Foreword

In June 2014, with my colleague and friend Morgan Deters, we have submitted an advanced course for ESSLLI'15 about logical investigations on separation logics by focusing on expressiveness, computational complexity of reasoning tasks and decision procedures, some of them based on SMT technology. The submission has been accepted in the fall 2014. In november 2014, while Morgan visited the Laboratoire Spécification and Vérification (ENS Cachan), we discussed further the content of the lectures as well as the plan of the lecture notes. The current document is the fruit of a joint and intense effort to present in a single volume fundamental results about separation logics and to provide numerous bibliographical references for further study. Morgan passed away unexpectedly last january and our project to produce the exact document we had in mind became impossible. Morgan and I wrote several articles about separation logics and we had many discussions about the logical side of separation logics while I have been visiting New York University in 2012-2014. The current document is the outcome of our fruitful collaboration1 ; it is partly inspired from the material in the papers [START_REF] Demri | Expressive completeness of separation logic with two variables and no separating conjunction[END_REF][START_REF] Demri | Two-variable separation logic and its inner circle[END_REF][START_REF] Demri | Separation logics and modalities: A survey[END_REF]. All the mistakes are mine.

To the memory of Morgan Deters. Stéphane Demri demri@lsv.fr June 15th, 2015 -Cachan

INTRODUCTION

Introducing new logics is always an uncertain enterprise since there must be sufficient interest to use new formalisms. In spite of this hurdle, we know several recent success stories. For instance, even though a pioneering work on symbolic modal logic by Lewis appeared in 1918 [START_REF] Lewis | A survey of symbolic logic[END_REF], the first monographs on symbolic modal logic appear about fifty years later, see e.g. [START_REF] Hughes | An introduction to modal logic[END_REF]. Nowadays, modal logic is divided into many distinct branches and remains one of the most active research fields in logic and computer science, see e.g. [START_REF]Handbook of modal logic[END_REF]. Additionally, the introduction of temporal logic to computer science, due to Pnueli [START_REF] Pnueli | The temporal logic of programs[END_REF], has been a major step in the development of model-checking techniques, see e.g. [CGP00, BBF + 01]. This is now a well-established approach for the formal verification of computer systems: one models the system to be verified by a mathematical structure (typically a directed graph) and expresses behavioral properties in a logical formalism (typically a temporal logic). Verification by model-checking [START_REF] Clarke | Model checking[END_REF] consists of developing algorithms whose goal is to verify whether the logical properties are satisfied by the abstract model. The development of description logics for knowledge representation has also followed a successful path, thanks to a permanent interaction between theoretical works, pushing even further the high complexity and undecidability borders, and more applied works dedicated to the design of new tools and the production of more and more applications, especially in the realm of ontology languages. The wealth of research on description logic is best illustrated by [BCM + 03], in which can be found many chapters on theory, implementations, and applications.

It is well-known that modal logic, temporal logic, and description logic have many similarities even though each family has its own research agenda. For instance, models can be (finite or infinite) graphs, the classes of models range from concrete ones to more abstract ones, and any above-mentioned class includes a wide range of logics and fragments. In the present lecture notes, we deal with another class of logics, separation logic, that has been introduced quite recently (see e.g. [START_REF] Ishtiaq | BI as an assertion language for mutable data structures[END_REF][START_REF] Reynolds | Separation logic: a logic for shared mutable data structures[END_REF]) and is the subject of tremendous interest, leading to many works on theory, tools and applications (mainly for the automatic program analysis). Any resemblance to modal, temporal, or description logic is certainly not purely coincidental-but separation logic also has its own assets.

In the possible-world semantics for modal logic, the connective [resp. ] corresponds to universal [resp. existential] quantification on successor worlds, and these are essential properties to be stated, partly explaining the impact of Kripke's discovery [START_REF] Kripke | A completeness theorem in modal logic[END_REF][START_REF] Copeland | The genesis of possible worlds semantics[END_REF]. Similarly, the ability to divide a model in two disjoint parts happens to be a very natural property and this might explain the success of separation logic in which disjoint memory states can be considered, providing an elegant means to perform local reasoning. Separation is a key concept that has been already introduced in interval temporal logic ITL [START_REF] Moszkowski | Reasoning about digital circuits[END_REF] with the "chop" connective, and in many other logical formalisms such as in graph logics [START_REF] Lozes | Expressivité des Logiques Spatiales[END_REF][START_REF] Dawar | Expressiveness and complexity of graph logic[END_REF] or in extensions of PDL (see e.g. [START_REF] Benevides | Propositional dynamic logic with storing, recovering and parallel composition[END_REF][START_REF] Ph | Decidability and computability in PRSPDL[END_REF]). Moreover, dependence logic has also a built-in notion of separation, see e.g. [START_REF] Abramsky | From IF to BI: a tale of dependence and separation[END_REF][START_REF] Kontinen | Modal independence logic[END_REF][START_REF] Hella | The expressive power of modal dependence logic[END_REF]. Therefore, the development of separation logic can be partly explained by the relevance of the separation concept. Its impressive development can be also justified by the fact that separation logic extends Hoare logic for reasoning about programs with dynamic data structures, meeting also industrial needs as witnessed by the recent acquisition of Monoidics Ltd by Facebook (see e.g. [CDD + 15]).

Separation logic has been introduced as an extension of Hoare-Floyd logic (see e.g. [START_REF] Hoare | An axiomatic basis for computer programming[END_REF][START_REF] Apt | Ten Years of Hoare's Logic[END_REF]) to verify programs with mutable data structures [START_REF] Ishtiaq | BI as an assertion language for mutable data structures[END_REF][START_REF] Reynolds | Separation logic: a logic for shared mutable data structures[END_REF]. A major feature is to be able to reason locally in a modular way, which can be performed thanks to the separating conjunction * that allows one to state properties in disjoint parts of the memory. Moreover, the adjunct implication - * asserts that whenever a fresh heap satisfies a property, its composition with the current heap satisfies another property. This is particularly useful when a piece of code mutates memory locally, and we want to state some property of the entire memory (such as the preservation of data structure invariants). In a sense, if modal logic is made for reasoning about necessity and possibility, separation logic is made for reasoning about separation and composition. As a taste of separation logic, it is worth observing that models can be finite graphs and the classes of models range from concrete ones (with heaps for instance) to very abstract ones.

Smallfoot was the first implementation to use separation logic, its goal to verify the extent to which proofs and specifications made by hand could be treated automatically [START_REF] Berdine | Smallfoot: Modular automatic assertion checking with separation logic[END_REF]. The automatic part is related to the assertion checking, but the user has to provide preconditions, postconditions, and loop invariants. A Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15 CONTENTS major step has been then to show that the method is indeed scalable [YLB + 08]. In a sense, the legitimate question about the practical utility of separation logic was quickly answered, leading to a new generation of tools such as Slayer developed by Microsoft Research, Space Invader [DOY06, YLB + 08], and Infer [START_REF] Calcagno | Infer: An automatic program verifier for memory safety of C programs[END_REF] (still under development at Facebook [CDD + 15, Section 4]). Actually, nowadays, many tools support separation logic as an assertion language (see e.g. [START_REF] Maclean | Proof automation for functional correctness in separation logic[END_REF]) and, more importantly, in order to produce interactive proofs with separation logic, several proof assistants encode the logic, see e.g. [START_REF] Th | A separation logic fragment for HOL[END_REF]. Furthermore, there exists also many tools that are dedicated to program verification and closely related to tools explicitly using separation logic, see e.g. a description of the research prototype VeriFast in [START_REF] Vogels | Featherweight VeriFast[END_REF] (typically featherweight VeriFast and Smallfoot share a very similar programming language). Note also that the development of the different tools has been performed progressively; Whereas Smallfoot uses an assertion language for preconditions, postconditions and loop invariants, Small-footRG [VP07] goes beyond by inferring some loop invariants (which is apart from the introduction of rules for dealing the the magic wand operator). Space Invader [START_REF] Distefano | A local shape analysis based on separation logic[END_REF] extends further the ideas of Smallfoot by determining annotations for unannotated programs.

From the very beginning, the theory of separation logic has been an important research thread even if not always related to automatic verification. This is not very surprising since separation logic can be understood as a concretisation of the logic BI of bunched implications which is a general logic of resource with a nice proof theory [START_REF] O'hearn | The logic of bunched implications[END_REF]. More precisely, the logic BI exists in different flavours: its intuitionistic version has additive and multiplicative connectives that behave intuitionistically whereas its Boolean version admits Boolean additive connectives with intuitionistic multiplicative connectives ( * and - * ), see more details in [START_REF] Larchey-Wendling | Nondeterministic phase semantics and the undecidability of boolean BI[END_REF]. So, separation logic is rather a concretisation of Boolean BI (see more details in Section 1.3.1).

Besides, as for modal and temporal logics, the relationships between separation logic, and first-order or second-order logics have been the source of many characterisations and works. This is particularly true since the separating connectives are second-order in nature, see e.g. [Loz04a, KR04, CGH05, BDL12]. For instance, separation logic is equivalent to a Boolean propositional logic [START_REF] Lozes | Separation logic preserves the expressive power of classical logic[END_REF][START_REF] Lozes | Expressivité des Logiques Spatiales[END_REF] if first-order quantifiers are disabled. Similarly, the complexity of satisfiability and model-checking problems for separation logic fragments have been quite studied [COY01, Rey02, CHO + 11, AGH + 14, BFGN14]. In [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF], the model-checking and satisfiability problems for propositional separation logic are shown PSPACE-complete; this is done by proving a small model property.

CONTENTS

In this course, we would like to emphasise the similarities between separation logic and, modal and temporal logics. Our intention is to pinpoint the common features in terms of models, proof techniques, motivations, decision procedures. Second, we wish to present landmark results about decidability, complexity and expressive power. These are standard themes for studying logics in computer science and we deliberately focus on the logical side of separation logic. Even though our intention is to produce a self-contained document as far as the definitions and results are concerned, we invite the reader to consult surveys on formal verification and separation logic, see e.g., the primer on separation logic in [O'H12], the lecture notes about Hoare logic and separation logic in [START_REF] Gordon | Hoare Logic[END_REF] or [START_REF] Jensen | Enabling Concise and Modular Specifications in Separation Logic[END_REF]Chapter 7] and [START_REF] Jensen | Techniques for model construction in separation logic[END_REF]. See also [START_REF] Vogels | Featherweight VeriFast[END_REF] for a detailed description of the tool featherweight VeriFast.

The five lectures are organised as follows and each chapter is dedicated to one lecture.

Lecture 1: First steps in separation logics.

Lecture 2: Propositional separation logics.

Lecture 3: Expressiveness of first-order separation logics.

Lecture 4: Relationships with other logics.

Lecture 5: Decision procedures.

Because of time and space limitations, we had to focus on core separation logic and for the presentation of the main results we adopt a puristic point of view. Namely, most of the logics • are without data values (by contrast, see e.g. [BDES09, BBL09, MPQ11]),

• use concrete models (by contrast to abstract models considered in [COY07, BK10, LWG10, BV14]),

• are not multi-dimensional extensions of non-classical logics (by contrast, see e.g. [YRSW03, BDL09, CG13]),

• do not provide general inductive predicates (lists, trees, etc.) (by contrast, see e.g. [START_REF] Iosif | The tree width of separation logic with recursive definitions[END_REF][START_REF] Brotherston | A decision procedure for satisfiability in separation logic with inductive predicates[END_REF]).

However, these extensions shall be introduced and briefly discussed but we shall refer to original articles or surveys for in-depth developments.

Chapter 1 In this chapter, we provide a brief introduction to separation logic by showing how it is related to formal verification. Later sections give a precise definition and focus on the logical language rather than on the verification process. This means that we adopt a restrictive use of the term 'separation logic' which is understood as an assertion logic, rather than an understanding combining in some way the assertion logic, the programming language and/or the specification logic. Section 1.1.1 is dedicated to Floyd-Hoare logic understood as a proof system made of deduction rules to verify the correctness of programs. Section 1.1.4 recalls how separation logic appears as a way to repair the defects of Floyd-Hoare logic when pointers are involved. Relationships with the logic of bunched implications logic BI are also briefly explained. In Section 1.2.1, we present the syntax and semantics for the versions of separation logics considered in this document. Section 1.2.2 explains how to express properties with formulae from separation logics whereas Section 1.2.4 provides a classification of formulae involving pure, intuitionistic and strictly exact formulae, respectively. Section 1.2.3 presents a few rules in a Floyd-Hoare-like proof system when commands for mutable shared data structures are involved and when the assertion language uses formulae from separation logic. Section 1.2.5 presents some more decision problems for separation logics. Section 1.3 provides first insights about the relationships between separation logics and other non-classical logics. This shall be complemented by material in the subsequent chapters, as it is done, for instance, in Chapter 4.

FIRST STEPS IN SEPARATION LOGICS

Highlights of the chapter

1. Definition of separation logics following [START_REF] Ishtiaq | BI as an assertion language for mutable data structures[END_REF][START_REF] Reynolds | Separation logic: a logic for shared mutable data structures[END_REF] in which the set of addresses/values is equal to N.

2. Translation of kSL into weak monadic second-order logic by internalising the semantics.

3. Undecidability proof of 2SL (without separating connectives) by reduction from the finitary satisfiability problem for predicate logic restricted to a unique binary predicate symbol (Theorem 1.3.4) [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF].

1.1 Floyd-Hoare Logic and Separation Logic 1.1.1 Hoare triples

Hoare logic, proposed in 1969 by Tony Hoare [START_REF] Hoare | An axiomatic basis for computer programming[END_REF] and inspired by the earlier work of Floyd [START_REF] Floyd | Assigning meanings to programs[END_REF], is a formal system used to show the correctness of programs (see a quite complete survey in [START_REF] Apt | Ten Years of Hoare's Logic[END_REF], the recent lecture notes [START_REF] Gordon | Hoare Logic[END_REF] or the extension to parallel programming languages in [START_REF] Owicki | An axiomatic proof technique for parall programs I[END_REF]). This is an axiomatic method that had a substantial impact for the design and the verification of computer programs. Its hallmark, the Hoare triple, is composed of assertions ϕ and ψ and the command C: {ϕ} C {ψ}.

Simply put, such a triple means that given a program state where the precondition ϕ holds, the execution of C yields a state in which the postcondition ψ holds. Two commands can be composed:

{ϕ} C 1 {ψ} {ψ} C 2 {χ} {ϕ} C 1 ; C 2 {χ} composition
Similarly, the skip has no effect.

{ϕ} skip {ϕ} skip

Preconditions can be strengthened and postconditions can be weakened in a natural fashion:

ϕ ⇒ ϕ {ϕ } C {ψ} ψ ⇒ ψ {ϕ} C {ψ } strengthen/weaken
The expression ϕ ⇒ ϕ can be read as ϕ entails ϕ , which amounts to state the logical validity of the formula ϕ ⇒ ϕ , when defined in a first-order dialect. An assignment axiom schema is stated simply:

{ϕ[e/x]} x := e {ϕ} assignment

In general, atomic commands, such as the assignment, are axiomatised by socalled small axioms.

Example 1.1.1.

Here are examples of "valid" triples that are related to assignment but that are not instances of the assignment axiom schema.

• {x = 1} x := x + 2 {x ≥ 2}.

• {x = 1} x := x + 2 {x = 3}.

• {x = 1} x := x + 2 {∃ y, z (y

• z > 0 ∧ x = y • z -1)}.
By contrast, the triple below is an instance:

{x + 2 = 3} x := x + 2 {x = 3}.
Here is another deduction rule (that remain sounds even when the new commands introduced below are considered): {ϕ} C {ψ} {∃ u ϕ} C {∃ u ψ} auxiliary variable elimination assuming that u is not free in C. Additional deduction rules for the command while and if-then-else in Floyd-Hoare logic proof system can be defined as follows: Note that B is a Boolean expression in the programming language but it also belongs to the assertion language for preconditions and postconditions since the deduction rules handles formulae of the form ϕ ∧ B and ϕ ∧ ¬B.

The rule of constancy can be also defined as follows:

{ϕ} C {ψ} {ϕ ∧ ψ } C {ψ ∧ ψ }
where no variable free in ψ is modified by C.

An instance of the rule of constancy can be found below: {x = 3} x := 4; z := x {x = 4} {x = 3 ∧ y = 8} x := 4; z := x {x = 4 ∧ y := 8} Note that y does not occur in x := 4; z := x.

Given a formal semantics for a simple imperative programming language based on the above command, it is possible to state soundness and completeness properties (see e.g. [START_REF] Apt | Ten Years of Hoare's Logic[END_REF]). We do not provide here a formal semantics in terms of small-step operational semantics for the commands but it can be defined via a binary relation s, C s , C that corresponds to one step in the computation. The expressions s and s are assignments for the program variables and executing one step of C leads to s and it remains to compute C. Termination is expressed by s, C * s , skip where * denote the reflexive and transitive closure. With this approach, the following simple observations can be made:

1. any command except skip can execute in any state (possibly except halt), 2. skip alone represents the final step of execution of a program, 3. there is no possible runtime error.

Consequently, C does not terminate means that C diverges. When pointers are involved, failed dereference operations are possible and therefore nontermination of a command does not imply necessarily divergence.

Correctness of the proof system involving Hoare triples means that whenever a triple {ϕ} C {ψ} is derived, it is valid. This means that if s, C * s , skip and s | = ϕ (the formula from the assertion language is satisfied by the current variable assignment), then s | = ψ. This type of correctness is called partial. By contrast, total correctness requires that if s | = ϕ, then s, C * s , skip (termination) and s | = ψ. Besides, relative completeness requires that every valid triple is derivable in the proof system. Of course, all these notions are relative to a programming language, to its semantics, to the assertion language for the pre/post-conditions and to the exact rules of the proof system.

Weakest preconditions

Relative completeness for Hoare logic has been established in [START_REF] Cook | Soundness and completeness of an axiom system for program verification[END_REF] by using weakest preconditions introduced by E.W. Dijkstra, see e.g. [START_REF] Dijkstra | A Discipline of Programming[END_REF]. A weakest precondition wp(C, ψ) is a predicate that describes the exact set of states s such that when C is started in s, if it terminates, then it terminates in a state satisfying ψ. In a sense, wp(C, ψ) corresponds to the minimal precondition ϕ that validates {ϕ} C {ψ}. So, Hoare logic is complete if the assertion logic L can express the weakest preconditions for any C and ψ. The proof for relative completeness from [START_REF] Cook | Soundness and completeness of an axiom system for program verification[END_REF] uses weakest preconditions and a structural induction on C.

FLOYD-HOARE LOGIC AND SEPARATION LOGIC

Note that checking validity of {ϕ} C {ψ} amounts to perform the following tasks:

1. to compute wp(C, ψ), 2. to check the validity of ϕ ⇒ wp(C, ψ).

Of course, this implies that {wp(C, ψ)} C {ψ} is valid, which is expected in view of the specification for defining weakest preconditions. So, the completeness result for mono-procedure sequential programs proved in [START_REF] Cook | Soundness and completeness of an axiom system for program verification[END_REF] establishes that each triple {wp(C, ψ)} C {ψ} is derivable.

By way of example, we brievely explain how weakest preconditions can be defined inductively. Note that this assumes that the assertion logic has sufficient syntactic resources and that it contains appropriate logical connectives and quantifiers.

wp(skip, ψ) (x 1 , . . . , x k are the assigned variables in C) Here, it is worth noting the necessity to annotate the program so that the invariant condition I is known before computing the weakest precondition, which is indeed problematic for a fully automated verification process.

Adding pointers

When pointers are added to the programming language (see an example below), soundness of the rule of constancy is not preserved, as briefly shown below. By way of example, we provide new commands for the manipulation of mutable shared data structures understood as an extension of an imperative programming language.

x := cons(e) allocation x := [e] lookup [e] := e mutation dispose(e) deallocation Again, we do not provide here a formal semantics in terms of small-step operational semantics for such commands but it is worth mentionning that computational states are extended so that a store is a variable assignment and a heap is understood as a map from the set of addresses into the set of values. A command of the form x := [e] updates the store whereas a command of the form [e] := e updates the heap. Moreover, the domain of the heap is augmented after the execution of the command x := cons(e) and it is reduced after the execution of the command dispose(e). In order to simplify technical developments, in the sequel, we assume that the set of adresses and the set of values are equal to the set of natural numbers. For instance, (s, h), x := cons(e)

(s[x → n], h {n → e }), skip

where n → e is a new memory cell and e denotes the interpretation of the expression e (parameterised by (s, h)). This can be generalised to the command x := cons(e 1 , . . . , e s ) whose effect is to create s new memory cells with consecutive addresses. Similarly, we have

(s, h), dispose(y) (s, h \ { y → m}), skip
where y belongs to the domain of h, h( y ) = m, and h \ { y → m} is equal to h, except that the memory cell y → m is removed.

As noted quite early, original Floyd-Hoare logic has a severe limitation when pointers are involved. Consider the following triple, an instance of the assignment rule: {y = 1} x := 2 {y = 1}

This essentially states that an assignment of 2 to x does not affect the value of y (if it is 1). With many popular imperative programming languages, this is not the case, as x and y may in fact be aliased, i.e., they may refer to the same or a partially-overlapping region of computer memory. More precisely, the presence of pointers invalidates the use of the rule of constancy. Indeed, consider the following instance of the rule when pointers are involved:

{∃ u (x → u)} [x] := 4 {x → 4} {(∃ u (x → u)) ∧ y → 3} [x] := 4 {x → 4 ∧ y → 3}
where x → u is a logical atomic formula stating that the heap has a memory cell with address x and value u. Unsoundness is due to the possibility that x is equal to y (aliasing).

FLOYD-HOARE LOGIC AND SEPARATION LOGIC

This defect will be repaired with the introduction of the frame rule below where * is a separating connective so that distinct parts of memory can be reasoned about distinctly.

{ϕ} C {ψ} {ϕ * ψ } C {ψ * ψ } frame rule

where no variable free in ψ is modified by C.

Naturally, the problem with pointers was understood early on as a limitation, and aliasing has continued to plague program analysis in the decades since. However, the simplicity and composability of Hoare's proposal was appreciated, and various ways of overcoming this limitation within Hoare's formalism have been sought. Many of these approaches have used some form of separation, by which distinct parts of memory can be reasoned about distinctly.

The birth of separation logic

Burstall introduced distinct nonrepeating tree systems in 1972 [START_REF] Burstall | Some techniques for proving correctness of programs which alter data structures[END_REF], implicitly appealing to a notion of separation to be later enshrined in separation logic. There were, however, limitations of Burstall's approach (see [START_REF] Reynolds | Intuitionistic reasoning about shared mutable data structure[END_REF] for a full treatment). Fragments of data structures could be asserted as separate, and this invention was important; however, they were not permitted to have internal sharing. This has the effect that the assertion language is limited in its ability to distinguish structures with (unbounded) sharing. Further, the notion of composition was directional, so that mutually-referential data posed a problem.

Recognising these limitations, Reynolds introduced the notion of an "independent conjunction" to Hoare logic, capable of speaking of disjoint structures and thus maintaining some control in the face of the aliasing problem. Its first incarnation, interpreted classically, was flawed, as it assumed monotonicity of interpretations of assertions in extensions of memory states but included an unsound proof rule. This was quickly repaired by coopting an intuitionistic semantics [START_REF] Reynolds | Intuitionistic reasoning about shared mutable data structure[END_REF].

This intuitionistic version was discovered independently [START_REF] Ishtiaq | BI as an assertion language for mutable data structures[END_REF] by Ishtiaq and O'Hearn. In fact, their efforts (together with Pym) on bunched implication (BI) logics [START_REF] O'hearn | The logic of bunched implications[END_REF][START_REF] Pym | The Semantics and Proof Theory of the Logic of Bunched Implications[END_REF] gave them a somewhat more general perspective, and they recognised Reynolds' assertion language as being an instance of bunched implication that reasons about pointers. Independently, working from Reynolds' earlier classical variant, they developed a version of BI that used Reynolds' independent conjunction, and gave it intuitionistic semantics. Afterward, they considered a classical version, but ended up presenting these in reverse, the intuitionistic as a variant of the classical; this as a result of the fact that the intuitionistic can be translated into the classical version, and the classical version was useful in reasoning about pointer disposal.

Their paper made two further important contributions. First, they introduced separating implication (the "magic wand") to the logic (this quite naturally came from BI's multiplicative implication). This addition of the magic wand was not merely an afterthought or side effect of the instantiation of bunched implication in this "pointer logic" setting; indeed its addition was justified in its own right when first introduced [START_REF] Ishtiaq | BI as an assertion language for mutable data structures[END_REF]. Despite this, many verification applications have made use of the separating conjunction only and do not employ the magic wand. However, nowadays its use in verification is more recognised; see [LP14, Section 1] and [HCGT14, Section 8] for recent discussions on this topic (see also [START_REF] Thakur | Satisfiability modulo abstraction for separation logic with linked lists[END_REF][START_REF] Schwerhoff | Lightweight support for magic wands in an automatic verifier[END_REF]).

Second, they introduced the frame rule, important for local reasoning [IO01] (see Section 1.1.1). Given a Hoare triple {ϕ} C {ψ} and reasoning about partial computer memories satisfying ϕ and ψ, one can make conclusions about (disjoint) extensions of those partial memories and, in particular, about how these extensions are unaltered by C. This is at the core of the scalability of separation logic and its ability to handle aliasing.

In all these early versions of separation logic, memory locations were distinct from the integers. Reynolds later offered an extension that takes memory locations to be a (countably infinite) subset of the integers, and made fields of larger units independently addressable. His goal was to adequately model the low-level operation of code and, particularly, address arithmetic. In this document, we adopt such a convention: memory locations are integers. We also adopt modern syntax; before 2002, Reynolds used '&' for separating conjunction. The modern syntax is ' * ' for separating conjunction and '- * ' for the separating implication, both taken from bunched implication logic.

A Core Version of Separation Logic

Basic definitions

Let us start by defining separation logics on concrete models, namely on heaps. Let PVAR = {x 1 , x 2 , . . .} be a countably infinite set of program variables and FVAR = {u 1 , u 2 , . . .} be a countably infinite set of quantified variables. A memory state is a pair (s, h) such that • s is a variable valuation of the form s : PVAR → N (the store),

• A heap with k ≥ 1 record fields is a partial function h : N N k with finite domain. We write dom(h) to denote its domain and ran(h) to denote its range.

Usually in models for separation logic(s), memory states have a heap and a store for interpreting program variables, see e.g. [START_REF] Reynolds | Separation logic: a logic for shared mutable data structures[END_REF]. Herein, sometimes, there is no need for program variables (with a store) because we establish hardness results without the help of such program variables. Moreover, for the sake of simplicity, we do not make a distinction between the set of locations (domain of h) and the set of values (set of elements from the range of h).

When k = 1, we write l to denote the cardinal of the set {l : h(l ) = l} made of predecessors of l (heap h is implicit in the expression l). A location l is an ancestor of a location l iff there exists i ≥ 0 such that h i (l) = l where h i (l) is shorthand for h(h(. . . (h(l) . . .))) (i applications of h to l).

Two heaps h 1 and h 2 are said to be disjoint, noted h 1 ⊥h 2 , if their domains are disjoint; when this holds, we write h 1 h 2 to denote the heap corresponding to the disjoint union of the graphs of h 1 and h 2 , hence dom(h 1 h 2 ) = dom(h 1 ) dom(h 2 ). When the domains of h 1 and h 2 are not disjoint, the composition h 1 h 2 is not defined even if h 1 and h 2 have the same values on dom(h 1 ) ∩ dom(h 2 ). Moreover, we can also define the disjoint union of the memory states (s 1 , h 1 ) and (s 2 , h 2 ) when s 1 = s 2 and h 1 ⊥h 2 so that (s 1 , h 1 ) (s 2 , h 2 ) def = (s 1 , h 1 h 2 ). We write h h when the heap h is a conservative extension of the heap h, i.e. dom(h) ⊆ dom(h ) and, h and h agree on dom(h). In Figure 1.1, we illustrate how disjoint memory states are built when there is a unique record field while recalling a standard graphical representation. Each node represents a distinct natural number (the value is not specified in Figure 1.1) and each edge l → l encodes the fact that h(l) = l , assuming that h is the heap graphically represented. A variable x i just above a node means that its value by the store s is precisely that node. In Figure 1.1, the heap on the left of the equality sign (say h) is equal to the disjoint union of the two heaps on the right of the equality sign (say h 1 , h 2 from left to right). For example, the self-loop on the node labelled by x 3 encodes that (s, h) x 1 Formulae are defined by the grammar

| = x 3 → x 3 where | = is the satisfaction relation defined below. Similarly, (s, h 1 ) | = x 3 → x 3 but not (s, h 2 ) | = x 3 → x 3 . Each edge
x 2 x 3 x 4 = x 1 x 2 x 3 x 4 x 1 x 2 x 3 x 4
ϕ, ψ ::= π | ϕ ∧ ψ | ¬ϕ | ϕ * ψ | ϕ - * ψ | ∃ u ϕ
where u ∈ FVAR. The connective * is separating conjunction and - * is separating implication, usually called the magic wand. The use of the magic wand - * is due to [START_REF] Ishtiaq | BI as an assertion language for mutable data structures[END_REF]. We also make use of standard notations for derived connectives for this and all logics defined in this document.

As in classical first-order logic, an assignment is a map f : FVAR → N. The satisfaction relation | = is parameterised by assignments (obvious clauses for Boolean connectives are omitted):

(s, h) | = f emp iff dom(h) = ∅ (s, h) | = f e = e iff e = e , with x def = s(x) and u def = f(u) (s, h) | = f e → e 1 , . . . , e k iff e ∈ dom(h) and h( e ) = ( e 1 , . . . , e k ) (s, h) | = f ϕ 1 * ϕ 2 iff h = h 1 h 2 , (s, h 1 ) | = f ϕ 1 , (s, h 2 ) | = f ϕ 2 for some h 1 , h 2 (s, h) | = f ϕ 1 - * ϕ 2 iff for all h , if h ⊥ h and (s, h ) | = f ϕ 1 then (s, h h ) | = f ϕ 2 (s, h) | = f ∃ u ϕ iff there is l ∈ N such that (s, h) | = f[u →l] ϕ where f[u → l]
is the assignment equal to f except that u takes the value l When ϕ has no program variables, we also write h | = f ϕ to mean that ϕ is satisfied on the heap h under the assignment f. Furthermore, when ϕ is a sentence, we can omit the subscript 'f' since ϕ has no free quantified variable. Note also that it is possible to get rid of program variables by viewing them as free quantified variables with rigid interpretation. However, it is sometime useful to distinguish syntactically program variables from quantified variables.

It is worth noting that separating conjunction * has an existential flavour whereas separating implication - * has a universal flavour. Nonetheless, - * universally quantifies over an infinite set, namely the set of disjoint heaps. In the literature, an alternative syntax is used where e → e 1 , . . . , e k is represented by the conjunction below:

e 1 → e 1 ∧ • • • ∧ e k → e k
When pointer arithmetic is allowed, e → e 1 , . . . , e k can be also understood as the conjunction below

(e → e 1 ) ∧ (e + 1 → e 2 ) ∧ • • • (e + (k -1) → e k ),
which requires some semantical adjustment. Nevertheless, in this document, we stick to e → e 1 , . . . , e k , as defined above.

The definition of kSL does not provide a special treatment for nil. Indeed, it is possible to regain the usual behaviour by requiring that the interpretation of nil is not in the heap domain. This can be done in different ways depending on the fragment at hand.

The exact/precise points-to atomic formulae x → y can be defined as abbreviations for (x → y) ∧ ¬(¬emp * ¬emp) and states that the domain of the heap is a singleton and the heap contains only the memory cell from x → y. The formula emp * ¬emp) enforces that card(dom(h)) ≥ 2. It is common to consider x → y as a primitive atomic formula and in the rest of the document, we shall often refer to such an atomic formula. It will be clear from the context, whether x → y should be considered as primitive.

For k ≥ 0, we write kSLk to denote the fragment of kSL with at most k quantified variables. So, we write kSL1 to denote the fragment of kSL restricted to a single quantified variable, say u. Moreover, kSLk (- * ) [resp. kSLk ( * )] denotes the fragment of kSLk without separating conjunction [resp. wihout separating implication]. Note also that kSL can be understood as a syntactic fragment of (k + 1)SL by simply encoding e → e 1 , . . . , e k by e → e 1 , e 1 , . . . , e k everywhere (the first expression is repeated twice).

As noted earlier, we do not make a distinction between the (countably infinite) set of locations and the set of values that includes the locations since only the set N is used to define the stores and heaps.

Let L be a logic of the form kSLk or one of its fragments or extensions. As usual, the satisfiability problem for L takes as input a formula ϕ from L and asks whether there is a memory state (s, h) and an assignment f such that (s, h) | = f ϕ. The validity problem is also defined as usual. The model-checking problem for L takes as input a formula ϕ from L, a memory state (s, h) and a finite assignment f for free variables from ϕ and asks whether (s, h) | = f ϕ (s is finitely encoded and it is restricted to the program variables occurring in ϕ). Note that the model-checking problem for first-order logic over finite structures is known to be PSPACE-complete (see e.g. [START_REF] Vardi | The complexity of relational query languages[END_REF]) but we cannot conclude a similar statement for fragments of separation logic (even though s, h and f can be finitely encoded) because separating implication quantifies over an infinite set of disjoint heaps.

When k = 1, observe also that heaps are understood as Kripke frames of the form (N, R) where R is a finite and functional binary relation. Indeed, R = {(l, h(l)) : l ∈ dom(h)} for some heap h. Furthermore, the locations l and l are in the same connected component whenever (l, l ) ∈ (R ∪ R -1 ) * . Usually, connected components are understood as non-singleton components. A finite functional graph (N, R) can be made of several maximal connected subgraphs so that each connected subgraph is made of a cycle, possibly with trees attached to it.

Finally, it is well-known that there exists a formal relationship between * and - * since - * is the adjunct of * . This means that (ϕ * ψ) ⇒ χ is valid iff ϕ ⇒ (ψ - * χ) is valid. Exercise 1.5 is dedicated to this equivalence. This does not imply that the formula ((ϕ * ψ) ⇒ χ) ⇔ (ϕ ⇒ (ψ - * χ)) is valid (otherwise * and - * would be inter-definable). However, sometimes, we are able to show that we can get rid of one of the separating connectives, see e.g. Chapter 3, without sacrificing the expressive power.

We also introduce so-called septraction operator ¬ - * : ϕ ¬ - * ψ is defined as the formula ¬(ϕ - * ¬ψ). As far as we know, its first appearance was in

[VP07]. So, (s, h) | = f ϕ ¬ - * ψ iff there is a heap h disjoint from h such that (s, h ) | = f ϕ and (s, h h ) | = f ψ.
The septraction operator states the existence of a disjoint heap satisfying a formula and for which its addition to the original heap satisfies another formula.

Expressing properties with separation logic

The logic 1SL allows one to express different types of properties on memory states. The examples below indeed illustrate the expressivity of 1SL.

• The domain of the heap has at least α elements: ¬emp * • • • * ¬emp (α times). • The variable x is allocated in the heap: alloc(x) def = (x → x) - * ⊥. Sometimes, atomic formulae of the form alloc(x) are primitive in the considered fragments of separation logics since alloc(x) is a fundamental property to express in a memory state (see Section 5.3).

• The variable x points to a location that is a self-loop:

∃ u (x → u) ∧ (u → u). x
In the following, let u and u be the variables u 1 and u 2 , in either order. Note that any formula ϕ(u) with free variable u can be turned into an equivalent formula with free variable u by permuting the two variables. Below, we define (standard) formulae and explain which properties they express.

• The domain dom(h) has exactly one location:

size = 1 def = ¬emp ∧ ¬(¬emp * ¬emp).
• The domain dom(h) has exactly two locations:

size = 2 def = (¬emp * ¬emp) ∧ ¬(¬emp * ¬emp * ¬emp).
It is easy to see that one can also define in 1SL that the heap domain has at least k ≥ 0 elements (written size ≥ k).

