A Proof System for Separation Logic with Magic Wand

Transcription

1 A Proof System for Separation Logic ith Magic Wand Wonyeol Lee Sungoo Park Department of Computer Science and Engineering Pohang University of Science and Technology (POSTECH) Republic of Korea Abstract Separation logic is an extension of Hoare logic hich is acknoledged as an enabling technology for large-scale program verification It features to ne logical connectives separating conjunction and separating implication but most of the applications of separation logic have exploited only separating conjunction ithout considering separating implication Nevertheless the poer of separating implication has been ell recognized and there is a groing interest in its use for program verification This paper develops a proof system for full separation logic hich supports not only separating conjunction but also separating implication The proof system is developed in the style of sequent calculus and satisfies the admissibility of cut The key challenge in the development is to devise a set of inference rules for manipulating heap structures that ensure the completeness of the proof system ith respect to separation logic We sho that our proof of completeness directly translates to a proof search strategy Categories and Subject Descriptors F41 [Mathematical Logic]: Mechanical theorem proving Proof theory General Terms Keyords 1 Introduction Verification Separation logic; Proof system; Theorem prover Separation logic [28] is an extension of Hoare logic designed to simplify reasoning about programs manipulating mutable data structures ith potential pointer aliasing It features to ne logical connectives separating conjunction and separating implication hose semantics directly assumes memory heaps structured as a monoid Separating conjunction allos us to describe properties of to disjoint heaps ith a single logical formula: A B means that a given heap can be divided into to disjoint heaps satisfying A and B respectively Separating implication commonly knon as magic and allos us to reason about hypothetical heaps extending a given heap: A B means that if a given heap is extended ith a disjoint heap satisfying A the resultant heap satisfies B The use of the to separating connectives naturally leads to local reasoning in program verification in that e Permission to make digital or hard copies of all or part of this ork for personal or classroom use is granted ithout fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page Copyrights for components of this ork oned by others than ACM must be honored Abstracting ith credit is permitted To copy otherise or republish to post on servers or to redistribute to lists requires prior specific permission and/or a fee Request permissions from permissions@acmorg POPL 14 January San Diego CA USA Copyright c 2014 ACM /14/01 $ only need to reason locally about those heaps directly affected by the program So far most of the applications of separation logic have exploited only separating conjunction For example all existing verification tools based on separation logic such as Smallfoot [3] Space Invader [11] THOR [23] SLAyer [1] HIP [25] jstar [12] Xisa [10] VeriFast [19] Infer [7] and Predator [14] use a decidable fragment by Berdine et al [2] or its extension hich provides only separating conjunction By virtue of the principle of local reasoning hoever these tools are highly successful in their individual verification domains despite not using separating implication at all Although separating implication is not discussed as extensively as separating conjunction in the literature its poer in program verification has nevertheless been ell recognized Just around the inception of separation logic Yang [29] already gives an elegant proof of the correctness of the Schorr-Waite algorithm hich relies crucially on the use of separating implication in the main loop invariant Krishnasami [20] shos ho to reason abstractly about an iterator protocol ith separation logic by exploiting separating implication in the specification of iterators Maeda et al [22] adopt the idea of separating implication in extending an alias type system in order to express tail-recursive operations on recursive data structures Recently Hobor and Villard [17] give a concise proof of the correctness of Cheney s garbage collector in a proof system based on the ramify rule a cousin of the frame rule of separation logic hose premise checks a logical entailment involving separating implication These promising results arguably suggest that introducing separating implication alone raises the level of technology for program verification as much as separation logic only ith separating conjunction improves on Hoare logic Despite the potential benefit of separating implication in program verification hoever there is still no practical theorem prover for full separation logic The state-of-the-art theorem provers for separation logic such as SeLoger [16] and SLP [24] support only separating conjunction and the labelled tableau calculus by Galmiche and Méry [15] does not directly give rise to a proof search strategy Because of the unavailability of such a theorem prover all proofs exploiting separating implication should be manually checked hich can be time-consuming even ith the help of lemmas provided by the proof system (as in [17]) Another consequence is that no existing verification tools based on separation logic can fully support backard reasoning by eakest precondition generation hich requires separating implication henever verifying heap assignments (see Ishtiaq and O Hearn [18]) This paper develops a proof system P SL for full separation logic hich supports not only separating conjunction but also separating implication Its design is based on the principle of proof by contradiction from classical logic and e develop its inference rules in the style of sequent calculus P SL uses a ne form of sequent

