%!TEX root = thesis.tex

\chapter{Monitoring Timing Constraints on possibly infinite Streams}
\label{chapter-monitorability}
	The goal of this thesis is to implement online monitors for the TADL2 Timing Constraints on possibly infinite streams. An online monitor checks the current execution of a system, parallel to its execution. Because every computing system has finite memory resources and the online monitor should be able to process at least as many events as occur in the stream in a specific amount of time, not every property can be monitored in an online monitoring setting. In this chapter, the term \emph{Simple Monitorability} will be introduced, which ensures that monitoring a property on infinite streams is possible with finite memory resources and finite runtime per event. As an introduction into the setting, some related work will be described, inter alia \emph{TeSSLa}, the programming language which is used for the implementation.

\section{Related Work}

	\subsection{Runtime Verification}
		As monitoring plays a major role in runtime verification, a short overview of this will be given. The definitions of \cite{RuntimeVerification} are used, in which \emph{Runtime Verification} is a technique that can detect deviations between the run of a system and its formal specification by checking correctness properties. A \emph{run}, which might also be called \emph{trace}, is a sequence of system states, which might be infinite. An \emph{execution} is a finite prefix of this run. A \emph{monitor} reads the trace and decides whether it fulfills the correctness properties or violates them.\\
		A distinction is made between \emph{offline} and \emph{online} monitoring. Offline monitoring is using a stored trace that has been recorded before. Therefore, the complete trace (or the complete part of the trace that should be analyzed) is known in the analysis. Online monitoring checks the properties while the system is running, which means that the analysis must be done incrementally on a growing prefix of the trace. Because of memory and time limitations, not all previous states can be reread in online monitoring. More detailed contemplations on the limitations of online monitors will be given later in this chapter.

	\subsection{TeSSLa}
		TeSSLa (\textbf{Te}mporal \textbf{S}tream-based \textbf{S}pecification \textbf{La}nguage) \cite{TeSSLa1} is a specification language built for stream-based runtime verification. In TeSSLa, all streams in one specification must have a common global clock. Events or changes in a signal may occur in streams irregularly, independent of events in other streams. The verified streams are either considered as a signal, which remains unchanged for a certain amount of time (called \textit{piecewise constant signals}), or they are \textit{event streams}, in which each event consists of a timestamp and a data value. Both variants can be transferred into each other, as described in \cite{TeSSLa1}. A formal definition of the TeSSLa language core can be found in \cite{TeSSLa2}. A short overview of the formal definition of event streams will be given next.\\
		An event stream is defined over a time domain $\mathbb{T}$ and a data domain $\mathbb{D}$ and is a possibly infinite sequence $s=a_0a_1...\in\mathcal{S}_D=(\mathbb{T}\cdot\mathbb{D})^\omega\cup(\mathbb{T}\cdot\mathbb{D})^+\cup(\mathbb{T}\cdot\mathbb{D})^*\cdot(\mathbb{T}_\infty\cup\mathbb{T}\cdot\{\bot\})$ where $a_{2i} < a_{2(i+1)}$ for all $i$ with $0 < 2(i + 1) < |s|$ ($0 < 2(i + 1) < \infty$ if the sequence is infinite). While the data domain $\mathbb{D}$ can be bounded (e.g., boolean or integer) or unbounded (e.g., maps or lists), the time domain $\mathbb{T}$ is a \emph{totally ordered semi-ring} $(\mathbb{T}, 0, 1, +, *, \leq)$ that is not negative.\\
		In TeSSLa, computations are done in timestamps, in which new events are arriving. Based on the specification, output streams are generated with events on the same timestamps as the used input streams, but filtering is possible, where not all input events produce output events. With the \textit{delay}-operator, it is possible to create new timestamps. If the \textit{delay}-operator is not used in a specification, the output streams only contain events in timestamps, which also had events in the input streams. These specifications are called \textit{timestamp conservative}.\\
		From a memory perspective, streams may be understood as \textit{piecewise constant signals}. Only the timestamp and the data value of the youngest event of one stream can be directly accessed. This event is available until the next event of this stream occurs. With the use of the \textit{last}-operator, which can be used recursively, the data value of the previous event can be accessed. Another important operator is the \textit{lift}-operator, which applies a function on data values (for example, the $+$ operator) on the data value of every event of one or more streams and creates a new stream with events at the same timestamps and the results of the function as data values.

	\subsection{LOLA\cite{LOLA}}
		\cite{LOLA} introduces \textit{LOLA}, a specification language for the observation of synchronous event streams, comparable to TeSSLa. The main difference between these languages is that TeSSLa is designed to monitor input streams, which are not synchronized, which means their events may occur independently from each other. Because the events of the timing constraints defined in TADL2 and AUTOSAR are also not synchronized, TeSSLa is more suitable for monitoring them.\\
		\cite{LOLA} also defines the term of \textit{Efficiently Monitorable Specifications}, which describes that the worst case-memory requirement of a LOLA Specification is independent of the length of the observed trace.\\
		Another main difference to TeSSLa is that in the standard variant of LOLA, it is not possible to create new time stamps like in TeSSLa.

	\subsection{Semantics of LTL$_3$\cite{1157} and RV-LTL\cite{10.1007/978-3-540-77395-5_11}}
		In Runtime Verification, the output of a monitor is based on a finite prefix on a possibly infinite trace of system states. On many of these prefixes, it cannot be finally decided if this run the system fulfills a given property.  Because of this, a binary boolean output of a monitor may be misleading because it cannot express if the output is final or may change due to upcoming system states.
		\begin{definition}[LTL$_3$\cite{1157}]
		\cite{1157} introduces a three-valued semantic for Runtime Verification and LTL (Linear Temporal Logic). This semantic, LTL$_3$ called, is defined on a finite trace $u=a_0...a_{n-1}\in\Sigma^*$ of length $n$. A LTL$_3$ formula $\phi$ on trace $u$ at position $i < n$ is defined as:\\
			\begin{math}
				[u,i\models\varphi]_3=
					\begin{cases}
						\top & \text{if } \forall \sigma\in\Sigma^\omega:u\sigma,i \vDash\varphi\\
						\bot & \text{if } \forall \sigma\in\Sigma^\omega:u\sigma,i \nvDash\varphi\\
						? & \text{otherwise }
					\end{cases}
			\end{math}
		\end{definition}
		If the prefix $\sigma$ fulfills the formula $\phi$, $[u,i\models\phi]$ is $\top$. If it doesn't fulfill the formula, $[u,i\models\phi]$ is $\bot$. In any other case, $[u,i\models\phi]$  is defined as $?$.\\ \\

		\cite{10.1007/978-3-540-77395-5_11} introduces a four-valued semantic called RV-LTL. It is defined as an extension of LTL$_3$, where the $?$-value is further split.
		\begin{definition}[RV-LTL]
			Again, let $u=a_0...a_{n-1}\in\Sigma^*$ be a finite trace of length $n$, $i < n$, and $\varphi$ be a RV-LTL formula. The truth value of this formula is defined as:\\
			\begin{math}
				[u,i\models\varphi]_{RV}=
					\begin{cases}
						\top & \text{if } [u, i\vDash \varphi']_3=\top\\
						\bot & \text{if } [u, i\vDash \varphi']_3=\bot\\
						\top^p & \text{if } [u, i\vDash \varphi']_3= ? \land [u,i\vDash\varphi]_F=\top\\
						\bot^p & \text{if } [u, i\vDash \varphi']_3= ? \land [u,i\vDash\varphi]_F=\bot
					\end{cases}
			\end{math}\\
			where $\phi'$ is a modified form of $\phi$, in which the weak next-state operator is replaced by the strong next-state operator. $[u,i\vDash\varphi]_F$, as defined in \cite{10.1007/3-540-15648-8_16}, is the binary (two valued boolean) truth value of the formula $\varphi$ over $u$ at position $i$.
		\end{definition}
		$\top$ and $\bot$ are final truth values, which will not change due to upcoming symbols of $u$. $\top^p$ and $\bot^p$ may change based on upcoming symbols of $u$, but on the prefix $u$ of the length $i$, $\varphi$ is (not) fulfilled.

	\subsection{Transducer Models}
		In section~\ref{sec:monitorability}, some transducer models are used, which will be introduced next.
		\begin{definition}[Deterministic Finite State Transducer\cite{Berstel1979}]
			A \textit{Deterministic Finite State Transducer}(DFST) is a 5-Tuple $(\Sigma, \Gamma, Q, q_0, \delta)$, where
			\begin{itemize}
				\item
				$\Sigma$ is an input alphabet
				\item
				$\Gamma$ is an output alphabet
				\item
				$Q$ is a finite set of states, with initial state $q_0$
				\item
				$\delta:Q\times\Sigma\rightarrow Q\times\Gamma$ is a state transition function
			\end{itemize}
			The run of a DFST for an input word $w=w_0w_1w_2...\in\Sigma^\infty$ is a sequence $s_0\xrightarrow{w_0/o_0} s_1\xrightarrow{w_1/o_1} s_2...$, where $s_0=q_0$, $\delta(s_i,w_i)=(s_{i+1}, o_i), i \geq 0$ and the output word $o=o_0o_1o_2...\in\Gamma^\infty$.
		\end{definition}
		DFSTs are similar to deterministic finite automata, with two major differences. First, the transition function outputs a symbol of $\Gamma$ at every transition and second, the states of a DFST are not accepting. The transducer \textit{transduces} an input word, not accepting or rejecting it.\\ \\
		Timed Deterministic Finite State Transducers(TDFST) are an extension of DFST. The extension from DFST to TDFST is done analogous to the extension of automata to timed automata in \cite{ALUR1994183}.
		\begin{definition}[Timed Deterministic Finite State Transducer]
			\textit{Timed Deterministic Finite State Transducers}(TDFST) are a 6-Tuple $(\Sigma, \Gamma, Q, q_0, C, \delta)$, where
			\begin{itemize}
				\item
				$\Sigma$ is an input alphabet
				\item
				$\Gamma$ is an output alphabet
				\item
				$Q$ is a finite set of states, with initial state $q_0$
				\item
				$C$ is a set of clocks
				\item
				$\delta:Q\times\Sigma\times\Theta(C)\rightarrow Q\times 2^C\times\Gamma$ is a state transition function, where for all $(q_a, \sigma_a, \vartheta_a, q_a', R_a, \gamma_a)$, $(q_b, \sigma_b, \vartheta_b, q_b', R_b, \gamma_b)\in \delta$ the conjunction $\vartheta_a\land\vartheta_b$ is unsatisfiable.
			\end{itemize}
			Let $v_i:C\rightarrow R$ be functions that map each clock to its current value.

			The run of a TDFST for an input word $w=(w_0,t_0)(w_1,t_1)(w_2,t_2)..., w_i\in\Sigma^\infty$ is a sequence $s_0, v_0\xrightarrow[o_0]{(w_0, t_0),\vartheta_0,r_0}s_1,v_1\xrightarrow[o_1]{(w_1, t_1),\vartheta_1,r_1}s_2,...$ with output $o=o_0o_1o_2...\in \Gamma^\infty$, if, and only if,
			\begin{itemize}
				\item
					$s_0=q_0$
				\item
					$\forall c\in C: v_0(c)=0$
				\item
					$\forall i\geq 0:$
					\begin{itemize}
						\item
							$\delta(s_i, w_i,\vartheta_i)=(s_{i+1},r_i,o_i)$
						\item
							$\forall c\in r_i: v_{i+1}=v_i[c\leftarrow t_i]$
						\item
							$t_i,v_i \models\vartheta_i$
					\end{itemize}
			\end{itemize}
		\end{definition}
		In addition to DFSTs, the state transition function of TDFSTs takes a set of clock constraints into account when defining the next state of the transducer.

\section{Monitorability}
	\label{sec:monitorability}
	In this section, the term \textit{Simple Monitorability} is introduced. It represents a stricter alternative to \textit{Efficiently Monitorable Specifications} mentioned above by also restricting the allowed runtime per timestamp with events. \textit{Simple Monitorability} ensures that the worst-case memory consumption and the worst-case runtime per input event of a monitor are bounded independently of the input streams.
	\subsubsection{Preliminary - Timestamps}
		\label{monitorability_timestamps}
		As we consider possibly infinite streams, the time value of events can also grow into infinity. This is problematic because it leads to infinite memory requirements, which cannot be met, especially not in the context of online monitoring. Therefore, the time domain $\mathbb{T}$ is restricted by the following constraints:
		\begin{enumerate}[1.]
			\item
				The first used timestamp has the value $t_0=0$
			\item
				All used timestamps must be smaller than $t_{max}$.\\
				$t_{max}$ must be big enough, so it is not reached in practical use \footnote{for example, a 64-bit unsigned integer variable is enough to cover nanoseconds for 584.55 years}.
			\item
				The distance between two subsequent time values is predetermined but arbitrarily small.
			\item
				The number of possible timestamps is significantly larger than the number of events.
		\end{enumerate}
	Because of the restrictions in 2., 3. and 4., the possible number of events in a specific time interval remains unaffected.

