Given a program P, a specification S, and an abstraction function α, verification determines whether P satisfies the specification S under the abstraction α. If not, a trace T that violate the specification is selected, and either the abstraction α is refined or a constraint that avoids the trace T is computed and added to a set of constraints. The set of constraints are used to modify the program P.