• u has a successor: alloc(u) • There is a non-empty path from u to u and nothing else except loops that exclude u:

def = ∃ u u → u. • u has at least α predecessors: u ≥ α def = α times (∃ u (u → u)) * • • • * (∃ u (u → u)) . • u has at most α predecessors: u ≤ α def = ¬ u ≥ α + 1 . • u has exactly α predecessors: u = α def = ( u ≥ α) ∧ ¬( u ≥ α + 1).
reach (u, u) def = u = 0 ∧ alloc(u) ∧ ¬alloc(u) ∧ ∀ u alloc(u) ∧ u = 0 ⇒ u = u ∧ ∀ u ( u 0 ∧ u u) ⇒ ( u = 1 ∧ alloc(u)) .
• There is a (possibly empty) path from u to u:

reach(u, u) def = u = u ∨ * reach (u, u) .

One can show that

h | = f reach(u, u) iff there is i ∈ N such that h i (f(u)) = f(u).
The proof for this property can be found in [BDL12, Lemma 2.4] (a similar property has been established for graph logics in [START_REF] Dawar | Expressiveness and complexity of graph logic[END_REF]).

• There is a (possibly empty) path from u to u and nothing else, can be defined as follows:

sreach(u, u) def = reach(u, u) ∧ ¬(¬emp * reach(u, u))
sreach(u, u) can be understood as the 'strict' reachability predicate and it is usually written as the segment predicate ls(u, u).

• There is at most a single connected component (and nothing else):

1comp def = ¬emp ∧ ∃ u ∀ u alloc(u) ⇒ reach(u, u).
• There are exactly two components:

2comps def = 1comp * 1comp.
It is also worth noting that the separation logic 1SL is not necessarily minimal, see obvious reasons below. A similar reasoning applies to any separation logic kSL. For instance, in 1SL, the atomic formula emp is logically equivalent to the following formula using only two quantified variables:

∀ u ¬(∃ u (u → u )).
Alternatively, it is equivalent to the following, which uses only one variable:

∀ u ¬((u → u) - * ⊥).

A CORE VERSION OF SEPARATION LOGIC

Note that (u → u) - * ⊥ is the way to express alloc(u) in 1SL1 (as shown at the top of this section).

More interestingly, the atomic formula of the form e = e for some expressions e, e is logically equivalent to the following formula by using a new quantified variable u that does not occur in e = e :

∀ u ((u → e) - * (u → e )).
The formula simply states that adding to the heap a memory cell pointing to the location interpreted by e amounts to adding a memory cell pointing to the location interpreted by e .

Below, we define (standard) formulae and explain which properties they express.

• For all ∼∈ {≤, ≥, =} and i, α ≥ 0, we define the following formulae:

u 0 ∼ α def = u ∼ α u i+1 ∼ α def = ∃ u u → u ∧ u i ∼ α u -i-1 ∼ α def = ∃ u (u → u) ∧ u -i ∼ α
For instance, u 6 ≥ 2 states that there is a (necessarily unique) location at distance 6 from u and its number of predecessors is greater than or equal to 2. This is illustrated below.

u Moreover, the formula u -5 ≤ 2 states that there is a (not necessarily unique) location at distance -5 from u and its number of predecessors is not strictly greater than 2. For instance, u 1 ≥ 1 is logically equivalent to alloc(u).

Remark. The heap is a finite tree with at least two nodes can be expressed by the formula below:

¬emp ∧ ∃ u ¬alloc(u) ∧ (∀ u alloc(u) ⇒ reach(u, u))
Complexity results about two-variable fragments of first-order logic over finite trees can be found in [BBC + 13] but we cannot really take advantage of them since we do not use predicate symbols apart from equality and the points-to relation. By contrast, we do admit separating connectives.

Deduction rules in a Floyd-Hoare proof system

In this section, we introduce deduction rules for some Hoare-like proof system in view of the new commands for mutable shared data structures and in view of the assertion language obtained by adding features from separation logic (presence of * and - * ).

The mutation command

Classes of formulae

Below, we provide a classification of formulae provided in [Rey02, Section 3], see also [START_REF] Ishtiaq | BI as an assertion language for mutable data structures[END_REF].

Definition 1.2.2. A sentence ϕ is pure if the true value of ϕ does not depend on the heap, i.e. for all stores s, and for all heaps h, h , we have (s, h)

| = ϕ iff (s, h ) | = ϕ. ∇
For instance, any Boolean combination built over equalities of the form x = y is a pure formula. When ϕ 1 and ϕ 2 are pure, the formulae below can be proved valid:

1. (ϕ 1 ∧ ϕ 2 ) ⇔ (ϕ 1 * ϕ 2 ). 2. (ϕ 1 ⇒ ϕ 2 ) ⇔ (ϕ 1 - * ϕ 2 ).
Definition 1.2.3. A sentence ϕ is intuitionistic if for all stores s, and for all heaps h, h , (h is a conservative extension of h and (s,

h) | = ϕ) imply (s, h ) | = ϕ. ∇
As a rule of thumb, intuitionistic semantics for separation logics is present whenever (s, h) | = ϕ and h h imply (s, h ) | = ϕ for a given class of formulae ϕ.

In particular, any pure formula is intuitionistic. A typical example of intuitionistic formula is x → y. Similarly, assuming that ϕ and ψ are intuitionistic formulae, the formulae below are intuitionistic too:

ϕ ∧ ψ ϕ ∨ ψ ϕ * ψ ϕ - * ψ
Moreover, whenever ϕ is intuitionistic, the formulae below are valid:

• (ϕ * ) ⇒ ϕ.
• (ϕ ⇒ ( - * ϕ).

Strictly exact formulae have been introduced in [Yan01].

Definition 1.2.4. A sentence ϕ is strictly exact if for all stores s, and for all heaps h, h , ((s, h) | = ϕ and (s, h

) | = ϕ) implies h = h . ∇
Any formula built over atomic formulae of the form x → y and * are strictly exact (see also Lemma 5.2.3). Strictly exact formulae are helpful to establish the validity of the formula below when ϕ is strictly exact:

((ϕ * ) ∧ ψ) ⇒ (ϕ * (ϕ - * ψ)).
Strictly exact formulae are clearly domain-exact in the following sense. A sentence ϕ is domain-exact if for all stores s, and for all heaps h, h , ((s, h) | = ϕ and (s, h ) | = ϕ) implies dom(h) = dom(h ).

Decision problems

Let L be a fragment of the separation logic kSL, k ≥ 1. Below, we introduce the satisfiability/validity/model-checking/frame inference/abduction problems. Some of the problems have been already mentioned earlier but we prefer to present all of them below, even if repetitions are witnessed.

The satisfiability problem for L is defined as follows:

Input: A sentence ϕ in L.
Question: Is there a memory state (s, h) such that (s, h) | = ϕ?

Similarly, the validity problem for L is defined as follows:

Input: A sentence ϕ in L.
Question: Is it the case that for all memory states (s, h), we have (s, h) | = ϕ?

A variant of the validity problem is the entailment problem for L that is defined as follows:

Input: Two sentences ϕ and ψ in L.

Question: Is it the case that ϕ | = ψ? (ϕ | = ψ is a shortcut for: for all memory states (s, h), (s, h)

| = ϕ implies (s, h) | = ψ)
Obviously the validity problem is more general than the entailment problem and such a subproblem makes particularly sense when L is not closed under negation, see e.g. the rule strenghtening preconditions in Section 1.1.1. Decidability of the entailement problem implies the decidability of the proof checking in Hoare-style proof systems in which separation logic is used as an assertion language. For example, strenghtening of preconditions or weakening of postconditions can be reduced to instances of the entailment problem. Usually, instances of the other deduction rules and the small axioms can be decided by a simple syntactic analysis. For instance, in tools such as Smallfoot, the proof is reconstructed from partial annotations (e.g., loop invariants) and a calculus of strongest postconditions is used to build verification conditions that are precisely instances of the entailment problem. The model-checking problem for L is defined as follows:

Input: A finite memory state (s, h) and a sentence ϕ in L. As mentioned earlier, the separating implication quantifies over an infinite set of disjoint heaps and therefore finiteness of (s, h) does not imply straightforwardly that the model-checking problem for some kSL0 is decidable. However, the infinite set of disjoint heaps can be sometimes abstracted finitely (see Section 5.3).

Herein, even though we mainly focus on the satisfiability problem, and sometimes on its dual version, the validity problem (or on some of its fragments such as the entailment problem), we present below the frame inference problem and the abduction problem that are quite specific to separation logics. The frame inference problem for L is defined as follows:

Input: Two sentences ϕ and ψ in L.

Question: Is there a sentence χ in L such that ϕ | = ψ * χ?

The abduction problem for L is defined as follows:

Input: Two sentences ϕ and ψ in L.

Question:

Is there a sentence χ in L such that ϕ * χ | = ψ?
The abduction problem is also called the anti-frame problem. Complexity of the abduction problem for symbolic heaps fragment of 1SL0 can be found in [START_REF] Gorogiannis | The complexity of abduction for separated heap abstractions[END_REF].

Relationships with Other Logics

Logic of bunched implications and its Boolean variant

The logic of bunched implications BI has been introduced in [OP99, Pym02] and it combines connectives from intuitionistic logic with connectives from the multiplicative fragment of linear logic [START_REF] Girard | Linear logic[END_REF]. The logic of bunched implications BI interprets formulae as resources that can be shared or separated. As mentioned previously, the works [IO01, OYR04] by O'Hearn, Reynolds and Ishtiaq have used separation to reason about programs with mutable data structures. More precisely, the assertion language of separation logic is a specialisation of the logic of bunched implications BI when the additive connectives (∧, ¬, ⇒, , ⊥) are classical and the multiplicative connectives ( * , - * ) admit an intuitionistic interpretation, leading to so-called Boolean BI, see e.g. [START_REF] Ishtiaq | BI as an assertion language for mutable data structures[END_REF][START_REF] Galmiche | Expressivity properties of boolean BI through relational models[END_REF]. By contrast, BI admits an intuitionistic interpretation of the additive connectives.

Below, we recall the Kripke-style semantics for Boolean BI from [START_REF] Galmiche | Expressivity properties of boolean BI through relational models[END_REF] providing an alternative to Boolean BI-algebras considered in [START_REF] Pym | The Semantics and Proof Theory of the Logic of Bunched Implications[END_REF]. A Kripkestyle semantics for BI can be found in [START_REF] Galmiche | Resource tableaux (extended abstract)[END_REF] too. Of course, the logic of bunched implications and Boolean BI admit proof-theoretical definitions and remarkable metatheoretical properties, see e.g. [START_REF] Pym | The Semantics and Proof Theory of the Logic of Bunched Implications[END_REF], but below we focus on the semantics in order to better illustrate how separation logic can be understood as a specialisation of Boolean BI. By way of example, Boolean BI admits several proof systems, such as labelled sequent calculi [START_REF] Hou | A labelled sequent calculus for BBI: proof theory and proof search[END_REF], nested sequent calculi [START_REF] Park | A theorem prover for Boolean BI[END_REF], Belnap-style display calculi [START_REF] Brotherston | Bunched logics displayed[END_REF] or Hilbert-style proof system for a hybrid extension of Boolean BI [START_REF] Brotherston | Parametric completeness for separation theories[END_REF]. A major difference between propositional separation logic 1SL0 and propositional Boolean BI is certainly that Boolean BI admits an undecidability validity/satisfiability problem [START_REF] Larchey-Wendling | Nondeterministic phase semantics and the undecidability of boolean BI[END_REF][START_REF] Brotherston | Undecidability of propositional separation logic and its neighbours[END_REF] whereas the satisfiability problem for 1SL0 is PSPACE-complete (see Chapter 5). Hence, the specialisation of Boolean BI to memory states, and therefore the introduction of that concrete semantics, has a significant advantage computationally.

A BBI-frame is a triple

(M, •, E) such that • M is a non-empty set, • • is binary function • : M × M → P(M) such that • is commutative and associative,
• E ⊆ M is the set of neutral elements, i.e. for all m ∈ M, {e • m : e ∈ E} = {m}.

A BBI-model [BV14] is a structure (M, •, E, V) such that (M,
•, E) is a BBI-frame and V is a map V : PROP → P(M) where PROP = {p 1 , p 2 , . . .} is a countably infinite set of atomic propositions. Let (HS k , , U k ) be the triple such that HS k is the set of memory states with k ≥ 1 record fields and U k is the set of memory states of the form (s, ∅) where ∅ is the unique heap with empty domain. Note that (HS k , , U k ) is a BBI-frame where the non-deterministic monoid (M, •, e) is made of memory states such that the heaps have k record fields and the binary function is the set-theoretical version of disjoint union.

The set of formulae for Boolean BI is defined with the following grammar.

ϕ, ψ ::= emp | p | ϕ ∧ ψ | ¬ϕ | ϕ * ψ | ϕ - * ψ.
Let m ∈ M and V : PROP → P(M) be a valuation, the satisfaction relation | = is defined as follows (we omit the obvious standard clauses for Boolean connectives):

1.3. RELATIONSHIPS WITH OTHER LOGICS m | = V emp iff m ∈ E m | = V p iff m ∈ V(p) m | = V ϕ 1 * ϕ 2 iff for some m 1 , m 2 ∈ M, we have m ∈ m 1 • m 2 , m 1 | = V ϕ 1 and m 2 | = V ϕ 2 m | = V ϕ 1 - * ϕ 2 iff for all m , m ∈ M such that m ∈ m • m , if m | = V ϕ 1 then m | = V ϕ 2 .
We keep the constant 'emp for Boolean BI but elements of the set E should be understood as units.

A formula ϕ is valid iff for all BBI-models (M, •, E, V) and for all m ∈ M, we have m | = V ϕ. Satisfiability can be formulated as usually, see e.g. [START_REF] Blackburn | Modal Logic[END_REF].

The satisfiability problem for kSL0 can be reformulated as the satisfiability problem in the BBI-frame (HS k , , U k ) in which atomic propositions are of the form x i → x j or x i = x j and the valuations V are constrained in such a way that

(s, h) ∈ V(x i → x j ) iff h(s(x i )) = s(x j ). Similarly, we require that (s, h) ∈ V(x i = x j ) iff s(x i ) = s(x j ).
Provability in Boolean BI is obtained by adding the rule "from ϕ ¬¬ψ conclude ϕ ψ" to the natural deduction calculus of BI [START_REF] Pym | The Semantics and Proof Theory of the Logic of Bunched Implications[END_REF]. That is why, Boolean BI is often abbreviated as BI + {¬¬ψ ⇒ ψ}. It is also possible to design an Hilbert-tyle proof system for Boolean BI, as done in [START_REF] Galmiche | Expressivity properties of boolean BI through relational models[END_REF], so that the notion of theorem for Boolean BI is clearly defined, but omitted herein.

Theorem 1.3.1. [START_REF] Galmiche | Expressivity properties of boolean BI through relational models[END_REF] Theorems of Boolean BI are exactly the formulae valid in the class of BBI-models.

In order to be precise, the BBI-models introduced in [START_REF] Galmiche | Expressivity properties of boolean BI through relational models[END_REF] assumes that E is a singleton set (single-unit condition) and it is shown in [START_REF] Brotherston | Parametric completeness for separation theories[END_REF] that the class of single-unit BBI-models is not definable in Boolean BI. By contrast, it has been shown recently that validity in Boolean BI is not sensitive to the single unit condition [START_REF] Larchey-Wendling | Looking at separation algebras with boolean BI-eyes[END_REF]. Furthermore, we invite the reader to consult [START_REF] Brotherston | Parametric completeness for separation theories[END_REF][START_REF] Larchey-Wendling | Looking at separation algebras with boolean BI-eyes[END_REF] for additional comparisons between variants of BBI-models and separation models. By analogy, the modal logic K is complete for the class of irreflexive frames but irreflexivity is not a property that is modally definable, see e.g. [START_REF] Blackburn | Modal Logic[END_REF].

First-order logic with second-order features

In this section, let us focus on 1SL without program variables. Models for 1SL can be viewed as first-order structures of the form (N, R) where R is a finite and deterministic binary relation. We have seen in Section 1.2.2 that there is a formula reach(u, u) in 1SL2( * ) such that h | = f reach(u, u) iff f(u)R f(u), where R is the reflexive and transitive closure of R with

R def = {(l, l ) : l ∈ dom(h), h(l) = l }.
Anyway, 1SL without the separating connectives is clearly a fragment of firstorder logic on structures of the form (N, R) where R is a finite and deterministic binary relation. Adding the separating conjunction provides a little bit of secondorder logic, for instance by encoding the reachability relation. Given a binary relation R, we write DTC(R) to denote the deterministic transitive closure of R defined as the transitive closure of the relation

R det = {(l, l ) ∈ R : there is no l l such that (l, l ) ∈ R}.
So, when (N, R) is an 1SL model, DTC(R) can be defined in 1SL2( * ) itself.

In fragments of classical logic, the presence of the deterministic transitive closure operator can lead to undecidability where the operator on the binary relation R amounts to consider the transitive closure of the deterministic restriction R det . In [START_REF] Grädel | Undecidability results on two-variable logics[END_REF], it is shown that FO2 (i.e. first-order logic restricted to two quantified variables) augmented with the deterministic transitive closure operator has an undecidable finitary satisfiability problem. By contrast, FO2 has the finite model property and the satisfiability problem is NEXPTIME-complete, see e.g. [START_REF] Grädel | On the decision problem for twovariable first-order logic[END_REF]. Recently, FO2 augmented with the deterministic transitive closure of a single binary relation is shown to have a decidable and EXPSPACE-complete satisfiability problem [START_REF] Charatonik | Decidability of Weak Logics with Deterministic Transitive Closure[END_REF]. The works [START_REF] Grädel | Undecidability results on two-variable logics[END_REF] and [START_REF] Charatonik | Decidability of Weak Logics with Deterministic Transitive Closure[END_REF] contain numerous undecidability results related to the deterministic transitive closure operator but this involves more than one binary relation, whereas the models for 1SL have a unique deterministic binary relation. However, several results presented in [START_REF] Charatonik | Decidability of Weak Logics with Deterministic Transitive Closure[END_REF] are quite optimal with respect to the syntactic resources.

Meanwhile, Yorsh et al. [YRS + 06] study a decidable version of first-order logic with reachability; they get decidability by making severe syntactic restrictions on the placement of quantifiers and on the reachability constraints, although the resulting logic is capable of describing useful linked data structures (see also the subsequent works [START_REF] Lahiri | Back to the future: revisiting precise program verification using SMT solvers[END_REF][START_REF] Piskac | Automating separation logic using SMT[END_REF]).

Translation into dyadic second-order logic

Next we define weak second-order logic kWSOL, for k ≥ 1. The sets PVAR and FVAR are defined as for kSL as well as the expressions e.

RELATIONSHIPS WITH OTHER LOGICS

We also consider a family SVAR = (SVAR i ) i≥1 of second-order variables, denoted by P, Q, R, . . . that are interpreted as finite relations over N. Each variable in SVAR i is interpreted as an i-ary relation.

As for kSL, models are memory states with k ≥ 1 record fields. A secondorder assignment f is an interpretation of the second-order variables such that for every P ∈ SVAR i , f(P) is a finite subset of N i .

Atomic formulae take the form where P ∈ SVAR n for some n ≥ 1. We write kMSOL (monadic second-order logic) to denote the restriction of kWSOL to second-order variables in SVAR 1 and kDSOL (dyadic second-order logic) to denote its restriction to SVAR 2 . Like kSL, models for kWSOL are memory states and quantifications are done over all the possible locations. The satisfaction relation | = is defined as follows (f is a hybrid valuation providing interpretation for first-order and second-order variables):

(s, h) | = f ∃ P ϕ iff there is a finite relation R ⊆ N n such that (s, h) | = f[P →R] ϕ where P ∈ SVAR n (s, h) | = f P(e 1 , . . . , e n )
iff ( e 1 , . . . , e n ) ∈ f(P).

The satisfiability problem for kWSOL takes as input a sentence ϕ in kWSOL and asks whether there is a memory state (s, h) such that (s, h) | = ϕ. By Trakhtenbrot's Theorem [START_REF] Trakhtenbrot | Impossibility of an algorithm for the decision problem in finite classes[END_REF][START_REF] Börger | The Classical Decision Problem[END_REF], the satisfiability problem for kDSOL (and therefore for kWSOL) is undecidable since finite satisfiability for first-order logic with a unique binary relation symbol is undecidable. Note that a monadic secondorder variable can be simulated by a binary second-order variable from SVAR 2 , and this can be used to relativise a formula from DSOL in order to check finite satisfiability.

Theorem 1.3.2. [START_REF] Brochenin | On the almighty wand[END_REF] kWSOL and kDSOL have the same expressive power.

It is just necessary to show how to reduce kWSOL to kDSOL since kDSOL is a syntactic fragment of kWSOL. Atomic formulae P(u) with the monadic secondorder variable P are replaced by P new (u, u) where P new is a fresh dyadic secondorder variable. Furthermore, P(u 1 , . . . , u n ) with n > 2 is substituted by

∃ u n i=1 P new i (u, u i )
where P new 1 , . . . , P new n are fresh dyadic second-order variables used only for P. The value k plays no special role here.

It has been recently shown in [START_REF] Demri | Expressive completeness of separation logic with two variables and no separating conjunction[END_REF] that 1SL2(- * ) is as expressive as 1WSOL. The proof hinges on the fact that that every sentence from 1DSOL has an equivalent sentence in 1SL2(- * ), as discussed in Chapter 3. Translation in the other direction concerns us below. Separation logic 1SL can easily be translated into 1DSOL. The presentation given here is by a simple internalisation.

First, some formula definitions useful for the translation.

init(P) def = ∀ u v (P(u, v) ⇔ u → v) heap(P) def = ∀ u v w ((P(u, v) ∧ P(u, w)) ⇒ v = w) (functionality) P = Q R def = ∀ u v ((P(u, v) ⇔ (Q(u, v) ∨ R(u, v))) ∧ ¬(Q(u, v) ∧ R(u, v))).
The formula init initialises a binary relation P to be precisely the heap graph; this is a notational convenience for the top level of the translation. heap requires that a relation P is functional and is used to ensure that subheaps (as interpreted by second-order variables) are in fact heaps. Finally, P = Q R composes two relations representing subheaps (Q and R) into one-or alternatively, it can be seen as decomposing P into two disjoint pieces; it is used in both "directions" in the translation.

Let the top-level translation t(ϕ) def = ∃ P init(P) ∧ t P (ϕ) , where t P is the translation with respect to P as the "current" heap for interpretation. It is homomorphic for Boolean connectives, and otherwise has this definition:

t P (u → v) def = P(u, v) t P (ϕ * ψ) def = ∃ Q Q P = Q Q ∧ t Q (ϕ) ∧ t Q (ψ) t P (ϕ - * ψ) def = ∀ Q ((∃ Q heap(Q ) ∧ Q = Q P) ∧ heap(Q) ∧ t Q (ϕ)) ⇒ (∃ Q heap(Q ) ∧ Q = Q P ∧ t Q (ψ)) .
Theorem 1.3.3. (see e.g. [START_REF] Brochenin | On the almighty wand[END_REF]) There exists a translation t such that for any 1SL sentence ϕ and for any memory state (s, h), we have (s,

h) | = ϕ in 1SL iff (s, h) | = t(ϕ) in 1DSOL.
Note that, then, there must also exist a translation from the smaller fragment 1SL2(- * ) into 1DSOL. This result (along with Theorem 1.3.2 above) will be useful later in showing expressive power results of separation logic.

General inductive predicates Using general inductive predicates provides another means to define second-order properties on heaps and this is a very useful feature to describe the shape of data structures, such as linked lists for instance. Semantics for general inductive predicates using least fixpoint operators can be naturally encoded in second-order logic, see e.g. [START_REF] Qiu | Natural proofs for structure, data, and separation[END_REF]. Until very recently, such predicates are hard-coded but new results on the satisfiability and entailment problems for general inductive predicates have been obtained, see e.g. [IRS13, AGH + 14, BFGN14]. Whereas, it is shown in [START_REF] Brotherston | A decision procedure for satisfiability in separation logic with inductive predicates[END_REF] that the satisfiability problem for many standard fragments of separation logic augmented with general inductive predicates is decidable and complexity is characterised (see also [START_REF] Iosif | The tree width of separation logic with recursive definitions[END_REF] for bounded tree-width structures), other fragments have been shown to admit decidable entailment problem [IRS13, AGH + 14]. These are general results that are very promising for automatic verification of programs, despite the generality of the defined predicates.

Undecidability

A remarkable result about the decidability status of (first-order) separation logic is stated below and is due to [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF] (see also [START_REF] Yang | Local Reasoning for Stateful Programs[END_REF]Section 8.1] for a related undecidability result).

Theorem 1.3.4. [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF] The satisfiability problem for 2SL is undecidable.

The proof is based on the fact that finitary satisfiability for classical predicate logic restricted to a single binary predicate symbol is undecidable [START_REF] Trakhtenbrot | Impossibility of an algorithm for the decision problem in finite classes[END_REF], see also [START_REF] Börger | The Classical Decision Problem[END_REF]. This means that given a first-order sentence ϕ built over the binary predicate symbol R, checking whether there is a finite structure (D, R) (a finite directed graph) such that (D, R) | = ϕ (in the first-order sense) is undecidable. Indeed, any such a structure can be encoded (modulo isomorphism) by some heap h and some distinguished location l 0 such that:

• l 0 dom(h), • D = {l ∈ N : h(l) = (l 0 , l 0 )}, • R = {(l, l ) ∈ D 2 : there is l such that h(l ) = (l, l )}.
Roughly speaking, a pair in R is encoded by a memory cell in h. Let us define the translation T such that ϕ has a finite model

(D, R) iff T(ϕ) is satisfiable in 2SL with T(ϕ) def = ∃ u, nil "non-empty domain" (u → nil, nil) ∧ "nil not in the domain" (¬∃u , u nil → u , u ) ∧tr(ϕ)
where tr(•) is homomorphic for Boolean connectives and it is defined below:

tr(u i = u j ) def = (u i = u j ) ∧ (u i → nil, nil) ∧ (u j → nil, nil) tr(R(u i , u j )) def = (u i → nil, nil) ∧ (u j → nil, nil) ∧ (∃u (u → u i , u j )) tr(∃ u ψ) def = ∃u (u → nil, nil) ∧ tr(ψ) tr(∀ u ψ) def = ∀ u (u → nil, nil) ⇒ tr(ψ).
Observe that nil is understood as a distinguished variable whose interpretation is not in the heap domain. It is also worth noting that T(ϕ) makes no use of program variables, separating conjunction, or separating implication. In a sense, the undecidability of 2SL, as explained above, is not very much related to separating connectives, but rather to the fact that heaps with two record fields can encode finite binary relations.

Theorem 1.3.5. [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF] The set of valid formulae for 2SL is not recursively enumerable.

As a consequence, 2SL is not finitely axiomatisable. Indeed, ϕ is finitely valid iff ∀u, nil ((u → nil, nil) ∧ (¬∃u , u nil → u , u )) ⇒ tr(ϕ) is 2SL valid. Since this is a logarithmic-space reduction and since the set of finitely valid formulae is not recursively enumerable, this leads to Theorem 1.3.5. It seems that this fact is not so well-known (this is of course mentioned in [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF], and in a few other places such as in [Web04, Section 5] or in [Qiu13, Chapter 2]) but it has unpleasant consequences for defining proof systems for separation logics with concrete heaps (see e.g., [START_REF] Galmiche | Tableaux and resource graphs for separation logic[END_REF][START_REF] Lee | A proof system for separation logic with magic wand[END_REF][START_REF] Hou | Proof search for propositional abstract separation logics via labelled sequents[END_REF][START_REF] Hou | Automated theorem proving for assertions in separation logic with all connectives[END_REF]). Note also that the result applies to any kSL since 2SL can be viewed then as a syntactic fragment of kSL as soon as k ≥ 2.

In Chapter 3, we are able to show a similar result with 1SL by using directly first-order theory of natural numbers with addition and multiplication.

Modal logics with updates

The separating connectives * and - * force the interpretation of subformulae in alternative heaps, which is reminiscent to the destructive aspect of van Benthem's sabotage modal logic [vB05]. Indeed, sabotage modal logic (SML) defined in [vB05] Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI '15 has the ability to remove states in a transition system. A variant of SML is introduced in [START_REF] Ch | Model checking and satisfiability for sabotage modal logic[END_REF] with the possibility to withdraw transitions, a feature also shared with logics from [START_REF] Pucella | Reasoning about dynamic policies[END_REF][START_REF] Demri | A reduction from DLP to PDL[END_REF][START_REF] Göller | On the complexity of reasoning about dynamic policies[END_REF], see also logics of public announcements [START_REF] Lutz | Complexity and succinctness of public announcement logic[END_REF]. The satisfiability problem for that variant is shown undecidable in [START_REF] Ch | Model checking and satisfiability for sabotage modal logic[END_REF] (another variant is shown undecidable in [START_REF] Ph | Moving in a crumbling network: The balanced case[END_REF] in which deletion of the transitions is done locally to the current state). Other modal logics updating the model while evaluating formulae have been considered in a systematic way in [START_REF] Aucher | Global and local graph modifiers[END_REF] and specific instances can be found in [START_REF] Mera | Modal Memory Logics[END_REF][START_REF] Areces | Swap logic[END_REF].

Exercises

Exercise 1.1. Heaps can be understood as canonical elements of equivalence classes. Given a bijection σ : N → N, we write h = h • σ to denote the heap whose graph is {(σ(l), σ(h(l))) : l ∈ dom(h)}. Similarly, we write f = f • σ to denote the assignment such that f

(u i ) = σ(f(u i )).
a) Show that for all formulae ϕ in 1SL without program variables, we have

h | = f ϕ iff h | = f ϕ.
b) Extend the property when memory states are involved (i.e. with stores).

Exercise 1.2. Show that * is commutative, associative and emp is a neutral element, i.e. show that the formulae below are valid.

a) ϕ 1 * ϕ 2 ⇔ ϕ 2 * ϕ 1 . b) (ϕ 1 * ϕ 2 ) * ϕ 3 ⇔ ϕ 1 * (ϕ 2 * ϕ 3 ). c) ϕ * emp ⇔ ϕ.
Exercise 1.3. Distributivity laws are best illustrated by showing that the formulae below are valid.

a) (ϕ 1 ∨ ϕ 2 ) * ψ ⇔ (ϕ 1 * ψ) ∨ (ϕ 2 * ψ). b) (ϕ 1 ∧ ϕ 2 ) * ψ ⇒ (ϕ 1 * ψ) ∧ (ϕ 2 * ψ). c) (∃ u ϕ) * ψ ⇔ ∃ u (ϕ * ψ), assuming that u is not free in ψ. d) (∀ u ϕ) * ψ ⇒ ∀ u (ϕ * ψ)
, assuming that u is not free in ψ.

Exercise 1.4. Show that if ϕ 1 ⇒ ϕ 2 and ϕ 1 ⇒ ϕ 2 are valid, then (ϕ 1 * ϕ 1 ) ⇒ (ϕ 2 * ϕ 2 ) is valid too.

Exercise 1.5. Let k ≥ 1 and, ϕ, ψ and χ be formulae in kSL0. Show that (ϕ * ψ) ⇒ χ is valid iff ϕ ⇒ (ψ - * χ) is valid.

Exercises 1.2-1.5 are inspired from properties stated in [Rey02, Section 3].

Exercise 1.6. Show that the local mutation rule from Section 1.2.3 is valid.

Exercise 1.7. Let ϕ be a formula in 1SL0 built without → and emp. Show that ϕ is a pure formula.

Exercise 1.8. Let ϕ 1 and ψ 2 be pure formulae. Show that the formulae below are valid:

a) (ϕ 1 ∧ ϕ 2 ) ⇔ (ϕ 1 * ϕ 2 ). b) (ϕ 1 ⇒ ϕ 2 ) ⇔ (ϕ 1 - * ϕ 2 ).
Exercise 1.9. Assuming that ϕ is intuitionistic, show that (ϕ * ) ⇒ ϕ and (ϕ ⇒ ( - * ϕ) are valid formulae.

Exercise 1.10. Let e, e be two expressions in 1SL and u be a variable that does not occur in e = e . Show that for all memory states (s, h) and for all assignments f, we have e = e iff (s, h) under the assignment f satisfies ∀ u ((u → e) - * (u → e )).

Exercise 1.11. Show that the validity of ϕ ⇒ (ψ - * χ) and ϕ ⇒ ψ implies the validity of ϕ * ϕ ⇒ χ.

Exercise 1.12. The version of kSL0 defined in this chapter admits an intuitionistic interpretation of the points-to atomic formulae, since whenever (s, h) | = f e → e and h is a conservative extension of h (written h h ), we still have (s, h (no negation, no atomic formula emp). In order to define the intuitionistic version of kSL0, we keep the clauses for the satisfaction relation from classical kSL0 except that we provide an intuitionistic interpretation for the connective ⇒:

) | = f e → e .
(s, h) | = f ϕ ⇒ ψ iff for all h h , we have if (s, h ) | = f ϕ, then (s, h ) | = f ψ.
Show that the intuitionistic version of kSL0 admits the monotonicity condition: if

(s, h) | = f ϕ and h h , then (s, h ) | = f ϕ.
Exercise 1.13. Let ϕ be a sentence in kSL without any program variable. Show that ϕ is valid iff (emp ∧ ( - * ϕ)) * is satisfiable.

Exercise 1.14. Show that reach(u, u) as defined in the chapter corresponds indeed to the reachability predicate.

Exercise 1.15. Show that the formula below in 1SL2 characterizes the heaps with a unique connected component and with a non-empty domain:

¬emp ∧ ∃ u ∀ u alloc(u) ⇒ reach(u, u).
Chapter 2 In this chapter, we consider decidability and computational complexity issues for propositional fragments of separation logics of the form kSL0 with k ≥ 1. The upper bounds are mainly proved in Chapter 5. Section 2.1 is dedicated to the presentation of the PSPACE-completeness for the satisfiability and model-checking problems for kSL0 based on developments from [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF]. Proofs for PSPACEhardness are provided. Section 2.2 contains a presentation of the fragments of kSL0 made of symbolic heaps and for which the entailment problem and the satisfiability problem can be solved in polynomial time [CHO + 11]. It is very essential that the reasoning for this fragment is tractable since it is used in early tools dealing with separation logic such as Smallfoot [START_REF] Berdine | Smallfoot: Modular automatic assertion checking with separation logic[END_REF]. Abstract separation logics are presented in Section 2.3; in such versions of separation logics atomic propositions are introduced and can be true in any part of the model (contrary to points-to formulae), see also Section 1.3.1. Moreover, models are more abstract and correspond to cancellative partial commutative monoids. We show that the satisfiability problem for a few abstract separation logics is undecidable based on developments from [START_REF] Larchey-Wendling | Nondeterministic phase semantics and the undecidability of boolean BI[END_REF][START_REF] Brotherston | Undecidability of propositional separation logic and its neighbours[END_REF][START_REF] Demri | Separation logics and modalities: A survey[END_REF]. A reduction from the halting problem for Minsky machines is designed.

PROPOSITIONAL SEPARATION LOGICS

Highlights of the chapter

1. PSPACE-hardness proof for several fragments of 1SL0 by reduction from QBF as done in [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF] (straightforward extensions to kSL0 with k > 1).

2. Presentation of the symbolic heaps fragment (and variants) that is used in the tool Smallfoot (Section 2.2) as well as recent complexity results.

3. Undecidability proof for propositional separation logic based on memory states (Theorem 2.3.1) inspired from the original proof in [START_REF] Brotherston | Undecidability of propositional separation logic and its neighbours[END_REF][START_REF] Larchey-Wendling | The undecidability of Boolean BI through phase semantics[END_REF] but adapted to avoid any proof-theoretical consideration [START_REF] Demri | Two-variable separation logic and its inner circle[END_REF].

PSPACE-Completeness and Expressive Power

PSPACE-hard fragments of kSL0

Most probably, NP-completeness already implies non-tractability but actually, propositional separation logic of the form kSL0 with k ≥ 1 can be potentially of even worse complexity, see e.g. [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF][START_REF] Reynolds | Separation logic: a logic for shared mutable data structures[END_REF].

Theorem 2.1.1. [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF] For every k ≥ 1, the satisfiability problem for (propositional) kSL0 is PSPACE-complete.

The proof for the PSPACE upper bound is provided in Section 5.3 in which other results about the expressive power of kSL0 are discussed. Meanwhile, below, we show that 1SL0 is PSPACE-hard by reduction from QBF, following developments from [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF]. QBF formulae are built from propositional formulae with the addition of propositional quantifications of the form ∀ p ψ and ∃ p ψ. Below, without any loss of generality, we consider QBF formulae in prenex normal form. We consider several fragments of 1SL0 in order to pinpoint different causes for PSPACE-hardness.