	\subsection{Simple Monitorability}
		The concept behind the definition of \textit{Simple Monitorability} is that a monitor for event streams is defined by three parts, a state transition function, a state defining the memory of the monitor and an output function. At each timestamp containing input events, the new state is created by applying the state transition function to the previous state and the input events of the current timestamp. The output function is applied to the new state and the previous output and evaluates whether the specification is met until this timestamp.\\
		All following definitions of streams and functions follow the syntax and semantic from \cite{TeSSLa2}. The left half of figure~\ref{fig:OverviewMonitorability} visualizes the definitions, which will be done now.
		\begin{definition}[Simple Monitorability]
			A property is called \textit{Simple Monitorable} if a monitor, which monitors the property correctly, can be constructed in the following way:
			\begin{itemize}
				\item[\textbf{Input Streams}]
					Let $S_1, S_2, ..., S_n$ be the input streams with\\
					$\forall i:$ $S_i=(\mathbb{T}\cdot \mathbb{D}_i)^\omega\cup(\mathbb{T}\cdot \mathbb{D}_i)^+\cup(\mathbb{T}\cdot \mathbb{D}_i)^*\cdot(\mathbb{T}_\infty\cup\mathbb{T}\cdot\{\bot\})$
				\item[\textbf{State}]
					Let $S_{state}$ with $S_{state}= (\mathbb{T}\cdot \mathbb{D}_{state})^+\cup(\mathbb{T}\cdot \mathbb{D}_{state})^*$ be the state stream of the monitor. The cardinality of $\mathbb{D}_{state}$ is finite, the worst-case memory requirement is bounded independently of the input streams.\\
					Further let $f: S_1 \times S_2 \times ... \times S_n \times S_{state}\rightarrow S_{state}$ be a state transition function, which defines the state stream in an incremental fashion:\\
					\begin{math}
						\forall t\in \mathbb T \exists i\in \{1,2,...,n\}: S_i(t)\in\mathbb D_i:\\
						S_{state}(t)= f(S_1(t), S_2(t), ..., S_n(t), last(S_{state}, merge(S_1, S_2, ..., S_n))(t))
					\end{math}\\
					The worst-case runtime of $f$ is bounded independently of the input streams.
				\item[\textbf{Output Stream}]
					Let $S_{output}= (\mathbb{T}\cdot \{\top, \top^p, \bot^p, \bot\})^+\cup(\mathbb{T}\cdot \{\top, \top^p, \bot^p, \bot\})^*$\\
					be the output stream of the monitor, which is defined via a function\\
					$g:S_{state}\times S_{output}\rightarrow S_{output}$\\
					which incrementally defines the output stream:\newpage
					\begin{math}
						\forall t\in \mathbb T \exists S_{state}(t)\in\mathbb D_i:\\
						S_{output}(t)= g(S_{state}(t), last(S_{output}, S_{state})(t))
					\end{math}\\
					The worst-case runtime of $g$ is bounded independently of the input streams.
			\end{itemize}
		\end{definition}
		In every timestamp with input events, the state transition function $f$ is applied to the current youngest input events and the previous event of the state stream $S_{state}$. The output of $f$, combined with the timestamp of the latest input event, defines the new event in $S_{state}$. The output of function $g$ is applied to the current state and the previous output and produces the new output. It should be noted that a monitor, which follows this scheme is \textit{timestamp conservative}.\\
		For any monitor created in the way described above, a Deterministic Finite State Transducer (DFST) can be constructed, which is equivalent to the combination of a finite state and the state transition function. For that, let
		\begin{itemize}
			\item
			$Q=\mathbb{D}_{state}$ be the finite set of possible states with initial state $q_0$
			\item
			$\Sigma=((\mathbb{D}_1\times \mathbb{T}),...,(\mathbb{D}_n\times \mathbb{T}))$ be the input alphabet
			\item
			$\Gamma = \mathbb D_{state}$ be the output alphabet and
			\item
			$\delta: Q\times \Sigma\rightarrow Q\times\Gamma$ be the transition function.
		\end{itemize}
		For the output stream in combination with the output function, an equivalent DFST can be constructed too. For that, let
		\begin{itemize}
			\item
				$Q' = \{\top, \top^p, \bot^p, \bot\}$ be the states with initial state $q\in Q'$
			\item
				$\Sigma'=\mathbb D_{state}\times \mathbb{T}$ be the input alphabet
			\item
				$\Gamma' = \{\top, \top^p, \bot^p, \bot\}$ be the output alphabet and
			\item
				$\delta': Q'\times \Sigma'\rightarrow Q'\times\Gamma'$ be the transition function.
		\end{itemize}
		It should be noted that both transducers could be combined into one transducer without changing the expressiveness. This is not done in order to keep analogies to the following definition.
	\subsection{Simple Monitorability With Delay}
		Most of the TADL2 constraints cannot be monitored correctly in a \emph{timestamp conservative} way. For example, the \emph{RepeatConstraint} with the attributes $lower=upper=4$ and $span=1$ expects subsequent events to have a time distance of $4$. If one event is missing, the output of a timestamp conservative monitor will remain $\top^p$, until the next input event arrives. Therefore, the monitor cannot check the constraint correctly. Because of this problem, the definition of \emph{Simple Monitorability} is expanded by the ability to introduce exactly one new timestamp. The following definitions are visualized in the right half of figure~\ref{fig:OverviewMonitorability}.
	\begin{definition}[Simple Monitorability With Delay]
		A property is called \textit{Simple Monitorable With Delay} if a monitor, which monitors the property correctly, can be constructed in the following way:
		\begin{itemize}
			\item[\textbf{Input Streams}]
				Let $S_1, S_2, ..., S_n$ be the input streams with\\
				$\forall i:$ $S_i=(\mathbb{T}\cdot \mathbb{D}_i)^\omega\cup(\mathbb{T}\cdot \mathbb{D}_i)^+\cup(\mathbb{T}\cdot \mathbb{D}_i)^*\cdot(\mathbb{T}_\infty\cup\mathbb{T}\cdot\{\bot\})$
			\item[\textbf{State}]
				Let $S_{state}$ with $S_{state}= (\mathbb{T}\cdot \mathbb{D}_{state})^+\cup(\mathbb{T}\cdot \mathbb{D}_{state})^*$ be the state stream of the monitor. The cardinality of $\mathbb{D}_{state}$ is finite, the worst-case memory requirement of the state is bounded independently of the input streams.\\
				Further let $f: S_1 \times S_2 \times ... \times S_n \times S_{state}\rightarrow S_{state}$ be a state transition function, which defines the state stream in an incremental fashion:
				\begin{math}
					\forall t\in \mathbb T \exists i\in \{1,2,...,n\}: S_i(t)\in\mathbb D_i:\\
					S_{state}(t)= f(S_1(t), S_2(t), ..., S_n(t), last(S_{state}, merge(S_1, S_2, ..., S_n))(t))
				\end{math}\\
				The worst-case runtime of $f$ is bounded independently of the input streams.
			\item[\textbf{State$_\text{timeout}$}]
				Let $S_{state_{timeout}}$ with $S_{state_{timeout}}= (\mathbb{T}\cdot (\mathbb{D}_{state}\cup \{timeout\}))^+\cup(\mathbb{T}\cdot (\mathbb{D}_{state}\cup \{timeout\}))^*$ be a second state stream, which is defined via a delay generator $DelayGen: S_{state}\rightarrow S_{state_{timeout}}$. $DelayGen$ has two tasks. First, it copies each input event to the output. Second, a timer is started at every input timestamp. The duration of this timer is dependent on the input. If the next input comes before the timer runs out, the timer is reset and started again. If the timer runs out once, the Delay Generator outputs the $timeout$ signal, which is repeated at every following input and the timer is not started again. The worst-case runtime for calculating the required delay must be bounded independently of the input streams.
			\item[\textbf{Output Stream}]
				Let $S_{output}= (\mathbb{T}\cdot \{\top, \top^p, \bot^p, \bot\})^+\cup(\mathbb{T}\cdot \{\top, \top^p, \bot^p, \bot\})^*$\\
				be the output stream of the monitor, which is defined via a function\\
				$g:S_{state}\times S_{output}\rightarrow S_{output}$\\
				which defines the output stream in an incremental fashion:\\
				\begin{math}
					\forall t\in \mathbb T \exists S_{state}(t)\in\mathbb D_i:\\
					S_{output}(t)= g(S_{state_{timeout}}(t), last(S_{output}, S_{state_{timeout}})(t))
				\end{math} \\
				The worst-case runtime of $g$ is bounded independently of the input streams.
		\end{itemize}
	\end{definition}
		A monitor, which is \textit{Simple Monitorability With Delay}, is not \textit{timestamp conservative} anymore because one new timestamp can be created. Because of this characteristic, the monitor cannot be described via (Timed) Deterministic Finite State Transducers. A modification to TDFST is introduced to solve this problem, which allows $\epsilon$-transitions, which are guarded by a clock constraint but do not consume an input symbol to perform a state transition.
		\begin{definition}[Delay Generator]
			Let $tmr: \mathbb{D}\rightarrow \mathbb{T}$ a function, which determines the required delay period.\\
			A Delay Generator is a 6-Tuple $(\Sigma, \Gamma, Q, q_0, C, \delta)$, where
			\begin{itemize}
				\item
					$Q = \{q_{start}, q_{timeout}\}\cup\{q_{wait,i} | \forall i\in \mathbb{D}_{0}\}$ is a finite set of states with initial state $q_{start}$
				\item
					$\Sigma = \mathbb D_{state}$ is an input alphabet
				\item
					$\Gamma = \mathbb D_{state} \cup \{timeout\}$ is an output alphabet
				\item
					$C=\{c\}$ is a set of exactly one clock and
				\item
					$\delta:Q\times(\Sigma\cup\{\epsilon\})\times\Theta(C)\rightarrow Q\times 2^C\times\Gamma$ a state transition function. $\delta$ is defined as:
					\begin{align}
						\forall i\in \mathbb{D}_{state}:\delta(q_{start}, i, \emptyset) &= (q_{wait,i}, \{c\}, i)\\
						\forall i, i'\in \mathbb{D}_{state}:\delta(q_{wait, i'}, i, \{c \leq tmr(i')\}) &= (q_{wait,i}, \{c\}, i)\\
						\forall i \in \mathbb{D}_{state}:\delta(q_{wait, i}, \epsilon, \{c > tmr(i)\}) &= (q_{timeout}, \emptyset, timeout)\\
						\forall i \in \mathbb{D}_{state}:\delta(q_{timeout}, i, \emptyset) &= (q_{timeout}, \emptyset, timeout)
					\end{align}
			\end{itemize}
		\end{definition}
		The definition of the \textit{Delay Generator} is visualized in figure~\ref{fig:DelayGenerator}. On the left side is the initial state $q_{start}$. The first input leads to a transition to the wait state of the corresponding input symbol. The clock $c$ is reset in this transition.\\
		In the figure's middle column are the wait states, one for each possible state of the monitor. $|\mathbb{D}_I|+1$ transitions leave each wait state. One is the $\epsilon$-transition introduced above, which is constrained in a way that the value of clock $c$ must be equal or greater than the corresponding delay time. This $\epsilon$-transition leads to $q_{timeout}$ and outputs the $timeout$ symbol. All other transition leaving the waiting states are done at input symbols, while the value of clock $c$ is less than the corresponding delay time. In these transitions, the input symbol $i\in \mathbb D_{state}$ is used as output and clock $c$ is reset. In the timeout state, each input symbol leads to a repetition of the $timeout$ symbol.

		A monitor, which monitors a property that is \textit{Simple Monitorability With Delay}, is equivalent to a combination of two DFSTs and a \textit{Delay Generator}. The first DFST depicts, like before, the combination of state and state transition function. For this transducer, let
		\begin{itemize}
			\item
			$Q=\mathbb{D}_{state}$ be the finite set of possible states with initial state $q_0$
			\item
			$\Sigma=((\mathbb{D}_1\times \mathbb{T}),...,(\mathbb{D}_n\times \mathbb{T}))$ be the input alphabet
			\item
			$\Gamma = \mathbb D_{state}$ be the output alphabet and
			\item
			$\delta: Q\times \Sigma\rightarrow Q\times\Gamma$ be the transition function.
		\end{itemize}
		The output of this DFST is the input of the \textit{Delay Generator} introduced above. The output of the \textit{Delay Generator} is the input of the second DFST, which represents the output stream in combination with the output function, which is defined in the following way:
		\begin{itemize}
			\item
			$Q' = \{\top, \top^p, \bot^p, \bot\}$ are the states with initial state $q\in Q'$
			\item
			$\Sigma'=\mathbb (D_{state}\cup\{timeout\})\times \mathbb{T}$ is the input alphabet
			\item
			$\Gamma' = \{\top, \top^p, \bot^p, \bot\}$ is the output alphabet and
			\item
			$\delta': Q'\times \Sigma'\rightarrow Q'\times\Gamma'$ is the transition function, where $delta(q, (timeout, t))=false$ for each possible $q$ and $t$.
		\end{itemize}
		The output transducer is nearly the same as before. The difference is that it additionally takes the $timeout$ symbol as input and, in this case, always returns $\bot$.\\

	The restrictions made to the timestamps and the fact that at most one new timestamp can be introduced in the monitor ensure that properties, which are \textit{Simple Monitorable With Delay}, can be monitored with finite resources.

	\begin{figure}
		\centering
		\begin{tikzpicture}[thick]
			\node[] (inputRight){$\mathbb{D}_1\times\mathbb{T}, ..., \mathbb{D}_n\times\mathbb{T}$};
			\node[draw, below of=inputRight] (fRight){$f$};
			\node[below of=fRight] (stateRight){$\mathbb{D}_{state}\times\mathbb{T}$};
			\node[draw, below of=stateRight] (delayRight){$DelayGen$};
			\node[below of=delayRight] (stateDelayRight){$\mathbb{D}_{state}\cup\{timeout\}\times\mathbb{T}$};
			\node[draw, below of=stateDelayRight] (gRight){$g$};
			\node[below of=gRight] (outputRight){$\{\top, \top^p, \bot^p, \bot\}\times\mathbb{T}$};

