Software Reliability Lab

Example Event

Sat, 01 Jun 2030 13:00:00 +0000

Slides can be added in a few ways:

Create slides using Wowchemy’s Slides feature and link using slides parameter in the front matter of the talk file
Upload an existing slide deck to static/ and link using url_slides parameter in the front matter of the talk file
Embed your slides (e.g. Google Slides) or presentation video on this page using shortcodes.

Further event details, including page elements such as image galleries, can be added to the body of this page.

An Empirical Study of Policy as Code: Adoption, Purpose, and Maintenance

Tue, 31 Mar 2026 00:00:00 +0000

Five Papers Accepted So Far in 2026

Tue, 31 Mar 2026 00:00:00 +0000

Paper update: the Software Reliability Lab has five papers accepted so far in 2026, spanning ICSE, FSE, MSR, EASE, and LAST-X.

We are delighted to share that, by the end of March, the Software Reliability Lab already has five papers accepted in 2026:

MutDafny: A Mutation-Based Approach to Assess Dafny Specifications
Accepted at the IEEE/ACM International Conference on Software Engineering (ICSE 2026).
Authors: Isabel Amaral, Alexandra Mendes, and José Campos.
ProfOlaf: Semi-Automated Tool for Systematic Literature Reviews
Accepted at the ACM International Conference on the Foundations of Software Engineering (FSE 2026), Tool Demonstrations Track.
Authors: Martim Afonso, Nuno Saavedra, Bruno Lourenço, Alexandra Mendes, and João F. Ferreira.
An Empirical Study of Policy as Code: Adoption, Purpose, and Maintenance
Accepted at the International Conference on Mining Software Repositories (MSR 2026).
Authors: Ruben Opdebeeck, Mahmoud Alfadel, Akond Rahman, Yutaro Kashiwa, João F. Ferreira, Raula Gaikovina Kula, and Coen De Roover.
The Ultimate Configuration Management Tool? Lessons from a Mixed Methods Study of Ansible’s Challenges
Accepted at the International Conference on Evaluation and Assessment in Software Engineering (EASE 2026).
Authors: Carolina Carreira, Nuno Saavedra, Alexandra Mendes, and João F. Ferreira.
Vibenix: An AI Assistant for Software Packaging with Nix
Accepted at the Workshop on LLM Assisted Security and Trust Exploration (LAST-X 2026), co-located with NDSS Symposium 2026.
Authors: Martin Schwaighofer, Martim Monis, Nuno Saavedra, João F. Ferreira, and Rene Mayrhofer.

Congratulations to all the authors!

ProfOlaf: Semi-Automated Tool for Systematic Literature Reviews

Tue, 17 Mar 2026 00:00:00 +0000

The Ultimate Configuration Management Tool? Lessons from a Mixed Methods Study of Ansible's Challenges

Fri, 13 Mar 2026 00:00:00 +0000

Vibenix: An AI Assistant for Software Packaging with Nix

Fri, 27 Feb 2026 00:00:00 +0000

InfraGov Final Technical Meeting at INESC-ID

Sun, 01 Feb 2026 00:00:00 +0000

The InfraGov research team met at INESC-ID, in Lisbon, for a two-day final project meeting focused on technical integration and engagement with our Public Administration partners.

On 29 January 2026, the InfraGov research team researchers held the final technical meeting. Throughout the day, we refined the integration of results across the different work packages and prepared the final demonstration of our framework.

On 30 January 2026, we presented the project outcomes to our Public Administration partners, sharing the main technical advances and discussing their practical impact and next steps.

It was an excellent meeting with an outstanding team spirit. We also enjoyed a social dinner on the evening of 29 January, which was a great opportunity to strengthen collaboration in an informal setting.

Photos from the Meeting

The “North” team on the way to the event on 29 January 2026. All trains were cancelled due to bad weather, so we had to travel by bus.

Luís Barbosa and Carlos Felgueiras working together on integration details and demo readiness of InfraBot.

Martim Monis, Daniel Carvalho, and Rodrigo Silva preparing the final demo of the AI components.

Nuno Saavedra capturing the good mood of the meeting.

Carolina Carreira refining aspects on the human aspects of the project.

Social Dinner on the evening of 29 January 2026.

InfraGov research team photo from the final meeting in Lisbon (30 January 2026).

MutDafny: A Mutation-Based Approach to Assess Dafny Specifications

Thu, 01 Jan 2026 00:00:00 +0000

Year in Review: 2025 Highlights and Achievements

Tue, 30 Dec 2025 00:00:00 +0000

Year in Review: As we bid farewell to 2025, it’s time to reflect on the remarkable milestones and achievements that have defined this year.

The Software Reliability Lab has had an extraordinary year filled with prestigious awards, groundbreaking research publications, major funding successes, and memorable team experiences. Here are the highlights from 2025.