Let Q 1 p 1 • • • Q n p n
ϕ be a QBF formula with {Q 1 , . . . , Q n } ⊆ {∃, ∀} and ϕ is a propositional formula built over the atomic propositions in {p 1 , . . . , p n } and the Boolean connectives ∧, ∨ and ¬ (only in front of atomic propositions). The formula is said to be in prenex normal form and every QBF formula can be reduced in logarithmic space to an equivalent formula in such a form. We recall that given a propositional valuation v : PROP → {⊥, },

we have v | = ∃ p ϕ iff there is b ∈ {⊥, } such that v[p → b] | = ϕ. Similarly, v | = ∀ p ϕ iff for all b ∈ {⊥, }, we have v[p → b] | = ϕ.
Satisfiability problem for QBF formulae is known to be PSPACE-complete [START_REF] Stockmeyer | The polynomial-time hierarchy[END_REF].

In the translation of the formula

Q 1 p 1 • • • Q n p n ϕ,
we consider n program variables, say x 1 , . . . , x n so that the truth of p i is encoded by the satisfaction of alloc(x i ) (that can be defined by (x i → x i ) - * ⊥). Similarly, we write x i →as an abbreviation for alloc(x i ) ∧ ¬(¬emp * ¬emp). Obviously, x i →holds true when x i is the unique location belonging to the heap domain.

In order to encode independence between the different variables, we enforce that all the program variables have distinct values in the original heap. Moreover, existential quantification over p i amounts to restrict the current heap either by the empty heap (in that case alloc(x i ) holds in the other heap) or by a unique memory cell so that alloc(x i ) holds, which allows to simulate quantification. However, it is necessary to enforce in the initial heap that alloc(x i ) holds for any program variable x i , i ∈ [1, n]. Let us define the map tr as follows when tr is homomorphic for Boolean connectives:

tr(p i ) def = alloc(x i ) tr(∃ p i ψ) def = (emp ∨ x i → -) * tr(ψ) tr(∀ p i ψ) def = ¬((emp ∨ x i → -) * ¬tr(ψ)). Lemma 2.1.2. The formula Q 1 p 1 • • • Q n p n ϕ is QBF satisfiable iff χ def = ( i j x i x j ) ∧ ( i alloc(x i )) ∧ tr(Q 1 p 1 • • • Q n p n ϕ) is 1SL0 satisfiable.
Proof. Let us start by introducing auxiliary definitions. For every j ∈ [1, n + 1], we write ϕ j to denote the formula

Q j p j • • • Q n p n ϕ. So, by definition, we have ϕ 1 = Q 1 p 1 • • • Q n p n ϕ
and by convention ϕ n+1 = ϕ. Note also that the atomic propositions in ϕ j that are not in the scope of a propositional quantification belongs to the (possibly empty) set

{p i : i ∈ [1, j -1]}.
Given a memory state (s, h) and a propositional valuation v, we write (s, h) ≈ j v to denote the fact that:

• For all i i ∈ [1, n], we have s(x i ) s(x i ) (this only depends on s).

• For all i ∈ [j, n], we have s(x i ) ∈ dom(h) (this only depends on the memory state).

• For all i ∈ [1, j -1], we have s(

x i ) ∈ dom(h) iff v(p i ) = .
It is easy to establish that (s, h)

≈ j v for some v is equivalent to (s, h) | = ( i i x i x i ) ∧ ( i∈[j,n] alloc(x i )).
By induction on j, we show that for all j ∈ [1,

n + 1], if (s, h) ≈ j v, then (s, h) | = tr(ϕ j ) iff v | = ϕ j .
The base case in the induction corresponds to j = n + 1 and therefore the induction step goes backwards.

Before providing the proof by induction, let us check that this is sufficient to establish the statement in the lemma.

If (s, h) ≈ 1 v, then (s, h) satisfies ( i j x i x j ) ∧ ( i alloc(x i )). Suppose that v | = Q 1 p 1 • • • Q n p n ϕ.
Let us consider the memory state (s, h) such that: for all i ∈ [1, n], we have s(x i ) = i and h(i) = i. Obviously, (s, h) ≈ 1 v and therefore by the property above, we get (s, h) | = tr(ϕ 1 ), that is (s, h) | = tr(ϕ). Consequently, (s, h) | = χ. Now suppose that (s, h) | = χ. Let us take any propositional valuation v. We have (s, h) ≈ 1 v and therefore by the property above, we get v | = ϕ 1 , that is v | = ϕ. Now let us consider the proof of the above property. Base case: j = n + 1. So, ϕ j = ϕ n+1 = ϕ. The proof is by structural induction but the cases in the induction step with ¬ (in front of atomic propositions), ∨ and ∧ are by an easy verification. We assume that (s, h) ≈ n+1 v and let us consider p i with i < n + 1.

If v | = p i , then v(p i ) = and since (s, h) ≈ n+1 v, we get s(x i ) ∈ dom(h) and (s, h) | = alloc(x i ) (= tr(p i )). Conversely, if (s, h) | = tr(p i ), then s(x i ) ∈ dom(h) and since (s, h) ≈ n+1 v we get v(p i ) = , whence v | = p i .
For the induction step with j < n + 1, below we deal with the case ϕ j = ∃ p j ϕ j+1 . The case ϕ j = ∀ p j ϕ j+1 is omitted since it is very similar. We assume that (s, h) ≈ j v.

First suppose that v | = ∃ p j ϕ j+1 . This means that there is

b ∈ { , ⊥} such that v[p j → b] | = ϕ j+1 . Case 1: b =⊥.
Let h , h be such that h = h h and dom(h ) = {s(x j )}. We know that such a separation of h is possible since (s, h) ≈ j v (in particular s(x j ) ∈ dom(h)). We get that (s, h ) ≈ j+1 v[p j →⊥] and therefore by the induction hypothesis, we have (s, h ) | = tr(ϕ j+1 ). So, (s, h) | = (x j → -) * tr(ϕ j+1 ) and a fortiori, (s, h) | = (emp ∨ (x j → -)) * tr(ϕ j+1 ) (= tr(ϕ j )).

Case 2: b = .

We get that (s, h) ≈ j+1 v[p j → ] and therefore by induction hypothesis, (s,

h) | = tr(ϕ j+1 ). So, (s, h) | = emp * tr(ϕ j+1 ) and a fortiori, (s, h) | = (emp ∨ (x j → -)) * tr(ϕ j+1 ). Now suppose that (s, h) | = (emp ∨ (x j → -)) * tr(ϕ j+1 ). Case 1: (s, h) | = emp * tr(ϕ j+1 ). So, (s, h) | = tr(ϕ j+1 ) and since (s, h) ≈ j+1 v[p j → ], by the induction hypothesis, we get v[p j → ] | = ϕ j+1 , whence v | = ∃ p j ϕ j+1 . Case 2: (s, h) | = (x j → -) * tr(ϕ j+1 ).
So, there are heaps h and h such that (s, h

) | = x j → -and (s, h ) | = tr(ϕ j+1 ). Since by construction, (s, h ) ≈ j+1 v[p j →⊥], by the induction hypothesis, we get v[p j →⊥] | = ϕ j+1 and therefore v | = ∃ p j ϕ j+1 .
QED

The above reduction implies that the satisfiability problem for the logic kSL0( * ) is PSPACE-hard too, assuming that the atomic formulae are of the form emp, alloc(x) and x = y.

Corollary 2.1.3. [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF] For every k ≥ 1, the satisfiability and model-checking problems for kSL0 is PSPACE-hard.

Proof. PSPACE-hardness of the satisfiability problem is a direct consequence of Lemma 2.1.2 since QBF is PSPACE-complete. Note that Lemma 2.1.2 is stated for k = 1 but it is easy to adapt it to any fixed k > 1 since the heap domain can be constrained only by atomic formulae of the form alloc(x). Now, it is easy to design a logarithmic-space reduction from QBF into the model-checking for 1SL0. Let

Q 1 p 1 • • • Q n p n ϕ be a QBF formula. We define the memory state (s, h) such that for all i ∈ [1, n], we have s(x i ) = i and h(i) = i. Obviously, (s, h) | = ( i j x i x j ) ∧ ( i alloc(x i ))
. Let v ⊥ be the propositional valuation that returns always the constant value ⊥. According to previous developments, we have (s, h)

| = tr(Q 1 p 1 • • • Q n p n ϕ) iff v ⊥ | = Q 1 p 1 • • • Q n p n ϕ.
The proof for k > 1 is similar since h(i) defined above can be adapted to be a k-tuple made of k times the value i. QED

A substantial fragment of 1SL0 that admits NP-complete satisfiability and model-checking problems is presented in Exercise 2.4. Other fragments have been considered in [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF] by restricting further the use of Boolean or separating connectives. Below we show that decision problems for kSL0(- * ) are PSPACEhard too, assuming that the atomic formulae are of the form alloc(x) and x = y (see a precise formulation of the fragment in Lemma 2.1.6).

Let

Q 1 p 1 • • • Q n p n ϕ be a QBF formula with {Q 1 , . . . , Q n } ⊆ {∃, ∀}
and ϕ is a propositional formula built over the atomic propositions in {p 1 , . . . , p n } and the Boolean connectives ∧, ∨ and ¬ (only in front of atomic propositions). This time, the truth of the atomic proposition p i is encoded by the truth of alloc(x i ) whereas the falsehood of p i is encoded by the truth of alloc(x ⊥ i ); x i and x ⊥ i are new program variables associated to p i . Obviously, alloc(x i ) and alloc(x ⊥ i ) may hold simultaneously, even if x i and x ⊥ i are interpreted differently. That is why, we introduce the formulae init i and ok i below. The formula init i holds true when the encoding of the truth value of p i is not yet done, i.e. none of alloc(x ⊥ i ) and alloc(x i ) holds true. Similarly, ok i holds true when the encoding of the truth value of p i is done, i.e. exactly one formula among alloc(x ⊥ i ) and alloc(x i ) holds true. This is generalized to sets of indices as defined below.

init i def = ¬alloc(x i ) ∧ ¬alloc(x ⊥ i ) ok i def = (alloc(x i ) ∧ ¬alloc(x ⊥ i )) ∨ (alloc(x ⊥ i ) ∧ ¬alloc(x i )) init X def = j∈X init j (with X ⊆ [1, n]) ok X def = j∈X ok j (with X ⊆ [1, n]).
The map tr defined below is homomorphic for the Boolean connectives ∧ and ∨ and satisfies the following clauses [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF]:

tr(p i ) def = alloc(x i ) tr(¬p i ) def = alloc(x ⊥ i ) tr(∀ p i ϕ i+1 ) def = (ok i ∧ init [1,n]\{i} ) - * tr(ϕ i+1 ) tr(∃ p i ϕ i+1 ) def = ∼ ((ok [1,i-1] ∧ init [i,n] )∧ ∼ ((ok [1,i] ∧ init [i+1,n] ) ∧ tr(ϕ i+1 ))). with ∼ ψ def = ψ - * ⊥.
Whereas the encoding of the propositional quantification '∀ p i ' is rather natural with the help of the separating implication that performs a universal quantification too, the encoding of '∃ p i ' with a double use of ∼ is not immediate and reflects the beauty of the solution given in [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF].

The translation tr takes advantage of the formulae of the form ∼ ψ. Below, we present properties that will be helpful in the sequel. Their proof are left as Exercise 2.1. First, we define the relation ≈ j (this slightly different from the one in the previous PSPACE-hardness proof). Given a memory state (s, h) and a propositional valuation v, we write (s, h) ≈ j v where the properties below are verified.

• For all x and y in {x i , x ⊥ i : i ∈ [1, n]}, we have s(x) s(y) (this only depends on s).

• For all i ∈ [j, n], we have {s(x ⊥ i ), s(x i )} ∩ dom(h) = ∅ (this only depends on the memory state).

• For all i ∈ [1, j -1], we have (s(x i ) ∈ dom(h) and s(x ⊥ i ) dom(h) and v(p i ) = ) or (s(x ⊥ i ) ∈ dom(h) and s(x i ) dom(h) and v(p i ) =⊥). Consequently, (s, h) ≈ j v for some v implies (s, h) | = ok [1,j-1] ∧ init [j,n] .
Below, we state essential properties about ∼.

Lemma 2.1.4. . Let (s, h) be a memory state and ϕ, ψ be formulae in kSL0.

(I) (s, h) | =∼ (ϕ ∧ ψ) iff for all heaps h disjoint from h, if (s, h ) | = ϕ, then (s, h ) | = ψ. (II) (s, h) | =∼ (ϕ∧ ∼ ψ) iff for all heaps h disjoint from h, if (s, h ) | = ϕ, then there is a heap h disjoint from h such that (s, h ) | = ψ. (III) Suppose that (s, h) ≈ i v for some v. Then, (s, h) | =∼ ((ok [1,i-1] ∧init [i,n] )∧ ∼ ((ok [1,i] ∧ init [i+1,n] ) ∧ ϕ)) iff there is h such that h h , (s, h ) ≈ i+1 v for some v and (s, h ) | = ϕ.
Correctness of the translation is stated below.

Lemma 2.1.5. The formula

Q 1 p 1 • • • Q n p n ϕ is QBF satisfiable iff χ def = ( x y∈{x i ,x ⊥ i :i∈[1,n]} x y ∧ ¬alloc(x)) ∧ tr(Q 1 p 1 • • • Q n p n ϕ) is 1SL0 satisfiable.
Proof. For every j ∈ [1, n+1], we write ϕ j to denote the formula

Q j p j • • • Q n p n ϕ.
By induction on j, we show that for all j

∈ [1, n + 1], if (s, h) ≈ j v, then (s, h) | = tr(ϕ j ) iff v | = ϕ j .
The base case in the induction corresponds to j = n + 1 and therefore the induction step goes backwards.

Before providing the proof by induction, let us check that this is sufficient to establish the statement in the lemma. If (s, h) ≈ 1 v, then (s, h) satisfies (s,h) ≈ 1 v and therefore by the property above, we get (s, h)

( x y∈{x i ,x ⊥ i :i∈[1,n]} x y ∧ ¬alloc(x)). Suppose that v | = Q 1 p 1 • • • Q n p n ϕ. Let us consider the memory state (s, h) such that: for all i ∈ [1, n], we have s(x i ) = 2i, s(x ⊥ i ) = 2i + 1 and dom(h) = ∅. Obviously,
| = tr(ϕ 1 ), that is (s, h) | = tr(ϕ). Consequently, (s, h) | = χ. Now suppose that (s, h) | = χ.
Let us take any propositional valuation v. We have (s, h) ≈ 1 v and therefore by the property above, we get

v | = ϕ 1 , that is v | = ϕ.
Now let us consider the proof of the above property. Base case: j = n + 1. So, ϕ j = ϕ n+1 = ϕ. The proof is by structural induction but the cases in the induction step with ∨ and ∧ are by an easy verification. We assume that (s, h) ≈ n+1 v and let us consider

p i with i < n + 1. If v | = p i , then v(p i ) = and since (s, h) ≈ n+1 v, we get s(x i ) ∈ dom(h) and (s, h) | = alloc(x i ) (= tr(p i )). If v | = ¬p i , then v(p i ) =⊥ and since (s, h) ≈ n+1 v, we get s(x ⊥ i ) ∈ dom(h) and (s, h) | = alloc(x ⊥ i ) (= tr(¬p i )). Conversely, if (s, h) | = tr(p i ), then s(x i ) ∈ dom(h) and since (s, h) ≈ n+1 v we get v(p i ) = , whence v | = p i . Similarly, if (s, h) | = tr(¬p i ), then s(x ⊥ i ) ∈ dom(h) and since (s, h) ≈ n+1 v we get v(p i ) =⊥, whence v | = ¬p i .
For the induction step with j < n + 1, below we deal with the case ϕ j = ∃ p j ϕ j+1 . The case ϕ j = ∀ p j ϕ j+1 is omitted and it is left as Exercise 2.2. We assume that (s, h)

≈ j v. First suppose that v | = ∃ p j ϕ j+1 . This means that there is b ∈ { , ⊥} such that v[p j → b] | = ϕ j+1 . Let h be such that dom(h ) = {s(x b j )} and h (s(x b j )) = 0 (arbi- trary value). Since (s, h) ≈ j v, we obtain (s, h h ) ≈ j+1 v[p j →⊥]
and therefore by the induction hypothesis, we have (s, h h

) | = tr(ϕ j+1 ). By Lemma 2.1.4(III), (s, h) | =∼ ((ok [1,j-1] ∧ init [j,n] )∧ ∼ ((ok [1,j] ∧ init [j+1,n] ) ∧ tr(ϕ j+1 ))) and there- fore (s, h) | = tr(ϕ j ). Now suppose that (s, h) | =∼ ((ok [1,j-1] ∧ init [j,n] )∧ ∼ ((ok [1,j] ∧ init [j+1,n] ) ∧ tr(ϕ j+1 ))
) and therefore (s, h) | = tr(ϕ j ). By Lemma 2.1.4(III), there is h h such that (s, h ) ≈ j+1 v for some v and (s, h ) | = tr(ϕ j+1 ). Note that v and v agree on the atomic propositions p i with i ∈ [1, j -1]. By the induction hypothesis, we have v | = ϕ j+1 and therefore v | = ∃ p j ϕ j+1 . QED Corollary 2.1.6. [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF] For every k ≥ 1, the satisfiability and model-checking problems for kSL0 restricted to formulae obeying the grammar below

ϕ ::= ¬(x = y) | alloc(x) | ¬alloc(x) | ϕ ∨ ϕ | ϕ ∧ ϕ | ϕ - * ϕ (with x, y in PVAR) is PSPACE-hard.
Note that ⊥ can be defined as alloc(x) ∧ ¬alloc(x) for some program variable x. In the above-mentioned fragment, it is remarkable that negation appears only in front of atomic formulae (to be compared with the formulae involved in Lemma 2.1.2) and the separating conjunction is banished. The proof of Corollary 2.1.6 is similar to the proof of Corollary 2.1.3 and it is left as Exercise 2.3

Boolean formulae for propositional separation logics

In this section, we present a characterisation of the expressive power of propositional separation logic 1SL0, and a similar analysis can be done for any kSL0 with k > 1.

Theorem 2.1.7. [Loz04a, Chapter 5] Any formula ϕ in 1SL0 built over the program variables in {x 1 , . . . , x q } is logically equivalent to a Boolean combination of atomic formulae among size ≥ k, alloc(x i ), x i → x j and x i = x j (k ∈ N, i, j ∈ {1, . . . , q}).

The formulae of the form size ≥ k and alloc(x i ) are introduced in Section 1.2.2 and we recall that alloc(x i ) holds when s(x i ) belongs to the heap domain and size ≥ k holds when the cardinal of the heap domain is at least k. By way of example (¬emp * (x 1 → x 2 - * ⊥)) is equivalent to size ≥ 2 ∧ alloc(x 1 ). Furthermore, the cardinal of the heap domain without the interpretation of x 1 and x 2 (in the case it belongs to the domain) is at least k ≥ 0, can be expressed as follows:

(alloc

(x 1 ) ∧ alloc(x 2 ) ∧ size ≥ k + 2)∨ (((alloc(x 1 ) ∧ ¬alloc(x 2 )) ∨ (¬alloc(x 1 ) ∧ alloc(x 2 ))) ∧ size ≥ k + 1)∨ (¬alloc(x 1 ) ∧ ¬alloc(x 2 ) ∧ size ≥ k).
It is clear that such a formula can be generalised to any finite set of program variables. We write size q ≥ k to denote the atomic formula such that (s, h)

| = size q ≥ k iff card(dom(h) \ {s(x i ) : i ∈ [1, q]}) ≥ k.
The formula size ≥ k can be expressed as follows:

(x 1 x 2 ∧ alloc(x 1 ) ∧ alloc(x 2 ) ∧ size 2 ≥ k -2)∨
Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15

(x 1 = x 2 ∧ alloc(x 1 ) ∧ size 2 ≥ k -1)∨ (((alloc(x 1 ) ∧ ¬alloc(x 2 )) ∨ (¬alloc(x 1 ) ∧ alloc(x 2 ))) ∧ size 2 ≥ k -1)∨ (¬alloc(x 1 ) ∧ ¬alloc(x 2 ) ∧ size 2 ≥ k).
Such a formula can be generalised to any q ≥ 1. So using atomic formulae of the form size ≥ k or size q ≥ k does not make a substantial difference in terms of expressive power. Even though Theorem 2.1.7 provides a nice characterisation of the expressive power for 1SL0, several features limit its application. First, Theorem 2.1.7 only deals with the propositional case but we know that this is close to the best we can hope for. Indeed, a similar result is established in [START_REF] Demri | Separation logic with one quantified variable[END_REF] for 1SL1 by enriching the set of atomic formulae and by polishing and extending material from [START_REF] Lozes | Expressivité des Logiques Spatiales[END_REF][START_REF] Brochenin | Reasoning about sequences of memory states[END_REF] but the extension to 1SL2 is not possible (see developments in Chapter 3). Moreover, neither Theorem 2.1.7 states how to compute the equivalent formula nor it provides a precise information about the maximal bound k in atomic formulae size ≥ k that are used to build a Boolean combination equivalent to ϕ in 1SL0 (see Corollary 5.3.12). Actually, one can restrict k to be at most polynomial in the size of ϕ, assuming that formulae are encoded as finite trees (as opposed to a DAG encoding that would imply an exponential blow-up). This entails a small model property in which the cardinal of the heap domain is bounded, see e.g. [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF][START_REF] Calcagno | From separation logic to firstorder logic[END_REF] or Section 5.3. This feature is at the core of the translation into first-order logic (with empty signature) designed in [START_REF] Calcagno | From separation logic to firstorder logic[END_REF] and it regains the PSPACE upper bound for the satisfiability problem for 1SL0 (and for 2SL0 too), see e.g. [CGH05, Section 3.4].

Below, let us be a bit more precise about the way to prove Theorem 2.1.7 and to explain the main steps to show the PSPACE upper bound, which is reminiscent to many proofs showing PSPACE upper bound for modal logics by using Ladnerlike algorithms, see e.g. [START_REF] Ladner | The computational complexity of provability in systems of modal propositional logic[END_REF][START_REF] Spaan | The complexity of propositional tense logics[END_REF][START_REF] Demri | A polynomial space construction of tree-like models for logics with local chains of modal connectives[END_REF]. More details can be found in Section 5.3. Let q ≥ 1 and α ∈ N. We write Test (q, α) to denote the following set of atomic formulae:

{x i = x j , x i → x j , alloc(x i ) : i, j ∈ [1, q]} ∪ {size q ≥ β : β ∈ [0, α]}.
We define an equivalence relation ≈ q α on the class of memory states, so that two models are in the same equivalence class whenever they cannot be distinguished by any formula in Test (q, α):

(s, h) ≈ q α (s , h ) iff for all ψ ∈ Test (q, α), we have (s, h) | = ψ iff (s , h ) | = ψ.
Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI '15 One can show that for any formula ϕ in 1SL0 with q ≥ 1 program variables and with size |ϕ| (for some reasonably succinct encoding), for any

α ≥ |ϕ|, if (s, h) ≈ q α (s , h ), then (s, h) | = ϕ iff (s , h ) | = ϕ.
This result or some of its variants established in [Loz04a, BDL09, DGLWM14] entails that for checking the satisfaction of ϕ in some memory state, what matters is really the satisfaction of atomic formulae in ≈ q |ϕ| . Theorem 2.1.7 is then a direct consequence of this property.

Corollary 2.1.8. [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF][START_REF] Yang | Local Reasoning for Stateful Programs[END_REF] Let ϕ be a satisfiable formula in 1SL0 with q program variables. Then there is memory state

(s, h) such that (s, h) | = ϕ and ran(s) ∪ dom(h) ∪ ran(h) ⊆ [0, q + |ϕ|].
PSPACE upper bound for 1SL0 can be pushed a bit further by allowing a unique quantified variable.

Theorem 2.1.9. [START_REF] Demri | Separation logic with one quantified variable[END_REF] The satisfiability problem for 1SL1 is PSPACEcomplete. PSPACE-hardness is inherited from the PSPACE-hardness of 1SL0 whereas the PSPACE upper bound requires an adequate abstraction. It is open whether 1SL1 extended with reachability predicates can lead to decidable extensions (which would capture some version of separation logic considered in [START_REF] Thakur | Satisfiability modulo abstraction for separation logic with linked lists[END_REF]).

NP and PTIME Fragments

Even though performing reasoning in propositional logic kSL0 (with k ≥ 1) can be computationally expensive, see above the PSPACE-completeness results for validity and satisfiability, fragments have been designed that are useful for automatic program analysis and hopefully less demanding computationally.

The fragment presented below, has been introduced in [BCO04] and shown decidable by providing a complete proof system. More importantly, the tool Smallfoot has been designed from it, see e.g. [START_REF] Berdine | Smallfoot: Modular automatic assertion checking with separation logic[END_REF], and decides the entailment problem for such a fragment, which allows to verify automatically numerous properties. Strangely enough, the precise computational complexity of the entailment problem for such a fragment is not considered in [START_REF] Berdine | A decidable fragment of separation logic[END_REF] and it is only in [CHO + 11, HIOP13] that this problem has been successfully solved.

Let SF ('Smallfoot fragment') be the fragment of 1SL2 defined by the formula ϕ below, where ϕ p defines pure formulae (see also Section 1.2.4 for the 2.2. NP AND PTIME FRAGMENTS introduction of pure formulae semantically) and ϕ s defines spatial formulae:

ϕ p ::=⊥ | | (x i = x j ) | ¬(x i = x j ) | ϕ p ∧ ϕ p ϕ s ::= emp | | x i → x j | sreach(x i , x j ) | ϕ s * ϕ s ϕ ::= ϕ p * ϕ s
where x i , x j are program variables from PVAR. As usually, the formulae are interpreted on memory states with one record field. Obviously,

x i → x j is inter- preted as the exact points-to relation ((s, h) | = x i → x j iff dom(h) = s(x i ) and h(s(x i )) = s(x j )) whereas (s, h) | = sreach(x i , x j
) holds true iff the heap contains exactly a path from s(x i ) to s(x j ). As shown in Section 1.2.2, sreach(x i , x j ) (and reach(x i , x j ) too) can be specified in 1SL2.

We briefly recall that the entailment problem for SF takes as input two SF formulae ϕ and ψ, and asks whether ϕ | = ψ. Note also that the rule for strengthening precedent (SP)

ϕ ⇒ ψ {ψ } C {ψ} {ϕ} C {ψ}
involves entailment checking. This is a building block of the verification process and in particular, proof checking requires that entailment problem is decidable, if not tractable at all. Whereas a coNP algorithm is provided in [START_REF] Berdine | A decidable fragment of separation logic[END_REF], the optimal complexity is established in [CHO + 11] by using an original approach: to represent formulae as graphs and to search for homomorphisms on these special graphs.

Theorem 2.2.1. [CHO + 11, Theorems 16 & 24] (see also [START_REF] Gorogiannis | The complexity of abduction for separated heap abstractions[END_REF]Section 4]) The entailment and satisfiability problems for SF can be solved in polynomial time.

Indeed, it is quite surprising that the entailment problem is computationally tractable. A slight extension may easily lead to intractability. For instance considering the variant clause ϕ ::= ϕ p * (ϕ s ∧ ϕ s ) (i.e., allowing a bit of conjunction) already leads to coNP-hardness [CHO + 11]. The graph-based algorithm presented in [CHO + 11] has been implemented and used for automatic verification, see [START_REF] Haase | SeLoger: A tool for graph-based reasoning in separation logic[END_REF].

Undecidable Propositional Separation Logics

A brief introduction to abstract separation logics

Concrete models for separation logic are memory states or heaps as defined earlier, but alternative models exist, for instance heaps with permissions, see e.g. [START_REF] Bornat | Permission accounting in separation logic[END_REF][START_REF] Brotherston | Undecidability of propositional separation logic and its neighbours[END_REF]. It is also possible to introduce more abstract models with a partial operator for gluing together models that are separate in some sense. We have already seen such abstract models in Section 1.3.1 when BBI-models have been introduced. This is precisely the approach introduced in [COY07] and investigated in great length in subsequent papers, see e.g. [BK10, LWG10, BV14, HCGT14]. After all, such an abstraction should not come as a surprise since separation logic is understood as an assertion language in a Hoare-style framework that interprets Boolean BI in concrete heaps (see Section 1.3.1). Moreover, sometimes, problems can be easily solved on abstract models because more freedom is allowed (see e.g. [START_REF] Brotherston | Parametric completeness for separation theories[END_REF][START_REF] Hou | Proof search for propositional abstract separation logics via labelled sequents[END_REF] or Theorem 1.3.5).

The structure (HS k , , U k ) satisfies the following properties.

(MON ms ) is a partial binary operation :

HS k × HS k → HS k and U k ⊆ HS k ,
(AC ms ) is associative and commutative,

(CAN ms ) is cancellative, i.e. if (s, h) (s , h ) is defined and (s, h) (s , h ) = (s, h) (s , h ), then (s , h ) = (s , h ), (U ms ) for all (s, h) ∈ HS k , we have {(s, h)} = {(s, h) (s , h ) : (s , h ) ∈ U k , (s, h) (s , h ) is defined}.
A separation model defined below satisfies the above properties for the structure (HS k , , U k ) by abstracting the essential features and can be viewed as a Kripke frame for a multi-dimensional modal logic with binary modalities, see e.g. [START_REF] Marx | Multi-Dimensional Modal Logic[END_REF][START_REF] Hou | Proof search for propositional abstract separation logics via labelled sequents[END_REF]. A separation model is a cancellative partial commutative monoid (M, •, U), i.e.

(MON) M is a non-empty set, • is a partial binary operation • : M × M → M and U ⊆ M, (AC) • is associative and commutative, (CAN) • is cancellative, i.e. if m • m is defined and m • m = m • m , then m = m , (U) For all m ∈ M, we have m • U = {m} where m • U def = {m • u : u ∈ U, m • u is defined}.
Obviously (HS k , , U k ) is a separation model but other memory models can be found in the literature, see e.g. [START_REF] Brotherston | Undecidability of propositional separation logic and its neighbours[END_REF] for many more examples. For instance, the RAM-domain model (P fin (N), , {∅}) is a separation model where P fin (N) is the set of finite subsets of N and

X 1 X 2 is defined only if X 1 ∩ X 2 = ∅ and then X 1 X 2 def = X 1 ∪X 2 (disjoint union). This corresponds to the separation model (HS k , , U k ) with k equal to zero.
Given a countably infinite set PROP = {p 1 , p 2 , . . .} of propositional variables, a valuation V is a map V : PROP → P(M). Semantical structures of the separation model (M, •, U) are understood as the separation model itself augmented by a valuation. Hence, the separation logic defined from the separation model (M, •, U) has models that can be understood as Kripke models with underlying ternary relation induced by the operation • and the interpretation of propositional variables done via V. The set of formulae is then defined as follows:

ϕ, ψ ::= emp | p | ϕ ∧ ψ | ¬ϕ | ϕ * ψ | ϕ - * ψ.
Let m ∈ M and V : PROP → P(M) be a valuation, the satisfaction relation | = is defined as follows (we omit the obvious clauses for Boolean connectives).

• m | = V emp iff m ∈ U (we keep the constant emp in the abstract setting but elements of U should be understood as units).

• m | = V p iff m ∈ V(p). • m | = V ϕ 1 * ϕ 2 iff for some m 1 , m 2 ∈ M, we have m = m 1 • m 2 , m 1 | = V ϕ 1 and m 2 | = V ϕ 2 . • m | = V ϕ 1 - * ϕ 2 iff for all m ∈ M such that m • m is defined, if m | = V ϕ 1 then m • m | = V ϕ 2 .
In the above definition for the satisfaction relation, the model (M, •, U) is implicit but we also sometimes use the notation that m | = V ϕ. We write SL(M, •, U) to denote the propositional separation logic defined from the separation model (M, •, U) with propositional variables. When C is a class of separation models, we can also define the propositional separation logic SL(C) by admitting a family of separation models instead of a single model. Satisfiability and validity problems are defined accordingly. For instance, ϕ is satisfiable for SL(C) iff there exist

(M, •, U), m | = V ϕ
(M, •, U) in C, m ∈ M and a valuation V such that (M, •, U), m | = V ϕ.
The satisfiability problem for kSL0 (i.e. kSL without any first-order quantification) can be reformulated as the satisfiability problem in the separation model (HS k , , U k ) in which propositional variables are of the form x i → x j or x i = x j and the valuations V are constrained in such a way that (s, h)

∈ V(x i → x j ) iff h(s(x i )) = s(x j ). Similarly, we require that (s, h) ∈ V(x i = x j ) iff s(x i ) = s(x j ).
Of course, this reformulation assumes that atomic formulae have some structure and it also requires restricting the set of valuations. The set of valuations can be restricted in many other ways, for instance by imposing that a propositional variable holds true only for a finite number of elements of M (see such restrictions in [START_REF] Brotherston | Undecidability of propositional separation logic and its neighbours[END_REF]).

Encoding runs of Minsky machines

Whereas the satisfiability problem for any propositional fragment kSL0 is decidable and indeed PSPACE-complete (see Section 2.1), propositional versions of abstract separation logic with propositional variables are easily shown undecidable.

Theorem 2.3.1.

[BK10, LWG10] The satisfiability problems for SL(P fin (N), , {∅}) and for SL(HS k , , U k ) -k ≥ 1are undecidable.

Actually, results in [START_REF] Brotherston | Undecidability of propositional separation logic and its neighbours[END_REF][START_REF] Larchey-Wendling | The undecidability of Boolean BI through phase semantics[END_REF] are much more general. Herein, we limit ourselves to two separation models that are obviously related to concrete heaps. Below, by way of example, we provide the undecidability proof for the logic SL(P fin (N), , {∅}) by simple semantical arguments (and without using any proof-theoretical arguments, unlike what is done in [START_REF] Brotherston | Undecidability of propositional separation logic and its neighbours[END_REF][START_REF] Larchey-Wendling | The undecidability of Boolean BI through phase semantics[END_REF]).

Before presenting the undecidability proof, let us mention the equivalence of the statements below:

1. ϕ is valid in SL(P fin (N), , {∅}).

Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15 2. ¬ϕ is not satisfiable in SL(P fin (N), , {∅}).

3. ¬ϕ is not satisfiable in SL(HS k , , U k ) (for any k ≥ 1). 4. ϕ is valid in SL(HS k , , U k ) (for any k ≥ 1).
Whereas the equivalences between instances for validity and satisfiability are standard (thanks to negation in the logical language), the equivalences related to distinct separation models are simply due to the fact, in such logics, composition of heaps only requires that the domain are disjoint, independently of the range of the heaps. Note also that SL(P fin (N), , {∅}) can be understood as the logic SL(HS k , , U k ) with k equal to zero.

Let M be a Minsky machine with α ≥ 1 instructions, 1 is the initial instruction and α is the halting instruction [START_REF] Minsky | Computation: Finite and Infinite Machines[END_REF]. Machine M has two counters c 1 and c 2 and the instructions are of the following types

( j ∈ [1, 2], I ∈ [1, α -1], J, J 1 , J 2 ∈ [1, α]): 1. I: c j := c j + 1; goto J. 2. I: if c j = 0 then goto J 1 else (c j := c j -1; goto J 2 ). 3. α: halt. Machine M halts if there is a run of the form (I 0 , c 1 0 , c 2 0 ), (I 1 , c 1 1 , c 2 1 ), . . . , (I L , c 1 L , c 2 L ) such that (I i , c 1 i , c 2 i ) ∈ [1, α] × N 2 (i ∈ [1, L]
), the succession of configurations respects the instructions (in the obvious way), I 0 = 1, I L = α, and c 1 0 = c 2 0 = 0. The halting problem consists in checking whether a machine halts and it is known to be undecidable, see e.g. [START_REF] Minsky | Computation: Finite and Infinite Machines[END_REF]. Indeed, Minsky machines are Turing-complete.