2 called orld sequent in order to give a complete description of the orld of heaps and its use of orld sequents allos us to treat separating implication in the same ay that it treats separating conjunction The key challenge in the development of P SL is to devise a set of inference rules for manipulating heap structures so as to correctly analyze separating conjunction and separating implication We sho that P SL satisfies the admissibility of cut and that it is sound and complete ith respect to separation logic The proof of completeness directly translates to a proof search strategy hich is the basis for our prototype implementation of P SL We sho that it is easy to extend P SL ith ne logical connectives and predicates such as an overlapping conjunction A B by Hobor and Villard [17] Separating implication has been commonly considered to be much harder to reason about than separating conjunction as partially evidenced by lack of theorem provers supporting separating implication and abundance of verification systems supporting separating conjunction Our development of P SL hoever suggests that a proof system designed in a principled ay can support both logical connectives in a coherent ay ithout requiring distinct treatments Our prototype implementation of P SL also suggests that such a proof system can develop into a practical theorem prover for separation logic To the best of our knoledge P SL is the first proof system for full separation logic that satisfies the admissibility of cut and provides a concrete proof search strategy This paper is organized as follos Section 2 gives preliminaries on separation logic Section 3 develops our proof system P SL and Section 4 gives three examples of proving orld sequents Section 6 proves the soundness and completeness of P SL ith respect to separation logic and Section 7 discusses the implementation and extension of P SL Section 8 discusses related ork and Section 9 concludes 2 Semantics of separation logic Separation logic extends classical first-order logic ith multiplicative formulas from intuitionistic linear logic: formula A B C ::= P A A A I A A A A aa primitive formula P ::= [l E] E = E expression E ::= x a L location expression l ::= x a L value V ::= L location L 1 L 2 L 3 stack variable x y z local variable a b c A A B and aa are from classical first-order logic I is the multiplicative unit A B is a separating conjunction and A B is a separating implication We define as A B as ( A B) and A B as A B We use conventional precedence rules for logical connectives: > > > > In this ork e do not consider inductively defined predicates Primitive formulas include a points-to relation [l E] for describing a singleton heap All other primitive formulas describe relations beteen expressions; for simplicity e consider only an equality relation E = E Expressions denote values hich include locations L Location expressions are a special class of expressions that denote locations In the present ork e allo only locations as values but it should be straightforard to introduce additional forms of expressions for ne types of values such as booleans and integers We syntactically distinguish beteen stack variables hich originate from the program being verified (and thus may be called global variables instead) and local variables hich are introduced by existential quantifiers (and thus can never appear outside corresponding existential formulas) We specify the semantics of separation logic ith respect to a stack and a heap A stack S is a finite partial mapping Var Val from stack variables to values here Var denotes the set of stack variables and Val denotes the set of values Given a stack S e can determine a unique value for every expression E hich e rite as E S A heap H is a finite partial mapping Loc Val from locations to values here Loc denotes the set of locations We rite H 1#H 2 to mean that heaps H 1 and H 2 are disjoint ie dom(h 1) dom(h 2) = We rite H 1 H 2 for the union of disjoint heaps H 1 and H 2 here H 1#H 2 is assumed and ɛ for an empty heap Heaps form a commutative cancellative monoid ith as the associative operation and ɛ as the identity: (neutrality) H ɛ = H (commutativity) H 1 H 2 = H 2 H 1 (associativity) H 1 (H 2 H 3) = (H 1 H 2) H 3 (cancellativity) H H 1 = H H 2 implies H 1 = H 2 Given a stack S and a heap H e obtain the semantics of separation logic from the satisfaction relation (S H) = A for formulas defined as follos: (S H) = [l E] iff H = l S E S ie H is a singleton heap mapping l S to E S (S H) = E = E iff E S = E S (S H) = iff never (S H) = A iff (S H) = A (S H) = A B iff (S H) = A or (S H) = B (S H) = I iff dom(h) = ie H = ɛ (S H) = A B iff H = H 1 H 2 and (S H 1) = A and (S H 2) = B for some heaps H 1 and H 2 (S H) = A B iff H 2 = H H 1 implies (S H 1) = A or (S H 2) = B for any heaps H 1 and H 2 (S H) = aa iff (S H) = [V/a]A for some value V Note that the definition of (S H) = aa directly substitutes value V for local variable a in formula A (in [V/a]A) ithout extending stack S because e syntactically distinguish beteen stack variables and local variables Although the satisfaction relation (S H) = A is enough for specifying the semantics of separation logic e deliberately derive the definition of its negation (S H) = A hich plays an equally important role in the development of our proof system: (S H) = [l E] iff H l S E S ie dom(h) { l S} or H( l S) E S (S H) = E = E iff E S E S (S H) = iff alays (S H) = A iff (S H) = A (S H) = A B iff (S H) = A and (S H) = B (S H) = I iff dom(h) ie H ɛ (S H) = A B iff H = H 1 H 2 implies (S H 1) = A or (S H 2) = B for any heaps H 1 and H 2 (S H) = A B iff H 2 = H H 1 and (S H 1) = A and (S H 2) = B for some heaps H 1 and H 2 (S H) = aa iff (S H) = [V/a]A for any value V We observe that the definition for separating implication is symmetric to the definition for separating conjunction: (S H) = A B should find a certain pair of heaps hereas (S H) = A B should analyze an unspecified pair of heaps (S H) = A B should analyze an unspecified pair of heaps hereas (S H) = A B should find a certain pair of heaps