			\draw[->] (inputRight) -- (fRight);

			\node[right of = stateRight] (ha){};
			\node[right of = fRight] (hb){};
			\draw[->] (ha)  .. controls (hb) .. (fRight);

			\node[right of = outputRight] (hg){};
			\node[right of = gRight] (hh){};
			\draw[->] (hg)  .. controls (hh) .. (gRight);

			\draw[->] (fRight) -- (stateRight);
			\draw[->] (stateRight) -- (delayRight);
			\draw[->] (delayRight) -- (stateDelayRight);
			\draw[->] (stateDelayRight) -- (gRight);
			\draw[->] (gRight) -- (outputRight);
			\node [below of=outputRight, align=center] (h0){Simple Monitorability\\with Delay};

			\node[left of = inputRight] (h1){};
			\node[left of = h1] (h2){};
			\node[left of = h2] (h3){};
			\node[left of = h3] (h4){};

			\node[left of = h4] (inputLeft){$\mathbb{D}_1\times\mathbb{T}, ..., \mathbb{D}_n\times\mathbb{T}$};
			\node[draw, below of=inputLeft] (fLeft){$f$};
			\node[below of = fLeft] (h5){};
			\node[below of=h5] (stateLeft){$\mathbb{D}_{state}\times\mathbb{T}$};
			\node[, below of=stateLeft] (delayLeft){};
			\node[draw, below of=delayLeft] (gLeft){$g$};
			\node[below of=gLeft] (outputLeft){$\{\top, \top^p, \bot^p, \bot\}\times\mathbb{T}$};
			\draw[->] (inputLeft) -- (fLeft);
			\draw[->] (fLeft) -- (stateLeft);
			\draw[->] (stateLeft) -- (gLeft);
			\draw[->] (gLeft) -- (outputLeft);

			\node[left of = stateLeft] (hc){};
			\node[left of = fLeft] (hd){};
			\draw[->] (hc)  .. controls (hd) .. (fLeft);

			\node[left of = outputLeft] (he){};
			\node[left of = gLeft] (hf){};
			\draw[->] (he)  .. controls (hf) .. (gLeft);

			\node [below of=outputLeft] {Simple Monitorability};
		\end{tikzpicture}
		\centering
		\caption{Overview Simple Monitorability - with or without \emph{delay}}
		\label{fig:OverviewMonitorability}
	\end{figure}

	\begin{figure}
		\centering
		\begin{tikzpicture}[thick, state/.style={draw, circle,minimum size=1.5cm, node distance=3cm}]
			\node[state, initial] at (0,0)(qstart)  {$q_{start}$};

			\node[state] at(3,2) (qwait1){$q_{wait,d_1}$};
			\node[]at (3,0) (qWaitBla){...};
			\node[state]at(3,-2) (qwaitn){$q_{wait,d_n}$};

			\node[state] at(6,0) (qTimeOut){$q_{timeout}$};

			\path[->] 	(qstart) edge node[left, near end]{$(d_1, \emptyset, \{c\}, d_1)$} (qwait1)
						(qstart) edge node[left, near end]{$(d_n, \emptyset, \{c\}, d_n)$} (qwaitn)
						(qwait1) edge node[right]{$(\epsilon, \{c > tmr(d_1)\}, \emptyset, timeout)$} (qTimeOut)
						(qwaitn) edge node[right]{$(\epsilon, \{c > tmr(d_n)\}, \emptyset, timeout)$} (qTimeOut)
						(qwait1) edge[loop above] node{$(d_1, \{c \leq tmr(d_1)\}, \{c\}, d_1)$}()
						(qwait1) edge[bend left] node[right, near end]{A}(qwaitn)
						(qwaitn) edge[bend left] node[right, near end]{B}(qwait1)
						(qwaitn) edge[loop below] node{$(d_n, \{c \leq tmr(d_n)\}, \{c\}, d_n)$}()
						(qTimeOut) edge[loop right] node{$\forall d_i \in \mathbb{D}_I:(d_i, \emptyset, \emptyset, timeout)$}();

		\end{tikzpicture}
		\label{fig:DelayGenerator}
		\caption{Visualization of the Delay Generator. Description A means $(d_n, \{c < tmr(d_1)\}, \{c\}, d_n)$ and description B means $(d_1, \{c < tmr(d_n)\}, \{c\}, d_1)$.}
	\end{figure}

	\subsection{Not Simple Monitorable}
		Disproving one of the characteristics of \textit{Simple Monitorability} does not necessarily mean that a property of infinite streams can not be monitored with finite resources. For example, a property, where all parts of \textit{Simple Monitorability} are fulfilled, except the worst-case runtime of the state transition function, which is dependent on the input streams, but the average runtime of this function over every possible trace of this function is not\footnote{In other words, the runtime over the entire trace is linear dependent on the length of the trace}. In these cases, a monitor with finite resources can be constructed, which can observe arbitrary long input traces.\\
		If you can prove that a limitation of the memory consumption, which is required to monitor a property correctly, cannot be given independently of the input streams or their events, it can be safely said that a property cannot be monitored correctly on arbitrary input traces with finite resources. This is because the memory of a computation system is always finite. If the required storage space is dependent on the input trace, a set of input streams can always be constructed, which requires an arbitrarily large amount of storage space, which is larger than the available memory.\\
		Not all TADL2 constraints are simple monitorable properties, even with delay, because they may require memory resources, which are not independent of the events of the observed trace. As stated before, correct online monitoring of these constraints is impossible for arbitrary traces because infinite memory resources may be required. On the other hand, many of these problems are solved using finite resources, hoping that the available resources are enough to cover ''real world'' inputs.
		A distinction is useful in these cases, because the memory or time requirements of some properties grow continuously with every input event, and other constraints only require infinite resources in worst-case scenarios.
		The ones with continuous requirement growth will be called \emph{Always Not Simple Monitorable} and the others \emph{Worst-Case Not Simple Monitorable} for the rest of this thesis.\\
		Obviously, the constraints with continuous resource requirement growth cannot be monitored infinitely, but the constraints that only need infinite resources in worst-cases can be monitored in many cases.


\documentclass{elsart}
\usepackage{epsfig,amssymb,amsmath}
\usepackage{rotating}
\usepackage{listings}
\usepackage{booktabs}
\usepackage{fancyhdr}

\usepackage{float}

\begin{document}

\section{ Alice TPC Performance}

%  Chapter 11: Performance  ps file
%Editors: Marian Ivanov and Marek Kowalski
%  1. double hit resolution
%  2. tracking efficiency
%  3. momentum resolution
%  4. dE/dx resolution
%  5. vertex Resolution

\subsection{Performance}

\subsubsection{tracking performance}

Main issue show the performance and compare the MC and real data
\begin{itemize}
\item Space point resolution parameterization.
      \begin{itemize}
      \item Plots 1 : 2 2D plots -Y, Z resolution (Z and Angle dependence)
      \item Plots 2 : 2 1D plots -Y and Z resolution Z dependence (cosmic and MC data)
      \end{itemize}
\item Track parameter resolution.
      \begin{itemize}
      \item Primary vertex: $DCA_r$, $DCA_z$,
      \item Angular:        $\phi$, $theta$,
      \item Momentum:       $1/p_{t}$
      \item Systematic effects discussion
      \end{itemize}
      \begin{itemize}
      \item  Plot: Resolution as function of drift length (5) - MC and Real data in the same plots
      \item  Plot: Resolution as function of the $p_t$        - MC and real data in the same plots
 	     + fit of the resolution  $\sigma^2 \approx \sigma^2_0+\sigma^2_1/p_{t}$
      \item  Plot: Normalized resolution (pulls) as function of the $p_t$        - MC and real data in the same plots
 	     + fit of the resolution  $\sigma^2 \approx \sigma^2_0+\sigma^2_1/p_{t}$
      \item Table: $\sigma_0$ and $\sigma_1$ -  MC and cosmic data
      \end{itemize}
\end{itemize}

\subsubsection{PID performance}
\begin{itemize}
\item  dEdx as function of beta gama - MC and cosmic
\item  Gain calibration. (Pad by pad, angular and position correction of energy deposit,time dependence of gas gain, dEdx equalization -short, medium, long pads)
\item  dEdx - Truncated mean - comparison of different truncation + maybe other methods - likelihood, weighted mean
\item

\end{itemize}

\subsubsection{tracking efficiency}
\begin{itemize}
\item 100 \% tracking efficiency
\item Physical tracking efficiency - Dead zone - Absorbtion in the material
\end{itemize}

\subsection{ double hit resolution}
Not enough data to study it. I think we should not include it

\section{ Alice TPC Performance}

\subsection{Space point resolution}

\begin{figure}
  \centering\epsfig{figure=picClusterResol/YResol_Pad0.eps,width=0.5\linewidth}
  \centering\epsfig{figure=picClusterResol/YResol_Pad1.eps,width=0.5\linewidth}
  \caption{Space point resolution as function of the drift length and the inlination angle.}
  \label{figPointResolYDRTAN}
\end{figure}

\subsection{Track parameter resolution}

The TPC performance was studied using the cosmic tracks.
Cosmic tracks are reconstructed independently in two halves of the TPC.
Both tracks are propagated independently to the DCA (Distance of Closest approach)  to point (0,0). Paramaters of the tracks are compared in the DCA point.

The TPC fiducial volume was restricted. Following selection criteria were used in the study:
\begin{itemize}
\item Selection criteria on parameter matching, to reduce the randmom matching of tracks
     \begin{itemize}
     \item $\Delta_{y} \leq$ 3  cm
     \item $\Delta_{z} \leq$ 15 cm
     \item $\Delta_{\phi}\leq$ 0.1 rad
     \item $\Delta_{\theta} \leq$ 0.1 rad
     \item $\Delta_{1/p_t} \leq$ 0.5 1/GeV
     \end{itemize}
\item Selection criteria on the pulls of variables.
     \begin{itemize}
     \item $\Delta_{y}/\sigma_{y} \leq$ 10
     \item $\Delta_{\phi}/\sigma_{\phi} \leq$ 10
     \item $\Delta_{1/p_t}/\sigma_{1/p_t} \leq$ 10
     \end{itemize}
\item Selection criteria on geometrical acceptance.
     \begin{itemize}
     \item $Z_{inner}\leq$ 240 cm and  $Z_{outer}\leq$ 240 cm- Tracks in TPC fiducial volume
     \item $DCA_r \leq$ 70 cm
     \end{itemize}
\end{itemize}

\begin{figure}
  \centering\epsfig{figure=pic/NCl_Radius.eps,width=0.5\linewidth}
  \centering\epsfig{figure=pic/NCl_Z.eps,width=0.5\linewidth}
  \caption{Number of TPC clusters as function of the DCA.
   Number of clusters as function of z done with DCA$_R$ selection less than 70 cm}
  \label{figNCLDCA}
\end{figure}

\begin{figure}
  \centering\epsfig{figure=pic/Sigma1Pt_N.eps,width=0.5\linewidth}
  \centering\epsfig{figure=pic/Pull1Pt_N.eps,width=0.5\linewidth}
  \caption{$P_{t}$ resolution as function of number of clusters. This number is dominated
     by the fraction of the track in the dead zone.}
  \label{figPtResNCL}
\end{figure}

The tracking performance depends on the track topology.
\begin{itemize}
\item Space point resolution. Space point error parameterization was determined by fitting the space point residuals for different topologies. (see ?).
\begin{itemize}
\item Z position of space points.
\item Local track inclination angle.
\end{itemize}
\item Level arm- the distance between last and first point on track.
      The momentum resolution depends on $1/L^2$ and angular resolution on$1/L$.
\item The fraction of the track in the dead zone, between TPC chambers.
      (see pic. \ref{figPtResNCL}).
\item The material crossed by track. On C side of the TPC (z$\leq$0) the absorber is present.
      The multiple scattering and precision of the energy loss correction determination depends linearly on the crossed material budget. (In following study not enough statisic to investigate only tracks pointing to ITS detector)
\end{itemize}

In the following section the resolution and pulls  as function of the z position and $1/p_{t}$ will be shown and results will be discussed. The $1/p_{t}$  variable instead of $p_{t}$ was choosen to characterize the performance as the multiple scattering and unprecission of the energy loss correction  ...