🏆 Awards and Recognition

Two Amazon Research Awards

In June, we celebrated a major milestone: Alexandra Mendes and João F. Ferreira each received an Amazon Research Award in Automated Reasoning! Alexandra’s award focuses on “Overcoming Barriers to the Adoption of Verification-Aware Languages” with Dafny, while João’s proposal addresses “Polyglot Automated Program Repair for Infrastructure as Code.”

These awards recognize the cutting-edge research conducted at the Software Reliability Lab and provide crucial support for advancing automated reasoning and formal methods.

ACM SIGSOFT Distinguished Paper Award at ICSE 2025

Our lab started the year with a bang! Nuno Saavedra and João F. Ferreira, along with collaborators from UC San Diego, Imperial College London, and UMass, received the ACM SIGSOFT Distinguished Paper Award at ICSE 2025, the premier conference in software engineering, for the paper “Rango: Adaptive Retrieval-Augmented Proving for Automated Software Verification.”

Rango introduces an innovative automated proof synthesis tool that uses machine learning and large language models with retrieval augmentation techniques. Tested on the newly created CoqStoq dataset of over 2,200 open-source Coq projects, Rango successfully synthesized proofs for 32% of theorems, representing a 29% improvement over previous state-of-the-art tools.

Most Cited Papers from ICSE and ASE According to Scholar Metrics

Another highlight this year came from recognizing the lasting impact of our earlier work on smart contract analysis. According to the 2025 Scholar Metrics, the paper “Empirical Review of Automated Analysis Tools on 47,587 Ethereum Smart Contracts” (T. Durieux, J.F. Ferreira, R. Abreu, P. Cruz – ICSE 2020) is the most cited paper from ICSE, while the companion paper “SmartBugs: A Framework to Analyze Solidity Smart Contracts” (J.F. Ferreira, P. Cruz, T. Durieux, R. Abreu – ASE 2020) ranks as the fourth most cited paper from ASE!

What started as a simple need to create a proper dataset for evaluating smart contracts evolved into SmartBugs, a framework that has been adopted in CI pipelines, audits, and teaching worldwide (including at TU Wien). The tool has grown far beyond its initial prototype, with the community continuously extending it with new tools and features, leading to SmartBugs 2.0 featured in an Empirical Software Engineering 2024 paper.

💰 Major Funding Success

InfraGov: New Project on IT Infrastructure Reliability

In March, João F. Ferreira and Alexandra Mendes secured funding for the InfraGov project, addressing critical challenges in the reliability and security of Infrastructure as Code (IaC) used in Public Administration.

InfraGov is developing a technology-agnostic framework for automated detection and repair of errors and vulnerabilities in IaC, leveraging cutting-edge advances in generative AI. The project is being developed in close collaboration with key Portuguese government partners: AMA, IGFEJ, and ESPAP. This ensures real-world impact across Portuguese public infrastructure.

SafeIaC: Building Technology-Agnostic Solutions for IaC

In July, we launched SafeIaC, an ambitious research project focused on building the first technology-agnostic solution for reliable analysis and automated repair of Infrastructure as Code with formal correctness guarantees.

SafeIaC aims to revolutionize how we ensure the reliability and security of DevOps systems by combining Artificial Intelligence and Formal Methods. The project builds on our lab’s expertise in Infrastructure as Code reliability, including our GLITCH and InfraFix tools, and extends this work to provide stronger guarantees about the correctness of automated repairs.

📚 Outstanding Research Publications

2025 was a great year for publications, with several papers accepted at top-tier conferences and journals! Some examples are:

Rango: Adaptive Retrieval-Augmented Proving for Automated Software Verification - ICSE 2025 (CORE A*, ACM SIGSOFT Distinguished Paper Award)
InfraFix: Technology-Agnostic Repair of Infrastructure as Code - ISSTA 2025 Tool Demonstrations Track (CORE A)
Do Experts Agree About Smelly Infrastructure? - IEEE Transactions on Software Engineering (Q1 journal)
Contract Usage and Evolution in Android Mobile Applications - ECOOP 2025 (CORE A)
What Challenges do Developers Face when using Verification-Aware Languages? - ISSRE 2025 (CORE A)
Specification-Guided Repair of Arithmetic Errors in Dafny Programs using LLMs - SEFM 2025 (CORE B)
Can Language Models Help Students Prove Software Correctness? An Experimental Study with Dafny - SEFM 2025 (CORE B)
Are Users More Willing to Use Formally Verified Password Managers? - SEFM 2025 (CORE B)
Teachers’ Perspective on Software Testing Education - ACM Transactions on Computing Education (Q1 journal)

🌍 International Collaboration and Recognition

Dagstuhl Seminar on Specification Engineering

Alexandra Mendes was invited to participate in the prestigious Dagstuhl Seminar 25392 on “Specification Engineering: Foundations for the Future of Software Development” in September. The seminar brought together leading researchers and practitioners to discuss recent advancements, challenges, and future directions in specification engineering, formal methods, and requirements engineering.

