A decision procedure for satisfiability in separation logic with inductive predicates

Abstract

We show that the satisfiability problem for the "symbolic heap" fragment of separation logic with general inductively defined predicates -which includes most fragments employed in program verification -is decidable. Our decision procedure is based on the computation of a certain fixed point from the definition of an inductive predicate, called its "base", that exactly characterises its satisfiability.A complexity analysis of our decision procedure shows that it runs, in the worst case, in exponential time. In fact, we show that the satisfiability problem for our inductive predicates is EXPTIMEcomplete, and becomes NP-complete when the maximum arity over all predicates is bounded by a constant.Finally, we provide an implementation of our decision procedure, and analyse its performance both on a synthetically generated set of test formulas, and on a second test set harvested from the separation logic literature. For the large majority of these test cases, our tool reports times in the low milliseconds.

Disproving Inductive Entailments in Separation Logic via Base Pair Approximation

“…To avoid ambiguity, we write existential quantifiers in the bodies of inductive rules explicitly, rather than leaving them implicit as is done e.g. in [10].…”

“…This fragment is much more expressive than the simple linked-list fragment, but is also computationally much harder. In particular, entailment in this fragment is undecidable [3], although satisfiability is decidable [10] and entailment is decidable when predicates are restricted to have bounded treewidth [19].…”

“…Our approach builds on the decision procedure for satisfiability in [10], which builds a summary of the models of a symbolic heap called its base. The base of a symbolic heap A is a finite set of base pairs recording, for each way of building a model of A, the variables in A that must be allocated on the heap (plus, in this paper, the "types" of the records they point to), and the equalities and disequalities that must hold.…”

“…The base of a symbolic heap A is a finite set of base pairs recording, for each way of building a model of A, the variables in A that must be allocated on the heap (plus, in this paper, the "types" of the records they point to), and the equalities and disequalities that must hold. In [10] it is shown that satisfiability of a symbolic heap is exactly nonemptiness of its base. Here we go further: we attempt to disprove an entailment A B by using the bases of A and B to infer the existence of a countermodel without computing it.…”

“…Section 2 gives an overview of our separation logic fragment, and Section 3 briefly reprises the key concept of base pairs from [10]. In Section 4 we then develop our entailment disproof method in detail.…”