\subsection { Y resolution}

YResolution in the Y coordiante is dominated mainly by the precission of the space point measurement in the TPC. Therefore the strong dependence on the z position of the track is visible (see pic \ref{figYvsZ}).

\begin{figure}
  \centering\epsfig{figure=pic/SigmaY_z.eps,width=0.5\linewidth}
  \centering\epsfig{figure=pic/PullY_z.eps,width=0.5\linewidth}
  \caption{Resolution in y coordinate - DCA$_r$ as function of z position- Drift length}
  \label{figYvsZ}
\end{figure}

\begin{figure}
  \centering\epsfig{figure=pic/SigmaY_1pt.eps,width=0.5\linewidth}
  \centering\epsfig{figure=pic/PullY_1pt.eps,width=0.5\linewidth}
  \caption{Resolution in y coordinate - DCA$_r$ as function of particle momenta}
  \label{figYvs1Pt}
\end{figure}

\subsection { Z resolution}

\begin{figure}
  \centering\epsfig{figure=pic/SigmaZ_z.eps,width=0.5\linewidth}
  \centering\epsfig{figure=pic/PullZ_z.eps,width=0.5\linewidth}
  \caption{Resolution in z coordinate  as function of z position- Drift length}
  \label{figZvsZ}
\end{figure}

\begin{figure}
  \centering\epsfig{figure=pic/SigmaZ_1pt.eps,width=0.5\linewidth}
  \centering\epsfig{figure=pic/PullZ_1pt.eps,width=0.5\linewidth}
  \caption{Resolution in z coordinate  as function of particle momenta}
  \label{figZvs1pt}
\end{figure}

\subsection { P$_t$ resolution}

\begin{figure}
  \centering\epsfig{figure=pic/SigmaPt_Pt.eps,width=0.5\linewidth}
  \centering\epsfig{figure=pic/SigmaPt_PtLog.eps,width=0.5\linewidth}
  \caption{Resolution $\Delta p_{t}/p_{t}$  as function of pt.}
  \label{figPtvsPt}
\end{figure}

\begin{figure}
  \centering\epsfig{figure=pic/Sigma1Pt_z.eps,width=0.5\linewidth}
  \centering\epsfig{figure=pic/Pull1Pt_z.eps,width=0.5\linewidth}
  \caption{Resolution in 1/p$_t$  as function of z position- Drift length}
  \label{fig1PtvsZ}
\end{figure}

\begin{figure}
  \centering\epsfig{figure=pic/Sigma1Pt_1pt.eps,width=0.5\linewidth}
  \centering\epsfig{figure=pic/Pull1Pt_1pt.eps,width=0.5\linewidth}
  \caption{Resolution in 1/p$_t$  as function of particle momenta}
  \label{fig1Ptvs1pt}
\end{figure}

\end{document}


\section{Introduction}

\textbf{Keylo} optimizes the layout for a given arbitrary keyboard.
Currently, it only supports the letters of the English alphabet of 26 letters.
Due to the sheer search space of \[26! \approx 4.03 \times 10^{26}\] layouts even with just 26 keys, it uses a stochastic optimization technique known as \textit{simulated annealing}.


\documentclass{scrartcl}

\usepackage{amssymb}
\usepackage{amsmath}
\usepackage{hyperref}
\usepackage{stmaryrd}
\usepackage{amsthm}
\usepackage{mathpartir}

\newtheorem{lemma}{Lemma}
\newtheorem{theorem}[lemma]{Theorem}
\theoremstyle{definition}
\newtheorem{definition}{Definition}
\newtheorem{remark}{Remark}

\newcommand{\smallfoot}{{\textsf{Smallfoot}}}
\newcommand{\HOL}{{\textsc{HOL}}}
\newcommand{\emp}{{\textsf{emp}}}
\newcommand{\nil}{{\textsf{nil}}}
\newcommand{\pftrue}{{\textsf{true}}}
\newcommand{\pfequal}[2]{\ensuremath{#1 \doteq #2}}
\newcommand{\pfunequal}[2]{\ensuremath{#1 \not\doteq #2}}
\newcommand{\values}{{\emph{Values}}}
\newcommand{\valuesnil}{\ensuremath{\values_\nil}}
\newcommand{\vars}{{\emph{Vars}}}
\newcommand{\expr}{{\emph{Exp}}}
\newcommand{\fields}{{\emph{Fields}}}
\newcommand{\pf}{{\emph{pf}}}
\newcommand{\sfset}{{\emph{sf}}}
\newcommand{\modelspf}{{\models_{\textit{pf}}\ }}
\newcommand{\modelssf}{{\models_{\textit{sf}}\ }}
\newcommand{\modelsds}{{\models_{\textit{ds}}\ }}

\newcommand{\sfemp}{{\textsf{emp}}}
\newcommand{\sftree}{{\textsf{tree}}}
\newcommand{\sfpointsto}[2]{#1 \mapsto [#2]}
\newcommand{\sfbintree}{{\textsf{bin-tree}}}
\newcommand{\sflist}{{\textsf{list}}}

\newcommand{\varpf}[1]{\textit{pf}_{#1}}
\newcommand{\varsf}[1]{\textit{sf}_{#1}}
\newcommand{\varel}{\eta}
\newcommand{\varepl}{\pi}

\newcommand{\heapdistinct}{\textit{heap\_distinct}}
\newcommand{\entailment}[2]{#1 \quad\vdash\quad #2}
\newcommand{\dom}{{\text{dom}}}
\newcommand{\tofin}{\xrightarrow{fin}}

\newcommand{\eqinferstyle}{
\mprset{fraction={={\raisebox{0pt}[5pt][5pt]{=}}=}}}

\title{A Deep Embedding of a Decidable Fragment of Separation Logic in \HOL}
\author{Thomas Tuerk}
\date{16th July 2007}

\begin{document}
\maketitle

\begin{abstract}
  \smallfoot\ is a tool to automatically check separation logic specifications
  of sequential programs. It uses a decidable fragment of separation logic. In
  this paper, a deep embedding of a slightly different decidable fragment of
  separation logic inspired by \smallfoot\ is presented. Moreover, a \HOL\
  implementation of a decision procedure for entailments in this logic is
  described.

  The main focus of this paper is on the introduction of the separation
  logic at an high level of abstraction and on inference rules for
  entailments. It is pointed out how these high-level concepts relate to
  the \HOL\ embedding. However, the \HOL\ embedding is not explained in detail.
\end{abstract}

\tableofcontents

\section{Motivation}
Separation logic \cite{reynolds02separation} is used to reason about shared
mutable data structures. It allows one to express light-weight specifications
about dynamically allocated pointer structures on a heap. For example, one can
easily express that some pointer is the starting point of a linked list. More
detailed properties, like e.\,g.\ constraints on the content of the list, are
not expressible. The main feature of this logic is a special $*$-operator,
which allows one to reason about disjoint parts of a heap.  Most other logics have
to express this disjointness explicitly. This usually means adding a number of
constraints, which is quadratic in the number of resources used. In contrast,
separation logic specifications are small. Moreover, simple and
short proofs are possible in separation logic.

\smallfoot~\cite{BerdineCO05} is a tool that uses a decidable fragment of
separation logic to automatically reason about specifications of programs
written in a simple, imperative language.  This work aims at formalising
separation logic in the interactive theorem prover \HOL~\cite{GoMe93}.
Additionally, a decision procedure for entailments in the logic used has been
implemented. As this decision procedure is a major part of \smallfoot, the
\HOL\ formalisation is likely to increase the trust in \smallfoot.

\section{Basic Definitions}

The definitions of the fragment of separation logic used here follow mainly the definition in
\cite{berdine05symbolic}. However, some things have been slightly modified for the
sake of the embedding.

\begin{definition}[Values]
  For a given set of values $\values$ let $\valuesnil$
  denote the extension of $\values$ with a special value $\nil$.

  As \nil\ is used to denote the null-pointer, it's often important that a set
  does not contain \nil. Thus, we assume without loss of generality that
  $\values$ does not contain \nil. Moreover, it will be necessary in the
  following to introduce fresh values. Therefore, let $\values$ denote a large
  enough set to always provide fresh values, i.\,e.\ let \values\ denote a
  countable infinite set.
\end{definition}

\begin{definition}[Expressions]
  An \emph{expression} $e$ over a set of variables \vars\ and a set of values
  \values\ is defined to be either
\begin{itemize}
\item a constant $c \in \valuesnil$ or
\item a variable $x \in \vars$.
\end{itemize}
%
The set of all \emph{expressions} over \vars\ and \values\ is denoted by
$\expr(\vars,\values)$.
\end{definition}

\begin{definition}[Stacks]
  A \emph{stack} $s$ over a set of variables \vars\ and a set of values
  \values\ is a function $s: \vars \to \valuesnil$.

  The evaluation $\llbracket e \rrbracket s$ of an expression $e$ in a stack
  $s$ is given by
 \begin{itemize}
\item $\llbracket c \rrbracket s := c$ for all constants $c$ and
\item $\llbracket x \rrbracket s := s(x)$ for all variables $x$.
\end{itemize}
\end{definition}

\begin{definition}[Pure Formulae]
  The set $\pf(\vars,\values)$ of \emph{pure formulae} over \vars\ and
  \values\ is recursively defined as the smallest set with
\begin{itemize}
\item $\pftrue \in \pf(\vars,\values)$
\item $(\pfequal{e_1}{e_2}) \in \pf(\vars,\values)$ for $e_1, e_2 \in
  \expr(\vars,\values)$
\item $(\pfunequal{e_1}{e_2}) \in \pf(\vars,\values)$ for $e_1, e_2 \in \expr(\vars,\values)$
\item $(\textit{pf}_1 \wedge \textit{pf}_2) \in \pf(\vars,\values)$ for $\textit{pf}_1, \textit{pf}_2 \in \pf(\vars,\values)$.
\end{itemize}
\bigskip
%
For a stack $s$ the semantics of a pure formula is given by
\begin{itemize}
\item $s \modelspf \pftrue$
\item $s \modelspf \pfequal{e_1}{e_2}$ iff $\llbracket e_1 \rrbracket s =
  \llbracket e_2 \rrbracket s$
\item $s \modelspf \pfunequal{e_1}{e_2}$ iff $\llbracket e_1 \rrbracket s \not =
  \llbracket e_2 \rrbracket s$
\item $s \modelspf \textit{pf}_1 \wedge \textit{pf}_2$ iff $s \modelspf
  \textit{pf}_1$ and $s \modelspf \textit{pf}_2$
\end{itemize}
\end{definition}

Thus, stacks are variable assignments and pure formula are simple restrictions
on stacks. These constructs of stacks and pure formula are used to define the
essential part of the logic: formulae over heaps.

\begin{definition}[Fields]
To define heaps \emph{fields} have to be introduced first. Fields are defined
by there usage. Anything may be used as a field. In contrast to values, the set
of fields may even be finite. In the \HOL\ embedding strings or integers are
usually used. Here, we will use the constants $l$, $r$, $\textit{tl}$ and $t_i$
with $i \in \mathbb N_0$, which are assumed to be pairwise distinct.
\end{definition}

\begin{definition}[Heaps]
  A \emph{heap} $h$ over a set of values $\values$ and a set of fields
  $\fields$ is a finite map
  $h: \values \tofin (\fields \tofin \valuesnil)$.
\end{definition}

As heaps are finite maps, a list notation can be used:
Let $f := [x_1 \to y_1, \ldots, x_n \to y_n]$ denote the finite map $f : X
\tofin Y$ with $\dom(f) = \{x_1, \ldots, x_n\}$ and
$f(x_i) = y_i$ for $1 \leq i \leq n$.
Furthermore, let $h_1 \cup h_2$ denote the union of two heaps, i.\,e.\
\begin{eqnarray*}
\dom(h_1 \cup h_2) & := & \dom(h_1) \cup \dom(h_2) \\
(h_1 \cup h_2)(x) & := & \left\{
\begin{array}{ll}
  h_1(x) & \text{iff}\ x \in \dom(h_1)\\
  h_2(x) & \text{otherwise}
\end{array}\right.
\end{eqnarray*}

Using this definition of heaps and these notations, spatial formulae and their
semantics can be defined:

\begin{definition}[Spatial Formulae]
  The set $\sfset(\vars,\values)$ of \emph{spatial formulae} over \vars\ and
  \values\ is recursively defined as the smallest set with
\begin{itemize}
\item $\sfemp \in \sfset(\vars,\values)$
\item $\sfpointsto{e}{t_1:e_1, \ldots, t_k:e_k} \in \sfset(\vars,\values)$ for
  $e, e_1, \ldots, e_k \in  \expr(\vars,\values)$ and $t_1, \ldots, t_k \in \fields$
\item $\sftree\left((t_1, \ldots, t_k),\textit{es},e\right) \in \sfset(\vars,\values)$
  for $\textit{es}, e \in \expr(\vars,\values)$ and\\$t_1, \ldots, t_k \in \fields$
\item $\textit{sf}_1 * \textit{sf}_2 \in \sfset(\vars,\values)$ for
  $\textit{sf}_1, \textit{sf}_2 \in \sfset(\vars,\values)$.
\end{itemize}
\bigskip
%
For a stack $s$ and a heap $h$ the semantics of a spatial formula is given by
\begin{itemize}
\item $s, h\ \modelssf \sfemp$ iff $h = []$
\item $s, h\ \modelssf \textit{sf}_1 * \textit{sf}_2$ iff $\exists h_1, h_2.$
  \begin{itemize}
  \item $h = h_1 \cup h_2$ and
  \item $\dom(h_1) \cap \dom(h_2) = \emptyset$ and
  \item $s, h_1\ \modelssf \textit{sf}_1$ and
  \item $s, h_2\ \modelssf \textit{sf}_2$
  \end{itemize}
\item $s, h\ \modelssf \sfpointsto{e}{t_1:e_1, \ldots, t_k:e_k}$ iff $\exists r.$
  \begin{itemize}
  \item $h = \left[ \llbracket e \rrbracket s \to r \right]$ (i.\,e.\ $h$ is
    just defined for the value $\llbracket e \rrbracket s$ and maps it to $r$) and
  \item $\forall\ 1 \leq i \leq k.\ t_i \in \dom(r)$ and
  \item $\forall\ 1 \leq i \leq k.\ r(t_i) = \llbracket e_i \rrbracket s$
  \end{itemize}
\item $s, h\ \modelssf \sftree\left((t_1, \ldots, t_k),\textit{es},e\right)$ iff
\begin{itemize}
  \item $s \modelspf \pfequal{e}{es}$ and $h = []$ or
  \item $s \modelspf \pfunequal{e}{es}$ and $\exists
  e_1, \ldots, e_k.\ s, h\ \modelssf \sfpointsto{e}{t_1:e_1, \ldots, t_k:e_k}
  *$\\$\sftree\left((t_1, \ldots, t_k),\textit{es},e_1\right) * \ldots * \sftree\left((t_1,
  \ldots, t_k),\textit{es},e_k\right)$
\end{itemize}
\end{itemize}
\end{definition}

