Automating Separation Logic Using SMT

Abstract

Abstract. Separation logic (SL) has gained widespread popularity because of its ability to succinctly express complex invariants of a program's heap configurations. Several specialized provers have been developed for decidable SL fragments. However, these provers cannot be easily extended or combined with solvers for other theories that are important in program verification, e.g., linear arithmetic. In this paper, we present a reduction of decidable SL fragments to a decidable first-order theory that fits well into the satisfiability modulo theories (SMT) framework. We show how to use this reduction to automate satisfiability, entailment, frame inference, and abduction problems for separation logic using SMT solvers. Our approach provides a simple method of integrating separation logic into existing verification tools that provide SMT backends, and an elegant way of combining SL fragments with other decidable first-order theories. We implemented this approach in a verification tool and applied it to heap-manipulating programs whose verification involves reasoning in theory combinations.

A Decidable Fragment in Separation Logic with Inductive Predicates and Arithmetic

“…If one of the disjuncts is satisfied, so is Q. We remark that as the base formulas do not contain any occurrences of inductive predicates, their satisfiability is decidable [23,17]. We generate the base formulas for each inductive predicate by: (i) constructing a cyclic unfolding tree and (ii) extracting base formulas from the leaf nodes in the tree.…”

“…In terms of decision procedures supporting inductive predicates and arithmetic, GRASShoper [23] and Asterix [22] are among the first decision procedures where shape definitions are restricted to linked lists. The decidable fragments have been recently widened in extended GRASShoper [24], CompSPEN [12], S2SATSL [17], [18] and [29].…”

“…A decision procedure for satisfiability of separation logic with inductive predicates could be useful for multiple analysis problems associated with heapmanipulating programs, e.g., compositional verification [8,26,19], shape analysis [15], termination analysis [6] as well as to uncover reachability in bug finding tools [17]. It has been shown that the satisfiability of the fragment of separation logic which does not include inductive (user-defined) predicates is decidable [7,23,22,17]. The main challenge on satisfiability checking of separation logic with inductive predicates is that it often requires reasoning about infinite heaps as well as infinite integer domain.…”

Satisfiability Modulo Heap-Based Programs

“…For instance, early proposals fixed the set of shape predicates that may be used, for example, to linked lists (in SeLoger [17,23], and SLLB [34]) or trees (GRIT [36]). There are few approaches supporting user-defined predicates [14,39,25].…”

Symbolic optimization with SMT solvers

“…To mention a few, in verification, SMT solvers have been used for device driver verification [5,34], checking complex verification conditions [22,38,48], and improving precision of invariant generation [33,45]; in testing and bug finding, they have been instrumental in making symbolic execution [15,26], fuzzing [28], and bounded model checking techniques [18,24] practical; in program synthesis, they have been used to search for programs satisfying a given specification [30,58]; in functional programming, they have been used to support strong typing guarantees with refinement types [12,52].…”