Decision Procedures for Region Logic

Abstract

Abstract. Region logic is Hoare logic for object-based programs. It features local reasoning with frame conditions expressed in terms of sets of heap locations. This paper studies tableau-based decision procedures for RL, the quantifier-free fragment of the assertion language. This fragment combines sets and (functional) images with the theories of arrays and partial orders. The procedures are of practical interest because they can be integrated efficiently into the satisfiability modulo theories (SMT) framework. We provide a semi-decision procedure for RL and its implementation as a theory plugin inside the SMT solver Z3. We also provide a decision procedure for an expressive fragment of RL termed restricted-RL. We prove that deciding satisfiability of restricted-RL formulas is NP-complete. Both procedures are proven sound and complete. Preliminary performance results indicate that the semi-decision procedure has the potential toscale to large input formulas.

The WhyRel Prototype for Modular Relational Verification of Pointer Programs

“…Manual effort involves applying a series of Why3 transformations (or proof tactics) and introducing intermediate assertions. We conjecture that the issue can be mitigated by using specialized solvers [23] or different heap encodings [24].…”

“…The paper builds on a line of work on region logic [4,2,3]. The VERL tool implements an early version of unary region logic without encapsulation and was used to evaluate a decision procedure for regions [23].…”

Constraint-Based Program Reasoning with Heaps and Separation

“…based on the propagation of set membership x ∈ S constraints. In [21] this idea was adapted into a decision procedure for Region Logic. Our approach works directly with heaps rather than indirectly via sets.…”

A Logical Analysis of Framing for Specifications with Pure Method Calls

“…For future work, the next steps towards observational purity are (a) to extend the logic with second order framing, as in RLII but with hiding of effects, and (b) to add weak purity which allows allocation though not other effects (this is not hard but does add a few complications). Another step is to add read effects and pure methods to our prototype SMT-based verifier for RL [18,19], which already provides limited support for pure function definitions with framing, based on a version of Leino's Dafny. As a first step, we have successfully checked versions of the Cell example by manual encoding in Why3, using SMT-provers only.…”