This invitation highlights our lab’s international reputation and commitment to advancing the field of software engineering.

🎉 Team Building and Lab Culture

Building a strong research community goes beyond publications and projects: it’s about the connections we build and the moments we share. Throughout 2025, our lab met regularly for lunches and dinners, fostering collaboration and camaraderie. Here we highlight two special social events that brought our team together in memorable ways.

Barracuda Submarine Visit

In October, the lab embarked on a unique team-building experience: a visit to Portugal’s historic S164 NRP Barracuda submarine, now a museum ship. The visit provided our team with fascinating insights into naval history and submarine engineering, followed by a tour of the historic Fragata D. Fernando II e Glória and a delicious Portuguese lunch.

Special thanks to Bruno Lourenço for guiding us through the submarine and sharing his extensive knowledge!

As the year drew to a close, the Software Reliability Lab came together for an online Christmas social that brought joy and friendly competition to our distributed team! 🎄

With team members spread across the country and around the world, we gathered on Discord, our virtual headquarters, for an exciting quiz night featuring three teams competing across four rounds of questions. The event was filled with laughter, teamwork, and plenty of competitive spirit as teams competed in a spirit of friendly rivalry.

A huge thank you to Carolina Carreira and Álvaro Silva for organizing such a fantastic event! It was the perfect way to celebrate the season and strengthen the bonds within our amazing research group!

🚀 From Research to Impact: Codeset.ai

Bridging the gap between academic research and real-world impact, our PhD student Nuno Saavedra and lab alumnus André Silva co-founded codeset.ai, a startup focused on transforming how developers work with code. This venture demonstrates how cutting-edge research in software reliability and automated reasoning can translate into practical tools that benefit the broader software development community.

We’re excited to see how Nuno and André’s entrepreneurial journey unfolds and look forward to the impact codeset.ai will have on the industry!

Looking Ahead to 2026

As we close 2025, we’re excited about the opportunities ahead. With new funding from Amazon, and the InfraGov and SafeIaC projects, we’re expanding our research team and continuing to push the boundaries of software reliability, automated reasoning, and formal methods.

We’re also ending the year with exciting news for 2026: Alexandra Mendes and Isabel Amaral had their paper “MutDafny: A Mutation-Based Approach to Assess Dafny Specifications” accepted at ICSE 2026 (CORE A*)! The preprint is available on arXiv.

If you’re interested in research positions on automated reasoning, program repair, or formal verification, get in touch! We have several positions available.

Thank you to all our collaborators, funding agencies, and partners who made 2025 such a successful year. Here’s to an even more impactful 2026!

Happy New Year from the Software Reliability Lab! 🎊

A Day Below Deck: Our Lab's Visit to the Barracuda Submarine

Sat, 04 Oct 2025 00:00:00 +0000

For our October social, the Software Reliability Lab visited Portugal’s historic S164 NRP Barracuda submarine, now a museum ship.

Our visit to the Barracuda Submarine provided us with a unique opportunity to explore naval history and gain insights into the technological advancements of submarine engineering. The S164 NRP Barracuda, in service since May 4, 1968, carried out a wide range of national and international missions over its 42 years of active duty. Its operations included patrols in the British sea lines, the Canary Islands, and the Western Mediterranean. After completing its final mission in 2010, the Barracuda now serves as an “active” attraction open to the public, helping preserve and promote Portugal’s naval heritage. It belonged to the Albacora-class submarines.

The visit also included a tour of the Fragata D. Fernando II e Glória, a historic frigate that has been converted into a museum ship. Our visit ended with a lunch at a nearby restaurant, where we reflected on the experience and, of course, enjoyed some delicious Portuguese cuisine.

We would like to thank Bruno Lourenço, who kindly guided us through the submarine and shared his extensive knowledge about its history and operations. Thank you, Bruno, for making our visit both educational and memorable!

Some pictures from our visit

And finally, an edited photo for fun! (Can you spot the joke?)

Alexandra Mendes participates in Dagstuhl Seminar on Specification Engineering

Fri, 26 Sep 2025 00:00:00 +0000

Alexandra Mendes was invited to participate in the Dagstuhl Seminar 25392 on Specification Engineering: Foundations for the Future of Software Development.

The Dagstuhl Seminar 25392 on Specification Engineering: Foundations for the Future of Software Development was held from September 21 to 26, 2025, in Dagstuhl, Germany.

The seminar brought together leading researchers and practitioners in the field of specification engineering to discuss recent advancements, challenges, and future directions. Topics covered included formal methods, requirements engineering, model-driven development, and the integration of specifications into modern software development practices.

This demonstrates Software Reliability Lab’s commitment to advancing the field of software engineering through active participation in high-profile academic events.

Link to seminar: https://www.dagstuhl.de/seminars/seminar-calendar/seminar-details/25392

Are Users More Willing to Use Formally Verified Password Managers?

