proof-based automatic abstra... |

2 |
A fast disprover for verifun
- Aderhold, Walther, et al.
- 2006
(Show Context)
Citation Context ..., HW-Hume level [18], and to reason about different Hume scheduling strategies [15]. Finally, the work presented here is at the action level of TLA, which is similar to Action Systems [3] and Event-B =-=[2]-=-. Thus, we believe this work is also applicable in these formalisations. 7 Future work This paper has applied rippling and critics to one small example. Extending this to programs of multiple concurre... |

2 |
Generation of Induction Axioms and Generalizations
- Hummel
- 1990
(Show Context)
Citation Context ...ed to the output wires. If a pattern fails, the next match is attempted. Hume boxes are scheduled in a two-phase lock step scheduling algorithm, where each step works as follows 3 : 3 See for example =-=[15]-=- for details. 47Towards Automated Property Discovery within Hume Grov, Ireland - each box is executed and output is produced in a result buffer (e.g. out of themult box of Figure 1) in the execute ph... |