Notice, that this definition is well founded. This may be difficult to see in
the case of $\sftree$. However, each recursion that occurs in the definition
of $\sftree$ removes -- according to the semantics of $\mapsto$ and
$*$ -- the root of the tree from the heap. Since the heap is by definition
finite, this recursion has to terminate and the definition is well founded.
However, in the $\HOL$\ embedding a definition is used that talks explicitly
about this number of recursions, i.\,e.\ about the height of the tree. Then, it
is shown that the two definitions are equivalent.
\bigskip

Spatial formulae are the core of separation logic. They contain the
$*$-operator, which requires that a heap can be split into disjoint heaps
that satisfy the subformulas. Additionally, there is a predicate $\sfemp$ to
describe the empty heap. The remaining predicates may be harder to understand
intuitively. Therefore, lets introduce some syntactic sugar first, which may
help to explain the intended semantics:

\begin{itemize}
\item $\sflist(t,e_1,e_2) := \sftree(t,e_2,e_1)$
\item $\sfbintree(t_1,t_2,e) := \sftree((t_1,t_2),\nil,e)$
\end{itemize}

Intuitively, $s, h\ \modelssf \sfbintree(l,r,e)$ means that $h$ contains a
binary tree with root $e$. The left child is pointed to by the field
index $l$, the right child is addressed by $r$. If $e$ evaluates to $\nil$,
i.\,e.\ if $s \modelspf \pfequal e \nil$ holds, the binary tree is empty and
the stack should be empty as well. Otherwise, one has to check
that the root node $e$ points to a left child $e_l$ and a right child $e_r$ such that
binary trees exists with these childs as roots. Formally, the expression evaluates to
$\exists e_l,e_r.\ s, h \modelssf \sfpointsto{e}{l:e_l, r:e_r} *
\sfbintree(l,r,e_l) * \sfbintree(l,r,e_r)$. This means, that the heap can be
split into three disjoint parts $h_e$, $h_1$ and $h_2$ with
\begin{itemize}
  \item $s, h_e \modelssf \sfpointsto{e}{l:e_l, r:e_r}$,
  \item $s, h_l \modelssf \sfbintree(l,r,e_l)$ and
  \item $s, h_r \modelssf \sfbintree(l,r,e_r)$.
\end{itemize}
According to the semantics of spatial formulae, the heap $h_e$ maps $\llbracket e
\rrbracket s$ to a finite map $f:\fields \tofin \valuesnil$ such that
$f(l) = \llbracket e_l \rrbracket s$ and $f(r) = \llbracket e_r \rrbracket
s$ hold. This example illustrates the usage of $\fields$. They are used
as indexes for different branches of a tree. Notice further, that $\dom(h_e) =
\{\llbracket e \rrbracket s\}$ holds and that the domains of $h_e$, $h_l$ and $h_r$
are disjoint. Thus, whole $h$ is used to model the tree and -- except for the
leaves -- each node occurs just once in the tree.

Similarly, $\sflist (tl, e_1, e_2)$ describes a single linked, acyclic list
from $e_1$ to $e_2$ following the pointers indexed by $tl$. Formally, it is
modeled as an unary tree. For lists it makes
sense to have arbitrary expressions as end points / leaves, whereas for binary
trees only $\nil$ is allowed. The predicate $\sftree$ is a generalisation of
$\sfbintree$ and $\sflist$. It has been introduced mainly because it makes
modelling of this logic easier in $\HOL$ since properties have to be proven
just once. However, the logic is now able to talk about trees of arbitrary, but
fixed width.
\bigskip

\begin{definition}[Normal Form]
The operators $\wedge$ and $*$ are both associative and
commutative. Therefore, a list notation can be used:
%
\setlength{\arraycolsep}{2pt}
\[
\begin{array}{lll@{\hspace{15pt}}c@{\hspace{15pt}}lll}
   s & \modelspf & \varpf 1, \ldots, \varpf n & := & s & \modelspf & \varpf 1 \wedge \ldots \wedge
   \varpf n \wedge \pftrue \\
   s, h & \modelssf & \varsf 1, \ldots, \varsf n & := & s, h & \modelssf & \varsf 1 * \ldots *
   \varsf n * \sfemp
\end{array}
\]
%
In fact, one could even use sets for pure formulae and multisets for spatial
formulae. However, its been easier to use lists in the $\HOL$ formalisation
and proof the additional properties of sets and multisets explicitly.
To be close to the \HOL\ formalisation, a list notation is used here as well.

Notice that the following equivalences hold for a field index $t$
occurring several times in a spatial formula:
%
\[
\begin{array}{lllr}
s, h & \modelssf & \sfpointsto e {t_1:e_1, \ldots, t: e_n, \ldots, t:
  e_m, \ldots, t_k : e_k} & \Longleftrightarrow \\
s & \modelspf & \pfequal {e_n} {e_m}\ \text{and} \\
s, h & \modelssf & \sfpointsto e {t_1:e_1, \ldots, t: e_n, \ldots, t_{m-1}:
  e_{m-1}, t_{m+1}: e_{m+1}, \ldots, t_k : e_k} \\ \\

s, h & \modelssf & \sftree \left((t_1, \ldots, t, \ldots, t, \ldots,
  t_k),\textit{es},e\right) & \Longleftrightarrow \\
s & \modelspf & \pfequal {e} {\textit{es}}\ \text{and} \\
s, h & \modelssf & \sfemp
\end{array}
\]
%
These equivalences can be easily used to rewrite formulae. Therefore, we will
just consider formulae such that all field indexes occurring in a $\sftree$ or
$\mapsto$ subformula are pairwise distinct. Additionally, we assume that
$\pftrue$ and $\sfemp$ do not occur in the lists. Otherwise they can be easily
eliminated, since they are the identity.

\noindent
As a writing convention let in the following
\begin{itemize}
  \item $\varpf {}$ denote a pure formula,
  \item $\varsf {}$ denote a spatial formula,
  \item $\Pi$ denote a list of pure formulae and
  \item $\Sigma$ denote a list of spatial formulae.
\end{itemize}
\end{definition}
\bigskip

These are the semantics of the subset of separation logic that will be
considered here. We are mainly interested in checking the validity of
entailments in this logic, i.\,e. we are interested in deciding whether
statements of the form $\forall s,h.\ \left(s\ \modelspf\ \Pi\right) \wedge
\left(s,h\ \modelssf\ \Sigma\right) \Rightarrow
\left(s\ \modelspf\ \Pi'\right) \wedge \left(s,h\ \modelssf\ \Sigma'\right)$ hold.

However, to keep track of some information during calculations a slightly
extended notation is introduced: a list of expressions is added such that
the value of these expressions is not $\nil$ but not in $\dom(h)$. Moreover,
all values of expressions in this list are pairwise distinct. This extension is
useful to define the \textsc{frame} rule later. However, sometimes a
expression should just be added to this list, if it is not equal to a second
expression in the current stack. Adding a list of pairs of expressions
for this purpose leads to the following definition:

\begin{definition}[Entailments]
  Let $\varel := e_1, \ldots, e_n$ be a list of expressions and
  $\varepl := (e'_1, e''_1), \ldots, (e'_m, e''_m)$ be a list of pairs of
  expressions. Furthermore, let $s$ be a stack and $h$ a heap. Then the predicate
  $\heapdistinct (s, h, \varel, \varepl)$ holds for $s$ and $h$
  iff
  \begin{itemize}
  \item for all expressions $e$ with $e \in \varel$ or $\exists e'.\ (e, e')
    \in \varepl \wedge s\ \modelspf\ \pfunequal {e} {e'}$ the following holds
    \begin{itemize}
    \item $\neg \left(\llbracket e \rrbracket s = \nil\right)$ and
    \item $\neg \left(\llbracket e \rrbracket s \in \dom(h)\right)$
    \end{itemize}
  \item all values of expressions $e \in \varel$ and all values of
    expressions $e'$ with $(e',e'') \in \varepl$ and $s\ \modelspf\ \pfunequal {e'} {e''}$
    are pairwise distinct:
    \begin{itemize}
    \item $\neg (i = j) \wedge 1 \leq i,j \leq n  \Longrightarrow \neg \left(\llbracket e_i \rrbracket s = \llbracket e_j \rrbracket
        s\right)$ and
    \item $\neg (i = j) \wedge 1 \leq i,j \leq m \wedge \left(s\ \modelspf\ \pfunequal {e'_i} {e''_i} \wedge \pfunequal {e'_j}
      {e''_j}\right) \Longrightarrow \\\neg \left(\llbracket e'_i \rrbracket s
      = \llbracket e'_j \rrbracket s\right)$ and
    \item $1 \leq i \leq n \wedge 1 \leq j \leq m \wedge \left(s\ \modelspf\ \pfunequal {e'_j}
      {e''_j}\right) \Longrightarrow \\\neg \left(\llbracket e_i \rrbracket s = \llbracket e'_j \rrbracket s\right)$
    \end{itemize}
  \end{itemize}

  This definition of $\heapdistinct$ is quite technical. It is intended to
  preserve information, which would otherwise be lost during applications of
  the frame rule. The idea behind its definition will become more
  apparent as soon as the frame rule is presented. At the moment it is
  sufficient to notice, that for the empty list $[]$ and for all stacks $s$
  and heaps $h$ the statement $\heapdistinct (s, h, [], [])$ holds. Therefore,
  the following notation is really capable of expressing entailments:
\[
\setlength{\arraycolsep}{0pt}
\begin{array}{ll}
  \entailment{\varel, \varepl, \Pi, \Sigma}{\Pi', \Sigma'} := \forall s, h.&
  \heapdistinct(s, h, \varel, \varepl)\ \wedge \\
  &\left(s\ \modelspf\ \Pi\right)\ \wedge\
\left(s,h\ \modelssf\ \Sigma\right)\ \Longrightarrow \\
&\left(s\ \modelspf\ \Pi'\right)\ \wedge\ \left(s,h\ \modelssf\ \Sigma'\right)
\end{array}
\]
\end{definition}

\section{Comparison to the logic used by \smallfoot}

The subset of separation logic presented here is very similar to the one used by
\smallfoot. Its definitions follow mainly \cite{berdine05symbolic}. However,
\cite{berdine05symbolic} just considers lists and binary trees. There is no
predicate for trees with arbitrary, but fixed width. This predicate $\sftree$
has been introduced here to help the deep-embedding in $\HOL$. It is a
generalisation of the predicates for lists and binary trees and helps to keep
some proofs more succinct. The predicate $\heapdistinct$ is not used
in \cite{berdine05symbolic}. Otherwise, the logics are identical.

However, \smallfoot\ uses an additional predicate
for double linked lists and one for xor linked lists \cite{BerdineCO05}. These
could be easily added to the logic presented here. For sake of time and
simplicity they have been omitted. Notice however, that these additions were
kept in mind during this work. Thus, the extension should be
straightforward.

\section{Deep Embedding in $\HOL$}

\texttt{decidable\_separationLogicScript.sml} contains the main part of the
$\HOL$ embedding. Conversions that implement inference rules and a decision
procedure for entailments can be found in
\texttt{decidable\_separationLogicLib.sml}. All other files are not interesting from a high-level point
of view.

The following is intended to give an overview of the main parts of the
implementation. This overview should -- combined with some informations
given in the next section~-- be sufficient to use $\HOL$ to reason about the
validity of entailments. However, for everything else, one should use this
short description just as an orientation and have a look
at the files mentioned themselves.
\medskip

The sets $\values$, $\fields$ and $\vars$ are modelled as free type variables.
This leaves the problem that a constraint that the set $\values$ is infinite
has to be added to the precondition of some theorems. However, it is
straightforward to define $\valuesnil$ and expressions using these free type
variables. $\valuesnil$ is modelled by the $\HOL$ datatype
\texttt{ds\_value}, expressions by the $\HOL$ datatype
\texttt{ds\_expression}. Using these basic datatypes, the datatypes \texttt{ds\_pure\_formula} and
\texttt{ds\_spatial\_formula} are defined for pure and spatial formulae,
respectively:

\begin{verbatim}
val _ = Hol_datatype `ds_value =
     dsv_nil
   | dsv_const of 'value`

val _ = Hol_datatype `ds_expression =
     dse_const of 'value ds_value
   | dse_var of 'vars`;

val dse_nil_def = Define `dse_nil = dse_const dsv_nil`

val _ = Hol_datatype `ds_pure_formula =
     pf_true
   | pf_equal of ('vars, 'value) ds_expression =>
                 ('vars, 'value) ds_expression
   | pf_unequal of ('vars, 'value) ds_expression =>
                   ('vars, 'value) ds_expression
   | pf_and of ds_pure_formula => ds_pure_formula`;

val _ = Hol_datatype `ds_spatial_formula =
     sf_emp
   | sf_points_to of ('vars, 'value) ds_expression =>
                     ('field # ('vars, 'value) ds_expression) list
   | sf_tree of 'field list => ('vars, 'value) ds_expression =>
                ('vars, 'value) ds_expression
   | sf_star of ds_spatial_formula => ds_spatial_formula`;

val sf_ls_def = Define `sf_ls f e1 e2 = sf_tree [f] e2 e1`;

val sf_bin_tree_def = Define
   `sf_bin_tree (f1, f2) e = sf_tree [f1;f2] dse_nil e`;
\end{verbatim}

The semantics of these formulas are defined by the predicates \texttt{PF\_SEM}
and \texttt{SF\_SEM}. In order to define these semantics, stacks are modeled
by functions, heaps are modeled using finite maps. The definition of
\texttt{PF\_SEM} is straightforward, whereas the definition of
\texttt{SF\_SEM} is tricky because of trees. It takes some time to prove
that the recursive definition used in this paper is well founded.  Therefore,
a predicate \texttt{SF\_SEM\_\_\_sf\_tree\_len}, which recurses over the
maximal height of the tree, is used instead of the one used here. That
the resulting semantics of trees is really the intended one, is ensured by
theorem \texttt{SF\_SEM\_\_\_sf\_tree\_THM}.