Sun, 07 Sep 2025 00:00:00 +0000

Can Large Language Models Help Students Prove Software Correctness? An Experimental Study with Dafny

Sun, 07 Sep 2025 00:00:00 +0000

Specification-Guided Repair of Arithmetic Errors in Dafny Programs using LLMs

Sun, 07 Sep 2025 00:00:00 +0000

Three Papers Accepted at SEFM 2025

Fri, 15 Aug 2025 00:00:00 +0000

The Software Reliability Lab has three papers accepted at SEFM 2025!

The Software Reliability Lab has three papers accepted at the 23rd International Conference on Software Engineering and Formal Methods (SEFM 2025), to be held in Toledo, Spain, from November 10 to 14, 2025.

The three accepted papers are:

Specification-Guided Repair of Arithmetic Errors in Dafny Programs using LLMs
Authors: Valentina Wu, Alexandra Mendes, and Alexandre Abreu
Can Language Models Help Students Prove Software Correctness? An Experimental Study with Dafny
Authors: Carolina Carreira, Álvaro Silva, Alexandre Abreu, and Alexandra Mendes
Are Users More Willing to Use Formally Verified Password Managers?
Authors: Carolina Carreira, João Ferreira, Alexandra Mendes, and Nicolas Christin

All papers available here: Software Reliability Lab Publications.

Congratulations to all the authors!

Update (After Event)

Here are some photos of Carolina Carreira and Alexandre Abreu at SEFM, who presented our work at the conference.

What Challenges do Developer Face when using Verification-Aware Languages?

Sun, 20 Jul 2025 00:00:00 +0000

SafeIaC: Reliable Analysis and Automated Repair for Infrastructure as Code

Tue, 01 Jul 2025 00:00:00 +0000

SafeIaC is building the first technology-agnostic solution for reliable analysis and automated repair for Infrastructure as Code that provides formal correctness guarantees.

In our modern world, the reliability and security of software systems are foundational to the functioning of critical infrastructure, financial systems, healthcare, and virtually every aspect of daily life. Central to the operation of these systems is the configuration and infrastructure code that defines and manages the environment in which applications run. This process of using programmable configuration files to provision and manage IT infrastructure is known as Infrastructure as Code (IaC).

Despite the many benefits provided by IaC, such as enabling more reliable and predictable deployments and supporting scalability with minimal effort, errors in these critical pieces of code are a significant source of system failures and degradation. Such mistakes lead to security vulnerabilities, application outages, and incorrect program executions, undermining the stability and reliability of essential services.

Despite the critical role of configuration and infrastructure code in software system reliability and security, research focusing on the reliable configuration and infrastructure as code remains scarce. In this project, we aim to address this gap by developing methodologies for the reliable analysis and automated repair of software configuration and infrastructure code. This goal faces several challenges, including the diversity of IaC technologies, the complexity of IaC ecosystems, and the need for techniques that can accurately model and reason about these systems’ behavior. Developing solutions that are both efficient and effective requires innovative approaches to modeling and analyzing the unique structures and semantics of infrastructure as code.

Building upon recent developments by our research team (Saavedra and Ferreira, 2022; Saavedra et al. 2023), we propose the first technology-agnostic solution for reliable analysis and automated repair for Infrastructure as Code that provides formal correctness guarantees. Our envisaged solution will encompass both the versatility of technology-agnostic support across various languages and environments and the reliability of formal correctness guarantees, addressing the needs of the industry by providing a singular solution to the previously unmet challenge of polyglot automated repair and reliable IaC management. We plan to cover a wide range of errors, including code smells, configuration inconsistencies, dependency errors, and so-called configuration drifts (which happen when the state of a system deviates from what is specified in the system’s configuration file).

Contacts

Principal Investigator (INESC-ID): João F. Ferreira

Principal Investigator (INESC TEC): Alexandra Mendes

Project website

Research and Academic Institutions:

Industry Partners:

Funding

SafeIaC is funded by Fundação para a Ciência e a Tecnologia (FCT) under the program MPr-12-2023 - ICDT/2023. Funded amount: 249.609,60 €

Teachers’ Perspective on Software Testing Education

Tue, 01 Jul 2025 00:00:00 +0000

Two Amazon Research Awards on Automated Reasoning!

Tue, 03 Jun 2025 00:00:00 +0000

Congratulations to Alexandra Mendes and João F. Ferreira, each awarded an Amazon Research Award in Automated Reasoning!

Alexandra was awarded an Amazon Research Award for her proposal “Overcoming Barriers to the Adoption of Verification-Aware Languages”, focusing on Dafny. João’s proposal is on “Polyglot Automated Program Repair for Infrastructure as Code”.

If you are looking for research positions on these topics, get in touch! We have several positions to offer. See also our opportunities page.

Many thanks to Amazon Science for supporting this research! It’s a recognition of the work that we do at the Software Reliability Lab!

You can read more about the program and see the full list of recipients here: 70 Amazon Research Award recipients announced

Learn more about the program on the Amazon Science website.

