Reasoning about sequences of memory states

Abstract

Motivated by the verification of programs with pointer variables, we introduce a temporal logic LTL mem whose underlying assertion language is the quantifier-free fragment of separation logic and the temporal logic on the top of it is the standard linear-time temporal logic LTL. We analyze the complexity of various model-checking and satisfiability problems for LTL mem , considering various fragments of separation logic (including pointer arithmetic), various classes of models (with or without constant heap), and the influence of fixing the initial memory state. We provide a complete picture based on these criteria. Our main decidability result is pspace-completeness of the satisfiability problems on the record fragment and on a classical fragment allowing pointer arithmetic. Σ 0 1-completeness or Σ 1 1-completeness results are established for various problems by reducing standard problems for Minsky machines, and underline the tightness of our decidability results.

Separation Logic with One Quantified Variable

“…In that way, we show a quantifier elimination property similar to the one for Presburger arithmetic (in that case, the test formulae are linear and periodicity constraints). This result extends previous ones on propositional separation logic (Lozes 2004a,b;Brochenin et al 2009) and as far as we know, this is the first time that this approach is extended to a first-order version of separation logic with the magic wand operator. However, it is the best we can hope for since 1SL with two quantified variables and no program variables (1SL2) has been recently shown undecidable in (Demri and Deters 2014).…”

“…1. We introduce test formulae that state simple properties about the memory states and we show that every formula in 1SL1 is equivalent to a Boolean combination of test formulae, extending what was done in (Lozes 2004b;Brochenin et al 2009) for the propositional case. For instance, separating connectives can be eliminated in a controlled way as well as first-order quantification over the single variable.…”

“…Test formulae express simple properties about the memory states; this includes properties about program variables but also global properties about numbers of predecessors or loops, following the decomposition in Section 2.3. These test formulae allow us to characterize the expressive power of 1SL1, similarly to what has been done in (Lozes 2004a,b;Brochenin et al 2009) for 1SL0. Moreover, we aim at defining the class of test formulae as small as possible in order to nail down the very expressive power of 1SL1.…”

Tableaux Methods for Propositional Dynamic Logics with Separating Parallel Composition

“…Indeed, a multiplicative conjunction semantically similar to the one found in BBI can be defined in PRSPDL. Hence PRSPDL is a modal logics of separation like logics in [5][6][7], and is closely related to the process logic MBIc [6]. The differences between PRSPDL and MBIc are the lack of sequential compositions in MBIc making it strictly less expressive [2] and the associativity of the separation relation making the satisfiability problem harder [14].…”

Towards Model-Checking Programs with Lists

“…Some efforts have already been made to introduce temporal logic for pointer verifications as the Evolution Temporal Logic [29], which used techniques similar to the one presented in TVLA, or the Navigation Temporal Logic presented in [14]. Recently, in [12], the authors have introduced a temporal logic based on separation logic. But, to our knowledge, these different logics do not allow to express quantitative properties of the memory heaps.…”