After introducing the basic definitions, some basic facts are proved. These
facts include that $*$ and $\wedge$ are commutative and associative. Using
this knowledge, list versions of the semantic predicates are introduced:
\texttt{LIST\_PF\_SEM}, \texttt{LIST\_SF\_SEM} and the combination
\texttt{LIST\_DS\_SEM}. Using these lists versions and a predicate
\texttt{HEAP\_DISTINCT} (that corresponds to $\heapdistinct$), the predicate
\texttt{LIST\_DS\_ENTAILS} is finally defined that represents entailments.

Using these definitions, for example the entailment
\[\entailment{x_1,(x_3,x_4), \pfequal {x_2} {x_3},
  \sfpointsto{x_2} {\textit{hd}:x_5, \textit{tl}:x_3},
  \sflist(\textit{tl}, x_3, x_4)}{\pfequal{x_2} \nil, \sfbintree(l,r,x_5)}\]
can be encoded in \HOL\ as
\begin{verbatim}
val t = ``LIST_DS_ENTAILS ([dse_var 1],[(dse_var 3, dse_var 4)])
  ([pf_equal (dse_var 2) (dse_var 3)],
   [sf_points_to (dse_var 2) [("hd",dse_var 5); ("tl", dse_var 3)];
    sf_ls "tl" (dse_var 3) (dse_var 4)])

   ([pf_equal (dse_var 2) dse_nil],
    [sf_bin_tree ("l", "r") (dse_var 5)])``;
\end{verbatim}

\section{Proof System for Entailments}

This work is mainly concerned with the validity of
entailments. To reason about entailments a set of inference rules will be
given. As usual, the semantics of the inference rule
%
\[
\inferrule[]{A_1 \\ \ldots \\ A_n}{B}
\]
%
is that if all $A_i$ hold, we can conclude that also $B$
holds. Thus, the semantics can be expressed by $(\bigwedge_{i=1 \ldots n} A_i) \Rightarrow B$.
Additionally, the notation
\[
\eqinferstyle
\inferrule{A_1 \\ \ldots \\ A_n}{B}
\]
will be used to indicate  $(\bigwedge_{i=1 \ldots n} A_i) \Leftrightarrow B$.

In the following these notations are used to present inferences for
entailments. Then it will be explained how these inferences can be combined
to form a decision procedure.

\subsection{Inferences for Entailments}

\subsubsection{\texttt{ds\_inference\_REMOVE\_TRIVIAL}}

Using our notations for inferences, one can for example easily express inferences that
remove trivial parts from an entailment:

\[\begin{array}{ll}
\eqinferstyle
\inferrule[RemoveTrivial-EQ-L]{\entailment{\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\pfequal e e,\Pi,\Sigma}{\Pi', \Sigma'}}
&
\eqinferstyle
\inferrule[RemoveTrivial-EQ-R]{\entailment{\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi, \Pi,\Sigma}{\pfequal e e, \Pi', \Sigma'}}
\bigskip
\\
\eqinferstyle
\inferrule[RemoveTrivial-EmpTree-L]{\entailment{\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\Pi,\sftree((t_1, \ldots, t_k),e,e),\Sigma}{\Pi', \Sigma'}}
&
\eqinferstyle
\inferrule[RemoveTrivial-EmpTree-R]{\entailment{\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\Pi,\Sigma}{\Pi',\sftree((t_1, \ldots, t_k),e,e), \Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[RemoveTrivial-Precond]{\entailment{\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,(e,e),\pi,\Pi,\Sigma}{\Pi', \Sigma'}}
\end{array}
\]
\bigskip

\noindent
According to the definition of $\vdash$, the ordering of the lists $\eta$,
$\pi$, $\Pi$, $\Sigma$, $\Pi'$ and $\Sigma'$ does not matter. Thus, these
inferences and similar ones should be understood as sets of inferences,
containing the interesting formulae at arbitrary positions instead of the
heads of the lists. Similarly, we do not distinguish between some formulae,
which obviously have the same semantics. So, $\pfequal {e_1} e_2$ and
$\pfequal {e_2} e_1$ are not distinguished. The same holds for $\pfunequal
{e_1} e_2$. Additionally, the order, in which fields occur in $\sftree$ and
$\mapsto$ formulae is not important. Thus, we do for example not
distinguish between $\sfbintree(l,r,e)$ and $\sfbintree(r,l,e)$ or between
$\sfpointsto e {t_1: e_1, t_2:e_2, t_3:e_3}$ and $\sfpointsto e {t_2: e_2,
  t_3:e_3, t_1:e_1}$.
\bigskip

The $\HOL$ conversion \texttt{ds\_inference\_REMOVE\_TRIVIAL\_\_\_CONV} is an
implementation of these \textsf{RemoveTrivial}-inferences. It can also handle $\sflist$ and
$\sfbintree$. However, since the corresponding inferences are just
instantiations of the $\sftree$ inference, they won't be explained here.
Similarly, special inferences for $\sflist$ and $\sfbintree$ won't be
presented in the following, if they are just instantiations of a corresponding
$\sftree$ inference.

\subsubsection{\texttt{ds\_inference\_AXIOM}}

Another simple example for an inference is:
\[
\eqinferstyle
\inferrule[Axiom]{\ }
{\entailment{\eta,\pi,\Pi}{\ }}
\]
%
This inference requires, that the lists $\Sigma$, $\Pi'$ and $\Sigma'$ are
empty. Moreover, there are no preconditions. Therefore, this inference means,
that its conclusion always holds. Altogether the semantics of this inference
rule are expressed by:
\[\begin{array}{ll}
  \forall \eta,\pi,\Pi.\ \forall s,h. & \left(\heapdistinct (s,h,\eta, \pi)\ \wedge\
  \left(s\ \modelspf\ \Pi\right)\ \wedge\ \left(s,h\ \modelssf\ \nil \right)
\right) \ \Longrightarrow \\
&  \left(s\ \modelspf\ \pftrue \right)\ \wedge\ \left(s,h\ \modelssf\ \nil \right)
\end{array}
\]
This inference is implemented by \texttt{ds\_inference\_AXIOM\_\_\_CONV}.

\subsubsection{\texttt{ds\_inference\_SUBSTITUTION}}

A more interesting example is the substitution inference, which does some
actual work in simplifying an entailment. However, to understand this
inference the notation $l[e/x]$ needs to be introduced. Informally, it denotes
the list resulting from replacing every occurrence of the variable $x$ in $l$ with the expression $e$.
This definition allows to write the following inference rule:
\[
\eqinferstyle
\inferrule[Substitution]{\entailment{\eta[e/x],\pi[e/x],\Pi[e/x],\Sigma[e/x]}{\Pi'[e/x],\Sigma'[e/x]}}
{\entailment{\eta,\pfequal x e,\pi,\Pi,\Sigma}{\Pi', \Sigma'}}
\]
This inference is implemented by \texttt{ds\_inference\_SUBSTITUTION\_\_\_CONV}.

\subsubsection{\texttt{ds\_inference\_HYPOTHESIS}}

The hypothesis inference removes pure formulae that occur on the left hand
side of an entailment from the right hand side. Since some information has
been moved to the precondition, it has to be used as well to eliminate pure
formulae.
\[\begin{array}{ll}
\eqinferstyle
\inferrule[Hypothesis-base]{\entailment{\eta,\pi,\varpf{},\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\varpf{},\Pi,\Sigma}{\varpf {},\Pi', \Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Hypothesis-precond-nil-right]{\entailment{e,\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{e,\eta,\pi,\Pi,\Sigma}{\pfunequal e \nil,\Pi', \Sigma'}}
&
\eqinferstyle
\inferrule[Hypothesis-precond-nil-left]{\entailment{e,\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{e,\eta,\pi,\pfunequal e \nil,\Pi,\Sigma}{\Pi', \Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Hypothesis-precond-unequal-right]{\entailment{e_1,e_2,\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{e_1,e_2,\eta,\pi,\Pi,\Sigma}{\pfunequal {e_1} {e_2},\Pi',
    \Sigma'}}
&
\eqinferstyle
\inferrule[Hypothesis-precond-unequal-left]{\entailment{e_1,e_2,\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{e_1,e_2,\eta,\pi,\pfunequal {e_1} {e_2},\Pi,\Sigma}{\Pi', \Sigma'}}

\end{array}
\]
These inferences are implemented by
\texttt{ds\_inference\_HYPOTHESIS\_\_\_CONV}. Additionally, this conversion
removes duplicates in $\Pi$ and $\Pi'$.

\subsubsection{\texttt{ds\_inference\_FRAME}}

It's much more complicated to remove spatial formulae. There is
a frame inference that is very similar to the basic hypothesis inference:
\[
\inferrule[Frame-base]{\entailment{\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\Pi,\varsf{},\Sigma}{\Pi', \varsf{},\Sigma'}}
\]
However, this inference describes a real implication. This can be shown by the
following example:
\[
\inferrule{\entailment{\sfpointsto e
    {g:e_2}}{}}
    {\entailment{\sfpointsto e {f:e_1}, \sfpointsto e
    {g:e_2}}{\sfpointsto e {f:e_1}}}
\]
$\entailment{\sfpointsto e {g:e_2}}{}$ does not hold, since there is
a heap such that $e$ points to $e_2$ by field index $g$ and since this heap is
obviously not empty. However, the original
entailment holds, since no heap can be split into two disjoint heaps such that
both contain the value of $e$.

Thus, one has to be careful, in which order to apply inferences using this
basic frame rule. \cite{berdine05symbolic} uses backtracking and ordering of
the application of inference rules. However, one can use the predicate
$\heapdistinct$ to record the otherwise lost information and get a real
equivalence instead of just an implication. A similar method is used by newer
versions of \smallfoot. However, it is not described in \cite{berdine05symbolic}.

\[\begin{array}{l}
\eqinferstyle
\inferrule[Frame-points\_to]
{\entailment{e,\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\Pi,\sfpointsto e {t_1:e_1, \ldots,
      t_n:e_n},\Sigma}{\Pi', \sfpointsto e {t_1:e_1, \ldots,
      t_m:e_m},\Sigma'}}
\qquad m \leq n
\bigskip\\
\eqinferstyle
\inferrule[Frame-tree]
{\entailment{\eta,(e,es),\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\Pi,\sftree((t_1, \ldots, t_k),es,e),\Sigma}{\Pi', \sftree((t_1, \ldots, t_k),es,e),\Sigma'}}
\end{array}
\]

For $\mapsto$, the expression $e$ is added to $\eta$. This means, that the
value of $e$ is not in the remaining heap and that it is distinct to the
values of everything else in $\eta$. These two properties capture the
properties of the $*$-operation. Additionally, it is stored that $e$ does
not equal to $\nil$, which captures the properties of the $\mapsto$-operator
itself.

For trees, it's very similar. However, the tree may be empty. Therefore,
$(e,es)$ is added to $\pi$, which has the same effect as adding $e$ to $\pi$
guarded by the condition that $e$ and $es$ do not evaluate to the same value,
i.\,e.\ that the tree is not empty.

These inferences are implemented by \texttt{ds\_inference\_FRAME\_\_\_CONV}
for $\mapsto$ and $\sftree$. Notice, that this
conversion does not apply the general frame inference. Thus, it's a real
conversion which always results in an equality
theorem. \texttt{ds\_inference\_FRAME\_\_\_IMPL\_\_\_CONV} applies the general
frame inference as well and may therefore result in an implication.