Detecting Resource Leaks on Android with Alpakka

Sun, 18 May 2025 00:00:00 +0000

Rango: Adaptive Retrieval-Augmented Proving for Automated Software Verification

Sun, 27 Apr 2025 00:00:00 +0000

InfraFix: Technology-Agnostic Repair of Infrastructure as Code

Fri, 11 Apr 2025 00:00:00 +0000

ACM SIGSOFT Distinguished Paper Award at ICSE 2025

Thu, 03 Apr 2025 00:00:00 +0000

Congratulations to Nuno Saavedra and João F. Ferreira for winning an ACM SIGSOFT Distinguished Paper Award at ICSE 2025 for their paper “Rango: Adaptive Retrieval-Augmented Proving for Automated Software Verification”.

Nuno Saavedra and João F. Ferreira, in collaboration with researchers from the University of California San Diego, Imperial College London, and the University of Massachusetts, have received the ACM SIGSOFT Distinguished Paper Award at the International Conference on Software Engineering (ICSE) 2025.

The paper “Rango: Adaptive Retrieval-Augmented Proving for Automated Software Verification,” introduces an innovative automated proof synthesis tool that uses machine learning and large language models with retrieval augmentation techniques. Rango dynamically identifies and incorporates relevant proofs and premises during each step of the verification process, adapting to both the project context and the evolving state of the proof. Tested on the researchers’ newly created CoqStoq dataset of over 2,200 open-source Coq projects, Rango successfully synthesized proofs for 32% of theorems—representing a 29% improvement over previous state-of-the-art tools and demonstrating its potential to make formal verification more accessible to developers.

The research team also includes Robert Thompson (University of California San Diego), Pedro Carrott (Imperial College London and a former MSc student at our group), Kevin Fisher (University of California San Diego), Alex Sanchez-Stern (University of Massachusetts), Yuriy Brun (University of Massachusetts), Sorin Lerner (University of California San Diego), and Emily First (University of California San Diego).

ICSE is the premier conference in software engineering, and the ACM SIGSOFT Distinguished Paper Award recognizes papers of exceptional quality presented at the conference. This achievement highlights our group’s commitment to excellence in research and international collaboration.

Congratulations to Nuno, João, and the entire research team on this outstanding achievement!

João, Yuriy, Kyle, Alex, and Emily were present at ICSE. Here’s a photo of the award session:

Do Experts Agree About Smelly Infrastructure?

Wed, 19 Mar 2025 00:00:00 +0000

InfraGov: A Public Framework for Reliable and Secure IT Infrastructure

Sat, 01 Mar 2025 00:00:00 +0000

As Public Administration services move to digital platforms, the reliability and security of IT infrastructure become even more critical to ensure seamless service delivery, safeguard citizens’ personal information, and maintain public trust in governmental systems. Central to the operation of these services is the configuration and infrastructure code that defines and manages the environment in which they run. This process of using programmable configuration files to provision and manage IT infrastructure is known as Infrastructure as Code (IaC).

Despite the benefits provided by Infrastructure as Code (IaC), such as more reliable and predictable deployments, as well as scalability with minimal effort, errors in these critical pieces of code can lead to security vulnerabilities, application outages, and incorrect program executions, ultimately undermining the stability and reliability of essential services.

In this project, we aim to develop an innovative solution for automated error and vulnerability detection and repair of software configuration and infrastructure code. This goal faces several challenges, including the diversity of IaC technologies, the complexity of IaC ecosystems, and the need for techniques that can accurately model and reason about these systems’ behavior.

Building upon recent developments by our research team (Saavedra and Ferreira, 2022; Saavedra et al. 2023), we will build a language-agnostic solution for reliable analysis and automated repair for Infrastructure as Code that also uses recent developments in generative AI for reducing the time from vulnerability disclosure to mitigation. We plan to cover a wide range of errors, including code smells, configuration inconsistencies, dependency errors, and so-called configuration drifts (which happen when the state of a system deviates from what is specified in the system’s configuration file).

Our solution is tailored to meet the needs of Public Administration IT teams. By collaborating closely with our partners at Agência para a Modernização Administrativa (AMA), Instituto de Gestão Financeira e Equipamentos da Justiça (IGFEJ), and Entidade de Serviços Partilhados da Administração Pública (ESPAP), we will ensure that the solution delivers immediate and practical benefits. The timing for this research is particularly appropriate, as we observe a significant shift of critical Public Administration systems to the cloud, underscoring the need for enhanced security and reliability in cloud infrastructure.

By advancing the reliability of configuration and infrastructure code, this research has the potential to significantly reduce the incidence of system failures and security breaches. Improving the robustness of these foundational elements of software systems will enhance the stability and security of critical services, contributing to the prevention, detection, analysis, and response capabilities regarding threats, risks, and incidents that jeopardize the protection of infrastructures, data, and individuals.