By way of example, the Minsky machine

1: c 1 := c 1 + 1; goto 2. 2: c 2 := c 2 + 1; goto 1. 3: halt.
has a unique computation

(1, 0, 0) - → (2, 1, 0) - → (1, 1, 1) - → (2, 2, 1) - → (1, 2, 2) - → (2, 3, 2) . . .
We build a formula ϕ M such that M halts iff ϕ M is valid in SL(P fin (N), , {∅}), which entails the undecidability of the satisfiability problem for SL(P fin (N), , {∅}).

q ¬p 1 ¬p 2 q : q ¬p 1 ¬p 2 q ¬p 1 ¬p 2 q ¬p 1 ¬p 2 p 1 ¬p 2 ¬q p 1 ¬p 2 ¬q p 1 ¬p 2 ¬q p 2 ¬p 1 ¬q p 2 ¬p 1 ¬q Figure 2.1: Set encoding of the configuration (4, 3, 2)
The formula ϕ M is built over the propositional variables q, q , p 1 and p 2 . Given a valuation V, a configuration (I, c 1 , c 2 ) of M is encoded by some set X ∈ P fin (N) such that

• X ∈ V(q ) (meaning X encodes a configuration),
• X = X 0 X 1 X 2 (X can be decomposed so that there are disjoint parts about the instruction counter, the first counter and the second counter),

• card(X 0 ) = I, card(X 1 ) = c 1 and card(X 2 ) = c 2 , • for all ∅ Y ⊆ X 0 , Y ∈ V(q) \ (V(p 1 ) ∪ V(p 2 )), • for all ∅ Y ⊆ X 1 , Y ∈ V(p 1 ) \ (V(p 2 ) ∪ V(q)), • for all ∅ Y ⊆ X 2 , Y ∈ V(p 2 ) \ (V(p 1 ) ∪ V(q)).
In that case, we write X ≈ V (I, c 1 , c 2 ). The basic idea is that the atomic proposition p j identifies the sets that contribute to the value for the counter c j whereas the atomic proposition q identifies the sets that contribute to the value of the instruction counter. Furthermore, we require more than that:

1. X ∈ V(p) implies that none of the strict non-empty subsets of X belongs to V(p ) with p p and all its strict non-empty subsets belongs to V(p).

2. The empty set is the only one satisfying both p 1 and p 2 , which should not come as a surprise since both counters can take the zero value. The formula ϕ M has the following form:

((emp ∧ p 1 ∧ p 2 ∧ ¬q ∧ ¬q ) ∧ closure) ⇒ ( ¬ - * (q ∧ (p 1 * p 2 * (size = α ∧ q))))
The formula closure guarantees that for any configuration (I, c 1 , c 2 ) reachable from the initial configuration (1, 0, 0), there is some

X ∈ P fin (N) such that X ≈ V (I, c 1 , c 2 ) (in that case, note that card(X) = I + c 1 + c 2 ).
The formula ¬ - * (q ∧(p 1 * p 2 * (size = α∧q))) states that there is X ∈ P fin (N) such that X = X 0 X 1 X 2 , card(X 0 ) = α, X 1 encodes the first counter and X 2 encodes the second counter.

In order to define the formula closure, we introduce the universal modalities U and [U]. Let U ψ be an abbreviation for ¬ - * ψ and [U] ψ be an abbreviation for - * ψ, following an obvious analogy with the universal modality in Kripke models, see e.g. [START_REF] Goranko | Using the universal modality: gains and questions[END_REF][START_REF] Hemaspaandra | The price of universality[END_REF]. The formula closure is defined as the conjunction of the following formulae:

• U (size = 1∧q∧q ). There is some set X encoding the configuration (1, 0, 0).

• [U](p 1 ⇒ (¬((¬p 1 ∧ ¬emp) * ) ∧ (¬emp ⇒ ¬p 2 ) ∧ ¬q ∧ ¬q ). • [U](p 2 ⇒ (¬((¬p 2 ∧ ¬emp) * ) ∧ (¬emp ⇒ ¬p 1 ) ∧ ¬q ∧ ¬q ). • [U](q ⇒ (¬((¬q ∧ ¬emp) * )) ∧ ¬p 1 ∧ ¬p 2 ).
In the sequel, the modalities U and [U] are used at the outermost level only and therefore they are evaluated only on the empty set. More generally, the universal modality [U] can be defined

[U]ϕ def = (emp ∧ ( - * ϕ)) * (see also Exercise 1.13). Consequently, whenever X | = V (q ∧ size = I) * p 1 * p 2 for some I ∈ [1, α], there is no I I such that X | = V (q ∧ size = I ) * p 1 * p 2 . Moreover, there are unique X 0 , X 1 and X 2 such that X = X 0 X 1 X 2 , X 0 | = V (q ∧ size = I), X 1 | = V p 1 and X 2 | = V p 2 .
We add to closure the following formulae:

• For all instructions of the form I: c 1 := c 1 + 1; goto J, we consider

[U]((((q ∧ size = I) * p 1 * p 2 ) ∧ q ) ⇒ (q ∧ size = I) * (((q ∧ size = J) * (size = 1 ∧ p 1 )) ¬ - * (((q ∧ size = J) * p 1 * p 2 ) ∧ q )))
• Formulae for instructions of the form I: c 2 := c 2 + 1; goto J are defined similarly.

• For all instructions of the form I: if c 1 = 0 then goto J 1 else (c 1 := c 1 -1; goto J 2 ), we consider

[U]((((q ∧ size = I) * p 2 ) ∧ q ) ⇒ ((q ∧ size = I) * ((q ∧ size = J 1 ) ¬ - * q )))∧ [U]((((q ∧ size = I) * (p 1 ∧ ¬emp) * p 2 ) ∧ q ) ⇒ (((q ∧ size = I) * (p 1 ∧ size = 1)) * ((q ∧ size = J 2 ) ¬ - * q )))
• Formulae for instructions of the form I: if c 2 = 0 then goto J 1 else (c 2 := c 2 -1; goto J 2 ), are defined similarly.

Here is the crucial property about the formula closure.

Lemma 2.3.2. Let V be a valuation such that ∅ | = V ((emp ∧ p 1 ∧ p 2 ∧ ¬q ∧ ¬q ) ∧ closure) and X ≈ V (I, c 1 , c 2 ). If (I, c 1 , c 2 ) - → (I , c 1 , c 2 ) in M, then there is a finite subset X of N such that X ≈ V (I , c 1 , c 2 ).
The proof of Lemma 2.3.2 is left as Exercise 2.9. Consequently, if

∅ | = V ((emp ∧ p 1 ∧ p 2 ∧ ¬q ∧ ¬q ) ∧ closure)
, then all the reachable configurations from (1, 0, 0) have an encoding by a set in the separation model.

The correctness proof works as follows. Suppose that the machine M halts. This means that for any valuation V, if ∅ | = V (emp ∧ p 1 ∧ p 2 ∧ ¬q ∧ ¬q ) ∧ closure, then by Lemma 2.3.2, there is some X ∈ P fin (N) such that X ≈ V (α, c 1 , c 2 ) for some c 1 , c 2 ∈ N, i.e. there is some X ∈ P fin (N) such that X | = V (p 1 * p 2 * (size = α ∧ q)) ∧ q , which is equivalent to ∅ | = V ( ¬ - * ((p 1 * p 2 * (size = α ∧ q))) ∧ q ). Now suppose that the machine M does not halt, this means that there is no configuration of the form (α, c 1 , c 2 ) reachable from the initial configuration (1, 0, 0). Let us define the following valuation V 0 :

• V 0 (q) def = P fin ([1, α -1]) \ {∅}. • V 0 (p 1 ) def = P fin ({α + 2k + 1 : k ∈ N}), V 0 (p 2 ) def = P fin ({α + 2k : k ∈ N}). So, X ∈ V 0 (p 1 ) and X ∈ V 0 (p 2 ) imply that X ∩ X = ∅.
• V 0 (q ) is equal to the set below:

{X ∈ P fin (N) : (I, c 1 , c 2 ) reachable from (1, 0, 0), X = X 0 X 1 X 2 , card(X 0 ) = I, X 0 ∈ P fin ([1, α-1]), card(X 1 ) = c 1 , X 1 ∈ P fin ({α+2k+1 : k ∈ N}), card(X 2 ) = c 2 , X 2 ∈ P fin ({α + 2k : k ∈ N})}.
Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI '15 One can check that 1. for every configuration (I, c 1 , c 2 ), we have

(I, c 1 , c 2 ) is reachable from (1, 0, 0) iff there is X such that X ≈ V 0 (I, c 1 , c 2 ), 2. ∅ | = V 0 (emp ∧ p 1 ∧ p 2 ∧ ¬q ∧ ¬q ) ∧ closure, 3. there is no X ∈ P fin (N) such that X | = V 0 (p 1 * p 2 * (size = α ∧ q)) ∧ q .
Consequently, ϕ M is not valid in SL(P fin (N), , {∅}). This concludes the proof of Theorem 2.3.1. It is worth noting that this undecidability proof uses only semantical arguments.

Exercises

Exercise 2.1. Prove Lemma 2.1.4.

Exercise 2.2. Complete the proof of 2.1.5 with the case ϕ j = ∃ p j ϕ j+1 in the induction step.

Exercise 2.3. Prove Corollary 2.1.6.

Exercise 2.4. [COY01, Section 5] Let L be the fragment of 1SL0 defined by the grammar below: e) Explain why the satisfiability problem for L is NP-complete.

ϕ, ψ ::= alloc(x) | ¬alloc(x) | emp | ¬emp | x → y | ¬(x → y) | x → y | ¬(x → y) | x = y | ¬(x = y) | | ⊥ | ϕ ∨ ψ | ϕ ∧ ψ | ϕ *
Exercise 2.5. By using Theorem 2.1.7, show that there is no formula in 1SL0 equivalent to the formula

∃ u (x 1 → u) ∧ (u → x 2 ).
Exercise 2.6. Prove that for all memory states (s, h), we have

(s, h) | = (¬emp * (x 1 → x 2 - * ⊥)) iff (s, h) | = size ≥ 2 ∧ alloc(x 1 ).
Exercise 2.7. Show that the formula ϕ is valid in SL(P fin (N), , {∅}

) iff ϕ is valid in SL(HS k , , U k ) -k ≥ 1.
Exercise 2.8. Check that (P fin (N), , {∅}) is a separation model.

Exercise 2.9. Prove Lemma 2.3.2. In this chapter, we take care of the expressiveness of first-order separation logics; for the sake of simplicity, we consider fragments without program variables and therefore no need to consider stores in memory states (the models are restricted to heaps). It is worth recalling a few well-known results about expressive power of modal or temporal logics. For instance, linear-time temporal logic LTL is known to be as expressive as first-order logic by Kamp's Theorem [START_REF] Kamp | Tense Logic and the Theory of Linear Order[END_REF] (see also [START_REF] Hodkinson | Separation -past, present, and future[END_REF][START_REF] Rabinovich | A Proof of Kamp's theorem[END_REF]). More references about bibliographical references for expressiveness of non-classical logics can be found in Section 3.6.

Section 3.1 shows how data words can be encoded as heaps by using formulae in 1SL2. In Section 3.2, we explain how to encode arithmetical constraints comparing the numbers of predecessors of two locations within 1SL2. Details are provided when the two locations belong to a specific class of heaps. By using the formulae built so far, in Section 3.3 we show that the satisfiability problem for 1SL2 is undecidable by reduction from the halting problem for Minsky machines. In Section 3.4, we explain how formulae in 1DSOL (without program variables) can be translated into 1SL2(- * ) (without program variables) by respecting faithfully the semantics. A reduction with program variables or with k > 1 record fields is possible but it is not presented in that section.

Highlights of the chapter

1. Presentation of an encoding of data words as heaps that can be specified in 1SL2 (Section 3.1) [START_REF] Demri | Two-variable separation logic and its inner circle[END_REF].

2. Undecidability proof of 1SL2 by reduction from the halting problem for Minsky machines (Theorem 3.3.7) [START_REF] Demri | Two-variable separation logic and its inner circle[END_REF].

3. Proof that 1SL2(- * ) is as expressive as weak second-order logic (Theorem 3.4.14). We use first principles from [START_REF] Brochenin | On the almighty wand[END_REF] and the encodings from [START_REF] Demri | Expressive completeness of separation logic with two variables and no separating conjunction[END_REF].

Encoding Data Words in 1SL2

In this section, we present a simple encoding of data words with multiple attributes into heaps that will be useful in the rest of the chapter. Finite data words [START_REF] Bouyer | A logical characterization of data languages[END_REF] are ubiquitous structures that include timed words [START_REF] Alur | A theory of timed automata[END_REF], runs of Minsky machines, and runs of concurrent programs with an unbounded number of processes. These are finite words in which every position carries a label from a finite alphabet and a finite tuple of data values from some infinite alphabet. A wealth of specification formalisms for data words (and slight variants) has been introduced stemming from automata (see e.g. [KF94, NSV04, BL10, Fig10]) to adequate logical languages such as first-order logic [BDM + 11, Dav09, SZ12] and temporal logics [START_REF] Figueira | Reasoning on words and trees with data[END_REF][START_REF] Decker | Ordered navigation on multi-attributed data words[END_REF].

A data word of dimension β is a finite non-empty sequence in ([1, α] × N β ) + for some α ≥ 1 and β ≥ 0. The set [1, α] is understood as a finite alphabet of cardinal α whereas N is the infinite data domain. Data words of dimension zero are simply finite words over a finite alphabet whereas data words of dimension one correspond to data words in the sense introduced in [START_REF] Bouyer | A logical characterization of data languages[END_REF]. Finite runs of Minsky machines (with two counters) can be viewed as data words of dimension two over the alphabet [1, α] assuming that the Minsky machine has α distinct instructions (see Section 2.3.2). In full generality, the set N could be replaced by any infinite data domain D (for instance by R to define timed words); however, we do not need to be so general, and in this chapter, we focus on the infinite domain

N. Let dw = (a 1 , v 1 1 , . . . , v 1 β ) • • • (a L , v L 1 , . . . , v L β ) be a data word in ([1, α] × N β ) + , i.e.
dw is of dimension β and its underlying alphabet has cardinal α ≥ 1. The data word dw shall be encoded by the heap h dw containing a path of the form below:

l 1 0 → l 1 1 → • • • → l 1 β → • • • → l L 0 → l L 1 → • • • → l L β where • for every i ∈ [1, L], l i 0 has a i + 2 predecessors, • for all i ∈ [1, L] and all j ∈ [1, β], l i j has v i j + α + 3 predecessors,
• every location in the heap domain is either on that path or points to a location on that path.

Such a path from l 1 0 to l L β is called the main path, and h

(β+1)L-1 dw (l 1 0 ) = l L β .
Other simple encodings are possible (for instance without shifting the values from the finite alphabet or from the infinite domain) but the current one is well-suited for all the developments made in this chapter. In particular, the encoding allows us to know easily whether a location encodes a letter from the finite alphabet or an element from the infinite domain. Note also that h dw is not uniquely specified, and we understand it modulo isomorphism, see Exercise 1.1.

Figure 3.1 presents the encoding of the data word dw 0 = (2, 1)(1, 2)(2, 2) of dimension 1 with α = 2 with its representation of the heap h dw in which the predecessors of the locations on the main path are provided schematically.

The heap h dw looks like a fishbone. Let us make this precise. A heap h is a fishbone

• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • Figure 3.1: The heap for data word dw 0 = (2, 1)(1, 2)(2, 2).
(fb2) there is a location reachable from all the locations of dom(h) that is not in dom(h), and (fb3) there are no distinct locations l 1 , l 2 , l 3 , l 4 , l 5 such that l 1 → l 2 → l 3 ← l 4 ← l 5 in the heap h.

When h is a fishbone, it has a tree-like structure (when looking at the edges backward), equipped with a root (the unique location from (fb2)), but additionally, one can recognise the locations on the main path as those locations with at least one predecessor. The existence of such a main path is guaranteed by (fb3). The first location on the main path satisfies the formula

first(u) def = ( u ≥ 1) ∧ ¬( u -1 ≥ 1)
and the last location on the main path satisfies precisely the formula

last(u) def = ( u ≥ 1) ∧ ¬alloc(u)
Let ϕ fb be the formula below:

(fb1) ¬emp ∧ (fb2) (∃ u ¬alloc(u) ∧ (∀ u alloc(u) ⇒ reach(u, u))) ∧
¬(∃ u ( u -2 ≥ 0) * ( u -2 ≥ 0)) .
The formulae of the form u -i ∼ k and reach(u, u) can be found in Section 1.2.2. Lemma 3.1.1. Let h be a heap. We have h | = ϕ fb iff h is a fishbone.

The proof for Lemma 3.1.1 is by an easy verification. Now, let us refine the notion of a fishbone heap so that it takes into account constraints on numbers of predecessors. An (α, β)-fishbone is a fishbone heap such that (C1) the first location on the main path has a number of predecessors in [3, α + 2], (C2) on the main path, a location with a number of predecessors in [3, α + 2], is followed by β locations with at least α + 3 predecessors, and

(C3) the number of locations on the main path is a multiple of β + 1.

It is easy to check that the formulae ϕ C1 , ϕ C2 and ϕ C3 in 1SL2( * ) defined below are able to express the conditions (C1), (C2) and (C3), respectively. This assumes that the heap is already known to be a fishbone, which is equivalent to the satisfaction of ϕ fb (by Lemma 3.1.1).

ϕ (C1) def = ∃ u first(u) ∧ (3 ≤ u ≤ α + 2) ϕ (C2) def = ∀ u (3 ≤ u ≤ α + 2) ⇒ i∈[1,β] u +i ≥ α + 3 ϕ (C3) def = ∀ u (3 ≤ u ≤ α + 2) ⇒ ((¬ u +(β+1) ≥ 0) ∨ (3 ≤ u +(β+1) ≤ α + 2)).
We write dw(α, β) to denote the formula ϕ fb ∧ ϕ (C1) ∧ ϕ (C2) ∧ ϕ (C3) . It specifies the shape of the encoding of data words in

([1, α] × N β ) + as stated below. Lemma 3.1.2. Let h be a heap. We have h | = dw(α, β) iff h is an (α, β)-fishbone.
Again, the proof is by an easy verification by using Lemma 3.1.1 and the correspondence between the condition (Ci) and the formula ϕ (Ci) .

Given a data word dw

= (a 1 , v 1 1 , . . . , v 1 β ) • • • (a L , v L 1 , . . . , v L β )
, we can associate a (α, β)-fishbone h dw with (1 + β) × L locations on the main path, say • for every

l 1 0 → l 1 1 → • • • → l 1 β → • • • → l L 0 → l L 1 → • • • → l L β such that
i ∈ [1, L], l i 0 = a i + 2,
• for all i ∈ [1, L] and all j ∈ [1, β], l i j = v i j + α + 3.

We recall that l denotes the number of predecessors of the location l (given an implicit current heap), see also Section 1.2.1. The heap h dw is unique modulo isomorphism. This natural encoding generalises the encoding of finite words by heaps in [BDL12, Section 3] (see also a related encoding in [START_REF] Bansal | Beyond shapes: Lists with ordered data[END_REF]) while providing a much more concise representation. Note also that the encoding by itself is of no use since it is essential to be able to operate on it with the logical language at hand.

Conversely, given a (α, β)-fishbone h with (1 + β) × L locations on the main path, say

l 1 0 → l 1 1 → • • • → l 1 β → • • • → l L 0 → l L 1 → • • • → l L β we associate a (unique) data word dw h = (a 1 , v 1 1 , . . . , v 1 β ) • • • (a L , v L 1 , . . . , v L β ) such that • for every i ∈ [1, L], a i def = l i 0 -2 and,
• for all i ∈ [1, L] and all j ∈ [1, β], v i j def = l i j -α -3.

Lemma 3.1.3. There is a one-to-one map between data words in ([1, α] × N β ) + and (α, β)-fishbone heaps (modulo isomorphism).

The proof is then by an easy verification. So, we have seen that finite words can be encoded in 1SL2( * ), which allows us to establish that 1SL2( * ) is NEXP-TIME-hard since first-order logic restricted to two quantified variables on finite words (written FO2 α,0 (<, +1, =) herein) is NEXPTIME-complete [START_REF] Etessami | First-order logic with two variables and unary temporal logics[END_REF]. Indeed, consider a sentence ϕ in that fragment of first-order logic. Let us define tr(ϕ) such that ϕ is satisfiable iff dw(α, 0) ∧ tr(ϕ) is satisfiable in 1SL2( * ). The logarithmic-space translation tr is homomorphic for Boolean connectives and is further defined as follows (i, j ∈ {1, 2}).

tr(u i = u j ) def = u i = u j tr(a(u i )) def = ( u i = a + 2) tr(u i = 1 + (u j )) def = u j → u i tr(u i < u j ) def = reach(u i , u j ) ∧ u i u j tr(∃ u i ϕ) def = ∃ u i ( u i ≥ 1) ∧ tr(ϕ).
Note that FO2 α,0 (<, +1, =) and 1SL2( * ) share the same number of quantified variables and reach(u i , u j ) can be expressed in 1SL2( * ) (see Section 1.2.2). We do not provide the correctness proof herein since we can do much better than NEXP-TIME-hardness by making a strong connection with Moszkowski's Interval Temporal Logic ITL (with the locality condition), see Section 4.2.

Encoding Arithmetical Constraints in 1SL2

Below, we show how to express in 1SL2 the constraints u = u, u = u + 1 and u = u + 1, when u and u are interpreted by locations on the main path of (α, 2)-fishbone heaps. We shall use the fact that N ≤ N (N, N ∈ N) iff for every n ≥ 0, we have N ≤ n implies N ≤ n. Quantification over the set of natural numbers will be simulated by quantification over disjoint heaps in which n is related to the cardinal of their heap domains. Such quantification is performed thanks to the magic wand operator.

A fork in h is a sequence of distinct locations l, l 0 , l 1 , l 2 such that h(l 0 ) = l, l 0 = 2, h(l 1 ) = l 0 , h(l 2 ) = l 0 and l 1 = l 2 = 0. The endpoint of the fork is l. Similarly, a knife in h is a sequence of distinct locations l, l 0 , l 1 such that h(l 0 ) = l, l 0 = 1, h(l 1 ) = l 0 and l 1 = 0. The endpoint of the knife is l. By way of example, the heap of Figure 3.2 contains three knives, two forks and four endpoints (identified by ' ').

• • • • • • • • • • • • • • • • • Figure 3
.2: A heap with three knives, two forks and four endpoints. Lemma 3.2.1. Let h be a (α, β)-fishbone heap with α ≥ 1 and β ≥ 0. Then, h has no knife and no fork.

Indeed, in such heaps, any allocated location has no predecessor or at least three predecessors.

A heap h is a collection of knives def ⇔ there is no location in dom(h) that does not belong to a knife and no distinct knives share the same endpoint. A heap h is segmented whenever dom(h) ∩ ran(h) = ∅ and no location has strictly more than one predecessor. Lemma 3.2.2. Let h be a (α, β)-fishbone heap with α ≥ 1, β ≥ 0 and h be a segmented heap disjoint from h. Then, h h has no fork.

Being segmented can be naturally expressed in 1SL2:

seg def = ∀ u u (u → u ⇒ (( u = 1) ∧ ( u = 0) ∧ ¬alloc(u))).
The statement below is counterpart to [BDL12, Lemma 5.2] with simplified properties and with simpler formulae but using only two quantified variables.

Lemma 3.2.3. There are formulae forky(u), KS and KS1F in 1SL2 such that for every heap h,

(I) h | = f forky(u) iff all the predecessors of f(u) are endpoints of forks, (II) h | = KS iff h is a collection of knives, (III) h | = KS1F iff there are h 1 , h 2 such that h = h 1 h 2 , h 1 is a collection of knives
and h 2 is made of a unique fork such that its unique endpoint is not in the range of h 1 .

Proof. forky(u) is equal to:

∀ u (u → u) ⇒ (∃ u (u → u) ∧ ( u = 2) ∧ ¬( u -1 ≥ 1)).
A knife is made of two consecutive memory cells that can be respectively called part 1 and part 2 as shown in

l part 1 ---→ l part 2 ---→ l . KS def = ∀ u alloc(u) ⇒ (ϕ part1 (u) ∨ ϕ part2 (u))
where

ϕ part1 (u) def = ( u = 0) ∧ ( u +1 = 1) ∧ ( u +2 = 1) ∧ ¬( u +3 ≥ 0) ϕ part2 (u) def = ( u = 1) ∧ ( u -1 = 0) ∧ ( u +1 = 1) ∧ ¬( u +2 ≥ 0).
KS1F def = unique fork [∃ u ( u = 2) ∧ ( u +1 = 1) ∧ ¬( u +2 ≥ 0) ∧ ¬( u -1 ≥ 1) ∧ ¬(∃ u (u u) ∧ ( u = 2))] ∧ [∀ u alloc(u) ⇒ (ϕ part1 (u) ∨ ϕ part2 (u) part with knifes ∨ (( u = 0) ∧ ( u +1 = 2)) ∨ ( u = 2))
part with one fork ]

In our proof, we use the idea of augmenting the heap with a segmented heap, then augmenting it further with knives to form forks whose endpoints are predecessors of u; this is borrowed from [START_REF] Brochenin | On the almighty wand[END_REF]. As it is, this would not be sufficient to express arithmetical constraints on fishbone heaps since only two quantified variables are allowed. This restriction is not considered in [BDL12]-the formulae there use strictly more than two quantified variables. This is why we had to provide specific developments that are well-tailored to fishbone heaps while taking into account our limited amount of syntactic resources (this can be generalised to any heap in [START_REF] Demri | Expressive completeness of separation logic with two variables and no separating conjunction[END_REF]). Simplifications have also been made in order to focus on undecidability rather than on questions of expressive power. Note also that there are versions of separation logics in which arithmetical constraints are built-in, for instance about the length of lists, see e.g. [START_REF] Bozga | Quantitative separation logic and programs with lists[END_REF]. Lemma 3.2.4. Let h be a heap with h = h 1 h 2 and f be an assignment such

that h 1 is a (α, 2)-fishbone f(u) is on the main path of h 1 , h 2 | = f seg ∧ u = 0, n = card(ran(h 2 ) \ dom(h 1 )
) and m is the number of predecessors of f(u) in h 1 . We have the following properties:

(I) h | = f ¬(KS - * ¬forky(u)) iff n ≥ m. (II) h | = f ¬(KS1F - * ¬forky(u)) iff n ≥ m -1.
In Figure 3.3, we present three heaps obtained by combining a segmented heap h 2 with collections of knives (corresponding to h 3 in the proof of Lemma 3.2.4). Edges labelled by '1' are part of a fishbone heap h 1 (partially represented) whereas edges labelled by '2' are part of a segmented heap h 2 so that no edge points to f(u) or to f(u). The heap on the left (corresponding to h 1 h 2 in Lemma 3.2.4) is obtained by adding a segmented heap h 2 whereas the heap in the middle (say h 1 h 2 h 3 ) is obtained then by adding a collection of knives h 3 so that every predecessor of f(u) is the endpoint of a fork. Note that not all edges of the segmented heap are used to build forks. Similarly, the heap on the right (say h 1 h 2 h 3 ) is obtained then by adding a collection of knives h 3 to the heap h 1 h 2 on the very left so that every predecessor of f(u) is the endpoint of a fork.

• f(u) • f(u) • • • • • • • • • • • • • • • 1 1 1 1 1 1 2 2 2 2 2 • f(u) • f(u) • • • 3 3 • • • • • • • • • • • • • • • • • • • • 3 3 1 1 1 1 1 1 2 2 2 2 2 3 3 3 3 3 3 • f(u) • f(u) • • • 3 3 • • • • • • • • • • • • • • • • • • 1 1 1 1 1 1 2 2 2
Proof. Let us provide the proof for (I). (The proof for (II), being analogous, is omitted.) So, let h be a heap with h = h 1 h 2 such that h 1 is an (α, 2)-fishbone heap, and h 2 | = f seg ∧ u = 0. Moreover, f(u) is on the main path, which entails that h(f(u)) f(u) (if h(f(u)) is defined at all) and f(u) has at least one predecessor.

One can make the following (obvious) observations.

(O1) The heap h 1 has no knives and, h 1 and h 1 h 2 have no forks. (see Lemma 3.2.1 and Lemma 3.2.2).

(O2) h 1 h 2 may not be a (α, 2)-fishbone heap but this is fine since we only need to focus on the number of predecessors of f(u) (i.e., on the value m). Indeed, h 1 h 2 may contain knives (see the left heap in Figure 3.3). A knife

l 1 → l 2 → l 3 in h 1 h 2 is made of l 1 ∈ dom(h 2 )
and of l 2 ∈ dom(h 1 ). This observation is not really used below but, hopefully, it could be helpful to better grasp how the heaps h 1 and h 2 are combined.

(O3) f(u) has the same number of predecessors in h 1 and in h 1 h 2 . This is due to the fact that h 2 | = f u = 0.

(O4) For every n ≥ 0, there is a disjoint heap h 2 such that h = h 1 h 2 , h 2 | = f seg∧ u = 0 and card(ran(h 2 )\dom(h 1 )) = n. See the left heap in Figure 3.3 with card(dom(h 2 )) = 5 and card(ran(h 2 ) \ dom(h 1 )) = 4 (look at edges labelled by '2'). Once more, this observation is not used below but it will be in the proof of Theorem 3.2.5.

First, let us suppose that h | = f ¬(KS - * ¬forky(u)), i.e., ( †) there is a heap h 3 , disjoint from h 1 h 2 , such that (h 1 h 2 ) h 3 | = f forky(u) and h 3 | = f KS. Let us make additional observations.

• The only forks in h 1 h 2 h 3 whose endpoints are predecessors of f(u) are those obtained with l 1 → l 2 such that l 1 ∈ dom(h 2 ) (so h 2 (l 1 ) = l 2 ), l 2 dom(h 1 ), and l 1 → l 2 → l 3 is a knife from h 3 . This is due to (O1) and to the fact that all the predecessors of f(u) in h have no predecessors since f(u) is on the main path of h.

• The number of forks in h 1 h 2 h 3 whose endpoints are predecessors of f(u) is therefore less of equal to card(ran(h 2 ) \ dom(h 1 )).

• The number of predecessors of f(u) in h 1 h 2 h 3 is greater or equal to the number of its predecessors in h 1 (by using (O3)). So, if h 1 h 2 h 3 | = f forky(u), then the number of predecessors of f(u) in h 1 is smaller or equal to card(ran(h 2 )\ dom(h 1 )) = n, i.e. n ≥ m.

Now, let us establish the other direction and let us suppose that n ≥ m and the predecessors of f(u) are p 1 , . . . , p m . Let l 1 1 , l 2 1 , . . . , l 1 n , l 2 n be locations such that {l 1 1 , . . . , l 1 n } = ran(h 2 ) \ dom(h 1 ) and for every i ∈ [1, n], we have h 2 (l 2 i ) = l 1 i . Let us build h 3 so that it satisfies ( †), which is quite easy to realise. Let l new 1 , . . . , l new m be (new) locations that are not in dom(h 1 h 2 ) ∪ ran(h 1 h 2 ). We define h 3 so that it contains exactly m knives whose endpoints are exactly all the predecessors of f(u). For every i ∈ [1, m], we define h 3 (l new i

) def = l 1 i and h 3 (l 1 i ) def = p i (well, that is possible because l 1 i dom(h 1 h 2 )). It is easy to check that h 3 satisfies ( †). Consequently, h | = f ¬(KS - * ¬forky(u)) iff n ≥ m.
QED Now, we are able to state the main proposition of this section that allows us to compare the numbers of predecessors for two locations on the main path of a fishbone heap. Let us introduce the following abbreviations:

χ 1 (u, u) def = seg ∧ u = 0 ∧ u = 0 χ 2 (u) def = ¬(KS - * ¬forky(u)) χ 3 (u) def = ¬(KS1F - * ¬forky(u)).
Theorem 3.2.5. [DD15b] Suppose h 1 is a (α, 2)-fishbone heap and, f(u) and f(u) are on the main path of h 1 . We have the following equivalences:

• h 1 | = f χ 1 (u, u) - * (χ 2 (u) ⇒ χ 2 (u)) iff u ≤ u. • h 1 | = f χ 1 (u, u) - * (χ 2 (u) ⇒ χ 3 (u)) iff u ≤ u + 1. • h 1 | = f χ 1 (u, u) - * (χ 3 (u) ⇒ χ 2 (u)) iff u ≤ u -1.
Proof. By way of example, let us show the second property. The other cases are proved in a similar fashion. Let h 1 be a (α, 2)-fishbone heap. The statements below are equivalent.

1.

h 1 | = f (χ 1 (u, u) - * (χ 2 (u) ⇒ χ 3 (u)))).

For every disjoint heap

h 2 such that h 2 | = f χ 1 (u, u), if h 1 h 2 | = f χ 2 (u), then h 1 h 2 | = f | = χ 3 (u). (by definition of | = f ) 3. For every n ≥ 0, there is a disjoint heap h 2 with card(ran(h 2 ) \ dom(h 1 )) = n such that h 2 | = f χ 1 (u, u) and if h 1 h 2 | = f χ 2 (u), then h 1 h 2 | = f χ 3 (u) (see (O4)
in the proof of Lemma 3.2.4). This is possible by using the fact that one can add a segmented heap so that the resulting heap has n isolated memory cells. Indeed, given the heap h 1 , let us build a disjoint heap h 2 such that h 2 | = f χ 1 (u, u) and dom(h 2 ) = n for any fixed n ≥ 0. Since X = dom(h 1 )∪ran(h 2 )∪{f(u), f(u)} is a finite subset of N, there are 2n distinct locations l 1 1 , l 2 1 , . . . , l 1 n , l 2 n in N \ X. We simply need to define h 2 such that dom(h 2 )

def = {l 1 1 , . . . , l 1 n }, ran(h 2 ) def = {l 2 1 , . . . , l 2 n } and for all i ∈ [1, n], we set h 2 (l 1 i ) def = l 2 i . 4. for every n ≥ 0, we have n ≥ u in h 1 implies n ≥ u -1 in h 1 . (by Lemma 3.2.4) 5. u ≤ u + 1. QED
Theorem 3.2.5 can be generalised by restricting ourselves to formulae in 1SL2(- * ) and without assuming any peculiar property on the heap h 1 . Theorem 3.2.6. [START_REF] Demri | Expressive completeness of separation logic with two variables and no separating conjunction[END_REF] There are formulae in 1SL2(- * ) that can express the properties u ≤ u, u ≤ u + 1 or u ≤ u -1 (whatever the heap).

Undecidabillity of 1SL2

Constraints between locations at distance three

This section is quite technical and it can be skipped for a first reading. Actually, Theorem 3.3.4 is used in forthcoming Section 3.3.2 in which runs of Minsky machines are encoded as (α, 2)-fishbone heaps. So, we should be able to compare the respective numbers of predecessors for two locations on the main path whose distance is three (number of edges to reach one location from the other one). Indeed, this is required to guarantee that the encoding of the counter values respects the instructions of the Minsky machine.

The goal of this section is the following: given a formula χ(u, u) equal to either u = u or u = u + 1 (in particular, this means that χ(u, u) only deals with numbers of predecessors and Section 3.2 explains how to define these formulae in 1SL2), we show how to define a formula in 1SL2, say χ +3 (u), such that

h | = f χ +3 (u) iff h | = f[u →h 3 (f(u))] χ(u, u), assuming that h 3 (f(u)) is defined, h | = f dw(α, 2) ∧ ( u ≥ α + 3)) and f(u) is on the main path. When χ(u, u) is equal to u = u [resp. u = u + 1], we write u = u +3 [resp. u = u +3 + 1] instead of χ +3 (u).
Note that if we had three quantified variables, defining χ +3 (u) would not require much work since the formula below does the job:

∃ u (u → u ∧ ∃ u (u → u ∧ ∃ u (u → u ∧ χ(u, u )))).
Let us start our construction. To do so, let h be a heap and f be an assignment such that h | = f dw(α, 2) ∧ ( u +3 ≥ 0) ∧ ( u ≥ α + 3)). In the statements below, this property is always satisfied.

The u-3cut of h is the minimal subheap h 3cut of h (with respect to set inclusion of the domain and therefore h 3cut h) such that all the ancestors of l = h 3 (f(u)) in dom(h) are also ancestors of l in h 3cut . As a consequence, f(u) and l have the same amount of predecessors in h and in the u-3cut heap.