3 This symmetry suggests that e can incorporate separating implication into the proof system in an analogous ay to separating conjunction A formula A is valid ritten = A if (S H) = A holds for every stack S and heap H Our proof system P SL can check the validity of every formula in separation logic 3 Proof system P SL for separation logic This section presents the proof system P SL for separation logic hich is developed in the style of sequent calculus We first explain orld sequents the main judgment in P SL and then present the inference rules 31 World sequents The design of P SL is based on the principle of proof by contradiction from classical logic We describe the state of each heap ith a set of true formulas and another set of false formulas A orld sequent in P SL gives a description of the entire orld of heaps and a derivation of it means that the description is self-contradictory Hence in order to check the validity of a formula in separation logic e use it as a false formula about an arbitrary heap (about hich nothing is knon) and attempt to produce a logical contradiction by proving a orld sequent consisting solely of heap The definition of orld sequents and the principle of proof by contradiction are inherited from the nested sequent calculus for Boolean BI by Park et al [26] Since P SL is designed to check the validity of a formula it assumes an arbitrary stack hich implies that every stack variable denotes an arbitrary value This in turn implies that in a derivation of a orld sequent e may use a fresh stack variable to denote an arbitrary value We exploit this interpretation of stack variables in an inference rule for first-order formulas A orld sequent consists of expression relations Θ heap relations Σ and heap sequents Π: expression relation θ ::= E = E E E expression relations Θ = θ 1 θ n heap variable u v heap relation σ ::= = ɛ = ɛ = [l E] = [l E] = 1 2 heap relations Σ = σ 1 σ n truth context Γ ::= Γ A falsehood context ::= A heap sequent π ::= [Γ = ] heap sequents Π = π 1 π n orld sequent An expression relation θ is an equality or inequality beteen to expressions If e introduce ne forms of primitive formulas (eg E < E ) e should introduce corresponding forms of expression relations We assign a heap variable to each heap and a heap relation σ relates a heap to an empty heap ( = ɛ and = ɛ) a singleton heap ( = [l E] and = [l E]) or the union of to disjoint heaps ( = 1 2) We refer to those heap relation involving an empty heap or a singleton heap as atomic heap relations As heaps form a commutative (cancellative) monoid e assume commutativity of and use 1 2 and 2 1 interchangeably A heap sequent [Γ = ] describes heap ith truth context Γ and falsehood context hich contain true formulas and false formulas respectively about heap In this ay a orld sequent gives a complete description of the orld of heaps We require that no local variable appear in expression relations and heap relations and that a orld sequent contain a unique heap sequent for each heap variable A orld sequent represents a graph of heaps induced by heap relations Given a heap relation = 1 2 e say that parent heap has to child heaps 1 and 2 hich are sibling heaps to each other We can also extend parent-child relations to derive ancestor-descendant relations If a heap has no pair of child heaps e call it a terminal heap (here e ignore such a heap relation as = ɛ ith ɛ = ɛ); otherise e call it a non-terminal heap Note that a heap relation = ɛ or = [l E] does not immediately mean that is a terminal heap because e may have another heap relation = 1 2 P SL hoever allos us to normalize all heap relations and turn into a terminal heap P SL also uses an expression contradiction judgment Θ hich is an abbreviation of a particular form of a orld sequent Θ; and means that expression relations Θ produce a logical contradiction Since the definition of expression relations is extensible e do not give inference rules for the expression contradiction judgment and just assume a decidable system for it For simplicity e rite Θ E = E for Θ E E and Θ E E for Θ E = E We rite Θ [l E] = [l E ] for Θ l = l and Θ E = E and Θ [l E] [l E ] for Θ l l or Θ E E P SL consists of logical rules in Figure 1 structural rules in Figure 2 and heap contradiction rules in Figure 3 The logical rules deal ith formulas in heap sequents Π the structural rules reorganize graphs of heaps induced by heap relations Σ and the heap contradiction rules detect logical contradictions in heap relations Σ or heap contradictions P SL shares the logical rules (for propositional and multiplicative formulas) ith the nested sequent calculus for Boolean BI in [26] but the structural rules and the heap contradiction rules are specific to separation logic We read every inference rule from the conclusion to the premise and the derivation of a orld sequent alays terminates ith a proof of a logical contradiction Hence in order to sho the validity of a formula A e try to prove a orld sequent ; [ = A] 32 Logical rules of P SL Figure 1 shos the logical rules of P SL Except for the rule ExpCont a logical rule focuses on a principal formula in a heap sequent and either produces a logical contradiction (in the rule L) or rerites the orld sequent of the conclusion according to the semantics of separation logic in Section 2 For each type of formulas P SL has both a left rule hich analyzes a true formula about a heap and a right rule hich analyzes a false formula about a heap as in a typical sequent calculus The rules for points-to relations introduce a corresponding heap relation The rules for propositional and first-order formulas are from first-order classical logic In the rule L the fresh stack variable x denotes an arbitrary value In the rules L and R e rite [E/a]A for substituting expression E for local variable a in formula A The rules =L and =R are the only rules that add expression relations and the rule ExpCont checks if expression relations Θ produce a logical contradiction The rules IL and IR use the fact the I is true only at an empty heap The rules L and R are based on the folloing interpretation of multiplicative conjunction hich closely matches the semantics of separation logic in Section 2: A B is true at heap iff = 1 2 and A is true at heap 1 and B is true at heap 2 for some heaps 1 and 2 A B is false at heap iff = 1 2 implies that A is false at heap 1 or that B is false at heap 2 for any heaps 1 and 2 Hence the rule L creates (some) fresh child heaps 1 and 2 hereas the rule R chooses (any) existing child heaps 1 and

