3,394 research outputs found
Separation Logic Modulo Theories
Logical reasoning about program data often requires dealing with heap
structures as well as scalar data types. Recent advances in Satisfiability
Modular Theory (SMT) already offer efficient procedures for dealing with
scalars, yet they lack any support for dealing with heap structures. In this
paper, we present an approach that integrates Separation Logic---a prominent
logic for reasoning about list segments on the heap---and SMT. We follow a
model-based approach that communicates aliasing among heap cells between the
SMT solver and the Separation Logic reasoning part. An experimental evaluation
using the Z3 solver indicates that our approach can effectively put to work the
advances in SMT for dealing with heap structures. This is the first decision
procedure for the combination of separation logic with SMT theories.Comment: 16 page
Decision Procedure for Entailment of Symbolic Heaps with Arrays
This paper gives a decision procedure for the validity of en- tailment of
symbolic heaps in separation logic with Presburger arithmetic and arrays. The
correctness of the decision procedure is proved under the condition that sizes
of arrays in the succedent are not existentially bound. This condition is
independent of the condition proposed by the CADE-2017 paper by Brotherston et
al, namely, one of them does not imply the other. For improving efficiency of
the decision procedure, some techniques are also presented. The main idea of
the decision procedure is a novel translation of an entailment of symbolic
heaps into a formula in Presburger arithmetic, and to combine it with an
external SMT solver. This paper also gives experimental results by an
implementation, which shows that the decision procedure works efficiently
enough to use
On Deciding Local Theory Extensions via E-matching
Satisfiability Modulo Theories (SMT) solvers incorporate decision procedures
for theories of data types that commonly occur in software. This makes them
important tools for automating verification problems. A limitation frequently
encountered is that verification problems are often not fully expressible in
the theories supported natively by the solvers. Many solvers allow the
specification of application-specific theories as quantified axioms, but their
handling is incomplete outside of narrow special cases.
In this work, we show how SMT solvers can be used to obtain complete decision
procedures for local theory extensions, an important class of theories that are
decidable using finite instantiation of axioms. We present an algorithm that
uses E-matching to generate instances incrementally during the search,
significantly reducing the number of generated instances compared to eager
instantiation strategies. We have used two SMT solvers to implement this
algorithm and conducted an extensive experimental evaluation on benchmarks
derived from verification conditions for heap-manipulating programs. We believe
that our results are of interest to both the users of SMT solvers as well as
their developers
On Automated Lemma Generation for Separation Logic with Inductive Definitions
Separation Logic with inductive definitions is a well-known approach for
deductive verification of programs that manipulate dynamic data structures.
Deciding verification conditions in this context is usually based on
user-provided lemmas relating the inductive definitions. We propose a novel
approach for generating these lemmas automatically which is based on simple
syntactic criteria and deterministic strategies for applying them. Our approach
focuses on iterative programs, although it can be applied to recursive programs
as well, and specifications that describe not only the shape of the data
structures, but also their content or their size. Empirically, we find that our
approach is powerful enough to deal with sophisticated benchmarks, e.g.,
iterative procedures for searching, inserting, or deleting elements in sorted
lists, binary search tress, red-black trees, and AVL trees, in a very efficient
way
Predicate Abstraction for Linked Data Structures
We present Alias Refinement Types (ART), a new approach to the verification
of correctness properties of linked data structures. While there are many
techniques for checking that a heap-manipulating program adheres to its
specification, they often require that the programmer annotate the behavior of
each procedure, for example, in the form of loop invariants and pre- and
post-conditions. Predicate abstraction would be an attractive abstract domain
for performing invariant inference, existing techniques are not able to reason
about the heap with enough precision to verify functional properties of data
structure manipulating programs. In this paper, we propose a technique that
lifts predicate abstraction to the heap by factoring the analysis of data
structures into two orthogonal components: (1) Alias Types, which reason about
the physical shape of heap structures, and (2) Refinement Types, which use
simple predicates from an SMT decidable theory to capture the logical or
semantic properties of the structures. We prove ART sound by translating types
into separation logic assertions, thus translating typing derivations in ART
into separation logic proofs. We evaluate ART by implementing a tool that
performs type inference for an imperative language, and empirically show, using
a suite of data-structure benchmarks, that ART requires only 21% of the
annotations needed by other state-of-the-art verification techniques
- …