200 research outputs found
Deciding Entailments in Inductive Separation Logic with Tree Automata
Separation Logic (SL) with inductive definitions is a natural formalism for
specifying complex recursive data structures, used in compositional
verification of programs manipulating such structures. The key ingredient of
any automated verification procedure based on SL is the decidability of the
entailment problem. In this work, we reduce the entailment problem for a
non-trivial subset of SL describing trees (and beyond) to the language
inclusion of tree automata (TA). Our reduction provides tight complexity bounds
for the problem and shows that entailment in our fragment is EXPTIME-complete.
For practical purposes, we leverage from recent advances in automata theory,
such as inclusion checking for non-deterministic TA avoiding explicit
determinization. We implemented our method and present promising preliminary
experimental results
Program Analysis in A Combined Abstract Domain
Automated verification of heap-manipulating programs is a challenging task due to the complexity of aliasing and mutability of data structures used in these programs. The properties of a number of important data structures do not only relate to one domain, but to combined multiple domains, such as sorted list, priority queues, height-balanced trees and so on. The safety and sometimes efficiency of programs do rely on the properties of those data structures. This
thesis focuses on developing a verification system for both functional correctness and memory safety of such programs which involve heap-based data structures.
Two automated inference mechanisms are presented for heap-manipulating programs in this thesis. Firstly, an abstract interpretation based approach is proposed to synthesise program invariants in a combined pure and shape domain. Newly designed abstraction, join and widening
operators have been defined for the combined domain. Furthermore, a compositional analysis approach is described to discover both pre-/post-conditions of programs with a bi-abduction technique in the combined domain.
As results of my thesis, both inference approaches have been
implemented and the obtained results validate the feasibility and precision of proposed approaches. The outcomes of the thesis confirm that it is possible and practical to analyse heap-manipulating programs automatically and precisely by using abstract interpretation
in a sophisticated combined domain
The Tree Width of Separation Logic with Recursive Definitions
Separation Logic is a widely used formalism for describing dynamically
allocated linked data structures, such as lists, trees, etc. The decidability
status of various fragments of the logic constitutes a long standing open
problem. Current results report on techniques to decide satisfiability and
validity of entailments for Separation Logic(s) over lists (possibly with
data). In this paper we establish a more general decidability result. We prove
that any Separation Logic formula using rather general recursively defined
predicates is decidable for satisfiability, and moreover, entailments between
such formulae are decidable for validity. These predicates are general enough
to define (doubly-) linked lists, trees, and structures more general than
trees, such as trees whose leaves are chained in a list. The decidability
proofs are by reduction to decidability of Monadic Second Order Logic on graphs
with bounded tree width.Comment: 30 pages, 2 figure
Decision Procedure for Entailment of Symbolic Heaps with Arrays
This paper gives a decision procedure for the validity of en- tailment of
symbolic heaps in separation logic with Presburger arithmetic and arrays. The
correctness of the decision procedure is proved under the condition that sizes
of arrays in the succedent are not existentially bound. This condition is
independent of the condition proposed by the CADE-2017 paper by Brotherston et
al, namely, one of them does not imply the other. For improving efficiency of
the decision procedure, some techniques are also presented. The main idea of
the decision procedure is a novel translation of an entailment of symbolic
heaps into a formula in Presburger arithmetic, and to combine it with an
external SMT solver. This paper also gives experimental results by an
implementation, which shows that the decision procedure works efficiently
enough to use
Local Reasoning for Global Graph Properties
Separation logics are widely used for verifying programs that manipulate
complex heap-based data structures. These logics build on so-called separation
algebras, which allow expressing properties of heap regions such that
modifications to a region do not invalidate properties stated about the
remainder of the heap. This concept is key to enabling modular reasoning and
also extends to concurrency. While heaps are naturally related to mathematical
graphs, many ubiquitous graph properties are non-local in character, such as
reachability between nodes, path lengths, acyclicity and other structural
invariants, as well as data invariants which combine with these notions.
Reasoning modularly about such graph properties remains notoriously difficult,
since a local modification can have side-effects on a global property that
cannot be easily confined to a small region.
In this paper, we address the question: What separation algebra can be used
to avoid proof arguments reverting back to tedious global reasoning in such
cases? To this end, we consider a general class of global graph properties
expressed as fixpoints of algebraic equations over graphs. We present
mathematical foundations for reasoning about this class of properties, imposing
minimal requirements on the underlying theory that allow us to define a
suitable separation algebra. Building on this theory we develop a general proof
technique for modular reasoning about global graph properties over program
heaps, in a way which can be integrated with existing separation logics. To
demonstrate our approach, we present local proofs for two challenging examples:
a priority inheritance protocol and the non-blocking concurrent Harris list
- …