4 Rules for points-to relations: Rules for propositional formulas: Θ; Σ = [l E] Π [Γ = ] [Γ [l E] = ] L [Γ = ] L [Γ = A] [Γ A = ] L Θ; Σ = [l E] Π [Γ = ] [Γ = [l E]] R [Γ A = ] [Γ = A] R [Γ A = ] [Γ B = ] [Γ = A B] [Γ A B = ] L [Γ = A B] R Rules for multiplicative formulas: Θ; Σ = ɛ Π [Γ = ] Θ; Σ = ɛ Π [Γ = ] [Γ I = ] IL [Γ = I] IR fresh 1 2 Θ; Σ = 1 2 Π [Γ = ] [A = ] 1 [B = ] 2 [Γ A B = ] L = [Γ = A B] [Γ 1 = 1 A] 1 [Γ 2 = 2 ] Σ [Γ = A B] [Γ 1 = 1 ] 1 [Γ 2 = 2 B] 2 [Γ = A B] [Γ 1 = 1 ] 1 [Γ 2 = 2 ] R 2 2 = 1 Σ [Γ A B = ] [Γ 1 = 1 A] 1 [Γ 2 = 2 ] 2 [Γ A B = ] [Γ 1 = 1 ] 1 [Γ 2 B = 2 ] 2 [Γ A B = ] [Γ 1 = 1 ] 1 [Γ 2 = 2 ] 2 fresh 1 2 Θ; Σ 2 = 1 Π [Γ = ] [A = ] 1 [ = B] 2 [Γ = A B] R Rules for first-order formulas: fresh x [Γ [x/a]a = ] [Γ = [E/a]A aa] [Γ aa = ] L [Γ = aa] R Rules for primitive formulas for expressions: Θ E = E ; Σ Π [Γ = ] [Γ E = E = ] =L Θ E E ; Σ Π [Γ = ] [Γ = E = E ] =R L Θ ExpCont Figure 1 Logical rules in the proof system P SL for separation logic 2 Similarly the rules L and R are based on the folloing interpretation of multiplicative implication : A B is true at heap iff 2 = 1 implies that A is false at heap 1 or that B is true at heap 2 for any heaps 1 and 2 A B is false at heap iff 2 = 1 and A is true at heap 1 and B is false at heap 2 for some heaps 1 and 2 Hence the rule L chooses (any) existing sibling heap 1 and parent heap 2 hereas as the rule R creates (some) fresh sibling heap 1 and parent heap 2 The rules L and R are the only logical rules that add parent-child heap relations to extend the graph of heaps and introduce fresh heap variables 1 and 2 that are not found in the orld sequent in the conclusion The rules R and L are the only logical rules that replicate the principal formula into orld sequents in the premise In the rules R and L e allo equalities beteen heap variables 1 2 and Since an equality beteen these heap variables invalidates the requirement that a orld sequent contain a unique heap sequent for each heap variable e interpret heap sequents for the same heap variable in the rules R and L as follos: In the conclusion e implicitly replicate the same heap sequent as necessary In the premise e combine all changes made to individual heap sequents for the same heap variable to produce a single heap sequent For example an equality = 1 in the rule R yields the folloing special instance: = 2 Σ [Γ = A B A] [Γ 2 = 2] 2 [Γ = A B] [Γ 2 = 2 B] 2 [Γ = A B] [Γ 2 = 2] 2 The rule R has to more special instances (corresponding to heap relations = 1 1 and = ) and similarly the rule L has a total of three special instances No e can decompose each individual formula by applying its corresponding logical rule thus accumulating expression relations and heap relations and creating fresh heaps When expression relations become self-contradictory e apply the rule ExpCont to complete the proof search In order to obtain a complete proof search strategy hoever e should also be able to: 1) enumerate all heap relations = 1 2 and 2 = 1 for a given heap for the rules R and L; 2) produce heap contradictions for example from = ɛ and = [l E] (We assume that e can make a correct guess on expression E in the rule R) The remaining challenge is to devise a set of structural rules and another set of heap contradiction rules satisfying these to requirements hich ould enable us to enumerate all feasible heap relations from those

5 Rules for disambiguating heap relations and leaving only disjoint terminal heaps: { = u 1 u 2 = v 1 v 2 } Σ fresh Θ; Σ u 1 = 1 2 u 2 = 3 4 v 1 = 1 3 v 2 = 2 4 Π [ = ] 1 [ = ] 2 [ = ] 3 [ = ] 4 Disj { 1 = u1 u 2 2 = u2 u 3 } Σ fresh v 1 v 2 v 3 Θ; Σ Rules for applying associativity of the union of disjoint heaps Rules for propagating atomic heap relations: = 1 v 3 = v 1 2 u 1 = v1 v 2 u 3 = v2 v 3 Π [ = ] [ = ] v 1 [ = ] v 2 [ = ] v 3 { = u v u = u 1 u 2 } Σ fresh u Θ; Σ u = u2 v = u 1 u Π [ = ] u { = ɛ = 1 2 } Σ Θ; Σ 1 = ɛ 2 = ɛ Π Propɛ { = [l E] = 1 2 } Σ Θ; Σ 1 = [l E] 2 = ɛ Π Θ; Σ 1 = ɛ 2 = [l E] Π { = [l E] = 1 2 } Σ Rules for normalizing heap relations: { = ɛ = 1 2 } Σ Θ; Σ 1 = ɛ Π Θ; Σ 2 = ɛ Π Assoc Propɛ = Θ; Σ 1 = ɛ 1 = [l E] Π Θ; Σ 1 = [l E] 2 = [l E] Π Θ; Σ 1 = ɛ 2 = ɛ Π Θ; Σ 2 = ɛ 2 = [l E] Π Θ; [/ ]Σ = u v Π [Γ Γ = ] Disj Prop Prop = Θ; Σ = u v NormEq = u v Π [Γ = ] [Γ = ] Θ; [/u]σ v = ɛ Π [Γ Γ = ] Θ; Σ = u v v = ɛ Π [Γ = ] [Γ = ] u NormPC Θ; [/u]σ = ɛ Π [Γ Γ = ] Θ; Σ = ɛ u = ɛ Π [Γ = ] [Γ = ] u NormEmpty Rules for creating an empty heap and applying the monoid las for empty heaps: fresh ɛ Θ; Σ ɛ = ɛ Π [ = ] ɛ ENe ɛ = ɛ Σ Θ; Σ = ɛ Π EJoin = u Σ Θ; Σ u = ɛ Π ECancel Figure 2 Structural rules in the proof system P SL for separation logic generated by the logical rules and detect all types of heap contradictions 33 Structural rules of P SL The structural rules of P SL are divided into five groups according to their roles in reorganizing graphs of heaps represented by orld sequents The order of the structural rules in Figure 2 roughly follos their use in the proof of the completeness of P SL ith respect to separation logic (Theorem 64) In a certain sense e design the structural rules so as to obtain a complete proof search strategy for separation logic hen the logical rules are already given as in Figure 1 Belo e informally discuss the key properties of the structural rules hich e formally present as part of the proof of the completeness of P SL in Section Rules for disambiguating heap relations The rules Disj and Disj disambiguate heap relations in order to leave only disjoint terminal heaps Roughly speaking to heaps are disjoint if they share a common ancestor hich has a heap relation separating them In the premise of the rule Disj child heaps u i and v j (i j = 1 2) share a common parent heap but their exact relations are unknon For example heap u 1 may completely subsume partially overlap ith or be disjoint from heap v 1 In general each pair of child heaps u i and v j are alloed to share a common child heap so the rule Disj disambiguates their relations by introducing four fresh terminal heaps 1 to 4 hich are all disjoint from each other: u 1 u 2 v 1 v 2 Disj = u 1 u 2 v 1 v No for example e may assume that the intersection of heaps u 1 and v 1 is represented by heap 1 Note that if heap u i or v j is not a terminal heap the rule Disj gives rise to unknon relations beteen the existing child heaps of u i or v j and to of the fresh