\subsubsection{\texttt{ds\_inference\_INCONSISTENT}}

If there is no stack and heap that satisfies the left hand side, i.\,e.\ if
the left hand side is inconsistent, then the whole entailment holds.
\[\begin{array}{ll}
\eqinferstyle
\inferrule[Inconsistent-unequal]
{\ }
{\entailment{\eta,\pi,\pfunequal e e,\Pi,\Sigma}{\Pi',\Sigma'}}
&
\eqinferstyle
\inferrule[Inconsistent-pointsto-nil]
{\ }
{\entailment{\eta,\pi,\Pi,\sfpointsto \nil {\ldots}, \Sigma}{\Pi',\Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Inconsistent-precond-nil]
{\ }
{\entailment{\nil,\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
&
\eqinferstyle
\inferrule[Inconsistent-precondition-not-distinct]
{\ }
{\entailment{e,e,\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Inconsistent-precond-pointsto]
{\ }
{\entailment{e,\eta,\pi,\Pi,\sfpointsto e {\ldots}, \Sigma}{\Pi',\Sigma'}}
&
\eqinferstyle
\inferrule[Inconsistent-precond-bintree]
{\ }
{\entailment{e,\eta,\pi,\Pi,\sfbintree(l,r,e), \Sigma}{\Pi',\Sigma'}}
\end{array}
\]
These inference are implemented by
\texttt{ds\_inference\_INCONSISTENT\_\_\_CONV}.

\subsubsection{\texttt{ds\_inference\_NIL\_NOT\_LVAL}}

According to the semantics of $\mapsto$, $\nil$ cannot point to
anything. The following inferences make this fact explicit.
\[\begin{array}{l}
\eqinferstyle
\inferrule[NIL-NOT-LVAL-pointsto]
{\entailment{\eta,\pi,\pfunequal e \nil, \Pi,\sfpointsto e {\ldots},\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\Pi,\sfpointsto e {\ldots},\Sigma}{\Pi',\Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[NIL-NOT-LVAL-tree]
{\entailment{\eta,\pi,\pfunequal e \nil, \pfunequal e \textit{es},\Pi,\sftree\left(\ldots,\textit{es},e\right),\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\pfunequal e \textit{es},\Pi,\sftree\left(\ldots,\textit{es},e\right),\Sigma}{\Pi',\Sigma'}}
\end{array}
\]
This inference is implemented by
\texttt{ds\_inference\_NIL\_NOT\_LVAL\_\_\_CONV}. To prevent the inference
rule and therefore the final decision procedure from looping, only facts are
added that are not already present in $\Pi$ or $\eta$.

\subsubsection{\texttt{ds\_inference\_PARTIAL}}
This inference makes implicit unequalities explicit.
\[\begin{array}{l}
\eqinferstyle
\inferrule[Partial-pointsto-pointsto]
{\entailment{\eta,\pi,\pfunequal {e_1} {e_2}, \Pi,\sfpointsto {e_1} {\ldots},\sfpointsto {e_2} {\ldots},\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\Pi,\sfpointsto {e_1} {\ldots},\sfpointsto {e_2}
    {\ldots},\Sigma}{\Pi',\Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Partial-pointsto-tree]
{\entailment{\eta,\pi,\pfunequal {e_1} {e_2}, \pfunequal {e_2} {e_3},
    \Pi,\sfpointsto {e_1} {\ldots},\sftree (\ldots, {e_3}, e_2),\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\pfunequal {e_2} {e_3},\Pi,\sfpointsto {e_1} {\ldots},\sftree (\ldots, {e_3}, e_2),\Sigma}{\Pi',\Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Partial-tree-tree]
{\entailment{\eta,\pi,\pfunequal {e_1} {e_2}, \pfunequal {e_1} {e_3}, \pfunequal {e_2} {e_4},
    \Pi,\sftree (\ldots, {e_3}, e_1),\sftree (\ldots, {e_4}, e_2),\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\pfunequal {e_1} {e_3}, \pfunequal {e_2}
    {e_4},\Pi,\sftree (\ldots, {e_3}, e_1), \sftree (\ldots, {e_4}, e_2),\Sigma}{\Pi',\Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Partial-pointsto-precond]
{\entailment{e_1,\eta,\pi,\pfunequal {e_1} {e_2}, \Pi,\sfpointsto {e_2} {\ldots},\Sigma}{\Pi',\Sigma'}}
{\entailment{e_1,\eta,\pi,\Pi,\sfpointsto {e_2} {\ldots},\Sigma}{\Pi',\Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Partial-tree-precond]
{\entailment{e_1,\eta,\pi,\pfunequal {e_1} {e_2}, \pfunequal {e_2} {e_3}, \Pi,\sftree (\ldots, {e_3}, e_2),\Sigma}{\Pi',\Sigma'}}
{\entailment{e_1,\eta,\pi,\pfunequal {e_2} {e_3},\Pi,\sftree (\ldots, {e_3}, e_2),\Sigma}{\Pi',\Sigma'}}
\end{array}
\]
This inference is implemented by
\texttt{ds\_inference\_PARTIAL\_\_\_CONV}. To prevent the inference
rule and therefore the final decision procedure from looping, only facts are
added that are not already present in $\Pi$ and $\eta$.

\subsubsection{\texttt{ds\_inference\_SIMPLE\_UNROLL}}

These inferences perform unrolling of lists and binary trees for the simple cases,
that either it can be deducted that a list is empty or that the head of a list
/ binary tree is known:

\[\begin{array}{c}
\eqinferstyle
\inferrule[Unroll-NilList]
{\entailment{\eta,\pi,\pfequal {e} {\nil}, \Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\Pi,\sflist(\textit{tl}, \nil, e),\Sigma}{\Pi',\Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Unroll-precond-list]
{\entailment{e_1,\eta,\pi,\pfequal {e_1} {e_2}, \Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{e_1,\eta,\pi,\Pi,\sflist(\textit{tl}, e_1, e_2),\Sigma}{\Pi',\Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Unroll-right-list]
{\entailment{e_1,\eta,\pi,\pfunequal {e_1} {e_3}, \Pi,\Sigma}{\Pi',\sflist(\textit{tl}, e_2, e_3),\Sigma'}}
{\entailment{\eta,\pi,\pfunequal {e_1} {e_3}, \Pi,\sfpointsto{e_1}
    {\textit{tl}:e_2, \ldots}, \Sigma}{\Pi',\sflist(\textit{tl}, e_1, e_3),\Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Unroll-right-bintree]
{\entailment{e,\eta,\pi, \Pi,\Sigma}{\Pi',\sfbintree(l,r, e_l),\sfbintree(l,r, e_r),\Sigma'}}
{\entailment{\eta,\pi,\Pi,\sfpointsto{e}
    {l:e_l, r:e_r, \ldots}, \Sigma}{\Pi',\sfbintree(l,r,e),\Sigma'}}
\end{array}
\]
%
These inferences are implemented by \texttt{ds\_inference\_SIMPLE\_UNROLL\_\_\_CONV}.

\subsubsection{\texttt{ds\_inference\_STRENGTHEN\_PRECONDITION}}

The preconditions that result from the elimination of trees contain an
implicit case split. These inferences are used to eliminate this case split:

\[\begin{array}{ll}
\eqinferstyle
\inferrule[Strengthen-precond-unequal]
{\entailment{e_1,\eta,\pi,\pfunequal {e_1} {e_2},\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,(e_1,e_2),\pi,\pfunequal {e_1}{e_2}, \Pi,\Sigma}{\Pi',\Sigma'}}
&
\eqinferstyle
\inferrule[Strengthen-precond-equal-1]
{\entailment{\eta,\pi,\pfequal {e_1} {e_2},\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,(e_1,e_2),(e_1,e_2),\pi, \Pi,\Sigma}{\Pi',\Sigma'}}
\bigskip\\

\eqinferstyle
\inferrule[Strengthen-precond-equal-2]
{\entailment{e_1,\eta,\pi,\pfequal {e_1} {e_2},\Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{e_1,\eta,(e_1,e_2),\pi, \Pi,\Sigma}{\Pi',\Sigma'}}
\end{array}
\]
%
These inferences are implemented by \texttt{ds\_inference\_PRECONDITION\_STRENGTHEN\_\_\_CONV}.

\subsubsection{\texttt{ds\_inference\_PRECONDITION\_CASES}}

It is sometimes necessary to do a case analysis on a precondition.
\[
\eqinferstyle
\inferrule[Unroll-left-precond]
{\entailment{\eta,\pi,\pfequal {e_1} {e_2},\Pi,\Sigma}{\Pi',\Sigma'} \\\\
{\entailment{e_1,\eta,\pi,\pfunequal {e_1} {e_2},\Pi,\Sigma}{\Pi',\Sigma'}}}
{\entailment{\eta,(e_1,e_2),\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
\]
This inference is implemented by \texttt{ds\_inference\_PRECONDITION\_CASES\_\_\_CONV}.

\subsubsection{\texttt{ds\_inference\_UNROLL}}
\[
\eqinferstyle
\inferrule[Unroll-list]
{\entailment{\eta,\pi,\pfequal {e_1} {e_2}, \Pi,\Sigma}{\Pi',\Sigma'} \\\\
 \forall x.\ \entailment{\eta,\pi,\pfunequal {e_1} {e_2},\pfunequal {e_2} {x},
   \Pi,\sfpointsto {e_1} {\textit{fl}:x}, \sfpointsto {x} {\textit{fl}:e_2},
   \Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\Pi,\sflist(\textit{tl}, e_1, e_2),\Sigma}{\Pi',\Sigma'}}
\]
This inference does a case analysis on the length of lists. Its interesting to
note that just two cases are sufficient to cover everything. Thus, it is not necessary
to do induction for lists.

The general idea behind the correctness proof of this inference is that the
logic can just access the two endpoints $e_1$ and $e_2$ of the list. It can
not look at its internal representation, e.\,g.\ it cannot consider how many
elements are between the endpoints. Therefore, a case analysis that considers
the endpoints to be equal or to be unequal and not point at each other is
sufficient.

This inference is an instance of a more general inference for arbitrary
trees. However, besides lists, just the instance for binary trees is
implemented as a $\HOL$ conversion:

\[
\eqinferstyle
\inferrule[Unroll-bintree]
{\entailment{\eta,\pi,\pfequal {e_1} {e_2}, \Pi,\Sigma}{\Pi',\Sigma'} \\\\ \\\\
 \forall x_1,x_2.\ \eta,\pi,\pfunequal {e} {\nil},\pfunequal {x_l}
   {\nil},\pfunequal {x_r} {nil}, \Pi,\\\\
   \entailment{\sfpointsto {e} {l:x_l,r:x_r}, \sfpointsto {x_l} {l:\nil,r:\nil}, \sfpointsto {x_r} {l:\nil,r:\nil},
   \Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\Pi,\sfbintree(l,r, e),\Sigma}{\Pi',\Sigma'}}
\]

However, these inferences are applied by the decision procedure as late as
possible in order to avoid the case split and the introduction of fresh
variables. Instead, they are used to derive specialised inference rules which
are more efficient. And they are useful for the proof that the later
described procedure is really a decision procedure.  \medskip

\texttt{ds\_inference\_UNROLL\_LIST\_\_\_CONV} implements the list
inference rule. There is a
version that searches for $\pfunequal {e_1} {e_2}$ in $\Pi$ in order to be able to
discard the first case:
\texttt{ds\_inference\_UNROLL\_LIST\_\_\_NON\_EMPTY\_\_\_CONV}.
The conversion for binary trees is called
\texttt{ds\_inference\_UNROLL\_BIN\_TREE\_\_\_CONV}.

\subsubsection{\texttt{ds\_inference\_UNROLL\_RIGHT\_CASES}}

In general its possible to do a case split, whenever one thinks it is useful:
\[
\eqinferstyle
\inferrule[ExcludedMiddle]
{\entailment{\eta,\pi,\pfequal {e_1} {e_2}, \Pi,\Sigma}{\Pi',\Sigma'} \\\\
 \entailment{\eta,\pi,\pfunequal {e_1} {e_2}, \Pi,\Sigma}{\Pi',\Sigma'}}
{\entailment{\eta,\pi,\Pi,\Sigma}{\Pi',\Sigma'}}
\]

To really get a decision procedure in the very end, a case split is performed on
trees on the right hand side:
\[
\eqinferstyle
\inferrule[Unroll-right-Cases]
{\entailment{\eta,\pi,\pfequal {e_1} {e_2}, \Pi,\Sigma}{\Pi',\sftree((t_1, \ldots, t_k),e_2, e_1),\Sigma'} \\\\
 \entailment{\eta,\pi,\pfunequal {e_1} {e_2}, \Pi,\Sigma}{\Pi',\sftree((t_1, \ldots, t_k),e_2, e_1),\Sigma'}}
{\entailment{\eta,\pi,\Pi,\Sigma}{\Pi',\sftree((t_1, \ldots, t_k),e_2, e_1), \Sigma'}}
\]

This case split is implemented by
\texttt{ds\_inference\_UNROLL\_RIGHT\_CASES\_\_\_CONV}.