Contacts

Principal Investigator (INESC-ID): João F. Ferreira

Principal Investigator (INESC TEC): Alexandra Mendes

Project website

Research and Academic Institutions:

Public Administration Partners:

Funding

InfraGov is funded by Fundação para a Ciência e a Tecnologia (FCT) under the program Inteligência Artificial, Ciência dos Dados e Cibersegurança de relevância na Administração Pública. Funded amount: 124.918,40 €

More details in the SciPROJ portal.

InfraGov: New Funded Project on Reliable and Secure IT Infrastructure

Sat, 01 Mar 2025 00:00:00 +0000

Congratulations to João F. Ferreira and Alexandra Mendes for securing funding for the InfraGov project, a new research project funded to address critical challenges in the reliability and security of Infrastructure as Code (IaC) used in Public Administration.

As more public services move to cloud-based and digital platforms, the integrity of configuration and infrastructure code becomes essential to safeguard sensitive data, prevent system outages, and maintain trust in government services. InfraGov aims to develop a technology-agnostic framework for automated detection and repair of errors and vulnerabilities in IaC, leveraging cutting-edge advances in generative AI to reduce the time from vulnerability discovery to mitigation.

The project will be developed in close collaboration with key government partners—AMA, IGFEJ, and ESPAP—ensuring real-world impact across Portuguese public infrastructure. By addressing a wide spectrum of issues, from configuration inconsistencies to security vulnerabilities, our goal is to improve the reliability, resilience, and responsiveness of essential public digital services.

InfraGov reflects our commitment to building secure and trustworthy foundations for the digital transformation of the public sector.

Contract Usage and Evolution in Android Mobile Applications

Fri, 28 Feb 2025 00:00:00 +0000

GAMFLEW: Serious game to teach white-box testing

Wed, 01 Jan 2025 22:42:47 +0000

SR Lab members meet and present their work to Portuguese Minister of Education, Science and Innovation

Tue, 12 Nov 2024 00:00:00 +0000

Alexandra Mendes, João F. Ferreira, and Martim Afonso meet and present their work to Portuguese Minister of Education, Science and Innovation at Carnegie Mellon University.

Portuguese Minister of Education, Science and Innovation, Fernando Alexandre made his first official visit to Carnegie Mellon University (CMU) in Pittsburgh, alongside the Secretary of State for Science, Ana Paiva, to attend the 2024 edition of the CMU Portugal Summit.

Alexandra presented some of her projects and talked about her experience as a Visiting Researcher at Carnegie Mellon in 2023 hosted at the CyLab Security and Privacy Institute. Her research at CMU set the ground for winning, among other recognitions, the FLAD Atlantic Security Award. Martim talked about his experience as a Visiting Student and about his current project on automated fault localization.

VeriFixer: Automated Repair of Verification-Aware Languages

Tue, 01 Oct 2024 00:00:00 +0000

VeriFixer aims to assist programmers in fixing code issues identified by software verifiers, a task that remains largely manual despite advancements in automatic program repair.

Verification-aware languages help ensure software correctness by detecting violations of formal specifications. While these languages aid developers in identifying flaws, repairing them still requires significant manual effort. VeriFixer seeks to bridge this gap by building an open-source tool that automates code repair in verification-aware languages, starting with Dafny, a language used by companies like Amazon Web Services.

The project was funded in the highly competitive FCT Exploratory Projects call, which had an acceptance rate of 21%. It is a collaboration between researchers from INESC TEC, INESC ID, and Carnegie Mellon University. In addition to developing repair techniques, VeriFixer will create publicly available datasets with real-world examples to drive further research in this area. By advancing automatic repair methods, VeriFixer contributes to making software development more efficient and reliable, particularly in critical domains such as healthcare, aerospace, and finance.

VeriFixer: New Funded Project on Automated Repair of Verification-Aware Languages

Tue, 01 Oct 2024 00:00:00 +0000

Congratulations to Alexandra Mendes for securing funding for the VeriFixer project, a new research project focused on developing automated repair techniques for verification-aware programming languages.

BIP INESC TEC Magazine: INESC TEC with Five FCT Exploratory Projects Approved in Four R&D Areas

The Only Human Factor: Formal and Statistical Methods for Secure Password Composition Policy Design and Deployment

Wed, 26 Jun 2024 00:00:00 +0000

Does Every Computer Scientist Need to Know Formal Methods?

Sat, 01 Jun 2024 00:00:00 +0000

State of the Practice in Software Testing Teaching in Four European Countries

Tue, 07 May 2024 00:00:00 +0000

Alexandra Mendes wins Atlantic Security Award 2024

Fri, 19 Apr 2024 00:00:00 +0000

Congratulations to Alexandra Mendes for being one of the two winners of the third edition of the Atlantic Security Award!

Alexandra will receive 15,000 euros to develop research that combines Large Language Models (LLMs) with dark web data, with the goal of assisting in the formulation of defense policies, strategies, and policies, and security forces operations against cybercrime, illicit trade, and other threats facilitated by the dark web in the Atlantic.