In Figure 3.4, the bottom left heap is the u-3cut of the heap at the top. When h | = f u +4 ≥ 0, the almost u-3cut of h is the minimal subheap of h containing the u-3cut heap and such that u +4 = 1 holds true. The almost u-3cut of h contains the edge from l which is the only predecessor of the interpretation of u +4 . In Figure 3.4, the middle left heap is the almost u-3cut of the heap at the top. Below, we explain how to obtain the u-3cut of some heap, possibly via the construction of the almost u-3cut, if it exists. Lemma 3.3.1 below states that all we need to define χ +3 (u) is to be able to express a property in its u-3cut. In particular, the only location that is unallocated and on the main path is h 3 (f(u)).

Lemma 3.3.1. Let h | = f dw(α, 2) ∧ ( u +3 ≥ 0) ∧ ( u ≥ α + 3)) and h be its u-3cut heap. Then, h | = f[u →h 3 (f(u))] χ(u, u) iff h | = f (∃ u ¬alloc(u) ∧ u ≥ 1 ∧ χ(u, u)).
Proof. Let l = h 3 (f(u)) and l = f(u). Let h be the u-3cut heap of h. We have ( †) l in h is equal to l in h and l in h is equal to l in h . Indeed, the u-3cut heap h is a subheap of h such that all the ancestors of l in h are also ancestors of l in h and l is an ancestor of l in h. Note also that l is the unique location such that

h | = [u →l ] ¬alloc(u) ∧ u ≥ 1. So, h | = f (∃ u ¬alloc(u) ∧ u ≥ 1 ∧ χ(u, u)) iff h | = f[u →l ] χ(u, u)) iff h | = f[u →h 3 (f(u))] χ(u, u) by ( †)
. Note that we use the fact that χ(u, u) specifies a property about the numbers of predecessors. QED When h is equal to its u-3cut, i.e. when ( u +4 ≥ 0) does not hold, we have

h | = f[u →h 3 (f(u))] χ(u, u) iff h | = f ϕ UC (u) with ϕ UC (u) def = (∃ u ¬alloc(u) ∧ u ≥ 1 ∧ χ(u, u))
Now, let us consider the case when h is not equal to its u-3cut (probably, the most common situation) and let us show how to separate the current heap so that we can isolate the u-3cut heap.

Lemma 3.3.2. Let h | = f dw(α, 2) ∧ ( u +4 ≥ 0) ∧ ( u ≥ α + 3)) and ϕ(u) be an arbitrary formula. Then, h | = f 1comp * (1comp ∧ ( u +4 = 1) ∧ ¬( u +5 ≥ 0) ∧ ϕ(u)) iff the almost u-3cut of h, say h , satisfies: h | = f ϕ(u).
The formula 1comp was introduced in Section 1.2.2, and it states that the heap is made of a unique connected component (see also Exercise 1.15). The way h has to be divided to satisfy the formula is illustrated by the two heaps in the middle of Figure 3.4.

Proof. Let h be heap such that h | = f dw(α, 2) ∧ ( u +4 ≥ 0) ∧ ( u ≥ α + 3). Let h be the almost u-3cut heap of h and h be the heap such that h = h h . By construction of h , it is easy to check that h | = f 1comp ∧ ( u +4 = 1) ∧ ¬( u +5 ≥ 0). Similarly, h | = f 1comp. This implies that h | = f 1comp * (1comp ∧ ( u +4 = 1) ∧ ¬( u +5 ≥ 0)).
So, suppose that the almost u-3cut heap of h satisfies:

h | = f ϕ(u). This means that h | = f 1comp and h | = f (1comp ∧ ( u +4 = 1) ∧ ¬( u +5 ≥ 0) ∧ ϕ(u)). Hence, h | = f 1comp * (1comp ∧ ( u +4 = 1) ∧ ¬( u +5 ≥ 0) ∧ ϕ(u)). Now, suppose that h | = f 1comp * (1comp ∧ ( u +4 = 1) ∧ ¬( u +5 ≥ 0) ∧ ϕ(u)).
There are heaps h 1 and h 2 such that h 2 | = 1comp and

h 1 | = f (1comp ∧ ( u +4 = 1) ∧ ¬( u +5 ≥ 0) ∧ ϕ(u)). In particular, this means that h 1 | = f 1comp ∧ ( u +4 = 1) ∧ ¬( u +5 ≥ 0).
Let us show that there is a unique pair (h 1 , h 2 ) of heaps satisfying that property and h 1 = h , which will entail that h | = f ϕ(u). First note that

{f(u), h(f(u)), h 2 (f(u)), h 3 (f(u)), h 4 (f(u))} ⊆ dom(h 1 ) h 5 (f(u)) dom(h 1 )
Since h 1 | = f ( u +4 = 1), all the predecessors of h 4 (f(u)), apart from h 3 (f(u)), are in dom(h 2 ) and there are more than two such predecessors since h 4 (f(u)) is on the main path of h and therefore has at least three predecessors in h.

Hence, h 1 contains also all the ancestors of h 3 (f(u)), otherwise h 2 would have at least two distinct connected components. So, the u-3cut of h is also a subheap of h 1 . Now, it is easy to check that if any location in dom(h ) that is not a predecessor of h 4 (f(u)) were in dom(h 1 ), then h 1 would have more than two connected components. Hence, h 1 is the almost u-3cut heap of h and therefore h | = f ϕ(u). QED Let us build on Lemma 3.3.2 so as to be able to specify properties on the u-3cut heap.

Lemma 3.3.3. Let h | = f dw(α, 2) ∧ ( u +4 ≥ 0) ∧ ( u ≥ α + 3)) and ϕ(u) be the formula (size = 1) * (¬( u +4 ≥ 0)∧ϕ UC (u)). Then, h | = f 1comp * (1comp∧( u +4 = 1) ∧ ¬( u +5 ≥ 0) ∧ ϕ(u)) iff the u-3cut of h, say h , satisfies: h | = f ϕ UC (u).
Below, the auxiliary formulae ϕ(u)) and ϕ AUC (u) (in 1SL2):

ϕ(u) def = (size = 1) * (¬( u +4 ≥ 0) ∧ ϕ UC (u)) ϕ AUC (u) def = 1comp * (1comp ∧ ( u +4 = 1) ∧ ¬( u +5 ≥ 0) ∧ ϕ(u))
The proof for Lemma 3.3.3 is also by an easy verification by observing that an almost u-3cut heap is equal to the u-3cut plus one memory cell (see Figure 3.4).

By combining Lemma 3.3.1-3.3.3, we get the following proposition by performing a case analysis depending whether u +4 ≥ 0 holds true or not on the heap h.

Theorem 3.3.4. [START_REF] Demri | Two-variable separation logic and its inner circle[END_REF] Let h be a heap and f be an assignment such that h

| = f dw(α, 2)∧( u +3 ≥ 0)∧( u ≥ α+3)). We have h | = f[u →h 3 (f(u))] χ(u, u) iff h | = f χ +3 (u)
with the formula χ +3 (u) defined below:

χ +3 (u) def = (¬( u +4 ≥ 0) ∧ ϕ UC (u)) ∨ (( u +4 ≥ 0) ∧ ϕ AUC (u)).
Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15 Proof. We distinguish two cases depending whether h is itself its u-3cut or not. Case 1: ¬( u +4 ≥ 0), i.e. h is its own u-3cut heap. By Lemma 3.

• l • • • • • • • • • • • • • • • • • • l | = f ( u 4 = 1) ∧ ¬( u 5 ≥ 0) l • • • • • • • • • • l | = f 1comp • • • • • • • • l | = f ¬ u +4 ≥ 0 • • • • • • • • • • l | = f size = 1 l almost u-3cut heap u-3cut heap f(u) = l f(u) = l f(u) = l | = f dw(α, 2) ∧ ( u +3 ≥ 0) ∧ ( u ≥ α + 3) h 3 (f(u)) = l
3.1, if h | = f[u →h 3 (f(u))] χ(u, u), then h | = f ϕ UC (u) and therefore h | = f χ +3 (u). Conversely, if h | = f χ +3 (u), then h | = f ϕ UC (u) since ( u +4 ≥ 0) does not hold on h. Again, by Lemma 3.3.1, we get that h | = f[u →h 3 (f(u))] χ(u, u). Case 2: ( u +4 ≥ 0). By Lemma 3.3.1, if h | = f[u →h 3 (f(u))] χ(u, u), then h | = f ϕ UC (u) where h is the u-3cut of h. By Lemma 3.3.3, this implies that h | = f ϕ AUC (u) and therefore h | = f χ +3 (u) (thanks to its second disjunction). Conversely, if h | = f χ +3 (u), then h | = f ϕ AUC (u) since ( u +4 ≥ 0) holds on h. Again, by Lemma 3.3.3, we get that h | = f[u →h 3 (f(u))] ϕ UC (u) and by Lemma 3.3.1, we conclude h | = f[u →h 3 (f(u))] χ(u, u). QED
Note that the reasoning performed in this section cannot be extended to an arbitrary formula χ(u, u) since taking a u-3cut or an almost u-3cut preserves the number of predecessors of f(u) and h 3 (f(u)) but may not preserve more general properties. Nevertheless, this is sufficient for our needs in Section 3.3.2.

Reduction from the halting problem for Minsky machines

Let M be a Minsky machine with α ≥ 1 instructions, where 1 is the initial instruction and α is the halting instruction. We recall that a machine M has two counters c 1 and c 2 and the instructions are of the following types:

1. I: c j := c j + 1; goto J.

I:

if c j = 0 then goto J 1 else (c j := c j -1; goto J 2 ). 3. α: halt.
When a Minsky machine M has α ≥ 1 instructions, any run starting from the initial instruction 1 and ending by the halting instruction α (there is a single such run since M is deterministic) is a data word of dimension two over the finite alphabet [1, α]. We have seen that (α, 2)-fishbone heaps can be characterised thanks to the formula dw(α, 2). Obviously, more constraints need to be expressed, typically those related to the first instruction and those related to the halting instruction. Let us start by specifying the limit conditions thanks to the formulae ϕ first and ϕ last below.

• The first three locations on the main path have 3, α + 3, and α + 3 predecessors respectively:

ϕ first def = ∃ u first(u) ∧ ( u = 3) ∧ ( u +1 = α + 3) ∧ ( u +2 = α + 3).
• The main path encoding the run ends by a configuration with the halting instruction:

ϕ last def = ∃ u (( u = α + 2) ∧ ( u +2 ≥ 0) ∧ ¬( u +3 ≥ 0)).
Let us call ϕ the conjunction of dw(α, 2) ∧ ϕ first ∧ ϕ last . It specifies the shape of the encoding of the run without taking care of the constraints about counter values and instruction counter.

Lemma 3.3.5. Let h be a heap. h | = ϕ iff h encodes a data word dw = (a 1 , v 1 1 , v 1 2 ) • • • (a L , v L 1 , v L 2 )
such that a 1 = 1, a L = α, and

v 1 1 = v 1 2 = 0. • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • Figure 3.5: A (3, 2)-fishbone heap encoding (1, 0, 0) - → (2, 1, 0) - → (1, 1, 1) - → (2, 2, 1) Figure 3.5 presents an encoding of the sequence of configurations (1, 0, 0) - → (2, 1, 0) - → (1, 1, 1) - → (2
, 2, 1) when α = 3. Note that the (3, 2)-fishbone heap satisfies ϕ .

We have provided formulae for basic properties about the encoding of the runs, but this is insufficient. Indeed, three consecutive locations on the main path encode a configuration of the Minsky machine M. In order to check that two consecutive configurations correspond to a step that is valid for M, we need to compare numbers of predecessors for locations on the main path at distance three from each other. To do so, we use formulae of the form χ +3 (u) when χ(u, u) expresses one of the following arithmetical constraints: u = u, u = u + 1 and u = u + 1 (see Section 3.3.1). For each instruction I ∈ [1, α -1], we build a formula ϕ I so that the Minsky machine M halts iff the formula

ϕ ∧ I∈[1,α-1] χ I
is satisfiable in 1SL2. It remains to define χ I for each instruction I.

If the instruction I is of the form "I: c j := c j + 1; goto J" then we need to check the following properties:

1. If a location l encodes the instruction I on the main path (i.e. l = I + 2) and h 3 (l) is defined, then the location h 3 (l) encodes the instruction J.

(7)

(( u = α + 3) ∧ ( u -j = I + 2) ⇒ ( u +3 = α + 3)) ∧ (8) (( u ≥ α + 3) ∧ ( u j-3 = I + 2) ⇒ ( u = u +3 ))].
The subformula decorated by a curly bracket with (4) states that if a location l encodes the instruction I and h j (l) has α+3 predecessors (i.e., counter c j has value zero), then the location h 3 (l) has J 1 + 2 predecessors (i.e., the next instruction is J 1 ). Similarly, the subformula decorated by a curly bracket with (5) states that if a location l encodes the instruction I and h j (l) has strictly more than α + 3 predecessors (i.e., counter c j has non-zero value), then the location h 3 (l) has J 2 + 2 predecessors (i.e., the next instruction is J 2 ). Moreover, the subformula decorated by a curly bracket with (6) states that if a location l has at least α + 3 predecessors and its jth ancestor has I + 2 predecessors (i.e., counter c j has non-zero value and we are really dealing with instruction I), then the number of predecessors of h 3 (l) is equal to the number of predecessors of l minus one, which corresponds to encode a decrement on counter c j . Subformulae (7) and (8) admit a similar reading.

It is now easy to show the following lemma since we have seen that all the constraints between consecutive configurations can be encoded in 1SL2, assuming that the heap encodes a data word in ([1, α] × N 2 ) + . Lemma 3.3.6. M has a halting run iff

dw(α, 2) ∧ ϕ f irst ∧ ϕ last ∧ I∈[1,α] χ I is satisfiable in 1SL2.
Below, we conclude by a major undecidability result.

Theorem 3.3.7. [START_REF] Demri | Two-variable separation logic and its inner circle[END_REF] 1SL2 satisfiability problem is undecidable.

We know that if the number of quantified variables is not restricted, 1SL(- * ) is undecidable too [START_REF] Brochenin | On the almighty wand[END_REF] and recently the satisfiability problem for 1SL2(- * ) has been shown undecidable as well [START_REF] Demri | Expressive completeness of separation logic with two variables and no separating conjunction[END_REF], but this requires a far more complex proof passing via an equivalence to weak second-order logic (see the main steps of the proof in forthcoming Section 3.4).

Expressive Completeness

In Section 1.3.3, we have seen how 1SL2 can be translated into 1DSOL. Below, we provide the translation in the other direction with the fragment 1SL2(- * ), which is much more complicated as explained below. Material from this section is quite involved and can be skipped for a first reading; it is mainly taken from the submitted paper [START_REF] Demri | Expressive completeness of separation logic with two variables and no separating conjunction[END_REF]. A reduction from 1DSOL into 1SL(- * ) can be also found in [START_REF] Brochenin | On the almighty wand[END_REF].

In order to express sentences in DSOL by sentences in 1SL2(- * ), a hybrid valuation is encoded in the heap by building a disjoint valuation heap that takes care of pairs of locations (for interpretation of second-order variables) and that takes care of locations (for interpretation of first-order variables). In principle, this makes sense since every heap has a finite domain and therefore there is always an infinite set of locations that is not in its domain. This leaves enough room to encode a finite amount of information such as the interpretation of second-order variables when they are interpreted by finite sets. We can easily add to the original heap with the magic wand; this permits us to create and update the valuation heap. However, we then must always be able to distinguish between the original heap and the valuation heap.

The main idea to build such a valuation heap rests on the fact that a pair of locations (l, l ) belongs to the interpretation of a second-order variable P i whenever l and l can be identified in the valuation heap by special patterns involving l and l that uniquely characterise the interpretation by P i . Similarly, a location l is the interpretation of a first-order variable whenever l can be identified in the valuation heap thanks to some dedicated pattern around l.

Before explaining further the general principles, let us first provide more information about the above-mentioned patterns. An entry of degree d ≥ 2 is a sequence of distinct locations l 1 , . . . , l d , l ind , l such that

• h(l 1 ) = • • • = h(l d ) = l ind , • l ind = d, • l 1 = • • • = l d = 0, and • h(l ind ) = l.
The location l is called the element, l ind the index and the locations l 1 , . . . , l d , the pins. Entries generalise the notions of forks and large forks from Section 3.2 and are called markers in [START_REF] Brochenin | On the almighty wand[END_REF]. See an entry of degree 4 in the middle of Figure 3.6. So, the pair of locations (l, l ) is identified as part of the interpretation of P i when l and l are elements of entries with very large degree. The abovementioned special patterns are therefore entries, but we require that the degree of the respective entries for l and l satisfy some arithmetical constraints, which is possible thanks to Theorem 3.2.5, and which allows us to relate l with l .

Then, the principle of the translation consists in building the valuation heap on demand (typically when a quantification appears) and to find special patterns involving entries with large degree whenever an atomic formula needs to be evaluated.

These principles have been introduced in [START_REF] Brochenin | On the almighty wand[END_REF] to translate 1DSOL formulae into 1SL(- * ) formulae. However, because we are restricted to two first-order variables and because we also require that the separating conjunction is banished, we present below a different way to apply these principles so that we can show that 1SL2(- * ) is expressively equivalent to DSOL (and therefore to 1WSOL).

This high-level description of the formula translation and of the encoding of some hybrid valuation in the heap hides many of the details, which can be found below. However, before explaining how we apply these principles within 1SL2(- * ), let us emphasise the most obvious and difficult problems to be solved:

• we must be able to distinguish the pairs of locations from distinct second-order variables,

• we also need to encode first-order valuations, and

• the main problem is certainly to access the original heap properly without interference from the valuation heap.

Left and right parentheses

We introduce variants of entries that are used as delimiters.

A left j-parenthesis of degree d ≥ 3 with j ≥ 0 is a sequence of distinct locations l j+1 , . . . , l 1 , l 1 , . . . , l d , l ind such that The location l ind is called the index. The heap at the left of Figure 3.6 presents a left j-parenthesis of degree 3.

(u) h(l 1 ) = • • • = h(l d ) = l ind ; l ind = d; l j+1 = l 3 = l 4 = • • • = l d = 0, (v) l ind dom(h); l j+1 → l j → l j-1 → • • • → l 1 → l 1 ; l j = l j-1 = • • • = l 1 = l 1 = 1,
A right j-parenthesis of degree d ≥ 3 with j ≥ 0 is a sequence of distinct locations l j+1 , . . . , l 1 , l j+1 , . . . , l 1 , l 1 , . . . , l d , l ind such that (u), (v), and

• l j+1 = 0, • l j = l j-1 = • • • = l 1 = l 2 = 1, and • l j+1 → l j → l j-1 → • • • → l 1 → l 2 .
The location l ind is also called the index. The heap at the right of Figure 3.6 presents a right j-parenthesis of degree 5. A j-parenthesis can be understood as an entry, except that the index location is not allocated, and containing one or two paths of length j + 1, depending whether it is a left or a right parenthesis.

Lemma 3.4.1. For all j ≥ 0, there is a formula lp j (u) [resp. rp j (u)] in 1SL2(- * ) such that for all heaps h and valuations f,

we have h | = f lp j (u) [resp. h | = f rp j (u)] iff f(u)
is the index of some left [resp. right] j-parenthesis in h.

Proof. Let us start by defining formulae for backward paths of length j + 1:

• bpath(1, u) def = ( u = 1) ∧ ∀ u (u → u) ⇒ u = 0. • bpath(j + 1, u) def = ( u = 1) ∧ ∃ u (u → u) ∧ bpath(j, u).
So, whenever j ≥ 0, we have h | = f bpath(j + 1, u) iff there are l 0 , . . . , l j such that

l 0 → l 1 → • • • → l j → f(u) and l 0 = 0, for every k ∈ [1, j] l k = 1 and f(u) = 1.
The formula below characterises the locations such that the predecessors either have no predecessor or have a backward path of length j + 1 exactly:

χ j+1 (u) def = ∀ u (u → u) ⇒ ( u = 0 ∨ bpath( j + 1, u)).
Then, the formulae lp j (u) and rp j (u) are defined as follows:

• lp j (u) def = ¬alloc(u) ∧ χ j+1 (u) ∧ ( u ≥ 3) ∧ (∃ u (u → u) ∧ bpath(j + 1, u)) ∧ ((size = 1) ¬ - * χ j+2 (u)). • rp j (u) def = ¬alloc(u) ∧ χ j+1 (u) ∧ ( u ≥ 3) ∧ (∃ u (u → u) ∧ bpath(j + 1, u)) ∧ ¬((size = 1) ¬ - * χ j+2 (u)) ∧ ((size = 1) ¬ - * ((size = 1) ¬ - * χ j+2 (u))).
The formula lp j (u) states that f(u) is not allocated, it has at least three predecessors and any predecessor of f(u) either has no predecessor or has a backward path of length j + 1. Moreover, there is at least one predecessor of f(u) that has a backward path of length j + 1 thanks to the satisfaction of the subformula (∃ u (u → u) ∧ bpath( j + 1, u)). Satisfaction of the subformula (size = 1) ¬ - * χ j+2 (u) entails that there is only one such backward path of length j + 1. A similar analysis can be performed with the formula rp j (u) with the exception that it is required to guarantee that there are exactly two predecessors of f(u) that have a backward path of length j + 1.

QED

In several places, we need to identify the indices from entries as well as their pins. Let eindex(u) be defined as follows:

eindex(u) def = ( z u ≥ 2) ∧ allzpred(u) ∧ ∃ u u → u
that characterises indices from entries. The formula z u ≥ 2 states that the number of predecessors of u with zero predecessor is at least 2 and allzpred(u) holds true when all the predecessors of u have no predecessor, see Exercise 3.5. Let epin(u) characterise pins from entries:

epin(u) def = ∃ u u → u ∧ eindex(u).
Similarly, we need to characterise the locations from parentheses. We already know how to identify their indices (Lemma 3.4.1). It remains to identify the other locations via the formula onpar i (u) to characterise the locations on some i-parenthesis: roughly speaking, such locations are exactly those that can reach the index of some i-parenthesis in less than i + 2 steps. Let onpar i (u) be the formula

onpar i (u) def = i+2 j=0 dist i (j, u) with dist i (0, u) def = lp i (u)∨rp i (u), and dist i ( j+1, u) def = ∃ u (u → u)∧dist i ( j, u) for all j ≥ 0.
Lemma 3.4.2. Let h be a heap, f be a valuation and i ≥ 0. Then, h | = f onpar i (u) iff f(u) is on some left or right i-parenthesis in h.

Proof. The proof takes advantage of the following properties.

• h | = f dist i ( j, u) iff f(u) can reach an index location from a left i-parenthesis or from a right i-parenthesis, in j steps for some j ≥ 0. The proof is obvious, by induction on j.

• If f(u) can reach an index location from an i-parenthesis, then f(u) is necessarily on an i-parenthesis.

• Every location on an i-parenthesis can reach its index in less than i + 2 steps.

As a conclusion, f(u) is on an i-parenthesis iff it can reach the index of some iparenthesis in less than i + 2 steps, which is exactly the way onpar i (u) is defined with the help of the generalised disjunction. QED

The role of parentheses

Before explaining the role of parentheses, we introduce the interval of variable indices [1, K] (K ∈ N \ {0}) assuming that for each j ∈ [1, K], either P j or u j occurs in the 1DSOL formula to be translated (but not both of them). So, the developments below are relative to a finite set of first-order and second-order variables and this is concretised by the interval [1, K] (always possible since a formula has a finite number of variables).

Let us come back to parentheses and assume that X is a subset of [0, K]. In an X-well-formed heap h (see Definition 3.4.9 below), the parentheses play the following role. For each j ∈ X, we have the index location lp j from a distinguished left j-parenthesis and the index location rp j from a distinguished right j-parenthesis. Moreover, let d l j = lp j and d r j = rp j (in h). When j ∈ X is related to a first-order variable, we require that d r j = d l j + 2 and there is an entry of degree d l j + 1 such that its element is understood as the interpretation of the variable u j (see Figure 3.6 with d r j = 5 and d l j = 3). That explains why the parentheses are viewed as delimiters.

Similarly, let {(l 1 , l 1 ), . . . , (l β , l β )} be a finite set of pairs of locations, understood as the interpretation of a second-order variable P j with j ∈ X. In h, there are 2β entries whose respective degrees are exactly {d l j + 3(i -1) + 1,

d l j + 3(i -1) + 2 : i ∈ [1, β]} with d r j = d l j + 3β + 1.
A pair of entries of respective degrees d l j + 3(i -1) + 1 and d l j + 3(i -1) + 2 have exactly as elements l i and l i respectively, which allows l length ( j + 1)

Figure 3.6: Encoding [u j → l].
to encode the pair (l i , l i ). All this underlying encoding makes sense only if the left and right parentheses as well as the entries whose degrees are related to their degrees are uniquely determined (see Condition (1) in Definition 3.4.5, below). For this reason, we introduce a left 0-parenthesis and a right 0-parenthesis with d r 0 = d l 0 + 1 (0 is not a variable index), the degree d l 0 is strictly greater than the degree of any location in the original heap, all degrees d l j with j 0 are strictly greater than d l 0 and finally, the above-mentioned entries and parentheses are the only ones with their respective degrees. This guarantees that any entry from a pair of entries with successive degrees serving for the interpretation of a second-order variable, cannot serve twice for another pair or for another variable. Below, we provide the technical developments.

We say that a heap h is made of entries and parentheses only def ⇔ every location in dom(h) belongs either to a left i-parenthesis for some i ≥ 0, to a right i-parenthesis for some i ≥ 0, or to an entry. Given a heap h made of entries and parentheses only, we define the set indspect(h) as follows: indspect(h) def = { l : l is the index of some entry or parenthesis in h} This set indspect(h) is called the index spectrum of h.

Let h B be a heap such that α = max({ l : l ∈ N}). For instance, if h B has empty domain, then α = 0.

We can now find locations in a heap with a maximal number of predecessors, and we conclude this section with a definition useful in later constructions. Let us introduce the formula maxdeg(u):

maxdeg(u) def = ¬∃ u u > u
Corollary 3.4.3. For all heaps h and valuations f,

we have h | = f maxdeg(u) iff f(u) = max({ l : l ∈ N}).
A valuation heap h V for h B is made of entries and parentheses only whose degrees are greater than max(3, α + 1). The heap h V satisfies the following simple conditions (more constraints will follow): min(indspect(h V )) is greater than the value max(3, α + 1) and it is witnessed by the degree of some left 0-parenthesis; each degree in indspect(h V ) is witnessed by exactly one entry or parenthesis. Formula indmin(u) below is satisfied in h = h B h V by a location l witnessing the minimal value in indspect(h V ):

indmin(u) def = lp 0 (u) ∧ (∀ u ((u u) ∧ lp 0 (u)) ⇒ u < u).
Thanks to Section 3.2, we know that it is possible to compare numbers of predecessors as expressed above. So, indmin(u) holds when f(u) is the unique location that is the index of some left 0-parenthesis with greatest degree. Lemma 3.4.4. Let f be a valuation and h be a heap. We have h | = f indmin(u) iff f(u) is an index of some left 0-parenthesis and there is no other location l f(u) such that l ≥ f(u) and l is the index of some left 0-parenthesis.

The proof is by an easy verification by using Lemma 3.4.1. Once a heap h satisfies the formula ∃ u indmin(u), the unique location l 0 such that h | = [u →l 0 ] indmin(u) (say with l 0 = d 0 ) plays the role of a delimiter between the original heap and the part of the heap that encodes the hybrid valuation.

We have seen that an index spectrum is defined for heaps made of entries and parentheses only. This is fine, but below we adapt the definition to heaps h satisfying ∃ u indmin(u). Let us define the set spect(h) as follows:

spect(h) def = { l : l is an index of some entry or parenthesis in h} ∩ [d 0 , +∞[.
The set spect(h) is called the spectrum of h. This illustrates how the location l 0 and the degree l 0 = d 0 play the role of separator between the original heap and the valuation heap.

The subheap encoding the valuation is made of parentheses and entries and we shall need to identify the indices of such patterns. The formula Lindex(u) defined below suffices for this purpose:

Lindex(u) def = (∃ u indmin(u)∧ u ≤ u)∧ i∈[0,K] (lp i (u)∨rp i (u)) ∨eindex(u)
(u is interpreted as a large index). Given X ⊆ [0, K], we shall use also the following formula:

Lindex X (u) def = (∃ u indmin(u)∧ u ≤ u)∧ i∈X (lp i (u)∨rp i (u)) ∨eindex(u) .
Entries and parentheses with large indices are also called large entries and parentheses, respectively. It is easy to define a large index that is also the index of a left [resp. right] parenthesis. Let llp i (u) def = Lindex(u) ∧ lp i (u) and lrp i (u) def = Lindex(u) ∧ rp i (u) (see Lemma 3.4.1). The large index with a maximal degree can be also characterised as follows:

maxLindex(u) def = (∀ u Lindex(u) ⇒ ( u ≤ u)) ∧ Lindex(u).
Below, we state how the parentheses are organised. Definition 3.4.5. Let X = {i 0 , . . . ,

i s } ⊆ [0, K] with 0 = i 0 < i 1 < • • • < i s . A heap h is X-almost-well-formed def ⇔ 1. For every j ∈ [0, s], there is a unique location l l j [resp. l r j ] such that h | = [u →l l j ] llp i j (u) [resp. h | = [u →l r j ] lrp i j (u)].
2. For every j ∈ [0, s], l l j < l r j , and l r 0 = l l 0 + 1.

3. For every j ∈ [1, s], we have l l j = l r j-1 + 1.

4. h | = [u →l r s ] maxLindex(u).
5. For every j ∈ [1, s], if i j is the index of a first-order variable, then l l j = l r j -2 (see Figure 3.6).

For every

j ∈ ([1, K] \ X), there is no location l such that h | = [u →l] llp j (u) ∨ lrp j (u). ∇
The definition for X-almost-well-formed heaps mainly specifies the existence of j-parentheses with j ∈ X and how their respective degrees are related. The degrees are organised as follows and they all belong to the spectrum of h (below we let d l j = l l j and d r j = l r j ).

d l 0 | = indmin(u) < d r 0 || d l 0 + 1 < d l 1 < d r 1 || d r 0 + 1 < d l 2 < d r 2 || d r 1 + 1 < . . . < d l s < d r s || d r s-1 + 1 | = maxLindex(u)
Moreover, when i j is the index of a first-order variable, we have d r j = d l j + 2.

Lemma 3.4.6. There exists a formula awfh X in 1SL2(- * )

such that h | = awfh X iff h is X-almost-well-formed.
The proof is left as Exercise 3.1. Let h be an X-almost-well-formed heap for some {0} ⊆ X ⊆ [0, K] and i ∈ X. We write vind i (u) to denote

Lindex(u) ∧ eindex(u) ∧ (∃ u llp i (u) ∧ u < u) ∧ (∃ u lrp i (u) ∧ u > u)
It characterises indices whose degree is strictly between the degree of some large left i-parenthesis and the degree of some large right i-parenthesis. We write degrees(i, h) to denote the set:

degrees(i, h) def = { l ∈ N : h | = [u →l] vind i (u), l ∈ N}.
Lemma 3.4.7. Let h be a heap such that h | = ∃ u indmin(u) and i ≥ 0 be such that there are unique locations lp and rp with h

| = [u →lp] llp i (u) and h | = [u →rp] lrp i (u).
For every l ∈ N, we have h | = [u →l] vind i (u) iff l is the index of some entry and lp < l < rp.

The proof of Lemma 3.4.7 is left as Exercise 3.2. The formula elt j (u) defined below holds true when u is interpreted as the element of the unique entry attached to the first-order variable u j .

elt j (u) def = ∃ u (u → u) ∧ vind j (u)
P i (u j , u k ) works (j < i < k): (l, l ) ∈ V h (P i ).
Then, the translation of P i (u j , u k ) can be designed as follows:

∃ u (elt j (u) ∧ ∃ u (u → u ∧ vind i (u) ∧ ∃ u ( u = u + 1 ∧ vind i (u) ∧ ∃ u (u → u ∧ elt k (u))))).
These definitions take advantage of the fact that there are unique large left and right parentheses for each variable index. Figure 3.7 illustrates the constraints satisfied by the formula when j < i < k. From left to right, the figure represents explicitly a left j-parenthesis, then a right j-parenthesis, then a left iparenthesis, a right i-parenthesis and a left k-parenthesis, followed finally by a right k-parenthesis. Other entries and parentheses are present in the figure, but they are represented by dots in order to focus on the memory cells relevant to evaluate the formula obtained by translation of P i (u j , u k ). The degrees of parentheses and entries increase from left to right.

Taking care of valuations

Now that we have a way of identifying that part of the heap that encodes our valuation, we turn our attention to encoding the valuation itself. Below, we introduce a condition for a subheap to be "glued" to an existing valuation. We distinguish three cases.

• A local 0-valuation is a heap made of a left 0-parenthesis of degree d and a right 0-parenthesis of degree d + 1 only, for some d ≥ 3.

• Let i ∈ [1, K] be the index of some first-order variable. A local i-valuation is a heap made of a left i-parenthesis of degree d, an entry of degree d + 1 and a right i-parenthesis of degree d + 2 only, for some d ≥ 3.

• Let i ∈ [1, K] be the index of some second-order variable. A local i-valuation is a heap h such that 1. every location l in dom(h) belongs either to a left i-parenthesis, to a right i-parenthesis, or to an entry, 2. h contains a unique left [resp. right] i-parenthesis,

min(indspect(h))

is the degree of some left i-parenthesis,

max(indspect(h))

is the degree of some right i-parenthesis, 5. indspect(h) is of the form below for some α ≥ 3, β ≥ 0,

{α} ∪ {α + 3(i -1) + 1, α + 3(i -1) + 2 : i ∈ [1, β]} ∪ {α + 3β + 1} (when β = 0, indspect(h) is equal to {α, α + 1}),
6. there are no two distinct indices with the same degree.

Since local i-valuations are typically heaps that are added to the current heap to encode the interpretation of a variable, it is essential to be able to characterise them by 1SL2(- * ) formulae. This is the purpose of the result below.

Lemma 3.4.8. Let i ∈ [0, K]. There is a formula localval i (u) in 1SL2(- * ) such that h | = f localval i (u) iff h is a local i-valuation and f(u) is the index of its left i-parenthesis.

Proof. For characterising local 0-valuations, it is sufficient to express the properties below:

1. any location in the domain is on some left or on some right 0-parenthesis, 2. there is exactly one left 0-parenthesis whose index is f(u), 3. there is exactly one right 0-parenthesis, 4. l = f(u) + 1 where l is the index of the unique right 0-parenthesis.

(1)-( 4) can be expressed by the formula below:

(∀ u alloc(u) ⇒ onpar 0 (u)) ∧ (lp 0 (u) ∧ ¬(∃ u lp 0 (u) ∧ u u)) ∧ (∃ u (rp 0 (u) ∧ ¬(∃ u rp 0 (u) ∧ u u)) ∧ ( u = u + 1))
Formulae of the form lp i (u) and rp i (u) are provided in the proof of Lemma 3.4.1 whereas formulae of the form onpar i (u) are provided before Lemma 3.4.2.

For characterising local i-valuations for some first-order variable u i , it is sufficient to express the properties below:

1. any location in the domain is on some left i-parenthesis, or on some right iparenthesis or on some entry, 2. there is exactly one left i-parenthesis whose index is f(u),

3

. there is exactly one right i-parenthesis, 4. there is a unique entry, whose degree is d, such that l = f(u) + 2 and f(u) = d -1 where l is the index of the unique right i-parenthesis.

(1)-( 4) can be expressed by the formula below:

(∀ u alloc(u) ⇒ onpar i (u) ∨ epin(u) ∨ eindex(u))∧ (lp i (u)∧¬(∃ u lp i (u)∧u u))∧(∃ u (rp i (u)∧¬(∃ u rp i (u)∧u u)∧( u = u+2))∧ (∃ u eindex(u) ∧ (¬∃u (u u) ∧ eindex(u)) ∧ ( u = u + 1))
For characterising local i-valuations for some second-order variable P i , it is sufficient to express the properties below:

1. any location in the domain is on some left i-parenthesis, or on some right iparenthesis or on some entry, 2. there is exactly one left i-parenthesis whose index is f(u),

3

. there is exactly one right i-parenthesis whose index is the location l, 4. any entry has degree in [ f(u) + 1, l -1] and its index is the unique one with that degree, 5. l > f(u),

6. if l > f(u) + 1, then 1.
there is an entry with degree f(u) + 1, 2. there is an entry with degree f(u) + 2, 3. if there are entries with respective degree d and d + 1, then there is no entry or right i-parenthesis of degree d + 2, 4. if there are entries with respective degree d and d + 1 and d + 3 < l, then there are entries of respective degree d + 3 and d + 4.