6 terminal heaps The rule Disj corresponds to the cross-split axiom for separation algebras [13] The rule Disj disambiguates relations beteen to sibling heaps u 1 and u 3 of heap u 2 by introducing three fresh terminal heaps v 1 to v 3 hich are all disjoint from each other: 1 2 u 1 u 2 u 3 v 1 v 2 v Disj = u 1 u 2 u 3 v 1 v 2 v 3 Similarly to the rule Disj the rule Disj may give rise to ne unknon relations involving heap 1 2 u 1 or u 3 Unlike the rule Disj hoever it also creates a common ancestor of all heaps Otherise the fresh terminal heaps themselves come to have unknon relations thereby defeating the purpose of applying the rule Disj Thus the rule Disj eliminates unknon relations beteen child heaps and the rule Disj eliminates unknon relations beteen sibling heaps of a certain heap both potentially creating similar unknon relations By repeatedly applying these rules e can eventually obtain a graph of heaps such that: 1) there exists a root heap that is an ancestor of all other heaps; 2) all terminal heaps in the graph are disjoint 332 Rule for applying associativity of The rule Assoc creates ne heap relations according to associativity of the union of disjoint heaps Suppose that e have to heap relations = u v and u = u 1 u 2 The rule Assoc introduces a fresh heap u in order to associate to heaps u 2 and v hich are knon to be disjoint but do not have a common parent heap yet; it also assigns heap as the common parent heap of heaps u 1 and u : u u 1 u 2 v Assoc = u u u 1 u 2 v Note that unlike the rules Disj and Disj the rule Assoc creates no fresh terminal heaps The rule Assoc is crucial for enumerating all heap relations involving a particular heap The basic observation is that by repeatedly applying the rule Assoc to a graph of heaps e can eventually obtain another graph of heaps ith the same set of terminal heaps such that for each combination of terminal heaps there is at least one heap subsuming exactly these terminal heaps and no others By starting ith a graph of heaps obtained by repeatedly applying the rules Disj and Disj then e can enumerate all feasible heap relations = 1 2 and 2 = 1 for a particular heap here e assume that heaps 1 and 2 are in the graph For the case that 1 or 2 is an empty heap hoever e need another set of structural rules for dealing ith empty heaps We should also combine heap sequents for the same heap (Hence e have not yet accomplished the first requirement for obtaining a complete proof search strategy) 333 Rules for propagating atomic heap relations The rules for propagating atomic heap relations or propagation rules are designed to propagate all atomic heap relations ( = ɛ = ɛ = [l E] = [l E]) from non-terminal heaps to terminal heaps A propagation rule converts an atomic heap relation for a heap into semantically equivalent heap relations for its child heaps 1 and 2 (ith = 1 2) It rerites orld sequents according to the folloing fact on atomic heap relations here e assume = 1 2: = ɛ iff 1 = ɛ and 2 = ɛ (for the rules Propɛ and Propɛ = ) = [l E] iff either 1 = [l E] and 2 = ɛ or 1 = ɛ and 2 = [l E] (for the rules Prop and Prop = ) For example e negate the second clause to derive the rule Prop = hich has four orld sequents in the premise: = [l E] iff 1) 1 = [l E] and 1 = ɛ; 2) 1 = [l E] and 2 = [l E]; 3) 2 = ɛ and 1 = ɛ; or 4) 2 = ɛ and 2 = [l E] Note that although the ne heap relations for the child heaps 1 and 2 collectively imply the original heap relation σ e have to preserve σ in every orld sequent of the premise because it may still interact ith another pair of child heaps 1 and 2 (ith = 1 2) After considering all such interactions hoever e may safely discard σ (by the rule Weaken to be introduced in Section 62) The propagation rules are the first step toard a complete procedure for producing heap contradictions (hich detect all types of heap contradictions) Suppose that e repeatedly apply the propagation rules until no more ne heap relations arise from atomic heap relations After discarding atomic heap relations for nonterminal heaps e obtain a set of graphs of heaps (ith the same structure as the original graph) in hich atomic heap relations reside only for terminal heaps No in order to produce heap contradictions from atomic heap relations e need to inspect only terminal heaps of these graphs hich makes it much easier to develop a complete procedure for producing heap contradictions 334 Rules for normalizing heap relations The rules for normalizing heap relations or normalization rules merge to identical heaps and isolate empty heaps hile simultaneously shrinking the graph of heaps In the rule NormEq heaps and are identical and e merge the to heaps by combining their heap sequents Here e rite [/ ]Σ for substituting for in every heap relation in Σ Note that the rule NormEq implies that is (partial) deterministic In the rule NormPC v = ɛ implies that heaps and u are identical Hence e merge the to heaps by combining their heap sequents and isolate the empty heap v from the graph of heaps Similarly the rule NormEmpty merges to empty heaps and u by combining their heap sequents In effect it allos us to collect all empty heaps hich do not need to be distinguished for the purpose of proof search into a single empty heap Note that the rule NormEmpty implies the existence of a single unit of By repeatedly applying the normalization rules to a graph of heaps e can eventually obtain an equivalent graph hich maintains a unique orld sequent for each heap and possibly a unique empty heap isolated from the graph It is important that the normalization rules shrink the graph of heaps but preserve all the properties established by the previous structural rules For example if the graph satisfies the property that all terminal heaps are disjoint (established by the rules Disj and Disj ) it continues to satisfy the same property after an application of any normalization rule Hence it is safe to aggressively apply the normalization rules after applying the previous structural rules