CoqPyt: Proof Navigation in Python in the Era of LLMs

Tue, 16 Apr 2024 00:00:00 +0000

How are Contracts Used in Android Mobile Applications?

Mon, 01 Apr 2024 00:00:00 +0000

Evolution of automated weakness detection in Ethereum bytecode: a comprehensive study

Tue, 02 Jan 2024 10:35:12 +0100

Leveraging Large Language Models to Boost Dafny's Developers Productivity

Tue, 02 Jan 2024 00:00:00 +0000

DifFuzzAR: automatic repair of timing side-channel vulnerabilities via refactoring

Mon, 01 Jan 2024 00:00:00 +0000

Automatic Repair of Java Code with Timing Side-Channel Vulnerabilities (2021)

Patient-centric health data sovereignty: an approach using proxy re-encryption

Sun, 08 Oct 2023 00:00:00 +0000

Polyglot Code Smell Detection for Infrastructure as Code with GLITCH

Sat, 01 Jul 2023 00:00:00 +0000

SmartBugs 2.0: An Execution Framework for Weakness Detection in Ethereum Smart Contracts

Sat, 01 Jul 2023 00:00:00 +0000

Hoogle⋆: Constants and λ-abstractions in Petri-net-based Synthesis using Symbolic Execution

Fri, 12 May 2023 00:00:00 +0000

MUFIN: Improving Neural Repair Models with Back-Translation

Wed, 05 Apr 2023 00:00:00 +0000

Contact

Mon, 24 Oct 2022 00:00:00 +0000

People

Mon, 24 Oct 2022 00:00:00 +0000

bGSL: An Imperative Language for Specification and Refinement of Backtracking Programs

Mon, 01 Aug 2022 10:35:12 +0100

A wp Calculus for a Preferential Computations: Mechanisation in Isabelle/HOL (Technical report)

GLITCH: Automated Polyglot Security Smell Detection in Infrastructure as Code

Fri, 01 Jul 2022 00:00:00 +0000

Extending EcoAndroid with Automated Detection of Resource Leaks

Sat, 14 May 2022 00:00:00 +0000

Exploring Automatic Specification Repair in Dafny Programs

Sat, 07 May 2022 00:00:00 +0000

Verified password generation from password composition policies

Sat, 07 May 2022 00:00:00 +0000

A Preliminary Study on Generating Well-Formed Q# Quantum Programs for Fuzz Testing

Mon, 04 Apr 2022 00:00:00 +0000

EcoAndroid: An Android Studio Plugin for Developing Energy-efficient Java Mobile Applications

Tue, 07 Dec 2021 00:00:00 +0000

Exploring Usable Security to Improve the Impact of Formal Verification: A Research Agenda

Tue, 23 Nov 2021 00:00:00 +0000

Formal Methods Teaching: 4th International Workshop and Tutorial (FMTea 2021)

Tue, 23 Nov 2021 00:00:00 +0000

Automatic Repair of Java Code with Timing Side-Channel Vulnerabilities

Wed, 10 Nov 2021 00:00:00 +0000

DifFuzzAR: automatic repair of timing side-channel vulnerabilities via refactoring (2024)

Towards Improving the Usability of Password Managers

Fri, 10 Sep 2021 00:00:00 +0000

Automated narrative planning model extension

Fri, 07 May 2021 00:00:00 +0000

SmartBugs: A Framework to Analyze Solidity Smart Contracts

Fri, 07 Aug 2020 00:00:00 +0000

Evaluating the Accuracy of Password Strength Meters using Off-The-Shelf Guessing Attacks

Sat, 01 Aug 2020 00:00:00 +0000

Empirical Review of Automated Analysis Tools on 47,587 Ethereum Smart Contracts

Sat, 23 May 2020 00:00:00 +0000

Summary of contributions and findings

Skeptic: Automatic, Justified and Privacy-Preserving Password Composition Policy Selection

Sat, 01 Feb 2020 00:00:00 +0000

Errata

Correction concerning the source of the datasets used (it does not affect the conclusions of the work)

Extending Narrative Planning Domains with Linguistic Resources

Wed, 15 Jan 2020 00:00:00 +0000

Automated narrative planning model extension. In Autonomous Agents (2021)

Narrative Planning Model Acquisition from Text Summaries and Descriptions

Wed, 01 Jan 2020 00:00:00 +0000

Research Opportunities

Thu, 26 Dec 2019 13:27:59 +0000

We are always looking for new talented research students and researchers. If you are interested in working with us, get in touch!

Current Opportunities

NEW: We are recruiting research students (MSc and PhD) and researchers (postdoctoral) to work on topics related to software reliability, with a particular focus on 1) the application of formal methods to domains such as DevOps; and 2) the application of AI techniques to formal methods. See the list of publications in the main website for specific topics that we are interested in. If you are interested, get in touch for more details.