(1)-( 5) can be expressed by the formula below:

(∀ u alloc(u) ⇒ onpar i (u) ∨ epin(u) ∨ eindex(u))∧ (lp i (u) ∧ ¬(∃ u lp i (u) ∧ u u)) ∧ (∃ u (rp i (u) ∧ ¬(∃ u rp i (u) ∧ u u) ∧ u > u)) ∀ u eindex(u) ⇒ ¬(∃ u ((eindex(u) ∨ lp i (u) ∨ rp i (u)) ∧ u = u) (∃ u rp i (u) ∧ (∀ u eindex(u) ⇒ u < u -1)) ∧ (∀ u eindex(u) ⇒ u > u)
(6a)-(6d) can be expressed by the formula below:

(∃ u rp i (u) ∧ u > u + 1) ⇒ (∃ u eindex(u) ∧ u = u + 1) ∧ (∃ u eindex(u) ∧ u = u + 2)∧ ∀ u (eindex(u)∧(∃ u eindex(u)∧ u = u+1)) ⇒ ¬(∃ u (eindex(u)∨rp i (u))∧ u = u+2)∧ ∀ u (eindex(u) ∧ (∃ u eindex(u) ∧ u = u + 1) ∧ (∃ u rp i (u) ∧ u > u + 3)) ⇒ ((∃ u eindex(u) ∧ u = u + 3) ∧ (∃ u eindex(u) ∧ u = u + 4))

QED

The definition for X-almost-well-formed heaps mainly takes care of parentheses. In Definition 3.4.9, constraints on the degrees of large indices are specified. Definition 3.4.9. Let X = {i 0 , . . . , i s } ⊆ [0, K] with 0 = i 0 < i 1 < • • • < i s . A heap h is X-well-formed def ⇔ the following conditions hold:

1. h is X-almost-well-formed, 2. for every j ∈ [1, s], if i j is the index of a first-order variable, then degrees(i j , h) is a singleton, 3. for every j ∈ [1, s], if i j is the index of a second-order variable, then degrees(i j , h) is the set below for some α j ≥ 3, β j ≥ 0:

{α j + 3(i -1) + 1, α j + 3(i -1) + 2 : i ∈ [1, β j ]},
4. for every location l such that h | = [u →l] Lindex(u), there is no l l such that h | = [u →l ] Lindex(u) and l = l . 5. If a location has degree greater than the degree of the unique large left 0parenthesis, then it is a large index.

(d) ∀ u (vind i j (u) ∧ (∃ u vind i j (u) ∧ u = u + 1) ∧ (∃ u lrp i j (u) ∧ u > u + 3)) ⇒ ((∃ u vind i j (u) ∧ u = u + 3) ∧ (∃ u vind i j (u) ∧ u = u + 4))].
The above formula expresses the conditions below, mimicking Condition (6) from the proof of Lemma 3.4.8:

(a) there is an entry with degree d l + 1 where d l is the degree of the unique left i j -parenthesis, (b) there is an entry with degree d l + 2, (c) if there are entries with respective degree d and d + 1 in degrees(i j , h), then there is no entry or right i j -parenthesis of degree d + 2 in degrees(i j , h), (d) if there are entries with respective degree d and d + 1 in degrees(i j , h) and d + 3 < d r where d r is the degree of the unique right i j -parenthesis, then there are entries of respective degree d + 3 and d + 4 in degrees(i j , h). QED Condition (4) is expressed as follows by simply internalising the condition in 1SL2(- * ):

∀ u Lindex(u) ⇒ ¬(∃ u Lindex(u) ∧ (u u) ∧ u = u).
Condition (5) can be expressed as follows:

∀ u (∃ u indmin(u) ∧ u ≥ u) ⇒ Lindex X (u).
Let us define formally a valuation from a valuation heap.

Definition 3.4.11. Let h be an X-well-formed heap for some {0} ⊆ X ⊆ [0, K].

• For every second-order i ∈ X, we define

V h (P i ) def = {(h V (l), h V (l )) : l = l+1, l, l ∈ degrees(i, h), l, l are index locations} • For every first-order i ∈ X, V h (u i ) def = h V (l)
where l is the unique index location such that l ∈ degrees(i, h).

We say that V h is the valuation extracted from h. ∇ Below, we present an essential technical result stating how heaps can be composed when a new variable needs to be interpreted. The formulae involved to compose the X-well-formed heap h and the local i-valuation heap h are directly used in the translation of quantified formulae (see Section 3.4.4). Lemma 3.4.12 is used in the proof of Lemma 3.4.13.

Lemma 3.4.12 (Composition). Let f be a valuation, h be an X-well-formed heap with {0} ⊆ X ⊆ [0, K], i ∈ [1, K] \ X with i > max(X), and h be a disjoint heap such that:

(I) h | = f indmin(u) ∧ isoloc(u), (II) h | = f localval i (u), (III) h h | = f wfh X∪{i} ∧ indmin(u) ∧ llp i (u).

Then, spect(h h ) = spect(h) indspect(h ).

Roughly speaking, Lemma 3.4.12 states that given an X-well-formed heap h, adding a disjoint local i-valuation h with i X, leads to an (X ∪ {i})-well-formed heap so that the interpretation of variables with variable indices in X from the extracted valuation, is the same with h and with h h . The heap h can be then understood as a conservative extension of the heap h.

The proof of Lemma 3.4.12 is quite combinatorial and this is the place where we check that the original heap cannot be confused with the valuation heap (and the other way around). It is important to guarantee, as the proof does, that adding a new part of the valuation does not destroy what has been built so far.

A reduction from DSOL into 1SL2(- * )

Below, we define a translation from a sentence ϕ in 1DSOL into a sentence in 1SL2(- * ) that uses only logarithmic space. Without any loss of generality, we assume that 1. two occurrences of quantified variables in ϕ have distinct variable indices (e.g., P 4 and u 4 cannot both occur in ϕ and "∀ u 4 " cannot occur more than once) and 2. if ∃ u i ψ 1 is a subformula of ∃ u j ψ 2 , then i > j and this holds for any combination of first-order/second-order variables.

At the outset, we may rename variables so that these simple conditions are satisfied. We assume that the variable indices for (first-order or second-order) variables are among [1, K].

The translation of the formula ϕ, written T(ϕ), first applies a top-level translation t top (•) which takes care of initialising the valuation heap; then, a recursive map t(•) is applied. So, T(ϕ) def = t top ϕ where t top ϕ is defined as follows:

t top ϕ def = ∃ u isoloc(u) ∧ (localval 0 (u) ¬ - * (wfh {0} ∧ indmin(u) ∧ (∀ u ((u u) ∧ ¬lrp 0 (u)) ⇒ ( u < u)) ∧ t {0}, ϕ ))
The first step of the translation consists in adding 0-parentheses so that the heap that evaluates t {0}, ϕ is {0}-well-formed. The translation map t(•) has two arguments: the formula to be transformed and the set of variable indices for variables that have been quantified so far. The map t(•) is inductively defined as follows (X ⊆ [0, K], ψ subformula of ϕ) and it is homomorphic for Boolean connectives:

t X, u i = u j def = ∃ u elt i (u) ∧ elt j (u) t X, u i → u j def = ∃ u ∃ u (elt i (u) ∧ elt j (u) ∧ u → u) t X, P i (u j , u k ) def = ∃ u (elt j (u) ∧ ∃ u (u → u ∧ vind i (u)∧ ∃ u u = u + 1 ∧ vind i (u) ∧ ∃ u (u → u ∧ elt k (u)) )) t X, ∃ u i ψ def = ∃ u ∃ u ((indmin(u) ∧ isoloc(u)) ∧ (localval i (u) ¬ - * (wfh X∪{i} ∧ indmin(u) ∧ llp i (u) ∧ t X ∪ {i}, ψ ))) t X, ∃ P i ψ def = ∃ u ∃ u ((indmin(u) ∧ isoloc(u)) ∧ (localval i (u) ¬ - * (wfh X∪{i} ∧ indmin(u) ∧ llp i (u) ∧ t X ∪ {i}, ψ ))).
Every subformula t X, ψ has no free variable from free(ψ) ⊆ X where free(ψ) denotes the set of variable indices in ψ from either first-order or second-order free variables.

Below, we state the correctness lemma that allows us to get Theorem 3.4.14 (the proof is by structural induction).

Lemma 3.4.13 (Correctness). Let ϕ be a DSOL sentence of the above form, ψ be one of its subformulae and (free(ψ) ∪ {0}) ⊆ X ⊆ [0, K]. Let h = h B h V be a X-well-formed heap and V h be the valuation extracted from h. Then,

h B | = V h ψ iff h | = t X, ψ .
Proof. The proof is by structural induction. Base case 1: ψ is equal to u i = u j . Since h is X-well-formed and i, j ∈ X, V h (u i ) is equal to h V (l) where l is the unique index location such that l ∈ degrees(i, h). Similarly,

V h (u j ) is equal to h V (l )
where l is the unique index location such that l ∈ degrees(j, h). Uniqueness is a consequence of Definition 3.4.9(2).

Let us recall that elt i (u

) = ∃ u (u → u) ∧ vind i (u) with vind i (u) = Lindex(u) ∧ eindex(u) ∧ (∃ u llp i (u) ∧ u < u) ∧ (∃ u lrp i (u) ∧ u > u). Similarly, elt j (u) = ∃ u (u → u) ∧ vind j (u).
First, let us suppose that h B | = V h u i = u j . This means that V h (u i ) and V h (u j ) are equal, say to l and therefore there is a unique index location l i such that h V (l i ) = l and l i ∈ degrees(i, h). Moreover, there is a unique index location l j such that h V (l j ) = l and l j ∈ degrees(j, h). Since l i and l j belong to the index spectrum of h V , the locations l i and l j , have the same number of predecessors in h and in h V and they are also indices in h (see Lemma 3.4.12). Consequently,

h | = [u →l ] elt i (u) ∧ elt j (u) (see also Lemma 3.4.7), whence h | = ∃ u elt i (u) ∧ elt j (u). Now suppose that h | = ∃ u elt i (u) ∧ elt j (u).
There is a location l such that h | = [u →l ] elt i (u) ∧ elt j (u). Therefore there are index locations l i and l j such that l i ∈ degrees(i, h), l j ∈ degrees( j, h), h(l i ) = l and h(l j ) = l . By Lemma 3.4.12, h V (l i ) = l , l i ∈ indspect(h V ), h V (l j ) = l and l j ∈ indspect(h V ). By definition of V h (see Definition 3.4.11), this implies that V h (u i ) = V h (u j ) and therefore

h B | = V h u i = u j .
Base case 2: ψ is equal to u i → u j . Again, since h is X-well-formed and i, j ∈ X, V h (u i ) is equal to h V (l) where l is the unique location such that l ∈ degrees(i, h). Similarly,

V h (u j ) is equal to h V (l)
where l is the unique location such that l ∈ degrees(j, h).

First, let us suppose that

h B | = V h u i → u j . This means that h B (V h (u i )) = V h (u j )
, and there is a unique location l i such that h V (l i ) = V h (u i ) and l i ∈ degrees(i, h). There is also a unique location l j such that h V (l j ) = V h (u j ) and l j ∈ degrees( j, h). Since l i and l j belong to the index spectrum of h V , the locations l i and l j , have the same number of predecessors in h and in h V and they are also indices in h (see Lemma 3.4.12). There are index locations l , l

such that h | = [u →l ,u →l ] elt i (u) ∧ elt j (u) ∧ u → u. Note that h B (V h (u i )) = V h (u j ) implies h(V h (u i )) = V h (u j ) since h B is a subheap of h. Consequently, h | = ∃ u ∃ u elt i (u) ∧ elt j (u) ∧ u → u. Now suppose that h | = ∃ u ∃ u elt i (u)∧elt j (u)∧u → u.
Consequently, there are locations l and l such that h | = [u →l ,u →l ] elt i (u)∧elt j (u)∧u → u. Therefore there are locations l i and l j such that l i ∈ degrees(i, h), l j ∈ degrees(j, h), h(l i ) = l , h(l j ) = l and of course h(l ) = l . By Lemma 3.4.12 and since indspect(h

V ) = spect(h), h V (l i ) = l , l i ∈ indspect(h V ), h V (l j ) = l and l j ∈ indspect(h V ). By construction of V h (see Definition 3.4.11), this implies that h(V h (u i )) = V h (u j ) and therefore h B | = V h u i → u j . Note that V h (u i ) dom(h V ) since h is X-well- formed.
Base case 3:

ψ is equal to P i (u j , u k ). Suppose that h B | = V h P i (u j , u k ). By definition of the satisfaction relation | =, this is equivalent to (V h (u j ), V h (u k )) ∈ V h (P i ). By definition of V h , V h (u j ) is equal to h V (l j ) where l j is the unique index location such that l j ∈ degrees(j, h). Sim- ilarly, V h (u k ) is equal to h V (l k ) where l k is the unique index location such that l k ∈ degrees(k, h). So, h | = [u →l j ] vind j (u) and h | = [u →l k ] vind k (u).
Moreover, by definition of V h , there are index locations l i and l i such that 1.

l i = l i + 1, 2. l i , l i ∈ degrees(i, h), 3. h(l i ) = V h (u j ) and h(l i ) = V h (u k ), 4. h | = [u →l i ] vind i (u) and h | = [u →l i ] vind i (u).
Finally, the formulae elt j (u) and elt k (u) are defined so that h

| = [u →V h (u j )] elt j (u) and h | = [u →V h (u k )] elt k (u). So, we have • l i → V h (u j ), • l i = l i + 1, • l i → V h (u k ).

This guarantees the satisfaction of

h | = ∃ u elt j (u) ∧ ∃ u u → u ∧ vind i (u)∧
∃ u u = u + 1 ∧ vind i (u) ∧ ∃ u (u → u ∧ elt k (u))
The proof in the other direction is by an easy verification and similar since all of the above implications are indeed equivalences.

Induction step. The induction hypothesis is the following: for every subformula ψ of size strictly less than the size of ψ, for every free(ψ

) ⊆ X ⊆ [0, K], we have h B | = V h ψ iff h | = t X , ψ .
The cases when the outermost connective is Boolean are by an easy verification.

Case 1:

ψ is equal to ∃ u i ψ . Suppose that h B | = V h ∃ u i ψ . By definition of the satisfaction relation | =, there is l ∈ N such that h B | = V h [u i →l] ψ . In case l belongs to the set Y defined below, Y = dom(h V ) ∪ {l ∈ N : h | = [u →l] j∈X (llp j (u) ∨ lrp j (u))}
(and therefore l is an isolated location in h B ), we pick another location l that does not belong to Y and that is also isolated in h B . It is then easy to show that

h B | = V h [u i →l] ψ iff h B | = V h [u i →l ] ψ . So,
without any loss of generality, below we assume that l does not belong to Y.

Let us build h i V and an assignment f such that: 1.

h i V | = f localval i (u), 2. h | = f indmin(u) ∧ isoloc(u), 3. h h i V | = f wfh X∪{i} ∧ indmin(u) ∧ llp i (u).
Assume that max(X) = j and m be the degree of the right j-parenthesis with greatest degree. It is easy to define a local i-valuation h i V disjoint from h such that the degree of the left i-parenthesis is m + 1, the degree of the right i-parenthesis is m + 3, the degree of the unique entry is m + 2, its element is precisely l and all the locations in its domain are isolated in h (always possible since dom(h) ∪ ran(h) is finite).

It is not difficult to check that h i V and f satisfy the above conditions. Since h h i V is (X∪{i})-well-formed by construction, by Lemma 3.4.12, we have

V h [u i → l] equal to V h h i V . Hence, h B | = V h h i V ψ

and by the induction hypothesis, we get

h h i V | = t X ∪ {i}, ψ .
However, it is easy to conclude then that h | = t X, ψ . Indeed, h satisfies the formula below

∃ u ∃ u (indmin(u) ∧ isoloc(u) ∧ (localval i (u) ¬ - *
logics restricted to two variables that are expressively complete, see e.g. [START_REF] Lutz | Modal logic and the two-variable fragment[END_REF][START_REF] Marx | Semantic characterizations of navigational XPath[END_REF]. We get the ultimate undecidability result below (no separating conjunction, two quantified variables, one record field).

Corollary 3.4.15. [DD14] The satisfiability problem for 1SL2(- * ) is undecidable.

The absence of program variables in the logic 1SL2(- * ) makes the proof of Corollary 3.4.15 even more difficult to design, which is perfect to obtain the sharpest undecidability result. An expressiveness result with program variables is possible and it is left as Exercise 3.6.

Theorem 3.4.16. The set of valid formulae in 1SL2(- * ) is not recursively enumerable.

Indeed, finitary validity for classical predicate logic restricted to a single binary predicate is not recursively enumerable, which implies a similar property for DSOL and therefore for 1SL2(- * ) by Theorem 3.4.14.

A quick argument for proving Theorem 3.4.16 consists in noting that secondorder logic is not finitely axiomatizable and 1SL2(- * ) is equivalent to it, but this would be too sloppy since there are so many variants of second-order logic, and some of them are indeed finitely axiomatizable. In order to be more precise and to show Theorem 3.4.16, a more direct proof consists in combining the following arguments.

• First-order theory of natural numbers with addition and multiplication is not recursively enumerable by Gödel's first incompleteness theorem.

• There is a logarithmic-space reduction tr 1 such that for any formula ϕ from first-order arithmetic, ϕ is valid iff tr 1 (ϕ) is valid in 1WSOL. To show this, it is sufficient to represent natural numbers by the cardinals of finite sets and to deal with addition and multiplication by performing equality tests between finite set cardinalities. This can be done by using dyadic or ternary predicate symbols, for instance to state the existence of some bijection between two finite sets (see Theorem 1.3.2). By way of example, the atomic formula u 1 × u 2 = u 3 amounts to check whether the product set made of the interpretation of the monadic second-order variables P 1 and P 2 has the same cardinality as the interpretation of the monadic second-order variable P 3 . Obviously, this assumes that each variable u i has a unique corresponding monadic second-order variable P i . So the formula u 1 × u 2 = u 3 can be encoded by: ∃ P PRODUCT(P, P 1 × P 2 ) ∧ EQCARD(P, P 3 ) where PRODUCT(P, P 1 × P 2 ) def = ∀ u, u P(u, u ) ⇔ P 1 (u) ∧ P 2 (u ). The formula EQCARD(P, P 3 ) stating that the interpretation of the binary second-order variable has the same cardinality as the interpretation of the unary second-order variable can be defined similarly, but this requires to introduce a ternary second-order variable specified as a bijection between the two sets.

Exercises

Exercise 3.1. Prove Lemma 3.4.6.

Exercise 3.2. Prove Lemma 3.4.7.

Exercise 3.3. Prove Theorem 3.4.14.

Exercise 3.4. Let 1SL ∞ be the variant of 1SL in which the heap domain can be either finite or infinite (in 1SL, the heap domain is necessarily finite). a) Show that the set of valid formulae for 1SL ∞ without separating connectives is recursively enumerable.

b) Define a formula seg in 1SL ∞ that characterises the segmented heaps, i.e. those heaps h such that dom(h) ∩ ran(h) = ∅ and no location has strictly more than one predecessor. c) Show that for any heap for 1SL ∞ , dom(h) is infinite iff h satisfies seg ¬ - * ∀ u alloc(u). d) Conclude that 1SL ∞ (with separating connectives) does not admit a recursively enumerable set of valid formulae.

Exercise 3.5.

a) Define a formula in 1SL2 that states that the number of predecessors of u with zero precedessor is at least 2.

b) Define a formula allzpred(u) in 1SL2(- * ) that holds true exactly when all the predecessors of u have no predecessor. c) Define a formula ( z u = 0) in 1SL2(- * ) that holds true exactly when all the predecessors of u have at least one predecessor.

d) Define a formula size = 1 in 1SL2(- * ) that holds true exactly when the heap domain has exactly one location (the separating implication - * is not even needed).

e) Assuming that ϕ charaterises the heaps such that the number of predecessors of u that have no predecessor is at most k-1, define a formula that characterises the heaps such that the number of predecessors of u that have no predecessor is at most k (by using size = 1, ϕ and the septraction operator).

f) Show that for all ∈ {≤, ≥, <, >} and k ≥ 2, there is a formula in 1SL2(- * ) that holds true exactly that the number n of predecessors of u that have no predecessor verifies n k.

Exercise 3.6. . Extend the translation provided in Section 3.4 to deal with program variables.

Bibliographical References on Expressiveness

Expressive completeness. The literature is rich with results comparing the expressive power of non-classical logics with most standard logics such as firstor second-order logic. For instance, the celebrated Kamp's Theorem [START_REF] Kamp | Tense Logic and the Theory of Linear Order[END_REF][START_REF] Rabinovich | A Proof of Kamp's theorem[END_REF] amounts to stating that linear-time temporal logic (LTL) is equal in expressive power to first-order logic. More generally, we know the expressive completeness of Stavi connectives for general linear time, see e.g. [START_REF] Gabbay | Temporal Logic: Mathematical Foundations and Computational Aspects[END_REF]. This has been refined to the restriction to two variables, leading to the equivalence between unary LTL and FO2, see e.g. [START_REF] Etessami | First-order logic with two variables and unary temporal logics[END_REF][START_REF] Ph | Expressiveness and Succinctness of First-Order Logic on Finite Words[END_REF]. Monadic second-order logic (MSO) is another yardstick logic and, for instance, it is well-known that ω-regular languages (those definable by Büchi automata) are exactly those definable in MSO, see e.g. [START_REF] Straubing | Finite Automata, Formal Logic, and Circuit Complexity[END_REF]. Similarly, extended temporal logic ETL, defined in [START_REF] Wolper | Temporal logic can be more expressive[END_REF] and extending LTL, is also known to be equally expressive with MSO. This applies also to linear µ-calculus [START_REF] Vardi | A temporal fixpoint calculus[END_REF] or to PSL [START_REF] Lange | Linear time logics around PSL: Complexity, expressiveness, and a little bit of succinctness[END_REF], to quote a few more examples. On non-linear structures, bisimulation invariant fragment of MSO and modal µ-calculus have been shown equivalent [START_REF] Janin | On the expressive completeness of the propositional mu-calculus with respect to monadic second order logic[END_REF]. In addition, there is a wealth of results relating first-order logic with two variables and non-classical logics, providing a neat characterisation of the expressive power of many formalisms since first-order logic and second-order logic are queen logics. For instance, Boolean modal logic with converse and identity is as expressive as first-order logic with two quantified variables (FO2) [START_REF] Lutz | Modal logic and the two-variable fragment[END_REF]. Sometimes, a third variable is needed to get expressive completeness. For instance, in [START_REF] Venema | A modal logic for chopping intervals[END_REF] it is proved that interval logic with connectives Chop, D and T is expressively complete over linear flows of time with respect to first-order logic restricted to three quantified variables. In the realm of interval temporal logics, we also know expressive completeness of metric propositional neighborhood logic with respect to the two-variable fragment of first-order logic for linear orders with successor function, interpreted over natural numbers [BDG + 10].

Expressiveness of separation logics It is known since [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF] that first-order separation logic with two record fields (herein called 2SL) is undecidable (see also Section 1.3.4) and this is sharpened in [START_REF] Brochenin | On the almighty wand[END_REF] by showing that 1SL is also undecidable, as a consequence of the expressive equivalence between 1SL and weak second-order logic. More recently, 1SL restricted to two variables (1SL2) is shown undecidable too [START_REF] Demri | Two-variable separation logic and its inner circle[END_REF] (see Section 3.3). From the very beginning, the relationships between separation logic and second-order logic have been quite puzzling (see e.g. an interesting answer with infinite arbitrary structures in [START_REF] Kuncak | On spatial conjunction as second-order logic[END_REF]). Moreover, comparisons of fragments have been also studied, for instance 1SL( * ) has been established strictly less expressive than MSO in [START_REF] Antonopoulos | Separating graph logic from MSO[END_REF] (see also the related work [START_REF] Marcinkowski | On the expressive power of graph logic[END_REF] or Section 4.4). So, in this chapter, we have shown that first-order separation logic with one record field, two quantified variables, and no separating conjunction is as expressive as weak second-order logic on heaps; in short, 1SL2(- * ) ≡ 1WSOL [START_REF] Demri | Expressive completeness of separation logic with two variables and no separating conjunction[END_REF]. Because we forbid ourselves the use of many syntactic resources, this underlines even further the power of the magic wand. By way of comparison with [GOR99, IRR + 04], we show undecidability of a two-variable logic with second-order features. Our main undecidability result cannot be derived from [GOR99, IRR + 04] since in 1SL models, we deal with a single functional binary relation, namely the finite heap.

Chapter 4 In this chapter, we investigate further how to reduce the satisfiability problem for non-classical logics into similar problems for separation logics. In Section 4.1, we introduce several versions of separation logics with data values and we show undecidability by reduction from the satisfiability problem for Freeze LTL. In that section, we also explain how to obtain undecidability of 1SL2 by reducing first-order logics on data words; this provides an alternative undecidability proof for 1SL2 (see also Section 3.3). Section 4.2 is dedicated to interval temporal logic PITL and we establish that the satisfiability problem for 1SL2( * ) is non-elementary by reduction from the satisfiability problem for PITL. Section 4.3 introduces a modal logic for heaps MLH and shows the decidability of MLH( * ) by translation into 1SL2( * ) by using a translation similar to the one from the modal logic K into FO2. The non-elementarity of the satisfiability problem for MLH( * ) is also established. Section 4.4 is about the decidability status of 1MSOL and 1SL( * ) and their difference of expressivenesss. 1SL( * ) is an important fragment to consider-and an important one to show decidable-as some verification applications do not require the use of the separating implication. 2. The satisfiability problem for 1SL2( * ) has non-elementary complexity (Theorem 4.2.7). This is shown by reduction from propositional interval temporal logic with the locality condition [START_REF] Demri | Two-variable separation logic and its inner circle[END_REF].

RELATIONSHIPS TO OTHER LOGICS

Highlights of the chapter

Data Logics

Separation logic with data

In memory states defined in Section 1.2.1, heaps are of the form N N k when k record fields are involved. No record field is really distinguished and the logic kSL mainly allows to reason about the shape properties of the heap (and not so much on functional correctness). However, it is often important to be able to reason about data values, a typical example would be to consider programs that produce sorted lists. In that case, we would like to specify that the values occurring in a list are linearly ordered. Pointer arithmetic is another means to reason about data values when the set of locations (herein, represented by the set N) is equipped with relations other than equality. Even though it is well-known that adding data domains easily leads to undecidable logics, see e.g. [DD07, BMS + 06], there exist several successful examples of logics able to reason about heap structures and data values, while having decidable reasoning tasks, see e.g. [START_REF] Bouajjani | Rewriting systems with data[END_REF][START_REF] Bansal | Beyond shapes: Lists with ordered data[END_REF][START_REF] Bouajjani | A logic-based framework for reasoning about composite data structures[END_REF][START_REF] Madhusudan | Decidable logics combining heap structures and data[END_REF][START_REF] Brochenin | Separation Logic: Expressiveness, Complexity, Temporal Extension[END_REF]. Reasoning about data values mainly means to be able to distinguish at least one record field dedicated to data values and to express data constraints in the formulae. That is why, in full generality, data domains need to be introduced in the semantics.

A data domain is a pair (D, (R i ) i∈I ) where D is a non-empty set, I is an index set and each R i is a relation of arity a(i) on D, that is, it is a subset of D a(i) . A typical example of data domain is (Z, <, =). The index set I is not necessarily finite and below, we assume that D is infinite and the family (R i ) i∈I contains the diagonal relation on D so that equality tests between data values can be expressed in the logic. Indeed, this makes the data domain all the more interesting and nontrivial. A memory state with data (with respect to the data domain (D, (R i ) i∈I )) is a triple (s, h, d) such that (s, h) is a memory state and d is a partial function N D. Below, we also assume that dom(h) = dom(d) in order to have correspondences between partial functions of the form N D × N k (the first record field is therefore dedicated to data values) and pairs of the form (h, d) when h is a heap with k record fields. This is analogous to what is defined in [START_REF] Bansal | Beyond shapes: Lists with ordered data[END_REF], a pioneering work for separation logic with data values but other options are possible, even though not investigated below.

The logic kSL[D, (R i ) i∈I ] is defined as kSL except that atomic formulae of the form R i (e 1 , . . . , e a(i) ) are added for each i ∈ I and the models are memory states with data with respect to (D, (R i ) i∈I ). In order to avoid confusion with equality between locations (by contrast to equality between their data values, if any), we write e ∼ e to denote the equality formula between two data values, following a similar convention from [BMS + 06]. For instance, linear ordered data domains have been considered in [START_REF] Demri | An automata-theoretic approach to constraint LTL[END_REF][START_REF] Segoufin | Automata based verification over linearly ordered data domains[END_REF] with LTL-like logics or in [START_REF] Bansal | Beyond shapes: Lists with ordered data[END_REF] with separation logic where 1SL[Z, ≤, =] has been investigated. The satisfaction relation is extended in order to cope with the new atomic formulae:

• (s, h, d) | = f R i (e 1 , . . . , e a(i) )
def ⇔ d( e 1 ), . . . , d( e a(i) ) are defined and R i (d( e 1 ), . . . , d( e a(i) ) )).

In the logic kSL[D, (R i ) i∈I ], there is no quantification on data values but this would be possible by defining a multi-sorted separation logic to distinguish locations from data values, as done in [START_REF] Bansal | Beyond shapes: Lists with ordered data[END_REF]. Similarly, the logics of the form kSL happen to be quite expressive (see Chapter 3) and adding the ability to reason about data can only increase the computational complexity of the reasoning tasks. That is why, most of the variants of separation logic with data considered in [START_REF] Bansal | Beyond shapes: Lists with ordered data[END_REF] As noted in [START_REF] Bansal | Beyond shapes: Lists with ordered data[END_REF], only short-distance comparisons are possible in 1SL sdc < and this may allow to specify sorted lists. For example, the formula below specifies that the list between x 1 and x 2 (assuming that reach(x 1 , x 2 ) ∧ alloc(x 1 ) ∧ alloc(x 2 ) holds true) is sorted:

∀u, u ((reach(x 1 , u) ∧ reach(u, u ) ∧ reach(u , x 2 )) ⇒ u ≤ u )
where ≤ is "less than or equal relation" that is definable in the data domain (Z, < , =).

Other types of logics with data have been considered in the literature. One of the most prominent ones is the logic STRAND introduced [START_REF] Madhusudan | Decidable logics combining heap structures and data[END_REF] that can state constraints on the heap structures but also on the data. Recursive structures are defined thanks to monadic second-order logic whereas the use of data constraints is significantly limited. The very combination of the two types of properties allow to reason with heap-manipulation programs using deductive verification and SMT solvers, such as Z3 [START_REF] De Moura | Z3: An Efficient SMT Solver[END_REF]. Another related logic is the one introduced in [START_REF] Bouajjani | A logic-based framework for reasoning about composite data structures[END_REF] for which a quite general framework is proposed to reason about heap structures and data values.

Undecidability for separation logic with data

The logic 1SL( * ) happens to be decidable (see forthcoming Section 4.4). Below, we show that 1SL3( * )[Z, =], i.e. 1SL3( * ) augmented with data values in which only equality tests are possible is undecidable. The definition of 1SL( * )[Z, =] can be found in Section 4.1.1. We provide a reduction from the satisfiability problem for some temporal logic with the freeze operator, see e.g. [START_REF] Demri | LTL with the freeze quantifier and register automata[END_REF][START_REF] Figueira | Future-looking logics on data words and trees[END_REF] whereas the original proof in [START_REF] Bansal | Beyond shapes: Lists with ordered data[END_REF] uses a first-order logic on data words.

Below, we only consider data words of dimension 0. In Section 3.1, we have seen that there is a formula dw(α, 0) such that h | = dw(α, 0) iff h is an (α, 0)fishbone. Let us consider a subclass of (α, 0)-fishbone heaps so that the main path has at least two locations. We write dw (α, 0) to denote the formulae characterizing such heaps. There is also a formula mp(u) in 1SL2( * ) such that for any (α, 0)-fishbone heap h with the above definition, h | = f mp(u) iff f(u) is on the main path and it has exactly one predecessor. Now, let us show that the satisfiability problem for 1SL3( * )[Z, =] is undecidable by designing a reduction from an undecidable logic whose models are data words. We have already explained how 1SL3( * )[Z, =] can encode data words. As mentioned earlier, there exist many formalisms to specify properties about data words; among them can be found temporal logics with the freeze operator [START_REF] Demri | LTL with the freeze quantifier and register automata[END_REF][START_REF] Figueira | Future-looking logics on data words and trees[END_REF]. Let LTL α ↓ (F,F -1 ) be the set of formulae defined as follows:

ϕ ::= a | ↑ | ↓ ϕ | ¬ϕ | ϕ ∧ ϕ | Fϕ | F -1 ϕ with a ∈ [1, α].
The operators F and F -1 are the standard (non-strict) temporal operators stating the existence of some future [resp. past] position satisfying a given property. The atomic formula ↑ and the freeze operator ↓ are interpreted as in hybrid logics [START_REF] Areces | Hybrid logics: characterization, interpolation and complexity[END_REF] except that instead of storing a node address, a data value is stored. Formulae in LTL α ↓ (F,F -1 ) are interpreted over data words dw =

(a 1 , v 1 ) • • • (a L , v L ) in ([1, α]×N) + via the satisfaction relation | = v (Boolean clauses are omitted and i ∈ [1, L]): dw, i | = v a def ⇔ a i = a dw, i | = v ↑ def ⇔ v i = v dw, i | = v ↓ ϕ def ⇔ dw, i | = v i ϕ dw, i | = v Fϕ def ⇔ there is i ∈ [i, L] such that dw, i | = v i ϕ dw, i | = v F -1 ϕ def ⇔ there is i ∈ [1, i] such that dw, i | = v i ϕ.
A sentence is satisfiable def ⇔ there is a data word dw in ([1, α] × N) + such that dw, 1 | = ϕ (no need to specify a data value since ϕ is closed). The satisfiability problem for LTL α ↓ (F,F -1 ) is known to be undecidable [START_REF] Figueira | Future-looking logics on data words and trees[END_REF]Theorem 4]. Let us define T(ϕ) as follows:

T(ϕ) def = dw (α, 0) ∧ tr(u 0 , ϕ) ∧ mp(u 0 ) ∧ ¬∃ u 1 (u 1 → u 0 ∧ mp(u 1 )) We aim at satisfying that ϕ is satisfiable iff T(ϕ) is satisfiable in 1SL3( * )[Z, =].
The map tr takes two arguments: a quantified variable among {u 0 , u 1 } (variables are indeed recycled, see e.g. [START_REF] Gabbay | Expressive functional completeness in tense logic[END_REF]) and a formula. A third variable u 2 is used but its purpose is to store a data value because of the presence of the freeze operator.

We define the logarithmic-space translation tr as follows (i ∈ {0, 1}) where tr is homomorphic for Boolean connectives:

tr(u i , ↑) def = (u 2 ∼ u i ) tr(u i , a) def = ( u i = a + 2) tr(u i , ↓ ψ) def = ∃ u 2 ((u 2 ∼ u i ) ∧ tr(u i , ψ)) tr(u i , Fψ) def = ∃ u 1-i (tr(u 1-i , ψ) ∧ mp(u 1-i ) ∧ last(u 1-i ) ∧ reach(u i , u 1-i )) tr(u i , F -1 ψ) def = ∃ u 1-i (tr(u 1-i , ψ) ∧ mp(u 1-i ) ∧ last(u 1-i ) ∧ reach(u 1-i , u i )).
We recall that u 2 ∼ u i holds true when u 2 and u i are allocated and have the same data value.

We have already seen how to define the formulae

u i = a + 2, reach(u i , u 1-i ), mp(u 1-i ) and dw (α, 0). It is easy to check that ϕ is satisfiable iff T(ϕ) is satisfiable in 1SL3( * )[Z, =] since the map tr only internalizes the semantics of LTL α ↓ (F,F -1 ) in 1SL3( * )[Z, =]. Theorem 4.1.1. [BBL09, Theorem 3]
The satisfiability problem for 1SL3( * )[Z, =] is undecidable.