7 Θ; Σ = ɛ = [l E] Π Contɛ Θ; Σ = ɛ = ɛ Π Contɛ Θ [l E] [l E ] = Θ; Σ = [l E] = [l E ] Π Cont = Θ [l E] = [l E ] Θ; Σ = [l E] = [l E ] Π Cont Θ l 1 = l 2 = Θ; Σ = Cont = [l1 E 1 ] 2 = [l2 E 2 ] Π Figure 3 Heap contradiction rules in the proof system P SL for separation logic 335 Rules for dealing ith empty heaps The last group of structural rules create an empty heap and apply the monoid las for empty heaps We use the rule ENe hen no rule can directly produce an empty heap The rule EJoin hich is based on neutrality of ɛ is sound because extending a heap ith an empty heap makes no change The rule ECancel creates an empty heap hen a heap is shon to be a child heap of itself It is based on cancellativity of : e can alays generate = ɛ and ɛ = ɛ by the rules ENe and EJoin and = u and = ɛ imply u = ɛ by cancellativity of (Similarly the rule NormPC is based on cancellativity of : e can alays generate = v by the rule EJoin and = u v and = v imply = u) It turns out that e need the rule ECancel for the proof of admissibility of cut (Theorem 51) but not for the proof of the completeness of P SL (Theorem 64) No e can accomplish the first requirement for obtaining a complete proof search strategy In order to enumerate all heap relations = 1 2 and 2 = 1 for a heap e first analyze the graph of heaps obtained by repeatedly applying the previous structural rules This produces all such heap relations that involve only non-empty heaps Then e apply the rule EJoin as necessary to produce all such heap relations that involve empty heaps We may think of the rule EJoin as extending heap relations for heap ith a pair of child heaps and ɛ or a pair of sibling heap ɛ and parent heap It is the only rule in P SL that is capable of creating ne heap relations for an arbitrary heap Thus henever an arbitrary heap ith no heap relation needs a pair of child heaps or a pair of sibling and parent heaps e should apply the rule EJoin hich inevitably reuses an existing empty heap For example e prove the validity of as follos: ; ɛ = ɛ = ɛ [ = ] ɛ L [ = ] ; ɛ = ɛ = ɛ [ = ] [ = ] R ɛ ; ɛ = ɛ = ɛ [ = ] R [ = ] ɛ ; ɛ = ɛ [ = ] [ = ] ɛ EJoin ; [ = ] ENe Note that there is no need to create fresh child heaps 1 and 2 ith = 1 2: if e can prove the orld sequent using fresh child heaps about hich nothing is knon e should be able to prove it equally by reusing an existing empty heap Similarly e prove the validity of ( ) as follos: ; ɛ = ɛ = ɛ [ = ] ɛ L [ = ] ; ɛ = ɛ = ɛ [ = ] L [ = ] ɛ ; ɛ = ɛ [ = ] [ = ] ɛ EJoin ; [ = ] ENe ; [ = ( )] R Again e do not create fresh sibling and parent heaps and instead reuse an existing empty heap 34 Heap contradiction rules of P SL The proof system P SL has five rules Contɛ = to Cont for producing heap contradictions In conjunction ith the structural rules these rules enable us to detect all types of heap contradictions thereby accomplishing the second requirement for obtaining a complete proof strategy To see hy assume a orld sequent By repeatedly applying the structural rules in the same order as presented above e can obtain a semantically equivalent set of orld sequents Θ; Σ i Π i (i = 1 n) such that: 1) Σ i induces a graph of heaps in hich all terminal heaps are disjoint; 2) atomic heap relations reside only for terminal heaps and e need to consider only terminal heaps to detect heap contradictions For an empty heap e use the rules Contɛ = and Contɛ hich express the only ays to produce heap contradictions from an empty heap ith = ɛ Note that = ɛ and = [l E] do not produce a heap contradiction because the former implies the latter For a terminal singleton heap e use the rules Cont = and Cont = hich express the only ays to produce heap contradictions from a terminal singleton heap ith = [l E] Note that = [l E] implies = ɛ alays and = [l E ] if Θ [l E] [l E ] holds We do not need to consider other forms of terminal heaps for example those ith no atomic heap relations Finally the rule Cont expresses the only ay to produce heap contradictions from to disjoint terminal singleton heaps ith 1 = [l1 E 1] and 2 = [l2 E 2] This is because if Θ l 1 l 2 holds the to heap relations are consistent ith = 1 2 and e cannot produce a heap contradiction In this ay e can detect all types of heap contradictions in heap relations 4 Examples of proving orld sequents This section presents three examples of proving orld sequents in P SL We rite [l ] to denote [l E] for some expression E and assume to distinct location expressions l and l (l l ) 41 (([l ] [l ]) ([l ] [l ])) The goal formula implies that given a fragment of a heap e can uniquely determine the remaining fragment Its proof illustrates that the rule Disj indirectly applies cancellativity of to to pairs of child heaps We begin ith a orld sequent ; [ = C] here C is the goal formula After applying the logical rules e obtain the folloing graph of heaps here heap relations are displayed for child heaps: u 1 = [l ] u2 = [l ] v 1 = [l ] v2 = [l ] Then e apply the rule Disj and the propagation rules Prop and Prop = to generate = 32 different orld sequents as ne goals All these ne goals are immediately provable by the rules Contɛ Contɛ = and Cont = An example of such a

8 orld sequent has heap relations 4 = [l ] originating from heap u 2 by the rule Prop and 4 = [l ] originating from heap v 2 by the rule Prop = : u 1 u 2 v 1 1 = [l ] 2 = ɛ 3 = ɛ 4 = [l ] 4 = [l ] By applying the rule Cont = to heap 4 e complete the proof 42 A A A here A = ( I) The goal formula is valid in separation logic because heaps form a partial deterministic monoid: H 1 H 2 may be undefined (hen H 1#H 2 does not hold) but if it is defined the result is unique In contrast the same formula is not valid in Boolean BI the underlying theory of separation logic hich assumes a non-deterministic monoid [21] The proof illustrates the use of the rule EJoin in proving a nontrivial formula After applying the logical rules to a orld sequent ; [ = A A A] e obtain the folloing graph of heaps: u 2 = ɛ [ I = ] v2 = ɛ v 2 By applying the logical rules to heap and the propagation rule Propɛ e obtain the folloing graph: = ɛ = ɛ u 2 = ɛ = ɛ v2 = ɛ u 3 = ɛ u1 = ɛ v1 = ɛ v3 = ɛ No e can either apply the propagation rule Propɛ = to heap or use the rule NormPC to complete the proof 43 (([l ] ) ([l ] ([l ] ([l ] )))) The goal formula is an example of a formula that cannot be proven ithout an application of the rule Disj After applying the logical rules to a orld sequent ; [ = C] 1 here C is the goal formula e obtain the folloing graph: [[l ] = ] 1 u 2 [ = [l ] ] 2 u 1 = [l ] u3 = [l ] We ish to identify heaps 1 and 2 (because heaps u 1 and u 3 are identical) but there is no ay to