If you are an MSc or PhD student and you would like to work on your thesis as part of the Software Reliability lab, get in touch. We have opportunities within our funded projects and we can work together on a project specification.
We can normally offer research grants or paid internships, depending on the ongoing funded projects. We also work with companies that offer paid internships.
The Portuguese National Science Foundation has regular funding calls for PhD studentships and postdoctoral grants, some of them for dual degrees with universities such as CMU and MIT. These opportunities are also available to non-portuguese candidates. If you are interested, we can assist you in the application process.

Mon, 01 Jan 0001 00:00:00 +0000

Software Reliability Lab

Example Event

An Empirical Study of Policy as Code: Adoption, Purpose, and Maintenance

Five Papers Accepted So Far in 2026

ProfOlaf: Semi-Automated Tool for Systematic Literature Reviews

The Ultimate Configuration Management Tool? Lessons from a Mixed Methods Study of Ansible's Challenges

Vibenix: An AI Assistant for Software Packaging with Nix

InfraGov Final Technical Meeting at INESC-ID

Photos from the Meeting

MutDafny: A Mutation-Based Approach to Assess Dafny Specifications

Year in Review: 2025 Highlights and Achievements

🏆 Awards and Recognition

Two Amazon Research Awards

ACM SIGSOFT Distinguished Paper Award at ICSE 2025

Most Cited Papers from ICSE and ASE According to Scholar Metrics

💰 Major Funding Success

InfraGov: New Project on IT Infrastructure Reliability

SafeIaC: Building Technology-Agnostic Solutions for IaC

📚 Outstanding Research Publications

🌍 International Collaboration and Recognition

Dagstuhl Seminar on Specification Engineering

🎉 Team Building and Lab Culture

Barracuda Submarine Visit

Online Christmas Social

🚀 From Research to Impact: Codeset.ai

Looking Ahead to 2026

A Day Below Deck: Our Lab's Visit to the Barracuda Submarine

Some pictures from our visit

And finally, an edited photo for fun! (Can you spot the joke?)

Alexandra Mendes participates in Dagstuhl Seminar on Specification Engineering

Are Users More Willing to Use Formally Verified Password Managers?

Can Large Language Models Help Students Prove Software Correctness? An Experimental Study with Dafny

Specification-Guided Repair of Arithmetic Errors in Dafny Programs using LLMs

Three Papers Accepted at SEFM 2025

Update (After Event)

What Challenges do Developer Face when using Verification-Aware Languages?

SafeIaC: Reliable Analysis and Automated Repair for Infrastructure as Code

Contacts

Funding

Teachers’ Perspective on Software Testing Education

Two Amazon Research Awards on Automated Reasoning!

Related News and Mentions

Detecting Resource Leaks on Android with Alpakka

Rango: Adaptive Retrieval-Augmented Proving for Automated Software Verification

InfraFix: Technology-Agnostic Repair of Infrastructure as Code

ACM SIGSOFT Distinguished Paper Award at ICSE 2025

Related News and Mentions

Do Experts Agree About Smelly Infrastructure?

InfraGov: A Public Framework for Reliable and Secure IT Infrastructure

Contacts

Funding

InfraGov: New Funded Project on Reliable and Secure IT Infrastructure

Contract Usage and Evolution in Android Mobile Applications

GAMFLEW: Serious game to teach white-box testing

SR Lab members meet and present their work to Portuguese Minister of Education, Science and Innovation

Related News and Mentions

VeriFixer: Automated Repair of Verification-Aware Languages

VeriFixer: New Funded Project on Automated Repair of Verification-Aware Languages

Related News and Mentions

The Only Human Factor: Formal and Statistical Methods for Secure Password Composition Policy Design and Deployment

Does Every Computer Scientist Need to Know Formal Methods?

State of the Practice in Software Testing Teaching in Four European Countries

Alexandra Mendes wins Atlantic Security Award 2024

Related News and Mentions

CoqPyt: Proof Navigation in Python in the Era of LLMs

How are Contracts Used in Android Mobile Applications?

Evolution of automated weakness detection in Ethereum bytecode: a comprehensive study

Leveraging Large Language Models to Boost Dafny's Developers Productivity

DifFuzzAR: automatic repair of timing side-channel vulnerabilities via refactoring

Related

Patient-centric health data sovereignty: an approach using proxy re-encryption

Polyglot Code Smell Detection for Infrastructure as Code with GLITCH

SmartBugs 2.0: An Execution Framework for Weakness Detection in Ethereum Smart Contracts

Hoogle⋆: Constants and λ-abstractions in Petri-net-based Synthesis using Symbolic Execution

MUFIN: Improving Neural Repair Models with Back-Translation

Contact

People

bGSL: An Imperative Language for Specification and Refinement of Backtracking Programs

Related

GLITCH: Automated Polyglot Security Smell Detection in Infrastructure as Code