Other undecidability results about separation logics with data values can be found in [START_REF] Bansal | Beyond shapes: Lists with ordered data[END_REF].

A decidable fragment

In Section 4.1.1, we introduce an extension of 1SL( * ) in which data interpreted in Z are added and can be compared only locally. The translation from 1SL( * ) to 1MSOL can be extended to 1SL sdc < , which provides a quite strong new decidability result.

First-order data logics

As mentioned earlier, there exist many formalisms to specify properties about data words; among them can be found first-order languages. Below, we recall a few standard definitions. Finally, we sketch the proof of a reduction from an undecidable variant of first-order logic on data words into 1SL2. These results show interesting relationships between first-order logics on data words and separation logics.

Let us present the first-order language FO2 α,β (<, +1, =, ∼, ≺) to interpret data words in ([1, α] × N β ) + following developments from [BDM + 11]. Most of the time, a fragment of the full language is needed, but it is helpful to provide the most general definition once and uniformly.

Let FO2 α,β (<, +1, =, ∼, ≺) be the set of formulae defined below:

ϕ ::= a(v) | v ∼ j v | v ≺ j v | v < v | v = 1+(v) | v = v | ¬ϕ | ϕ∧ϕ | ∃ v ϕ with v ::= u 1 | u 2 , j ∈ [1, β] and a ∈ [1, α].
When β = 0, this implies that there is no atomic formula using ∼ j or ≺ j . We write FO2 α,β (<, +1, =, ∼) to denote the restriction of FO2 α,β (<, +1, =, ∼, ≺) without ≺. Formulae in FO2 α,β (<, +1, =, ∼, ≺) are interpreted over data words

dw = (a 1 , v 1 1 , . . . , v 1 β ) • • • (a L , v L 1 , . . . , v L β ) in ([1, α] × N β ) + via the satisfaction relation | = f parameterised by f : {u 1 , u 2 } → [1, L]
(Boolean clauses are omitted, and i, i ∈ {1, 2}):

dw | = f a(u i ) def ⇔ a f(u i ) = a dw | = f u i ∼ j u i def ⇔ v f(u i ) j = v f(u i ) j dw | = f u i ≺ j u i def ⇔ v f(u i ) j < v f(u i ) j dw | = f u i = u i def ⇔ f(u i ) = f(u i ) dw | = f u i = 1 + (u i ) def ⇔ f(u i ) = f(u i ) + 1 dw | = f u i < u i def ⇔ f(u i ) < f(u i ) dw | = f ∃ u i ϕ def ⇔ there is p ∈ [1, L] such that dw | = f[u i →p] ϕ. A sentence ϕ in FO2 α,β (<, +1, =, ∼, ≺) is satisfiable def ⇔ there is a data word dw in ([1, α] × N β ) + such that dw | = ϕ (no need to specify a variable assignment since ϕ is closed).
Let us recall major results about FO2 on data words. Proposition 4.1.3(IV) shall be used in this section but decidability can be regained, as shown in [START_REF] Th | Two-variable logic and two order relations[END_REF], where finite satisfiability of FO2 over data words with a linear order on the positions and a linear order and a corresponding successor relation on the data values shown in EXPSPACE [START_REF] Th | Two-variable logic and two order relations[END_REF].

A slightly simpler undecidability proof for 1SL2 can be also obtained from the undecidability of the satisfiability problem for α≥1 FO2 α,1 (<, +1, =, ∼, ≺) on data words [BDM + 11] (see Theorem 4.1.3(IV)). Let us briefly provide the main ingredients for such a proof. We define a logarithmic-space translation tr as follows. A position u in the data word corresponds to a location on the main path of the fishbone encoding the same position but for the (unique) part related to the (unique) datum. In the translation process, we freely use macros defined earlier (i, j ∈ {1, 2}) and tr is homomorphic for Boolean connectives:

tr(u i = u j ) def = u i = u j tr(u i < u j ) def = reach(u i , u j ) ∧ u i u j tr(u j = 1 + (u i )) def = * (reach (u i , u j ) ∧ ( u +2 i = 1) ∧ ¬( u +3 i ≥ 0)) tr(a(u i )) def = ∃ u 3-i (u 3-i → u i ) ∧ ( u 3-i = a + 2) tr(u i ∼ 1 u j ) def = u i = u j tr(u i ≺ 1 u j ) def = u i + 1 ≤ u j tr(∃ u i ϕ) def = ∃ u i ( u i ≥ α + 3) ∧ tr(ϕ).
The arithmetical constraints of the form u i = u j and u i + 1 ≤ u j are those defined in Section 3.2 when the quantified variables are interpreted by locations on the main path of some (α, 1)-fishbone heap. (II) Let h be a heap such that h | = dw(α, 1) ∧ tr(ϕ), then there is a data word dw in ([1, α] × N) + such that h and h dw are isomorphic and dw | = ϕ.

As a corollary, the satisfiability problem for 1SL2 is undecidable.

Interval Temporal Logics

Interval-based temporal logics admit time intervals as first-class objects (instead of time points), and an early and classical study for reasoning about intervals can be found in [START_REF] Allen | Maintaining knowledge about temporal intervals[END_REF]. One of the most prominent interval-based logics is Propositional Interval Temporal Logic (PITL), introduced by Ben Moszkowski in [START_REF] Moszkowski | Reasoning about digital circuits[END_REF] for the verification of hardware components. It contains the so-called 'chop' operation that consists of chopping an interval into two subintervals. This is of course reminiscent of separating conjunction in separation logic, and in this section we make a formal statement about this correspondence. Before doing so, it is worth noting that even though most standard point-based temporal logics used in computer science are decidable (CTL, CTL , ECTL , etc.), undecidability is much more common in the realm of interval-based temporal logics (see e.g. [BMG + 14]). Below, we consider PITL in which propositional variables are interpreted under the locality condition and for which decidability is guaranteed but computational complexity is very high. This will allow us to derive similar bounds for 1SL2( * ). Below, we recall the main definitions about PITL under the locality condition and we explain why formulae from PITL can be faithfully translated into formulae in 1SL2( * ), leading to insights about both formalisms and new complexity results.

The logic PITL

Given α ≥ 1, we consider the finite alphabet Σ = [1, α] and we write PITL Σ to denote propositional interval temporal logic in which the models are non-empty finite words in Σ + . We write PITL instead of PITL Σ when the finite alphabet Σ is clear from the context. Formulae for PITL Σ are defined according to the following abstract grammar:

ϕ ::= a | pt | ¬ϕ | ϕ ∧ ϕ | ϕ C ϕ
with a ∈ Σ. Even though elements of Σ are natural numbers (for the sake of technical convenience), we write a to denote such an arbitrary element in order to emphasise that a is a letter from a finite alphabet. Roughly speaking, a holds true at word w when a is the first letter of w. Similarly, the atomic formula pt holds true at a word w when the word w is only a single letter. The connective C is the chop operator, which chops a word.

Formally, we have a nonempty word w ∈ Σ + , its length |w|, extractions of the ith letter w i where 1 ≤ i ≤ |w|, and extractions of nonempty subwords w i..j = w i w i+1 ..w j , where 1 ≤ i ≤ j ≤ |w|. We define a ternary relation chops on words:

chops def = {(w 1 , w 2 , w 3 ) | ∃ a, w , w s.t. w 1 = w aw , w 2 = w a, w 3 = aw } .
Observe that when a word w 1 is chopped into two subwords w 2 and w 3 , there is an overlap between the last letter of w 2 and the first letter of w 3 . For instance, (abb, ab, bb) ∈ chops but (ab, a, b) chops.

Let us define the satisfaction relation | = for PITL Σ between a word w ∈ Σ + and a formula ϕ:

w | = a def ⇔ the first letter of w is a w | = pt def ⇔ the length of w is equal to one w | = ¬ϕ def ⇔ w | = ϕ w | = ϕ ∧ ψ def ⇔ w | = ϕ and w | = ψ w | = ϕ C ψ def ⇔
there exist words w 1 , w 2 such that chops (w, w 1 , w 2 ), w 1 | = ϕ and w 2 | = ψ.

The satisfiability problem for PITL Σ consists in checking whether a PITL Σ formula admits a model satisfying it. Note that the models are nonempty, finite words and the satisfaction of a letter on a word depends only on its first letter (the locality condition).

Two examples Consider the alphabet Σ with two distinct letters a and b and the PITL Σ formula below:

(b C a) C ¬pt
This formula is satisfiable; many words satisfy this formula, for example the word "bab"-the top-level chop is satisfied since ba | = b C a and ab | = ¬pt. This gives insight on how to specify a lower bound on word length, by applying sufficiently many chops and ¬pt to force a particular (minimum) length. Of course, b C a also enforces a minimum word length (of 2), but constrains also the word content.

Consider another example:

pt ∧ (a C b) .
For this formula to be satisfiable, there must exist a word w for which both w | = pt and w | = a C b. This is impossible, as the first implies |w| = 1, and there is no way to chop a single-letter word into subwords that satisfy both a and b; the formula is unsatisfiable.

Proposition 4.2.1. (see e.g. [START_REF] Moszkowski | Reasoning about digital circuits[END_REF][START_REF] Moszkowski | A hierarchical completeness proof for propositional interval temporal logic with finite time[END_REF]) Given α ≥ 1 and Σ = [1, α], the satisfiability problem for PITL Σ is decidable, but with α ≥ 2 is not elementary recursive.

A correspondence between words and heaps

From now on, we use the data word representation from Section 3.1. Thanks to Lemma 3.1.3, we know there is a fishbone heap h w corresponding to each nonempty word w ∈ Σ + . Let us define a relation ∼ that establishes this correspondence between words and their fishbone representations, adding also a correspondence between the empty word and the empty heap:

∼ def = (w, h w ) | w ∈ Σ + ∪ {(ε, ∅)} .
Here, observe that:

1. ∼ is a bijection between the set of finite words in Σ * and the set of (equivalence classes of isomorphic) (α, 0)-fishbone heaps augmented with the empty heap;

2. so, every word w is in dom(∼); 3. so, every (α, 0)-fishbone heap is in ran(∼); 4. so, if w ∼ h, h is either empty or an (α, 0)-fishbone heap; and 5. if w ∼ h, then w is empty iff dom(h) is empty.

In this section, we will only employ (α, 0)-fishbone heaps, with α = card(Σ).

The correspondence between finite words in Σ + and (α, 0)-fishbone heaps satisfies a nice property as far as splitting a word into two disjoint subwords is concerned (which is a slight variant of chopping). Before making a formal statement, let us introduce the following notion.

A clean cut of a (α, 0)-fishbone heap h is a pair of (α, 0)-fishbone heaps (h 1 , h 2 ) such that h = h 1 h 2 , and for some words w 1 ∼ h 1 and w 2 ∼ h 2 , we have w 1 w 2 ∼ h. That is, a clean cut is one that neatly cleaves a heap representation of a word into two subheaps in correspondence with two subwords. Figure 4.1 illustrates examples of a clean cut and a non-clean cut on a fishbone heap. Clockwise from left: the original (α, 0)-fishbone heap; a clean cut of the original heap; a non-clean cut of the original heap. Note that clean cuts must result in two (α, 0)-fishbone heaps. A non-clean cut may or may not do so; the figure depicts a non-clean cut that does result in two (α, 0)-fishbone heaps. Informally, a non-clean cut is one that either results in one subheap (or both) no longer satisfying the (α, 0)-fishbone conditions, or that results in subheaps that don't preserve predecessor counts and thus don't represent subwords of the original.

• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • Figure 4.1: A visual depiction of clean and non-clean cuts. Lemma 4.2.2. Let w ∼ h with w = w 1 w 2 ∈ Σ * . There exist heaps h 1 and h 2 such that h = h 1 h 2 , w 1 ∼ h 1 , and w 2 ∼ h 2 .
Proof. Suppose that w ∼ h and w = w 1 w 2 ∈ Σ * . If w 1 = ε or w 2 = ε, then the proof is by an easy verification with h equal to h 1 or h 2 respectively. In particular, if w = ε, then h is the empty heap and therefore w 1 = w 2 = ε and h 1 = h 2 = ∅, which satisfies the statement.

Otherwise suppose that w

= a 1 • • • a K ∈ Σ + , w 1 = a 1 • • • a K ∈ Σ + , w 2 = a K +1 • • • a K ∈ Σ + (K > K ).
Since w is nonempty and w ∼ h, h is a fishbone heap and the main path of h is of the form l 1 -→ l 2 -→ • • • -→ l K and for every i ∈ [1, K], l i = a i + 2. Let h 1 be the subheap of h whose domain is {l ∈ N : l is an ancestor of l K in h}, and let h 2 be the unique heap such that h = h 1 h 2 . It is easy to show that w 1 ∼ h 1 and w 2 ∼ h 2 . Moreover, it is not difficult to see that (h 1 , h 2 ) is a clean cut of h. QED Lemma 4.2.2 entails the following lemma, that will be useful to show the correctness of our reduction from PITL Σ into 1SL2( * ). It is tailored to the semantics of the chop operator in PITL Σ .

Lemma 4.2.3. For all letters a, b ∈ Σ, words w ∈ Σ + and w , w ∈ Σ * , and heaps h such that w ∼ h and chops (aw, aw b, bw ), there exist heaps h 1 , h 2 such that w b ∼ h 1 , w ∼ h 2 , and h = h 1 h 2 .

A reduction and its three ways to chop

In this section, we present a satisfiability-preserving translation of PITL Σ into 1SL2( * ). This translation hinges on the insight that the chop operation is very similar to the separating conjunction in separation logic. However, the correspondence is not an exact one: the connective C of PITL Σ does not cut into disjoint pieces, but rather preserves one letter on both sides, in a sense "duplicating" the letter upon which the chop operates.

To handle this discrepancy, our translation uses the standard separating conjunction on heaps, but internally carries a "ghost letter" (a parameter to the translation) on one side to represent this "lost" letter. In the translation, we denote this ghost letter parameter a ∈ Σ. Figure 4.2 illustrates how a chop operation on words is translated into a separation on heaps. It is worth noting that we must always obtain a clean cut from the original heap.

Before presenting the formal definition of the translation, let us present a formula that allows us to perform a clean cut for which one of the subheaps contains all the ancestors of f(u). Such a formula will be used in the translation and this is the purpose of Lemma 4.2.4 below. Lemma 4.2.4. Given a fishbone heap h and a word w such that w ∼ h, and an assignment f such that f(u) is a location on the main path of h with h | = f alloc(u), any pair of heaps Proof. Since h 1 | = f dw(α, 0) and h 2 | = f dw(α, 0), we know the heaps h 1 and h 2 are (α, 0)-fishbones. Fishbones are single components, so we know that h must be separated into exactly two connected components. It remains to analyse precisely how h can be separated into two fishbones, and to show that it must be a clean cut.

(h 1 , h 2 ) such that h = h 1 h 2 , h 1 | = f dw(α, 0) ∧ ¬alloc(u), and h 2 | = f dw(α, 0) ∧ u = 0, is a clean cut of h.
We know l = f (u) is on the main path of h, so that means h | = f u > 0. Since h 2 | = f u = 0, that means l must have the same number of predecessors in h as it does in h 1 . We know h 1 | = f ¬alloc(u), and we know l has at least one predecessor in h 1 . Therefore, l is on the main path of h 1 . We know h 2 | = f u = 0, so l is not on the main path of h 2 . However, it is allocated (since h | = f alloc(u) and h 1 | = f ¬alloc(u)), so its successor (call the location l ) is on the main path of

h 2 . Let f = f [u → l ]. Now, note that h | = f u → u and h 1 | = f u → u,
and recall that that on a fishbone, no two predecessors of an element can both have predecessors (fb3). Therefore, l must have the same number of predecessors in h 2 as it did in h, and none of these predecessors can be on the main path.

Thus l is the final location on the main path of h 1 , and l is the first location on the main path of h 2 . Further, l has 0 predecessors in h 2 and the same number of predecessors in h and h 1 . l has 0 predecessors in h 1 and the same number of predecessors in h and h 2 .

Putting the above together, since l and l are positions on the main path of h such that h(l) = l , and since l dom(h 1 ), l ∈ dom(h 2 ), l ∈ ran(h 1 ), l ran(h 2 ), we must have a clean cut.

QED

We reduce a PITL Σ formula ϕ to a 1SL2( * ) formula t ϕ with the help of the main translation t(•). We use the auxiliary translation map t a (•) parameterised by a ghost letter a. The three disjuncts in the translation of ϕ C ψ correspond to three types of chopping of w that leads to three ways of separating the heap h (assuming that w ∼ h):

1. When (w, aw 1 b, bw 2 ) ∈ chops and the ghost letter is a, the heap h is separated into the heap h 1 with w 1 b ∼ h 1 (with ghost letter a) and into the heap h 2 with w 2 ∼ h 2 (with ghost letter b).

2. When (w, w, b) ∈ chops and the ghost letter is a, the heap h is separated into itself (again with ghost letter a) and into the empty heap (with ghost letter b).

3. When (w, a, w) ∈ chops and the ghost letter is a, the heap h is separated into the empty heap (with ghost letter a) and into itself (again with ghost letter a).

These are the three possible cases and the rest of the translation is quite straightforward.

t ϕ def = dw(α, 0) ∨ emp ∧ a∈Σ t a ϕ
The map t a (•) is homomorphic for Boolean connectives and it is defined as follows for the remaining cases:

t a (b) def = if b = a t a (b) def = ⊥ if b a t a (pt) def = emp t a ϕ C ψ def = chop1 a ∨ chop2 a ∨ chop3 a (see below) chop1 a def = b∈Σ ∃ u( u = b + 2 ∧ [dw(α, 0) ∧ ¬alloc(u) ∧ t a ϕ * dw(α, 0) ∧ u = 0 ∧ t b ψ ]) chop2 a def = b∈Σ (∃ u last(u) ∧ u = b + 2) ∧ [t a ϕ * (emp ∧ t b ψ )] chop3 a def = (emp ∧ t a ϕ ) * t a ψ
Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI '15 In full generality, t a (•) is also parameterised by the alphabet Σ (see the clause for formulae with outermost chop operator C) and the formulae chop1 a , chop2 a , and chop3 a are parameterised by ϕ C ψ. Clearly the translation t(•) can only produce 1SL2( * ) formulae, as the right-hand side of each translation step above is in 1SL2( * ). Note also that t a ϕ always produces a closed formula (i.e., without free occurrences of individual variables).

The correctness of the translation is stated below, making completely explicit the role of the ghost letter in the translation process.

Lemma 4.2.5. Let a ∈ Σ, w ∈ Σ * , and h be a heap such that w ∼ h. For every PITL Σ formula ϕ, we have aw

| = ϕ iff h | = t a ϕ .
Since t a ϕ has no free occurrences of individual variables, in Lemma 4.2.5, there is no need to specify what the assignments are. The proof is by structural induction and it is left as Exercise 4.3.

As a result, we obtain a reduction between the satisfiability problems, as stated below.

Lemma 4.2.6. Given α ≥ 1 and Σ = [1, α], a PITL Σ formula ϕ is satisfiable if and only if the 1SL2( * ) formula t ϕ is satisfiable.

Proof. (⇒) Suppose that ϕ is satisfiable. This means that there exists a nonempty word w such that w | = ϕ. The word w can be written in the form w = aw for some letter a. If w = ε, we have w ∼ ∅ and by Lemma 4.2.5, we have ∅ | = emp ∧ t a ϕ . So ∅ | = t ϕ and therefore t ϕ is satisfiable. If w ε, then there is a (α, 0)-fishbone heap h such that w ∼ h . By Lemma 4.2.5, we have h | = dw(α, 0) ∧ t a ϕ . So h | = t ϕ and therefore t ϕ is satisfiable.

(⇐) If t ϕ is satisfiable, then there exists a heap h such that

h | = (dw(α, 0) ∨ emp) ∧ a∈Σ t a ϕ .
If h | = emp ∧ t a ϕ for some letter a, then by Lemma 4.2.5, we have a | = ϕ. Otherwise, if h | = dw(α, 0) ∧ t a ϕ , then h is an (α, 0)-fishbone heap by Lemma 3.1.2 and then there is a word w such that w ∼ h such that by Lemma 4.2.5, we have aw | = ϕ. In both cases, ϕ is a satisfiable formula in PITL Σ . QED Theorem 4.2.7. The satisfiability problem for 1SL2( * ) is decidable but not elementary recursive.

Proof. Satisfiability for PITL Σ is known to be decidable with non-elementary complexity when Σ has at least two elements, see e.g. [START_REF] Moszkowski | Reasoning about digital circuits[END_REF][START_REF] Moszkowski | A hierarchical completeness proof for propositional interval temporal logic with finite time[END_REF], and 1SL( * ) is decidable [START_REF] Brochenin | On the almighty wand[END_REF] (see also Section 4.4). From the correctness of our translation t(•) of PITL Σ to 1SL2( * ) (Lemma 4.2.6), we then conclude that 1SL2( * ) is decidable but not elementary recursive. Note that the map t(•) may require exponential time and space in the size of the input formula in the worst-case but this is still fine to establish that 1SL2( * ) is not elementary recursive, since this adds only a single exponential. QED

As mentioned earlier, Theorem 4.2.7 refines the non-elementarity result for 1SL( * ) established in [START_REF] Brochenin | On the almighty wand[END_REF]. So, solving the satisfiability problem for 1SL2( * ) requires time bounded below by towers of exponentials of height that depend on the formula size, see e.g. [START_REF] Schmitz | Complexity hierarchies beyond Elementary[END_REF].

Remark. The reduction from PITL to 1SL2( * ) [START_REF] Demri | Two-variable separation logic and its inner circle[END_REF] allows us to underline the common features of both formalisms. To our knowledge, this is the first time that the similarity has been turned into a concrete, interesting result. The possibility to relate separation logic and interval temporal logic has been already envisaged by Tony Hoare, see e.g. [START_REF] Zhou Chaochen | Logics of Specification Languages, chapter Reviews on "Duration Calculus[END_REF] (We thank Ben Moszkowski for pointing us to this work.) However, non-elementarity of 1SL2( * ) can be established in a slightly different way as explained below. First, non-elementarity of PITL is due to Dexter Kozen (see e.g. [Mos04, Appendix A.3]) (We thank Ben Moszkowski for pointing us to this fact.), and the proof is by reduction from the nonemptiness problem of regular expressions built over a binary alphabet with union, concatenation and complement [START_REF] Stockmeyer | The complexity of decision problems in automata theory and logic[END_REF]. Nonelementarity of 1SL2( * ) can be obtained by defining a similar reduction, but this is of course less insightful to understand the relationships between interval temporal logic and separation logic. Alternatively, it is also possible to consider the variant of PITL in which the chop operator does not share a letter, since this variant is of identical expressive power and complexity. In that way, we may avoid the introduction of the ghost letter but at the cost of introducing empty models (which may occur when chopping has no sharing) and of using a less standard interval temporal logic. So, the current reduction from PITL is quite an attractive option to relate the logics. Finally, as noted in [Mos04, Appendix A], complexity results about PITL presented in [START_REF] Moszkowski | Reasoning about digital circuits[END_REF] were obtained in collaboration with Joseph Halpern.

In Section 4.3.2 below, we establish an even stronger result about 1SL2( * ) (see Theorem 4.3.5). The proof uses the same principles as for the proof of Theorem 4.2.7 and we only need to express the properties in modal lingua.

Modal Logics

A modal logic for heaps

Let us introduce a new modal logic that is closely related to 1SL2. Modal Logic for Heaps (MLH) is a multimodal logic in which models are exactly heap graphs and it does not contain propositional variables (as 1SL does not contain unary predicate symbols). In a sense, it is similar to Hennessy-Milner logic HML [START_REF] Hennessy | On observing nondeterminism and concurrency[END_REF] in which the only atomic formulae are truth constants. However, the language contains modal operators and separating connectives, which is a feature shared with the logics defined in [START_REF] Courtault | A modal BI logic for dynamic resource properties[END_REF]. We define below the formulae of the modal logic MLH.

ϕ ::= ⊥ | ¬ ϕ | ϕ ∧ ϕ | ϕ | -1 ϕ | ϕ | ϕ | ϕ * ϕ | ϕ - * ϕ.
There are no quantified variables involved in formulae, which is a feature shared with most known propositional modal logics, see e.g. [START_REF] Blackburn | Modal Logic[END_REF]. We write MLH( * ) to denote the fragment of MLH without the magic wand operator - * .

A model for MLH M is a pair (N, R) such that R is a binary relation on N that is finite and functional. Otherwise said, the models for MLH are heap graphs (when the heaps encode a unique record field, i.e. k = 1). Models for MLH could be alternatively defined as heaps but we prefer to stick to the most usual presentation for modal logics with frames. The satisfaction relation | = is defined below and it provides a standard semantics for the modal operators and separating connectives (we omit the clauses for Boolean connectives):

never M, l | = ⊥ M, l | = ϕ def ⇔ there is l such that (l, l ) ∈ R and M, l | = ϕ M, l | = -1 ϕ def ⇔ there is l such that (l , l) ∈ R and M, l | = ϕ M, l | = ϕ def ⇔ there is l such that (l, l ) ∈ R * and M, l | = ϕ (R * is the reflexive and transitive closure of R) M, l | = ϕ def ⇔ there is l l such that M, l | = ϕ M, l | = ϕ 1 * ϕ 2 def ⇔ (N, R 1 ), l | = ϕ 1 and (N, R 2 ), l | = ϕ 2 for some partition {R 1 , R 2 } of R M, l | = ϕ 1 - * ϕ 2 def ⇔ for all models M = (N, R ) such that R ∩ R = ∅ and R ∪ R is functional, M , l | = ϕ 1 implies (N, R ∪ R ), l | = ϕ 2
We use the following standard abbreviations:

U ϕ def = ϕ ∨ ϕ [U]ϕ def = ¬ U ¬ϕ [ ]ϕ def = ¬ ¬ϕ -1 ≥k def = -1 * • • • * -1 (k ≥ 1 times) -1 ≤k-1 def = ¬ -1 ≥k -1 [k 1 ,k 2 ] def = -1 ≥k 1 ∧ -1 ≤k 2 -1 =k def = -1 ≥k ∧ -1 ≤k
Whenever ϕ is already in MLH( * ), these abbreviations allow to remain in MLH( * ).

A formula ϕ is satisfiable whenever there is a model M and a location l such that M, l | = ϕ. The satisfiability problem for MLH is therefore defined as any such problem for modal logics.

Note that MLH has forward and backward modalities as in Prior's tense logic (see e.g. [START_REF] Prior | Past, Present and Future[END_REF]), the inequality modal operator (see e.g. [dR92]) and the transitive closure operator as in PDL (see e.g. [START_REF] Harel | Dynamic Logic[END_REF]). The most non-standard feature of MLH is certainly the presence of the separating connectives.

It is possible to design a relational translation from MLH formulae into 1SL2 formulae by recycling variables (only u 1 and u 2 are used, so i ∈ {1, 2}) and tr is homomorphic for the connectives ¬, ∧, * and - * :

tr(⊥, u i ) def = ⊥ tr( ϕ, u i ) def = ∃ u 3-i (u i → u 3-i ) ∧ tr(ϕ, u 3-i ) tr( -1 ϕ, u i ) def = ∃ u 3-i (u 3-i → u i ) ∧ tr(ϕ, u 3-i ) tr( ϕ, u i ) def = ∃ u 3-i (u i u 3-i ) ∧ tr(ϕ, u 3-i ) tr( ϕ, u i ) def = ∃ u 3-i reach(u i , u 3-i ) ∧ tr(ϕ, u 3-i ).
The formulae of the form reach(u i , u i ) have been introduced in Section 1.2.2 and states the reachability of u i from u i .

Lemma 4.3.1. A formula ϕ in MLH is satisfiable iff ∃ u 1 tr(ϕ, u 1 ) is satisfiable in 1SL2. Moreover, if ϕ is in MLH( * ), then ∃ u 1 tr(ϕ, u 1 ) is in 1SL2( * ).
Proof. (sketch) The proof is obtained as an obvious adaptation of the proof for the relational translation from modal logic K into FO2, see e.g. [START_REF] Ch | Methods for automated theorem proving in non classical logics[END_REF][START_REF] Van Benthem | Correspondence Theory[END_REF][START_REF] Blackburn | Modal Logic[END_REF]. Indeed, the models (N, R) for MLH are heap graphs and therefore formulae in 1SL2 can be equivalently interpreted on MLH models; for instance, we get (N, R)

| = f u 1 → u 2 iff (f(u 1 ), f(u 2 )) ∈ R. Similarly, (N, R) | = f ϕ 1 - * ϕ 2 iff for all MLH models (N, R ) such that (N, R ∪ R ) is an MLH model too and (N, R ) | = f ϕ 1 , we have (N, R ∪ R ) | = f ϕ 2 .
Note that u j is the only free variable in tr(ϕ, u j ). The standard translation tr is semantically faithful in the following sense: for all MLH models (N, R), l ∈ N and formulae ϕ in MLH, we have (N, R), l | = ϕ iff (N, R) | = [u 1 →l] tr(ϕ, u 1 ). This is sufficient to establish Lemma 4.3.1.

We show that for all i ∈ {1, 2}, for all formulae ψ in MLH, for all MLH models M = (N, R) and for l ∈ N, we have

M, l | = ψ iff M | = [u i →l] tr(ψ, u i ).
The proof is by structural induction. The base case for ⊥ and the cases in the induction step for the Boolean connectives are straightforward. By way of example, let us provide the cases in the induction step for ψ = ψ and for ψ = ψ 1 * ψ 2 . The proof for the other cases is similar and quite standard. Case ψ = ψ . The following are equivalent:

• M, l | = ψ, • M, l | = ψ for some l ∈ R * (l) (by definition of | =), • M | = [u 3-i →l ] tr(ψ , x 3-i ) for some l ∈ N such that l ∈ R * (l) (by the induction hypothesis), • M | = [u i →l] ∃ u 3-i reach(u i , u 3-i ) ∧ tr(ψ , x 3-i ) (by definition of | = in 1SL2
and by the fact that reach is the reachability predicate),

• M | = [u i →l] tr(ψ, u i ) (

by definition of tr).

Case ψ = ψ 1 * ψ 2 . The following are equivalent:

• M, l | = ψ, • (N, R 1 ), l | = ψ 1 and (N, R 2 ), l | = ψ 2 for some partition {R 1 , R 2 } of R, (by definition of | = in MLH), • (N, R 1 ) | = [u i →l] tr(ψ 1 , u i ) and (N, R 2 ) | = [u i →l] tr(ψ 2 , u i ) for some partition {R 1 , R 2 } of R, (by the induction hypothesis), • M | = [u i →l] tr(ψ 1 , u i ) * tr(ψ 2 , u i ) (by definition of the satisfaction relation in 1SL2) • M | = [u i →l] tr(ψ, u i ) (

by definition of tr). QED

Modal logic MLH can be viewed as a fragment of 1SL2. Any formula ψ 1 * ψ 2 [resp. ψ 1 - * ψ 2 ] in tr(ϕ, u 1 ) has at most one free variable. A similar restriction can be found in monodic fragments for first-order temporal logics, see e.g. [START_REF] Degtyarev | Equality and monodic firstorder temporal logic[END_REF].

Since MLH( * ) can be translated into 1SL2( * ) and 1SL( * ) is decidable [BDL12, Corollary 3.3] (see also Section 4.4), we get decidability of MLH( * ) as a corollary.

Corollary 4.3.2. The satisfiability problem for MLH( * ) is decidable.

Note that to be more uniform, we could have added to the modal language the converse operators -1 and -1 . However, since the inequality relation is symmetric, -1 ϕ is logically equivalent to ϕ. The above translation can be obviously extended with the modal operator -1 and therefore decidability holds also for this extension. However, we have introduced MLH mainly to establish non-elementarity of MLH( * ) (shown below), refining the result for 1SL2( * ). We did not include -1 because the proof of non-elementarity result does not require it. By contrast, we do not know whether the satisfiability problem for MLH is decidable. As far as we know, the characterisation of the computational complexity of MLH without separating connectives is open too. This corresponds to a fragment of deterministic PDL with (restricted) graded modalities and inequality modality.

A refinement with the modal fragment of 1SL2( * )

In this section, we show that the satisfiability problem for MLH( * ) is decidable but it is not elementary recursive. Decidability is due to the fact that the standard translation leads to formulae in 1SL2( * ), see Section 4.3.1. In order to establish the lower bound, we express in MLH( * ) all the properties that were useful to translate PITL Σ formulae into 1SL2( * ). For instance, note that the empty heap is the only heap validating the formula ([U]¬

). Similarly, a location with at least one predecessor and with no successor (for instance, last location on the main path in a fishbone heap) satisfies the formula ( -1 ∧ ¬

). More interestingly, the formula in 1SL2( * ) characterising the (α, β)-fishbone heaps has a modal counterpart. Let us consider the following formulae.

• The formula ϕ fb defined below is designed exactly as the formula ϕ fb (see Section 3.1).

( U )∧ U (( -1 ∧¬ )∧[ ]¬( -1 ∧¬ ))∧[U]( ⇒ ( -1 ∧¬ ))∧ (¬ U ( -1 -1 * -1 -1 )).
This is a faithful translation except that we use the specification language MLH( * ).

• The formula ϕ (C1) defined below is also designed exactly as the formula ϕ (C1) (see Section 3.1).

U (( -1 ) ∧ (¬ -1 -1 ) ∧ -1 [3,α+3] ). • The formula ϕ (C2) is equal to [U]( -1 [3,α+3] ⇒ i∈[1,β] i times • • • -1 ≥α+3 ).
• The formula ϕ (C3) is defined below:

[U]( -1 [3,α+3] ⇒ (¬ β+1 times • • • ) ∨ β+1 times • • • ( -1 [3,α+3] )).
We write dw (α, β) to denote the formula ϕ fb ∧ϕ (C1) ∧ϕ (C2) ∧ϕ (C3) . It specifies the shape of the encoding of data words in ([1, α] × N β ) + as stated below. Note that since dw (α, β) is a Boolean combination of formulae whose outermost connectives are [U] or U , then dw (α, β) holds true at some location iff dw (α, β) holds true at any location.

Lemma 4.3.3. Let M = (N, R) be a model for MLH. M, l | = dw (α, β) for some location l iff M is the graph of an (α, β)-fishbone heap.

Again, the proof is by an easy verification by using Lemma 3.1.1 and the correspondence between condition (Ci) and the formula ϕ (Ci) . In the rest of this section we are back to the case β = 0.

Given a formula ϕ in PITL Σ with Σ = [1, α], we define a modal formula t ϕ such that ϕ is satisfiable iff t ϕ is satisfiable. Actually, the modal formula t ϕ will express exactly the same properties as in the translation into 1SL2( * ). For instance, t ϕ is precisely the formula below:

(dw (α, 0) ∨ ([U]¬ )) ∧ ( a∈Σ t ϕ a )
The formula t ϕ a is defined inductively as follows. • t(•) a is homomorphic for Boolean connectives.

• t(pt) a def = ([U]¬ ).

• The formula t ϕ C ψ a is defined as chop1 a ∨ chop2 a ∨ chop3 a where:

-chop1 a def = b∈Σ U (( -1 =b+2 ∧ dw (α, 0) ∧ ¬ ∧ t ϕ a ) * (dw (α, 0) ∧ ¬ -1 ∧ t ψ b )), -chop2 a def = ( b∈Σ U (( -1 ∧ ¬ ) ∧ -1 =b+2 ) ∧ (t ϕ a * (t ψ b ∧ ([U]¬ )))), -chop3 a def = ((t ϕ a ∧ ([U]¬ )) * t ψ a ). Lemma 4.3.4. Let α ≥ 1, Σ = [1, α]
, ϕ be a PITL Σ formula and t ϕ be its translation in MLH. We have ϕ is satisfiable iff t ϕ is satisfiable.

The proof goes as in the case for the direct translation into 1SL2( * ) since the modal subformulae express exactly the same properties. Therefore, we can refine Theorem 4.2.7 as follows.

Theorem 4.3.5. The satisfiability problem for MLH( * ) is decidable but not elementary recursive.

Interestingly, we do not know the decidability status for full MLH (i.e., with the magic wand operator).

