Theoretical Studies of Program Verification Based on Separation Logic

Program verification is a fundamental concern in computer science. It underpins the reliability and security of complex software systems, helping to avoid elusive and costly defects. One of the classical frameworks for program reasoning is Hoare Logic, which lacks mechanisms for modular reasoning about memory. To address this, Separation Logic (SL) was introduced as an extension of Hoare Logic for heap-manipulating programs. Its core innovation is the separating conjunction, which asserts that the heap can be partitioned into disjoint parts. This concept, captured by the Frame rule, enables a principle of locality that enhances modularity and scalability. This has made SL the foundation for many verification tools, such as Facebook Infer.

Building on SL, researchers developed Concurrent Separation Logic (CSL) for modular reasoning about parallel programs. To manage shared-memory complexity, CSL was extended with fractional permissions, enabling a fine-grained distinction between shared read-only and exclusive write access to prevent data races. Brotherston et al. further introduced nominal labels to give heap regions unique identities, ensuring consistency for reasoning about overlapping memory chunks accessed by different threads. Despite the expressive power of combining fractional permissions and nominal labels, the decidability of their logical entailment remained an open question.

Another extension is Incorrectness Separation Logic (ISL), introduced by Raad et al. ISL adapts SL's principles for under-approximate reasoning to formally prove the presence of bugs, in contrast to traditional over-approximate logics which prove their absence. By showing that an erroneous state is reachable from a set of initial states, ISL provides formal guarantees for bug-finding tools. While the logic is known to be sound, its relative completeness had yet to be proven.

This dissertation advances the foundations of these logics by resolving these underlying limitations. First, it establishes the decidability of entailment checking for a symbolic-heap fragment of the CSL developed by Brotherston et al. Entailment checking is the problem of determining whether one logical formula implies another; this task must be automated to enable practical verification tools. This work demonstrates that by restricting the formulas to a specific symbolic-heap fragment, the entailment problem becomes decidable. The solution employs a normalization process to calculate the permissions on shared memory regions and eliminates the nominal labels. This syntactic transformation reduces the entailment checking of our restricted CSL fragment to the decidable entailment checking problem of an existing logic.

Second, we establish the relative completeness of Incorrectness Separation Logic. Relative completeness is the property that a proof system is complete provided an oracle for entailment checking of assertions exists. We prove this property for ISL by developing a weakest postcondition calculus that handles heap predicates and reasons about both normal and error terminations. A key technical innovation in this proof is a canonicalization procedure that rigorously and exhaustively analyzes all possible variable aliasing scenarios.

The third topic extends relative completeness to a version of ISL supporting array predicates and pointer arithmetic, essential for reasoning about low-level systems code. Following on extensions in traditional SL, this work addresses the absence of these features in under-approximate reasoning. To achieve this, we establish relative completeness utilizing an enhanced canonicalization procedure that accounts for all possible orderings of the terms involved.

We provide new results on decidable entailment in CSL and relative completeness in ISL. These contributions offer a deeper understanding of how logical principles can support verifying both correct and incorrect program behaviors. They thereby strengthen the formal methods available for building trustworthy software.