Proof automation for functional correctness in separation logic

Abstract

We describe an approach to automatically prove the functional correctness of pointer programs that involve iteration and recursion. Building upon separation logic, our approach has been implemented as a tightly integrated tool chain incorporating a novel combination of proof planning and invariant generation. Starting from shape analysis, performed by the Smallfoot static analyser, we have developed a proof strategy that combines shape and functional aspects of the verification task. By focusing on both iterative and recursive code, we have had to address two related invariant generation tasks, i.e. loop and frame invariants. We deal with both tasks uniformly using an automatic technique called term synthesis, in combination with the IsaPlanner/Isabelle theorem prover. In addition, where verification fails, we attempt to overcome failure by automatically generating missing preconditions. We present in detail our experimental results. Our approach has been evaluated on a range of examples, drawn in part from a functional extension to the Smallfoot corpus.

The History of the DReaM Group

“…Proof Planning: Our development of proof methods and meta-level reasoning crystallised into proof planning: specifying proof tactics so that plan formation could be used to construct a plan for a whole proof [8] (see §6.5.1). Applications of Proof Planning to Formal Methods: Since inductive reasoning is required for reasoning about repetition in both software and hardware, our automation of it could be applied to software verification [37,51,49], hardware verification [17] and program synthesis [43,27,38] (see §6.6.1). Applications to Cyber Security: Inductive reasoning was also applied to discover attacks on security protocols [69].…”

Automated Theorem Proving for Assertions in Separation Logic with All Connectives

“…Having − * is a desirable feature, since many algorithms/programs are verified using this connective, especially when expressing tail-recursive operations [26], iterators [23], septraction in rely/guarantee [37] etc.. Moreover, − * is useful in the weakest precondition calculus for SL, which introduces − * "in each statement in the program being analysed" [25]. See the introduction of [24] and [36] for other examples requiring − * .…”