The Relationship Between Separation Logic and Implicit Dynamic Frames

Abstract

Abstract. Separation logic is a concise method for specifying programs that manipulate dynamically allocated storage. Partially inspired by separation logic, Implicit Dynamic Frames has recently been proposed, aiming at first-order tool support. In this paper, we precisely connect the semantics of these two logics. We define a logic whose syntax subsumes both that of a standard separation logic, and that of implicit dynamic frames as sub-syntaxes. We define a total heap semantics for our logic, and, for the separation logic subsyntax, prove it equivalent the standard partial heaps model. In order to define a semantics which works uniformly for both subsyntaxes, we define the novel concept of a minimal state extension, which provides a different (but equivalent) definition of the semantics of separation logic implication and magic wand connectives, while also giving a suitable semantics for these connectives in implicit dynamic frames. We show that our resulting semantics agrees with the existing definition of weakest pre-condition semantics for the implicit dynamic frames fragment. Finally, we show that we can encode the separation logic fragment of our logic into the implicit dynamic frames fragment, preserving semantics. For the connectives typically supported by tools, this shows that separation logic can be faithfully encoded in a first-order automatic verification tool (Chalice).

A Case Study in Formal Verification Using Multiple Explicit Heaps

“…It seems that none of the other verification systems that we are aware of try to make heap or heap-like structures explicit on the level of the specification language, although certainly some of them indeed use multiple heap or heap-like structures internally. Most notably, the Chalice tool [15,22] works with two global variables H and P , that, respectively, represent the heap and the permission mask in the Boogie proof obligations. Not exposing the heap in the Separation Logic specifications and associated tools [11,7] seems natural, however, applying them to new verification scenarios named in Sect.…”

“…Permission accounting is a specification oriented methodology for ensuring race freedom in concurrent programs that allows for efficient threadlocal reasoning. Similarly to the implementation of permissions in the Chalice tool [15,22] we introduce a permission mask to the JDL to keep track of permissions in the verified programs. From our point of view, this permission mask is nothing more than a parallel heap-like structure that stores permission values for each location instead of the actual values.…”

“…Central in all these efforts is the notion of the object heap that is used in respective logics to represent the memory that programs operate on and to handle possible object aliasing. In particular, Separation Logic [22], that some of the verification systems utilise, is strictly built around the notion of the heap, rather than the program that operates on it.…”

GRASShopper

“…Our SL translation and the handling of the frame rule is in part inspired by work on implicit dynamic frames [20,24]. Per se, the implicit dynamic frames approach provides no decidability guarantees for the first-order logic fragment used by the SL encoding.…”

“…In this paper, we present GRASShopper, a tool which extends our previous work with support for local reasoning. Inspired by implicit dynamic frames [20,24], we present a translation of programs with mixed separation logic and first-order logic specifications to programs with GRASS specifications. The translation and verification of the resulting program is fully automated.…”