\subsubsection{\texttt{ds\_inference\_APPEND\_LIST}}
A combination of the inferences \texttt{ds\_inference\_UNROLL},
\texttt{ds\_inference\_SIMPLE\_UNROLL} and \texttt{ds\_inference\_FRAME} leads
to the following inference rules for lists:
\[
\begin{array}{l}
\eqinferstyle
\inferrule[Append-list-nil]
{\entailment{\eta,(e_1,e_2),\pi,\Pi,\Sigma}{\Pi',\sflist(\textit{tl},e_2, \nil),\Sigma'}}
{\entailment{\eta,\pi,\Pi,\sflist(\textit{tl},e_1, e_2),\Sigma}{\Pi',\sflist(\textit{tl},e_1, \nil),\Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Append-list-precond]
{\entailment{e3,\eta,(e_1,e_2),\pi,\pfunequal{e_1}{e_3},\Pi,\Sigma}{\Pi',\sflist(\textit{tl},e_2, e_3),\Sigma'}}
{\entailment{e3,\eta,\pi,\pfunequal{e_1}{e_3},\Pi,\sflist(\textit{tl},e_1, e_2),\Sigma}{\Pi',\sflist(\textit{tl},e_1, e_3),\Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Append-list-pointsto]
{\entailment{\eta,(e_1,e_2),\pi,\pfunequal{e_1}{e_3},\Pi,\sfpointsto {e_3} {\ldots},\Sigma}{\Pi',\sflist(\textit{tl},e_2, e_3),\Sigma'}}
{\entailment{\eta,\pi,\pfunequal{e_1}{e_3},\Pi,\sflist(\textit{tl},e_1,
    e_2),\sfpointsto {e_3} {\ldots},\Sigma}{\Pi',\sflist(\textit{tl},e_1, e_3),\Sigma'}}
\bigskip\\
\eqinferstyle
\inferrule[Append-list-tree]
{\entailment{\eta,(e_1,e_2),\pi,\pfunequal{e_1}{e_3},\pfunequal{e_3}{e_4},\Pi,\sftree(\ldots,e_4,e_3),\Sigma}{\Pi',\sflist(\textit{tl},e_2, e_3),\Sigma'}}
{\entailment{\eta,\pi,\pfunequal{e_1}{e_3},\Pi,\sflist(\textit{tl},e_1,
    e_2),\sftree(\ldots,e_4,e_3),\Sigma}{\Pi',\sflist(\textit{tl},e_1, e_3),\Sigma'}}
\end{array}
\]
%
These inferences are implemented by \texttt{ds\_inference\_LIST\_APPEND\_\_\_CONV}.

\subsection{The decision procedure}

The inferences presented in the previous section can be easily combined to
form a decision procedure (\texttt{ds\_DECIDE\_CONV}) for entailments not containing the general $\sftree$
predicate, but just the instantiations $\sflist$ and $\sfbintree$:

\begin{enumerate}
\item bring the entailment ${\eta,\pi,\Pi,\Sigma}\vdash{\Pi',\Sigma'}$ to
  normal form, i.\,e.\:
  \begin{itemize}
  \item remove all occurrences of $\nil$, $*$, $\pftrue$ and $\wedge$ from
    $\Pi, \Sigma, \Pi', \Sigma'$
  \item remove multiple occurrences of the same field index from $\Sigma$ and $\Sigma'$
  \end{itemize}
\item apply all the equality inferences (all except \textsc{Frame-base}) in an
  arbitrary order, until no further inference applications are possible
\item the original entailment holds iff and only iff it has been simplified to $\textit{true}$
\end{enumerate}

To show that this algorithm is really a decision procedure for entailments,
notice first that all steps preserve equality with the original entailment due
to the correctness of the inference and rewrite rules. Moreover, all steps
terminate. That's obvious for step 1. Step 2 may loop because of applications
of \textsc{Hypothesis} and \textsc{NIL-NOT-LVAL} / \textsc{Partial}
inferences. However, the sidecondition that no facts that are already
explicitly present are added prevents such loops.  Thus, the first two steps
terminate and transform ${\eta,\pi,\Pi,\Sigma}\vdash{\Pi',\Sigma'}$ to a
finite list of entailments
${\eta_i,\pi_i,\Pi_i,\Sigma_i}\vdash{\Pi_i',\Sigma_i'}$ such that the
following expression folds:

\[\big(\forall \vec{x}. \bigwedge_i
{\eta_i,\pi_i,\Pi_i,\Sigma_i}\vdash{\Pi_i',\Sigma_i'}\big) \Longleftrightarrow
{\eta,\pi,\Pi,\Sigma}\vdash{\Pi',\Sigma'}
\]

Thus, if the list of entailments
${\eta_i,\pi_i,\Pi_i,\Sigma_i}\vdash{\Pi_i',\Sigma_i'}$ is empty, the original
entailment really holds. If it is not empty, it remains to show that
the original entailment does not hold. Let
${\eta_x,\pi_x,\Pi_x,\Sigma_x}\vdash{\Pi'_x,\Sigma'_x}$ be an element of the
list. Then it is sufficient to show, that this element does not hold.

This can be shown by constructing a concrete counterexample: We know that the
entailment ${\eta_x,\pi_x,\Pi_x,\Sigma_x}\vdash{\Pi'_x,\Sigma'_x}$ is in
normal form and that no inference rule is applicable. Thus, the following
holds:
\begin{itemize}
\item $\pi_x = []$ because of \textsc{Unroll-left-precond}
\item $\Pi_x$ contains just disequations $\pfunequal {e_1} {e_2}$ with $e_1
  \not = e_2$ because of \textsc{Substitution}, \textsc{RemoveTrivial-EQ-L} and \textsc{Inconsistent-unequal}.
\item $\Sigma_x$ contains just expressions of the form $\sfpointsto e
  {t_1:e_1, \ldots, t_k:e_k}$ such that $e \not\in \eta_x$, all $t_i$ are
  distinct and all $e$ are distinct
\end{itemize}

A case analysis on the exact form of the entailment, combined with the
knowledge that no inference rule is applicable allows the construction of a
counterexample for each case. The actual proof is tedious and omitted here.

\section{Examples}
\subsection{Example 1}

The following entailment is proofed  by \smallfoot\ while the example
specification \texttt{list.sf} is checked:
%
\begin{verbatim}
0!=z_3 * 0!=x * 0!=z * z_3!=y * z_3!=z * a!=e * x!=y * x!=z * y!=z *
z |-> hd:e,tl:y * listseg(tl; y, 0) * listseg(tl; x, z_3) * z_3 |-> tl:z
|-
listseg(tl; x, z) * z |-> tl:y * listseg(tl; y, 0)
\end{verbatim}
%
Using the variable renaming $z_3 \to x_0$, $x \to x_1$, $z \to x_2$, $y
\to x_3$, $a \to x_4$, $e \to x_5$, this can be written as
\[\begin{array}{lr}
\pfunequal {x_0} \nil,\pfunequal {x_1} \nil, \pfunequal {x_2} \nil,
\pfunequal {x_0} {x_3}, \pfunequal {x_0} {x_2}, \pfunequal {x_4} {x_5},
\pfunequal {x_1} {x_3},
\pfunequal {x_1} {x_2}, \pfunequal {x_3} {x_2},\\
\sfpointsto {x_2} {\textit{hd}:x_5, \textit{tl}:x_3},
\sflist(\textit{tl},x_3,\nil), \sflist(\textit{tl},x_1,x_0),
\sfpointsto {x_0} {\textit{tl},x_2} & \vdash \\
\sflist(\textit{tl},x_1,x_2), \sfpointsto {x_2} {\textit{tl}:x_3}, \sflist(\textit{tl},x_3,\nil)
\end{array}
\]
%
in the syntax of this work. It will now be shown, how the inferences rules can
be used to show that this entailment holds. To keep things readable, let $\Pi := [\pfunequal {x_0} \nil,\pfunequal {x_1} \nil, \pfunequal {x_2} \nil,
\pfunequal {x_0} {x_3}, \pfunequal {x_0} {x_2}, \pfunequal {x_4} {x_5},
\pfunequal {x_1} {x_3},
\pfunequal {x_1} {x_2}, \pfunequal {x_3} {x_2}]$ be used as an abbreviation.

\[\begin{array}{llc}
\Pi,\sfpointsto {x_2} {\textit{hd}:x_5, \textit{tl}:x_3},\sflist(\textit{tl},x_3,\nil), \sflist(\textit{tl},x_1,x_0),
\sfpointsto {x_0} {\textit{tl},x_2} & \vdash & \textsc{Frame} \\
\sflist(\textit{tl},x_1,x_2), \sfpointsto {x_2} {\textit{tl}:x_3},
\sflist(\textit{tl},x_3,\nil) & & \Longleftrightarrow \\
\\

x_2,(x_3,\nil),\Pi, \sflist(\textit{tl},x_1,x_0),
\sfpointsto {x_0} {\textit{tl},x_2} & \vdash & \text{\textsc{Append-List}} \\
\sflist(\textit{tl},x_1,x_2) & & \Longleftrightarrow \\
\\

x_2,(x_3,\nil),(x_1,x_0),\Pi,
\sfpointsto {x_0} {\textit{tl},x_2} & \vdash & \textsc{Simple-Unroll} \\
\sflist(\textit{tl},x_0,x_2) & & \Longleftrightarrow \\
\\

x_2,x_0,(x_3,\nil),(x_1,x_0),\Pi & \vdash & \textsc{Remove-Trivial} \\
\sflist(\textit{tl},x_2,x_2) & & \Longleftrightarrow \\
\\

x_2,x_0,(x_3,\nil),(x_1,x_0),\Pi & \vdash & \textsc{Axiom} \\
 & & \Longleftrightarrow \\

\top
\end{array}
\]

Do do the same proof in \HOL, one can either apply single inference rules manually or just
call the decision procedure:
\begin{verbatim}
val t = ``LIST_DS_ENTAILS ([],[])
  ([pf_unequal (dse_var 0) dse_nil;
    pf_unequal (dse_var 1) dse_nil;
    pf_unequal (dse_var 2) dse_nil;
    pf_unequal (dse_var 0) (dse_var 3);
    pf_unequal (dse_var 0) (dse_var 2);
    pf_unequal (dse_var 4) (dse_var 5);
    pf_unequal (dse_var 1) (dse_var 3);
    pf_unequal (dse_var 1) (dse_var 2);
    pf_unequal (dse_var 3) (dse_var 2)],
   [sf_points_to (dse_var 2) [("hd",dse_var 5); ("tl", dse_var 3)];
    sf_ls "tl" (dse_var 3) dse_nil;
    sf_ls "tl" (dse_var 1) (dse_var 0);
    sf_points_to (dse_var 0) [("tl", (dse_var 2))]])

   ([],
    [sf_ls "tl" (dse_var 1) (dse_var 2);
     sf_points_to (dse_var 2) [("tl", dse_var 3)];
     sf_ls "tl" (dse_var 3) dse_nil])``;

val thm1 =
(ds_inference_FRAME___CONV THENC
 ds_inference_APPEND_LIST___CONV THENC
 ds_inference_SIMPLE_UNROLL___CONV THENC
 ds_inference_REMOVE_TRIVIAL___CONV THENC
 ds_inference_AXIOM___CONV) t;

val thm2 = ds_DECIDE_CONV t;
\end{verbatim}

\subsection{Example 2}

Lets now consider an entailment that does not hold:

\[\begin{array}{lllc}
\sfpointsto {x} {\textit{tl}:y} & \vdash & \sflist(\textit{tl},x,y) &
\stackrel{\textsf{Unroll-Right-Cases}}{\Longleftrightarrow} \\
\\
\pfunequal {x} {y},\sfpointsto {x} {\textit{tl}:y} & \vdash &
  \sflist(\textit{tl},x,y)\ \ \wedge  \\
\pfequal x y,\sfpointsto {x} {\textit{tl}:y} & \vdash &
  \sflist(\textit{tl},x,y) & {\Longleftrightarrow}
\\
& \vdots \\
\pfequal x y,\sfpointsto {x} {\textit{tl}:y} & \vdash &
  \sflist(\textit{tl},x,y) & {\stackrel{\textsf{Substitution}}{\Longleftrightarrow}} \\ \\
\sfpointsto {x} {\textit{tl}:x} & \vdash & \sflist(\textit{tl},x,x) & {\stackrel{\textsf{Remove-Trivial}}{\Longleftrightarrow}} \\ \\
\sfpointsto {x} {\textit{tl}:x} & \vdash & & {\stackrel{\textsf{NIL-NOT-LVAL}}{\Longleftrightarrow}}\\
\pfunequal x \nil, \sfpointsto {x} {\textit{tl}:x} & \vdash &
\end{array}
\]
%
Now, no more inferences are applicable. However, one can easily see, that the
entailment does not hold.

Inferences to detect false entailments are not implemented in \HOL.
Thus, the above reasoning looks in \HOL\ as follows:
\begin{verbatim}
> val t = ``LIST_DS_ENTAILS ([],[])
              ([], [sf_points_to (dse_var 0) [("tl", dse_var 1)]])
              ([], [sf_ls "tl" (dse_var 0) (dse_var 1)])``;

- val thm = ds_DECIDE_CONV t;

> val thm =
     []
    |- LIST_DS_ENTAILS ([],[])
         ([],[sf_points_to (dse_var 0) [("tl",dse_var 1)]])
         ([],[sf_ls "tl" (dse_var 0) (dse_var 1)]) =
       LIST_DS_ENTAILS ([],[])
         ([pf_unequal (dse_var 0) dse_nil],
          [sf_points_to (dse_var 0) [("tl",dse_var 0)]]) ([],[]) : thm
\end{verbatim}

\section{Conclusions and Future Work}

We formalised the subset of separation logic described in
\cite{berdine05symbolic} in \HOL. This formalisation contains correctness
proofs for the inferences used in \smallfoot. Thus, the work increases the
trust in this tool. Moreover, the decision procedure for entailments has been
implemented in \HOL.

In the future, this formalisation and the decision procedure could be used to
implement a \HOL\ version of \smallfoot. Another interesting project may be to
extend the fragment of separation logic used here and explore possibilities to
interactively prove more complicated statements in this extended logic.

\bigskip
\bigskip
\bibliographystyle{alpha}
\bibliography{ds}

\end{document}


\section{Linear Support Vector Classifiers (SVCs)}