Relative Completeness of Incorrectness Separation Logic

2025-08-02

AI Summary

This paper addresses the lack of theoretical foundations for under-approximation–based error detection in heap-manipulating programs by establishing the first relatively complete proof system for Incorrectness Separation Logic (ISL). Methodologically, it introduces a normalized semantics supporting existential quantification and variable aliasing, permits infinite disjunctions in disjunctive normal forms to enhance expressiveness, and integrates Separation Logic with Reverse Hoare Logic—leveraging weakest-postcondition computation and symbolic heap modeling. The main contributions are: (1) the first relative completeness proof for ISL; (2) overcoming classical limitations to enable precise characterization of erroneous executions involving aliasing and nondeterminism; and (3) providing a rigorous logical foundation and formal guarantee for automated error discovery via under-approximation.

Technology Category

• Knowledge Representation and Reasoning: Logic Programming
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories

Application Category

• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

Incorrectness Separation Logic (ISL) is a proof system that is tailored specifically to resolve problems of under-approximation in programs that manipulate heaps, and it primarily focuses on bug detection. This approach is different from the over-approximation methods that are used in traditional logics such as Hoare Logic or Separation Logic. Although the soundness of ISL has been established, its completeness remains unproven. In this study, we establish relative completeness by leveraging the expressiveness of the weakest postconditions; expressiveness is a factor that is critical to demonstrating relative completeness in Reverse Hoare Logic. In our ISL framework, we allow for infinite disjunctions in disjunctive normal forms, where each clause comprises finite symbolic heaps with existential quantifiers. To compute the weakest postconditions in ISL, we introduce a canonicalization that includes variable aliasing.

Problem

• Proves relative completeness of Incorrectness Separation Logic
• Focuses on bug detection in heap-manipulating programs
• Uses weakest postconditions and infinite disjunctions

Innovation

• Uses Incorrectness Separation Logic for bug detection
• Leverages weakest postconditions for relative completeness
• Introduces canonicalization for variable aliasing