The Bernays-Schönfinkel-Ramsey Class of Separation Logic with Uninterpreted Predicates

International audienceThis paper investigates the satisfiability problem for Separation Logic with k record fields, with unrestricted nesting of separating conjunctions and implications. It focuses on prenex formulae with a quantifier prefix in the language ∃ * ∀ * , that contain uninterpreted (heap-independent) predicate symbols. In analogy with first-order logic, we call this fragment Bernays-Schönfinkel-Ramsey Separation Logic [BSR(SL k)]. In contrast with existing work on Separation Logic, in which the universe of possible locations is assumed to be infinite, we consider both finite and infinite universes in the present paper. We show that, unlike in first-order logic, the (in)finite satisfiability problem is undecidable for BSR(SL k). Then we define two non-trivial subsets thereof, for which the finite and infinite satisfiability problems are PSPACE-complete, respectively, assuming that the maximum arity of the uninterpreted predicate symbols does not depend on the input. These fragments are defined by controlling the polarity of the occurrences of separating implications, as well as the occurrences of universally quantified variables within their scope. These decidability results have natural applications in program verification, as they allow to automatically prove lemmas that occur in e.g. entailment checking between inductively defined predicates and validity checking of Hoare triples expressing partial correctness conditions

Reasoning in the Bernays-Schönfinkel-Ramsey Fragment of Separation Logic

International audienceSeparation Logic (SL) is a well-known assertion language used in Hoare-style modular proof systems for programs with dynamically allocated data structures. In this paper we investigate the fragment of first-order SL restricted to the Bernays-Schönfinkel-Ramsey quantifier prefix ∃ * ∀ * , where the quantified variables range over the set of memory locations. When this set is uninterpreted (has no associated theory) the fragment is PSPACE-complete, which matches the complexity of the quantifier-free fragment [7]. However, SL becomes undecid-able when the quantifier prefix belongs to ∃ * ∀ * ∃ * instead, or when the memory locations are interpreted as integers with linear arithmetic constraints, thus setting a sharp boundary for decidability within SL. We have implemented a decision procedure for the decidable fragment of ∃ * ∀ * SL as a specialized solver inside a DPLL(T) architecture, within the CVC4 SMT solver. The evaluation of our implementation was carried out using two sets of verification conditions, produced by (i) unfolding inductive predicates, and (ii) a weakest precondition-based verification condition generator. Experimental data shows that automated quantifier instantiation has little overhead, compared to manual model-based instantiation

A Datalog Hammer for Supervisor Verification Conditions Modulo Simple Linear Arithmetic

The Bernays-Sch\"onfinkel first-order logic fragment over simple linear real arithmetic constraints BS(SLR) is known to be decidable. We prove that BS(SLR) clause sets with both universally and existentially quantified verification conditions (conjectures) can be translated into BS(SLR) clause sets over a finite set of first-order constants. For the Horn case, we provide a Datalog hammer preserving validity and satisfiability. A toolchain from the BS(LRA) prover SPASS-SPL to the Datalog reasoner VLog establishes an effective way of deciding verification conditions in the Horn fragment. This is exemplified by the verification of supervisor code for a lane change assistant in a car and of an electronic control unit for a supercharged combustion engine.Comment: 26 page

A Datalog Hammer for Supervisor Verification Conditions Modulo Simple Linear Arithmetic

The Bernays-Sch\"onfinkel first-order logic fragment over simple linear real arithmetic constraints BS(SLR) is known to be decidable. We prove that BS(SLR) clause sets with both universally and existentially quantified verification conditions (conjectures) can be translated into BS(SLR) clause sets over a finite set of first-order constants. For the Horn case, we provide a Datalog hammer preserving validity and satisfiability. A toolchain from the BS(LRA) prover SPASS-SPL to the Datalog reasoner VLog establishes an effective way of deciding verification conditions in the Horn fragment. This is exemplified by the verification of supervisor code for a lane change assistant in a car and of an electronic control unit for a supercharged combustion engine

A Sorted Datalog Hammer for Supervisor Verification Conditions Modulo Simple Linear Arithmetic

In a previous paper, we have shown that clause sets belonging to the HornBernays-Sch\"onfinkel fragment over simple linear real arithmetic (HBS(SLR))can be translated into HBS clause sets over a finite set of first-orderconstants. The translation preserves validity and satisfiability and it isstill applicable if we extend our input with positive universally orexistentially quantified verification conditions (conjectures). We call thistranslation a Datalog hammer. The combination of its implementation inSPASS-SPL with the Datalog reasoner VLog establishes an effective way ofdeciding verification conditions in the Horn fragment. We verify supervisorcode for two examples: a lane change assistant in a car and an electroniccontrol unit of a supercharged combustion engine. In this paper, we improve ourDatalog hammer in several ways: we generalize it to mixed real-integerarithmetic and finite first-order sorts; we extend the class of acceptableinequalities beyond variable bounds and positively grounded inequalities; andwe significantly reduce the size of the hammer output by a soft typingdiscipline. We call the result the sorted Datalog hammer. It not only allows usto handle more complex supervisor code and to model already consideredsupervisor code more concisely, but it also improves our performance on realworld benchmark examples. Finally, we replace the before file-based interfacebetween SPASS-SPL and VLog by a close coupling resulting in a single executablebinary.<br

Bernays-Schönfinkel-Ramsey with Simple Bounds is NEXPTIME-complete

25 pagespreprintLinear arithmetic extended with free predicate symbols is undecidable, in general. We show that the restriction of linear arithmetic inequations to simple bounds extended with the Bernays-Schönfinkel-Ramsey free first-order fragment is decidable and NEXPTIME-complete. The result is almost tight because the Bernays-Schönfinkel-Ramsey fragment is undecidable in combination with linear difference inequations, simple additive inequations, quotient inequations and multiplicative inequations

Foundations of Software Science and Computation Structures

This open access book constitutes the proceedings of the 22nd International Conference on Foundations of Software Science and Computational Structures, FOSSACS 2019, which took place in Prague, Czech Republic, in April 2019, held as part of the European Joint Conference on Theory and Practice of Software, ETAPS 2019. The 29 papers presented in this volume were carefully reviewed and selected from 85 submissions. They deal with foundational research with a clear significance for software science