Implicit dynamic frames

Abstract

An important, challenging problem in the verification of imperative programs with shared, mutable state is the frame problem in the presence of data abstraction. That is, one must be able to specify and verify upper bounds on the set of memory locations a method can read and write without exposing that method's implementation.Separation logic is now widely considered the most promising solution to this problem. However, unlike conventional verification approaches, separation logic assertions cannot mention heap-dependent expressions from the host programming language, such as method calls familiar to many developers. Moreover, separation logic-based verifiers are often based on symbolic execution. These symbolic execution-based verifiers typically do not support non-separating conjunction, and some of them rely on the developer to explicitly fold and unfold predicate definitions. Furthermore, several researchers have wondered whether it is possible to use verification condition generation and standard first-order provers instead of symbolic execution to automatically verify conformance with a separation logic specification.In this article, we propose a variant of separation logic called implicit dynamic frames that supports heap-dependent expressions inside assertions. Conformance with an implicit dynamic frames specification can be checked by proving the validity of a number of first-order verification conditions. To show that these verification conditions can be discharged automatically by standard first-order provers, we have implemented our approach in a verifier prototype and have used this prototype to verify several challenging examples from related work. Our prototype automatically folds and unfolds predicate definitions, as required, during the proof and can reason about non-separating conjunction which is used in the specifications of some of these examples. Finally, we prove the soundness of the approach.

Automating Separation Logic Using SMT

“…Alternatives to separation logic that enable compositional reasoning about heapmanipulating programs but rely on classical logic include (implicit) dynamic frames [22,31] and region logic [1,30]. The connection between separation logic and implicit dynamic frames has been studied in [26].…”

Specification and verification of synchronisation classes in Java : a practical approach

“…Specification and Verification of Atomic Operations in GPGPU Programs. In SEFM 2015, pages [69][70][71][72][73][74][75][76][77][78][79][80][81][82][83]2015..…”

“…IDF [78] is another program logic that extends Hoare Logic with the ability to reason about access to the heap by means of access permissions to heap locations, similar to permission-based Separation Logic. However, IDF and permission-based Separation Logic differ in how value-specifications are handled: in IDF, one uses side-effect-free expressions in the underlying programming language, while using permission-based Separation Logic, one first relates the program variables to logical variables and then states properties about these logical variables.…”

“…The main compilation target used for kernel programs is Silver, the intermediate language of the Viper framework [54]. Silver is a specification language designed along the lines of Implicit Dynamic Frames [78]. We can then verify these Silver programs with the Silicon tool that is part of the framework.…”

“…At the bottom layer, we use a combination of Implicit Dynamic Frames (IDF) [78] and CSL-style resource invariants, to reason about data race freedom of programs. We illustrate this on the verification of a lock-free queue implementation.…”