make further progress toard identifying 1 and 2 ithout applying the rule Disj Hence e apply the rule Disj and the propagation rule Prop to heaps u 1 and u 3 After eliminating three ne goals that are immediately provable e obtain the folloing graph: u 3 u 1 v 1 v 3 [[l ] = ] 1 [ = [l ] ] 2 Since heap has no sibling and parent heaps e cannot apply the rule L to I at this point To make further progress e apply either the rule Disj or the rule EJoin after creating an empty heap If e apply the rule EJoin e obtain the folloing graph: [ I = ] u 2 = ɛ [ I = ] v2 = ɛ u 3 u 1 v 1 v 3 An application of the rule L to I at heap generates to ne goals and the interesting case produces I as a true formula at the same heap (here e omit I): [ I = ] = ɛ u 2 = ɛ [ I = ] v2 = ɛ u 3 u 1 v 1 v 3 = ɛ u 1 u 2 u 3 v 1 = ɛ v2 = [l ] v3 = ɛ By applying the rule NormPC to merge heaps 1 and 2 e obtain a heap sequent [[l ] = [l ] ] hich is easily provable 5 Admissibility of cut We state the admissibility of cut in P SL as follos: Theorem 51 (Admissibility of cut) If [Γ = C] and [Γ C = ] then [Γ = ] Theorem 51 assumes a fe properties such as eakening and contraction of the expression contradiction judgment Θ (for hich e do not provide inference rules) In particular e assume its on admissibility of cut (here θ denotes the negation of θ): Θ 1 θ and Θ 2 θ imply Θ 1 Θ 2 The first step in the proof of Theorem 51 is to sho that it is safe to merge to arbitrary heap sequents: Lemma 52 If [Γ 1 = 1] u [Γ 2 = 2] v then Θ; [u/v]σ Π [Γ 1 Γ 2 = 1 2] u Intuitively the second orld sequent inherits every heap relation from the first orld sequent so e should be able to prove the

9 second by the same sequence of rules in the proof of the first or its subsequence Next e prove the contraction property for heap relations: Proposition 53 If Θ; Σ σ σ Π then Θ; Σ σ Π The statement in Proposition 53 implicitly assumes that e may apply the rules Disj Disj and Assoc to the same heap relation For the rules Disj and Disj the proof for such an application hich essentially has no effect requires the rules ENe and EJoin hich are necessary for the completeness of P SL anyay For the rule Assoc hoever the proof for such an application requires the rule ECancel hich is unnecessary for the completeness of P SL Hence if e never apply the rule Assoc to the same heap relation e may discard the rule ECancel To prove Theorem 51 e generalize its statement as follos: Lemma 54 If Θ 1; Σ 1 Π 1 [Γ 1 = 1 C] and Θ 2; Σ 2 Π 2 [Γ 2 C = 2] then Θ 1 Θ 2; Σ 1 Σ 2 Π 1 Π 2 [Γ 1 Γ 2 = 1 2] Here Π 1 Π 2 denotes the result of combining heap sequents for the same heap variable In conjunction ith the contraction property for formulas Lemma 54 implies Theorem 51 6 Soundness and completeness of P SL This section proves the soundness and completeness of the proof system P SL ith respect to separation logic The proof of soundness is straightforard hereas the proof of completeness uses several subtle properties of graphs of heaps represented by orld sequents In this section metavariable W denotes orld sequents and heap variables directly refer to heaps For simplicity e do not consider first-order formulas 61 Soundness The soundness property states that a derivation of a orld sequent means that its semantic interpretation is self-contradictory As a special case e obtain Theorem 61: Theorem 61 (Soundness) If ; [ = A] then = A The key step in the proof of soundness is to sho that in any inference rule of P SL the orld sequent in the conclusion is either self-contradictory in itself or semantically implies the disjunction of all orld sequents in the premise Given a stack S let us rite W S for the interpretation of orld sequent W according to the semantics of separation logic (hich is formally defined belo) We ish to prove that a derivation of W implies W S ie W S is self-contradictory for any stack S Suppose that the last inference rule in the derivation of W is not an axiom and has orld sequents W 1 W n in its premise (n 1) By induction hypothesis e have W 1 S W n S or equivalently i=1 n Wi S Then by proving that W S implies i=1 n Wi S e prove that i=1 n Wi S implies W S No W S immediately follos Formally e define W S using three auxiliary semantic functions θ S σ S and π S all of hich follo our intuition on orld sequents given in Section 31: E = E S = E S = E S E E S = E S E S = ɛ S = = ɛ = ɛ S = ɛ = [l E] S = = l S E S = [l E] S = l S E S = 1 2 S = = 1 2 [Γ = ] S = A Γ (S ) = A B (S ) = B S = θ Θ θ S σ Σ σ S π Π π S No e prove the key step in the proof of soundness: Lemma 62 For every inference rule ith the conclusion W and the premise consisting of W 1 W n it holds that W S implies Wi S for any stack S If n = 0 e have W S i=1 n As a corollary e prove that a derivation of a orld sequent means that its semantic interpretation is self-contradictory Corollary 63 If there is a derivation of a orld sequent W in P SL then W S holds for any stack S For the rule ExpCont e assume that Θ implies Θ S Then a derivation of ; [ = A] implies (S ) = A: ; [ = A] S = (S ) = A = (S ) = A Since denotes an arbitrary heap e have = A and Theorem 61 follos 62 Completeness The completeness property states that a valid formula in separation logic has a proof of its negation in P SL : Theorem 64 (Completeness) If = A then ; [ = A] For the proof of completeness e eaken the rules R and L by discarding their principal formula in the premise The original rules are invertible and useless applications ith rong heap relations are safe but only because the principal formula survives in the premise and e can alays try different heap relations ithout having to backtrack This is hoever inadequate for the proof of completeness hich must sho ho to actually find a right heap relation Hence e eaken the rules R and L to directly reflect the semantics of and but also present a scheme for computing the complete set of heap relations for a given heap We also introduce an explicit eakening rule for eliminating an atomic heap relation (hich is admissible) as a ne structural rule: σ is an atomic heap relation Θ; Σ σ Π Weaken We use the rule Weaken to eliminate all atomic heap relations at non-terminal heaps hen the propagation rules can produce no more ne heap relations As explained in Section 5 e do not use the rule ECancel Our proof of Theorem 64 uses three ne concepts: canonical orld sequents disjunctive derivation states and conjunctive proof goals A canonical orld sequent Z is a special form of a orld sequent such that if Z S holds for any stack S e can construct its derivation using only the rules L ExpCont and the heap contradiction rules (In Proposition 612 e introduce a class of orld sequents that are shon to be canonical) A disjunctive derivation state Ψ for a orld sequent W is a set of orld sequents that constitute all the leaves in a partial derivation of W That is a disjunctive derivation state Ψ = {W 1 W n} for a orld sequent W means that there is a partial derivation of the folloing form: W 1 W n W We use a reduction judgment Ψ R Ψ to mean that such a partial derivation expands to another partial derivation ith disjunctive derivation state Ψ by an application of the logical or structural rule R to some orld sequent W i (1 i n) That is e have Ψ = Ψ {W i} {Wi 1 Wi m } ith:

10 Wi 1 Wi m R W 1 W i W n W We rite Ψ Ψ for the reflexive and transitive closure of For a stack S e define the interpretation Ψ S = W i Ψ Wi S A conjunctive proof goal Ω is a set of disjunctive derivation states for a common orld sequent Given a logical or structural rule R e use a reduction judgment Ω R Ω to mean that e can generate Ω by applying the rule R to some disjunctive derivation state Ψ in Ω That is e have Ω = Ω {Ψ} {Ψ 1 Ψ n} and Ψ R Ψ i for i = 1 n If R is the rule R or L e have n 1 and produce each Ψ i by focusing on the same formula in the same heap sequent in the same orld sequent in Ψ For all the other rules e have n = 1 and replace Ψ by Ψ 1 We rite Ω Ω for the reflexive and transitive closure of For a stack S e define the interpretation Ω S = Ψ i Ω Ψi S In order to prove Theorem 64 assume a goal formula A such that = A We aim to build a sequence of conjunctive proof goals Ω 1 Ω N such that: Ω 1 = {{W }} here W = ; [ = A] Ω i R i Ω i+1 for i = 1 N 1 here R i is a logical or structural rule Ω i+1 S implies Ω i S for i = 1 N 1 and any stack S Ω N contains only canonical orld sequents With such a sequence of conjunctive proof goals e can build a derivation of W as follos: Since e have = A e have (S ) = A = (S ) = A = W S = Ω 1 S for any stack S Since Ω N S implies Ω 1 S e have Ω N S Since every disjunctive derivation state in Ω N contains only canonical orld sequents e may rite Ω N = j Ψj and Ψ j = k Zj k Since e have Ω N S = j Ψj S = j Ψj S there exists a disjunctive derivation state Ψ j such that Ψ j S holds Since e have Ψ j S = k Zj k S = k Zj k S e have Z j k S for each k Since Ω 1 Ω N e have {W } Ψ j Since e have Z j k S for each k there is a derivation of Zj k for each k by the definition of canonical orld sequents By combining {W } Ψ j and the derivation of Z j k for each k e obtain a derivation of W Belo e explain ho to build such a sequence of conjunctive proof goals 621 Completeness of the invertible rules Suppose that a orld sequent in Ω i contains a formula to hich e can apply a rule R other than L R and L By applying the rule R e obtain Ω i R Ω i+1 By Corollary 66 Ω i+1 S implies Ω i S for any stack S In this ay e can eliminate all such formulas ithout losing completeness Proposition 65 Except for the rules L ExpCont R L and Weaken every logical or structural rule ith the conclusion W and the premise consisting of W 1 W n is invertible in that i=1 n Wi S implies W S for any stack S Corollary 66 (Completeness of the invertible rules) For such an invertible rule R and any stack S if {W } R Ψ then Ψ S implies {W } S 622 Completeness of the rules R L and Weaken We no sho ho to recover the completeness of the rules R and L We introduce several notations in order to concisely describe properties of graphs of heaps: u means that there is a sequence of zero or more childparent relations from heap to heap u in the graph: = 0 1 = 0 0 n = n 1 n 1 and n = u for n 0 Hence if u heap is a descendant of heap u or equivalently heap u is an ancestor of heap Note that e allo means that is a terminal heap ie there is no heap relation = u v T () denotes the set of terminal descendants of heap ie T () = {v v and v } We assume that heap relations in every orld sequent induce not only a graph of heaps but also a special empty heap ɛ ith heap relation ɛ = ɛ that is separate from the graph This assumption is safe because e can alays generate such a special empty heap ith the rule ENe if there is none and combine multiple empty heaps ith the rule NormEmpty if there are many We classify orld sequents according to the property of graphs of heaps induced by their heap relations (ithout considering its special empty heap ɛ) as follos: 1 Elementary: if = 1 2 then T ( 1) T ( 2) = 2 Rooted: elementary and there is a root heap such that v for every heap v 3 Consistent: rooted and if = u 1 u 2 and = v 1 v 2 then T (u 1) T (u 2) = T (v 1) T (v 2) 4 Full: consistent and for any non-empty set S of terminal heaps there exists at least one heap ith T () = S 5 -ready for heap : full and for any pair of non-empty sets S 1 and S 2 of terminal heaps such that S 1 S 2 = and S 1 S 2 = T () there exist heaps 1 and 2 such that = 1 2 ith T ( 1) = S 1 and T ( 2) = S 2 6 -ready for heap : full and for any pair of non-empty sets S 1 and S 2 of terminal heaps such that T () S 1 = and T () S 1 = S 2 there exist heaps 1 and 2 such that 2 = 1 ith T ( 1) = S 1 and T ( 2) = S 2 7 Saturated: full and applications of the propagation rules produce no more ne heap relations 8 Sanitized: full and non-terminal heaps have no atomic heap relations 9 Normalized: sanitized ith no empty heaps and for any nonempty set S of terminal heaps there exists a unique heap ith T () = S 10 Expanded: obtained by applying only the logical rules except R and L to some consistent orld sequent Suppose that a orld sequent in Ω i contains a false formula A B or a true formula A B about heap By converting it into normalized orld sequents that are also -ready or -ready for heap according to Corollary 610 e obtain Ω i Ω i+1 such that Ω i+1 S implies Ω i S for any stack S By Proposition 611 e can apply the rule R or L to obtain Ω i+2 ith Ω i+1 R Ω i+2 i+1 L or Ω Ω i+2 such that Ω i+2 S implies Ω i+1 S for any stack S In this ay e can eliminate every false