Monadic Second-Order Logic

We have seen that 1SL( * ) is decidable with non-elementary recursive complexity (actually two variables suffice). Below, we briefly explain why decidability comes from the decidability of 1MSOL and we provide a property that can separate the expressive power of 1SL( * ) and 1MSOL.

First, note that 1MSOL on memory states with one record field is decidable by taking advantage of [START_REF] Rabin | Decidability of second-order theories and automata on infinite trees[END_REF][START_REF] Börger | The Classical Decision Problem[END_REF]. Indeed, the weak monadic second-order theory of unary functions is the theory over structures of the form (D, f, =) where D is a countable domain, f is a unary function, and = is equality. Weakness means that quantifications are over finite sets.

MONADIC SECOND-ORDER LOGIC

This theory is decidable, see e.g. [START_REF] Börger | The Classical Decision Problem[END_REF]Corollary 7.2.11]. Since it is possible to express that D is infinite and to simulate that f is a partial function with finite domain, one can specify that (D, f, =) augmented with a first-order valuation is isomorphic to a heap. It is then possible to define a simple translation tr P (.), computable in logarithmic space, such that a 1MSOL sentence ϕ is satisfiable iff infinity (¬∃ P ∀u P(u)) ∧∃ P tr P (ϕ) is satisfiable in the weak monadic second-order theory of one unary function. See details in [START_REF] Brochenin | On the almighty wand[END_REF]. Using a similar technique, it is possible to translate 1SL( * ) into 1MSOL. Any formula ϕ in 1SL( * ) is satisfiable iff

∃ P (∀u P(u) ⇔ (∃u u → u )) ∧ tr P (ϕ)
is satisfiable where tr P (•) is defined with the following clauses:

tr P (u → u ) def = P(u) ∧ u → u tr P (u = u ) def = u = u tr P (ϕ * ψ) def = ∃ Q, Q (P = Q Q ) ∧ tr Q (ϕ) ∧ tr Q (ψ)
where P = Q Q is an abbreviation for ∀u (P(u) ⇔ (Q(u)∨Q (u)))∧¬(Q(u)∧Q (u)).

We leave out the Boolean connectives and first-order quantification, for which tr P is homomorphic.

Theorem 4.4.1. [BDL12, Corollary 3.3] The satisfiability problem for 1SL( * ) is decidable.

As conjectured in [START_REF] Brochenin | On the almighty wand[END_REF], we have the following separation result.

Proposition 4.4.2. [AD09, Corollary 5.3] (see also [START_REF]Expressive Power of Query Languages[END_REF]) 1SL( * ) is strictly less expressive than 1MSOL.

A standard tool to show non-expressibility in first-order logic or in secondorder logic is to use Ehrenfeucht-Fraïssé games, see e.g. [START_REF] Libkin | Elements of Finite Model Theory[END_REF] (called EFgames in the sequel). These games have been adapted for some versions of separation logic, see e.g. [START_REF] Antonopoulos | Separating graph logic from MSO[END_REF][START_REF]Expressive Power of Query Languages[END_REF] based on similar games on spatial logics [START_REF] Dawar | Adjunct elimination through games in static ambient logic[END_REF][START_REF] Marcinkowski | On the expressive power of graph logic[END_REF][START_REF] Dawar | Expressiveness and complexity of graph logic[END_REF]. In [START_REF] Antonopoulos | Separating graph logic from MSO[END_REF][START_REF]Expressive Power of Query Languages[END_REF], using EF-games, it is shown that there is no formula in 1SL( * ) that characterises the forests of binary trees such that there is one binary tree whose number of leaves is a multiple of 3.

Even though the principle of the method with EF-games is standard, the proof is quite complex and tedious, since it requires designing two families of heaps, to define an adequate strategy for the Duplicator player and to show that the strategy does the job, see e.g. [START_REF]Expressive Power of Query Languages[END_REF] for most of the details as well as for additional bibliographical references. In particular, Duplicator has a winning strategy for a game on (h 1 , h 2 ) with rank r iff h 1 and h 2 agree on all formulae of 1SL( * ) of rank r. See [START_REF]Expressive Power of Query Languages[END_REF] for more details about the notion of game and rank, for instance.

By way of example, we explain below why the above-mentioned property can be expressed in 1MSOL. First, let us express in 1SL( * ) that the heap is a forest of binary trees, which entails that this can be stated in 1MSOL too. It is sufficient to state that every location has at most two predecessors and every location l can reach a non-allocated location (the root of the tree to which l belongs too if l is in the heap domain):

∀ u ( u ≤ 2 ∧ ∃ u (reach(u, u) ∧ ¬alloc(u))).
Note that the quantification above is fine even when u is not in the heap domain (take the value for u to witness the satisfaction of ∃ u (reach(u, u)∧¬alloc(u))). In order to express in 1MSOL that there is a binary tree whose number of leaves is a multiple of 3, we first identify the locations of the tree (via the second-order variable P), we label each location of the tree by either P 0 , P 1 and P 2 (depending on the number of leaves (modulo 3) below the location) and we state consistency constraints (obviously simulating the behavior of some bottom-up three-state tree automaton) and finally we require that the root of the tree is labelled by P 0 . The formula defined below assumes that the heap is already known as a forest of binary trees.

∃ u (¬alloc(u) ∧ u ≥ 1) ∧ ∃ P, P 0 , P 1 , P 2 ((∀ u P(u) ⇔ reach(u, u)) ∧ (P = P 0 P 1 P 2 ) ∧ P 0 (u) ∧

(∀ u (P(u) ∧ u = 0) ⇒ P 1 (u))∧ (∀ u, u ((u → u ) ∧ P(u) ∧ u = 1) ⇒ 2 i=0 (P i (u) ⇔ P i (u )))∧ i, j,k∈{0,1,2},i≡ 3 j+k (∀ u, u , u (P j (u )∧P k (u )∧(u u )∧(u → u)∧(u → u)) ⇒ P i (u)))
Note that we used a shortcut formula (P = P 0 P 1 P 2 ) to state that the interpretation of P is the disjoint union of the interpretation of P 0 , P 1 and P 2 , details are omitted.

Exercises

Exercise 4.1. Given α ≥ 1, define a formula mp(u) that holds true on (α, 1)fishbone heaps whenever u is interpreted as a location on the main path.

Exercise 4.2. Assuming that card(Σ) ≥ 2, show that computing t ϕ (in Section 4.2.3) may require exponential time in the worst-case. Exercise 4.5. Show that the formula below holds true on heaps that are made of a (finite) collection of trees in which each node has branching-degree at most two.

∀ u ( u ≤ 2 ∧ ∃ u (reach(u, u) ∧ ¬alloc(u))).
Exercise 4.6. Design a formula in 1MSOL that characterises the forests of binary trees such that there is one tree whose number of leaves is a multiple of 5. Numerous decision procedures have been designed for fragments of separation logics, from analytic methods [START_REF] Galmiche | Tableaux and resource graphs for separation logic[END_REF][START_REF] Hou | Proof search for propositional abstract separation logics via labelled sequents[END_REF] to translation to theories handled by SMT solvers [PWZ13, PR13, BRK + 15], passing via graph-based algorithms [START_REF] Haase | SeLoger: A tool for graph-based reasoning in separation logic[END_REF]. However, the framework of satisfiability modulo theories (SMT), strongly related to the mechanisation of the problems SAT and QBF, remains probably the most promising one to develop decision procedures dedicated to reasoning tasks for separation logics. This chapter is dedicated to present several distinct ways to decide fragments of separation logics. Section 5.1 briefly presents the standard dichotomy between the direct approach and the translation-based approach to decide non-classical logics. In Section 5.2 we present a translation from a symbolic heaps fragment of separation logic into the logic GRASS, following developments in [START_REF] Piskac | Automating separation logic using SMT[END_REF]. In Section 5.3, we establish that the satisfiability and model-checking problems for 1SL0 can be solved in polynomial space by using a non-deterministic algorithm. An equivalence relation on memory states with finite index is designed so that infinity involved in the interpretation of the magic wand operator can be tamed finitely. Then, we characterise precisely the expressiveness of 1SL0 and it is the key step to show a small heap property. Section 5.4 presents a translation from 1SL0 into QBF and into a PSPACE fragment of first-order logic by encoding the quantifications in the algorithm from Section 5.3. The chapter concludes by Section 5.5 in which bibliographical references about the design of proof systems are provided.

Highlights of the chapter

Direct Versus Translation Approach

5.1.1 Direct approach versus translation for deciding modal logics

In order to mechanise modal logics, there exist at least two main approaches with well-identified motivations. The direct approach consists in building specialised proof systems for the logics and requires building new theorem provers but, it has the advantage to design fine-tuned tools and to propose plenty of optimizations.

The development of tableaux-based provers for modal logics following the seminal work [START_REF] Fitting | Proof methods for modal and intuitionistic logics[END_REF] perfectly illustrates this trend (see also [START_REF] Gasquet | Kripke's Worlds -An Introduction to Modal Logics via Tableaux[END_REF]). By contrast, the translation approach consists in reducing decision problems for the original logics to similar problems for logics that have already well-established theorem provers (see e.g. [START_REF] De Nivelle | Resolution-based methods for modal logics[END_REF]). Its main advantage is to use existing tools and therefore to focus only on the translations, that are usually much simpler to implement. For example, translation of modal logics into first-order logic, with the explicit goal to mechanise such logics is an approach that has been introduced in [START_REF] Ch | Methods for automated theorem proving in non classical logics[END_REF] (see also [START_REF] Fine | Some connections between elementary and modal logic[END_REF][START_REF] Van Benthem | Correspondence Theory[END_REF][START_REF] Moore | Reasoning about knowledge and action[END_REF]) and it has been intensively developed over the years, see e.g. [START_REF] Ohlbach | Encoding two-valued non-classical logics in classical logic[END_REF] for an overview.

Translation versus specialised algorithms for separation logic

Despite its young age, one can observe that the mechanisation of separation logic follows a similar dichotomy. This is all the more obvious nowadays since there are a lot of activities to develop verification methods with decision procedures for fragments of practical use, see e.g. [CHO + 11]. Many decision procedures have been designed for fragments of separation logics or abstract variants, from analytic methods [START_REF] Galmiche | Tableaux and resource graphs for separation logic[END_REF][START_REF] Hou | Proof search for propositional abstract separation logics via labelled sequents[END_REF] to translation to theories handled by SMT solvers [START_REF] Lahiri | Back to the future: revisiting precise program verification using SMT solvers[END_REF][START_REF] Piskac | Automating separation logic using SMT[END_REF], passing via graph-based algorithms [START_REF] Haase | SeLoger: A tool for graph-based reasoning in separation logic[END_REF]. The translation approach has been already advocated in [START_REF] Calcagno | From separation logic to firstorder logic[END_REF] and in [START_REF] Hague | Static checkers for tree structures and heaps[END_REF]Chapter 8] in which propositional kSL0 is translated into a fragment of classical logic that can be decided in polynomial space (see Section 5.4 for an alternative presentation of that result). However, the framework of satisfiability modulo theories (SMT) remains probably the most promising one to develop decision procedures dedicated to reasoning tasks for separation logics, see e.g [BPS09, RBHC07, PR13, PWZ13]. It is worth noting that the verification of programs that manipulate linked-list structures can be also done with a SAT solver, when the assertions are written in some restricted logical formalism, see a remarkable example in [IBI + 13]. In Section 5.4, we illustrate why QBF solvers (see e.g. [START_REF] Lonsing | DepQBF: A dependency-aware QBF solver[END_REF][START_REF] Heule | A unified proof system for QBF preprocessing[END_REF]) can be useful too.

The SMT framework

Deciding logical formulae within a given logical theory is ubiquitous in computer science and the works around Satisfiability Modulo Theories (SMT) are dedicated to solve this problem by providing methods, proof systems and solvers in order to be able to decide as much theories as possible, as well as their combination (see e.g. [START_REF] Barrett | Satisfiability Modulo Theories[END_REF]). Nowadays, SMT solvers are essential for most tools that formally verify programs, from bounded model-checking to abstraction-based model-checking (actually the number of applications seems unbounded). Roughly speaking, decision problems for many verification problems are reduced to the satisfiability of formulae in specific first-order/quantifier-free theories that can be handled by SMT solvers. Typical theories are quantifier-free Presburger arithmetic (also known as linear integer arithmetic LIA) or the theory of equality over uninterpreted functions (EUF).

A nice feature of such solvers is their ability to combine distinct theories allowing to express richer statements. As advocated in [START_REF] Navarro Pérez | Separation Logic Modulo Theories[END_REF][START_REF] Piskac | Automating separation logic using SMT[END_REF], being able to integrate decidable fragments of separation logic in some SMT solver not only allows to decide satisfiability or entailment problems by taking advantage of the technology behind SMT solvers but also it provides an efficient way to combine separation logics with other theories, such as linear arithmetic LIA. Actually, the seminal paper [START_REF] Piskac | Automating separation logic using SMT[END_REF] provides a translation of SLLB (see also Section 5.2) into a decidable fragment of first-order logic and a decision procedure has been implemented in an SMT solver. This provides an important step to integrate reasoning about separation logic into SMT solvers. The paper [BRK + 15] goes even beyond since it presents how SMT solvers can be used systematically to obtain decision procedures for a class of theories that are decidable by using a finite instantiation of (quantified) axioms. Some strongly related work can be also found in [START_REF] Navarro Pérez | Separation Logic Modulo Theories[END_REF] in which the constraints added to list segments are much more general than pure equalities. Besides, the first competition of solvers for several fragments of separation logic was held recently, see e.g. [START_REF] Sighireanu | Report on SL-COMP 2014[END_REF], witnessing how promising appears this research direction. In the article [START_REF] Sighireanu | Report on SL-COMP 2014[END_REF] reporting the competition SL-COMP 2014, more can be found about the list of solvers that competed as well as the fragments of sep-aration logic that have been considered (roughly, symbolic heaps with recursive definitions, see also Sections 2.2 and 1.3.3). By way of examples, we list below solvers for separation logics involving SMT-based or SAT-based tools [START_REF] Sighireanu | Report on SL-COMP 2014[END_REF].

1. Asterix [START_REF] Navarro Pérez | Separation Logic Modulo Theories[END_REF] is a tool for solving entailment problem for symbolic heaps fragment augmented with theories richer than the one with pure equalities only that relies on SMT solving technology (Z3). This provides a generalization to what has been done in [START_REF] Piskac | Automating separation logic using SMT[END_REF], even though results in [START_REF] Piskac | Automating separation logic using SMT[END_REF] are not restricted to the theory of pure equalities.

SLSAT [BFGN14, SC14

] is a tool for solving the satisfiability problem for the so-called SLRD+ fragment with general defined predicates.

SPEN [ESS13

] is a solver that deals with satisfiability and entailment problems for SLRD+ for a subclass of recursive definitions. The solver MiniSAT is also used to resolve Boolean abstraction of separation logic formulae.

In order to solve decision problems for separation logics, there is indeed a great diversity of techniques. As we have seen, there are reductions to SAT or SMT problems [PR13, BFGN14, SC14, ESS13] but other approaches exist, for instance by reduction into tree automata membership/inclusion problems [START_REF] Enea | Compositional invariant checking for overlaid and nested linked lists[END_REF][START_REF] Iosif | Deciding entailments in inductive separation logic with tree automata[END_REF]. In the rest of the chapter, two approaches are presented in details.

Translation Into a Reachability Logic

In this section, we present a reduction from the satisfiability problem for SLLB into the logic GRASS, following the results from [START_REF] Piskac | Automating separation logic using SMT[END_REF][START_REF] Piskac | GRASShopper -complete heap verification with mixed specifications[END_REF]. Decidability and even NP-completeness of the satisfiability problem for GRASS are obtained by a reduction to a slight variant of the combination of two theories, following a standard approach in SMT, see e.g. [START_REF] Barrett | Satisfiability Modulo Theories[END_REF]. Interestingly, the decision procedure uses two standard techniques related to SMT: the combination of theories (see e.g. [START_REF] Nelson | Simplification by cooperating decision procedures[END_REF][START_REF] Tinelli | Combining decision procedures for sorted theories[END_REF]) and the handling of quantifiers (see e.g. [BRK + 15] for local theory extensions). Other examples of translations can be found in [Hag04, CGH05, CHO + 11, HIOP13, SC14] but because of lack of space, we focus on the current one that is very promising to use further SMT solvers in order to decide decision problems for fragments of separation logics. Actually, the work [START_REF] Piskac | Automating separation logic using SMT[END_REF] goes much beyond what is presented in this section.

A target logic combining reachability and sets

The logic of graph reachability and stratified sets GRASS [START_REF] Piskac | Automating separation logic using SMT[END_REF] is defined below as the disjoint combination of a theory of reachability in function graphs (see e.g. [START_REF] Lahiri | Back to the future: revisiting precise program verification using SMT solvers[END_REF][START_REF] Wies | An efficient decision procedure for imperative tree data structures[END_REF]) and a theory of stratified sets (see e.g. [START_REF] Zarba | Verification: Theory and Practice, Essays Dedicated to Zohar Manna on the Occasion of His 64th Birthday[END_REF]). This means that, on the top of a theory of elements, a theory of sets is defined so that the elements satisfied another theory. In that way, the theory of stratified sets is two-level. Presently, the theory of elements is a theory about reachability. Consequently, the logic GRASS contains two sorts: a sort for locations and a sort for sets of locations. GRASS is presented as the quantifier-free kernel of a many-sorted first-order logic, following an approach that has been at heart of modern SMT solvers (see more definitions in [START_REF] Piskac | Automating separation logic using SMT[END_REF][START_REF] Barrett | Satisfiability Modulo Theories[END_REF]). For the ease of presentation, and since we do not need the full generality of many-sorted firstorder logic, our presentation of GRASS semantics is quite ad-hoc but the reader should keep in mind that a more orthodox presentation based on standard features of SMT can be found in [START_REF] Piskac | Automating separation logic using SMT[END_REF].

Below, we present a translation from SLLB into the logic GRASS, following the results from [START_REF] Piskac | Automating separation logic using SMT[END_REF]. The tool GRASShopper [START_REF] Piskac | GRASShopper -complete heap verification with mixed specifications[END_REF] implements a decision procedure for GRASS on top of the SMT solver Z3 [START_REF] De Moura | Z3: An Efficient SMT Solver[END_REF].

Formulae in GRASS are built from terms T denoting locations and terms S denoting sets of locations. Atomic formulae of type A state properties between locations whereas atomic formulae of type B state properties between locations and sets of locations. Finally, formulae of type R are Boolean combinations of atomic formulae of type A. These syntactic objects are defined following the grammars below:

T ::= x | f(T) A ::= T = T | T \T - → T R ::= A | ¬R | R ∧ R S ::= X | ∅ | S \ S | S ∪ S | S ∩ S | {x.R} proviso: x does not occur below f in R B ::= S = S | T ∈ S ϕ ::= A | B | ¬ϕ | ϕ ∧ ϕ
The proviso in the definition of set comprehensions guarantees decidability of the logic GRASS. The term x is a variable from a countably infinite set of (program) variables whereas the term X is a set variable from an unspecified countably infinite set of such variables. By contrast, there is a single function symbol f.

Example 5.2.1. A formula of type R is presented below:

(x 1 = f(x 2 )) ∧ x 1 \x 2 -→ x 3 .
An atomic formula of type B is presented below:

f(f(x 1 )) ∈ {x. (x = x 1 )} ∩ {x . (x \x 2 -→ x 3 )}.
Now, let us define the models for the logic GRASS and let us explain how the formulae are interpreted on such semantical structures. A GRASS-model is a structure of the form A = (L, h) such that 1. L is a non-empty set; for obvious reasons elements of L are called locations.

2. h is a map L → L satisfying the conditions below.

1. For all l ∈ L, the set {l | (l, l ) ∈ h * } is finite where h * is the reflexive and transitive closure of the graph relation induced by the map h.

2.

Similarly, for all l ∈ L, the set {l | (l , l) ∈ h * } is finite.

The map h corresponds to the interpretation of the function symbol f.

Even though the symbol 'h' is also used to denote heaps, the map h in a GRASS-model is not strictly speaking a heap (in the sense provided in Section 1.2.1). For instance, L is not necessarily equal to N and h is a total function. Nevertheless, h satisfies two finiteness conditions. However, the way the logic GRASS is defined and the semantics is presented allows to use results about the combination of theories to establish the NP upper bound of the satisfiability problem. Herein, we do not present the details of the NP upper bound for deciding GRASS since we view such a decision procedure as a blackbox. Indeed, in the translation-based approach, the essential work is to design a translation into a logical theory for which decidability/complexity is already established. However, it would be definitely interesting to present how works the decidability proof for GRASS satisfiability, but this is currently beyond the scope of this document.

The terms T are interpreted as elements of L whereas the terms S are interpreted as subsets of L. More precisely, for any term T, T A,f is an element of L following the clauses below (f is a variable assignment):

x A,f def = f(x) f(T) A,f def = h( T A,f ).
Similarly, for any term S, S A,f is a subset of L following the clauses below:

X A,f def = f(X) ∅ A,f def =
∅ (no syntactic difference between the constant '∅' and the empty set)

S 1 O S 2 A,f def = S 1 A,f O S 2 A,f (O ∈ {\, ∪, ∩}) {x.R} A,f def = {l | A | = f[x →l] R}
where the satisfaction relation | = is defined below.

Despite the fact that the definition of | = uses the semantics map • A,f and the other way around for set comprehension, these mutually recursive definitions are well-founded. So, given a variable assignment f, the satisfaction relation | = for GRASS is defined as follows:

A | = f T 1 = T 2 iff T 1 A,f = T 2 A,f A | = f T 1 \T 2 -→ T 3 iff ( T 1 A,f , T 3 A,f ) ∈ R * where R = {(l, h(l)) | l ∈ L, l T 2 A,f } A | = f S 1 = S 2 iff S 1 A = S 2 A A | = f T ∈ S iff T A,f ∈ S A,f A | = f ¬ϕ iff not A | = f ϕ A | = f ϕ 1 ∧ ϕ 2 iff A | = f ϕ 1 and A | = f ϕ 2 .
Clauses for equalities and for Boolean connectives are completely standard and therefore the only clause that may deserve a bit of explanations if for atomic formulae of the form T 1 \T 2 -→ T 3 . Indeed, it holds true whenever T 3 A,f can be reached from T 1 A,f by using the graph of h, with the proviso that the path does not visit an edge starting by the location T 2 A,f .

The satisfiability problem for GRASS takes as input a formula ϕ and asks for the existence of a model A and a variable assignment f such that A | = f ϕ. Proposition 5.2.2. [START_REF] Piskac | Automating separation logic using SMT[END_REF] The satisfiability problem for GRASS is NP-complete.

The underlying theory of reachability in function graphs is not first-order definable not only because of the finiteness constraints on h but also because transitive closure of relations is not first-order definable. Nevertheless, satisfiability problem for the quantifier-free fragment of that fragment can be shown in NP, see details in [TW13, Section 5]. Using Nelson-Oppen combination of the decision procedures for the two theories [START_REF] Nelson | Simplification by cooperating decision procedures[END_REF] (see also [START_REF] Tinelli | Combining decision procedures for sorted theories[END_REF]), the fact that both of them are stably infinite with respect to the location sort and other properties, one can obtain an NP decision procedure for GRASS; again we omit the details that can be found in [PWZ13, Appendix A]. So, the decision procedure for GRASS is obtained from the combination of the theory of reachability and the theory of stratified sets, but some additional work is required, for instance to get rid of set comprehension, see e.g. [PWZ13, Appendix A] (see also [BRK + 15] for a more general approach using a lazy and finite instantiation of quantified axioms with the help of E-matching).

A variant separation logic interpreted on GRASS-models

Before designing the translation into GRASS, we introduce SLLB in which spatial formulae are interpreted precisely and equalities and disequalities are spatial formulae too. Spatial formulae ϕ s are defined as follows:

ϕ s ::= (x i = x j ) | ¬(x i = x j ) | x i → x j | sreach(x i , x j ) | ϕ s * ϕ s
Formulae of SLLB are simply Boolean combinations of spatial formulae.

Models of SLLB are GRASS-models and as we have seen earlier, these are not exactly heaps. Probably, the major difference is due to the fact that the map h in a GRASS-model is a total function and therefore to regain the semantics from separation logic, the finite domain is encoded by the interpretation of a set variable. Finiteness is guaranteed because the satisfaction relation | = X f (defined below) encodes a precise semantics parameterised by the set variable X. Below, we provide the definition of | = X f ; we omit the obvious clauses for the Boolean combinations of spatial formulae.

A | = X f x i = x j iff f(x i ) = f(x j ) and f(X) = ∅ A | = X f ¬(x i = x j ) iff f(x i ) f(x j ) and f(X) = ∅ A | = X f x i → x j iff h(f(x i )) = f(x j ) and f(X) = {f(x i )} A | = X f ϕ 1 s * ϕ 2 s iff there are X 1 , X 2 such that f(X) = X 1 X 2 , A | = X f[X →X 1 ] ϕ 1 s and A | = X f[X →X 2 ] ϕ 2 s A | = X f sreach(x i , x j ) iff either f(x i ) = f(x j ) and f(X) = ∅, or there is n ≥ 1 such that h n (f(x i )) = f(x j ) and f(X) = {f(x i ), h(f(x i )), . . . , h n-1 (f(x i ))}.
The (possibly empty) set of locations f(X) is called the footprint of ϕ when A | = X f ϕ and it corresponds to the (unique) domain of the underlying heap. For instance, the formula (x 1 = x 3 ) * (x 2 → x 2 ) is satisfiable unlike (x 1 = x 3 ) ∧ (x 2 → x 2 ). Lemma 5.2.3 below guarantees finiteness and unicity of the footprint.

Lemma 5.2.3. Let ϕ s be a spatial formula, A be a GRASS-model and f,f be variable assignments that differ at most for the set variable X.

If A | = X f ϕ s and A | = X f ϕ s then f = f and f(X) is finite.
The proof is left as Exercise 5.3. So, in this section, we have followed a precise interpretation of the spatial formulae and a memory state (s, h) in the usual sense in separation logic is encoded by a structure (N, h , f, X) where 1. (N, h ) is a GRASS-model, 2. s and f agree on the program variables and f(X) = dom(h), 3. h restricted to f(X) is equal to h.

We write GRASS-FO to denote the first-order extension of quantifier-free GRASS by adding existential quantification over set variables:

A | = f ∃ Y ϕ iff there is X ⊆ L such that A | = f[Y →X] ϕ.
Actually, in the translation described below, existential quantifications shall occur only in front of the formulae obtained by translation and therefore its satisfiability status is identical to the satisfiability status of the formulae obtained by removing the existential quantifications. So, the formulae in GRASS-FO are purely instrumental in this presentation and the logic GRASS-FO is not studied for itself.

In Lemma 5.2.4 below, we state a few properties that are useful to show the correctness of the forthcoming translation but these are quite standard in firstorder logic and therefore the proofs are left as Exercise 5.4. Lemma 5.2.4.

(I) Let ϕ 1 and ϕ 2 be GRASS-FO formulae so that Y 1 is not free in ϕ 2 and Y 2 is not free in ϕ 1 . Then,

(∃ Y 1 ϕ 1 ) O (∃ Y 2 ϕ 2 ) is logically equivalent to ∃ Y 1 , Y 2 (ϕ 1 O ϕ 2 ) with O ∈ {∧, ∨}.
(II) Given a GRASS-FO formula of the form ∃ Y ϕ, we have ϕ is satisfiable iff ∃ Y ϕ is satisfiable.

A logarithmic-space translation

Given an atomic formula ϕ and a (fresh) set variable Y, we introduce in the table below the formulae ψ 1 and ψ 2 (Y) that are used in the translation from SLLB into GRASS (implicitly these formulae are parameterised by ϕ). The formula ψ 1 (Y) encodes the reachability constraints expressed by ϕ whereas ψ 2 (Y) takes care of the footprint.

Atomic formula ϕ ψ 1 ψ 2 (Y)

x i = x j x i = x j Y = ∅ x i x j x i x j Y = ∅ x i → x j f(x i ) = x j Y = {y. (x i = y)} sreach(x i , x j ) x i \x j - → x j Y = {x. (x i \x j - → x) ∧ x x j }
Let X be a distinguished set variable that serves for the footprint. The translation tr defined below from SLLB formulae into GRASS-FO formulae is implicitly parameterised by X. Without any loss of generality, we can assume that the SLLB formulae are in negation normal form (binary connectives are ∧ and ∨, and negation occurs only in front of spatial formulae). The map tr is homomorphic for ∨ and ∧ and its definition is completed by the clauses below:

tr(ϕ 1 s * • • • * ϕ n s ) def = ∃ Y 1 • • • Y n ((ψ 1 1 ∧ • • • ∧ ψ n 1 ∧ i i Y i ∩ Y i = ∅)∧ ((ψ 1 2 (Y 1 ) ∧ • • • ∧ ψ n 2 (Y n ) ∧ X = Y 1 ∪ • • • ∪ Y n ),
* • • • * ϕ n s )) def = ∃ Y 1 • • • Y n ¬((ψ 1 1 ∧ • • • ∧ ψ n 1 ∧ i i Y i ∩ Y i = ∅)∧ ((ψ 1 2 (Y 1 ) ∧ • • • ∧ ψ n 2 (Y n ) ∧ X = Y 1 ∪ • • • ∪ Y n ).
So both translations quantify existentially over set variables and the only difference is the presence of the negation in front of one of the main conjuncts. This requires some explanation, which is provided below.

It is worth observing that for all GRASS-models A and for all variable assignments f, there is exactly one tuple

(X 1 , . . . , X n ) in L n such that A | = g (ψ 1 2 (Y 1 ) ∧ • • • ∧ ψ n 2 (Y n ) ∧ X = Y 1 ∪ • • • ∪ Y n where g = f[Y 1 → X 1 , . . . , Y n → X n ].
Thanks to that property that is closely related to preciseness, we can get advantage of the property below.

Lemma 5.2.5. Let χ 1 and χ 2 (X, Y 1 , . . . , Y n ) be GRASS formulae such that for all GRASS-models A and for all variable assignments f, there is exactly one tuple

(X 1 , . . . , X n ) in L n such that A | = g χ 2 (X, Y 1 , . . . , Y n ) where g = f[Y 1 → X 1 , . . . , Y n → X n ].
Then, for all GRASS-models A and all variable assignments f, the statements below are equivalent:

(I) A | = f ¬(∃ Y 1 • • • Y n χ 1 ∧ χ 2 (X, Y 1 , . . . , Y n )), (II) A | = f (∃ Y 1 • • • Y n ¬χ 1 ∧ χ 2 (X, Y 1 , . . . , Y n )).
The proof of Lemma 5.2.5 is left as Exercise 5.5 and requires standard arguments from first-order logic. Consequently, tr(¬(ϕ

1 s * • • • * ϕ n s )) is logically equivalent to the negation of tr(ϕ 1 s * • • • * ϕ n s
) even though both translations involve existential quantifications. This is a key property established in [START_REF] Piskac | Automating separation logic using SMT[END_REF]. Let T(ϕ) be the GRASS formula obtained from tr(ϕ) by removing the sequences of existential quantifications of the form

∃ Y 1 • • • Y n .
Example 5.2.6. The formula ϕ = (x 1 → x 2 ) ∧ x 1 = x 3 is not satisfiable and its translation T(ϕ) in GRASS is given below:

(f(x 1 ) = x 2 ∧ Y 1 = {y.(x 1 = y)} ∧ X = Y 1 ) ∧ (x 1 = x 3 ∧ Y 2 = ∅ ∧ X = Y 2 ).
By contrast, the formula ϕ = (x 1 x 3 ) * (x 1 → x 3 ) * (x 3 → x 3 ) is satisfiable and its translation T(ϕ ) is the following:

(x 1 x 3 ∧f(x 1 ) = x 3 ∧f(x 3 ) = x 3 ∧(Y 1 ∩Y 2 ) = ∅∧(Y 1 ∩Y 3 ) = ∅∧(Y 2 ∩Y 3 ) = ∅)∧ Y 1 = ∅ ∧ Y 2 = {y.(x 1 = y)} ∧ Y 3 = {y.(x 3 = y)} ∧ (X = Y 1 ∪ Y 2 ∪ Y 3 ).
By Lemma 5.2.4, T(ϕ) is satisfiable iff tr(ϕ) is satisfiable. It remains to show that the satisfiability status of tr(ϕ) is equivalent to the satisfiability status of ϕ. Lemma 5.2.7. Let ϕ be an SLLB formula in negation normal form, A be a GRASS-model, f be a variable assignment and X be a distinguished set variable.

Then A | = X f ϕ iff A | = f tr(ϕ).
Consequently, there is a logarithmic-space reduction from the satisfiability problem for SLLB into the satisfiability problem for GRASS. Given an SLLB formula ϕ, we perform the following operations:

1. Compute ϕ obtained from ϕ by pushing the negations inwards as much as possible so that ϕ is an equivalent formula in negation normal form.

2. Compute T(ϕ ) by using the recursive definition for tr(ϕ ) but we omit the prefixes of the form ∃ Y 1 • • • Y n on-the-fly.

The proof of Lemma 5.2.7 is left as Exercise 5.7 and it can be done by a standard structural induction. In the induction step, the cases for Boolean connectives ∧ and ∨ are by an easy verification whereas the base case for atomic formulae of the form ¬(ϕ 1 s * • • • * ϕ n s ) follows immediately from the base case for atomic formulae of the form ϕ 1 s * • • • * ϕ n s thanks to Lemma 5.2.5. So, the main difficulty in the proof is to consider the translation for atomic formulae of the form (ϕ 1 s * • • • * ϕ n s ) but this is not very difficult since then the translation simply internalises the SLLB precise semantics into GRASS-FO.

Corollary 5.2.8. The satisfiability, validity and entailment problems for SLLB can be solved in NP. NP-hardness is an obvious consequence that SLLB contains equality constraints and it is closed under Boolean connectives.

We have seen that the logics SLLB and GRASS have quite a lot of similarities and it is legitimate to wonder why to bother to introduce the logic GRASS as it has been done in [START_REF] Piskac | Automating separation logic using SMT[END_REF]. Indeed, the models are quite similar, the encoding of the reachability constraints and footprint is quite clear. However, the decidability proof for GRASS (omitted in this document) invokes results about the combination of theories along the lines of the seminal work of Nelson-Oppen (stably infinity of the theories) but also about elimination of implicit quantifiers or set comprehensions. That is why, the way GRASS has been designed allows to use material about the decidability of combined theories (we recall that the details can be found in [START_REF] Piskac | Automating separation logic using SMT[END_REF]) and to take advantage of the SMT framework for combinations with other theories. Alternatively, the developments in this section can be viewed as a piece of evidence that SLLB can be rephrased to fit the SMT framework, as far as several decision problems are concerned (satisfiability, abduction, etc).

Direct Approach: An Example

In this section, we show that the satisfiability and model-checking problems for 1SL0 (the propositional version of 1SL without quantifiers and quantified variables) can be solved in polynomial space. An equivalence relation on memory states with finite index is designed so that infinity involved in the interpretation of the magic wand operator can be tamed finitely [START_REF] Yang | Local Reasoning for Stateful Programs[END_REF][START_REF] Lozes | Separation logic preserves the expressive power of classical logic[END_REF]. This allows to characterise precisely the expressiveness of 1SL0 and it is the key step to show a small heap property. The developments made in this section are mainly inspired Lemma 5.3.2. Let q ≥ 1 and α ∈ N. Then ≈ q α+1 ⊆≈ q α and ≈

q+1 α ⊆≈ q α .
The proof is left as Exercise 5.9. Below, we establish two technical lemmas that garantee that ≈ q α behave properly. These are essential properties to establish forthcoming Theorem 5.3.6.

Lemma 5.3.3. Let α, α 1 , α 2 ∈ N with α = α 1 + α 2 and (s, h), (s , h ) be memory states such that (s, h) ≈ q α (s , h ). For all heaps h 1 , h 2 such that h = h 1 h 2 , there are heaps h 1 , h 2 such that h = h 1 h 2 , (s, h 1 ) ≈ q α 1 (s , h 1 ) and (s, h 2 ) ≈ q α 2 (s , h 2 ).
Proof. Let α, α 1 , α 2 , (s, h), (s , h ) and h 1 , h 2 be defined as in the statement. In order to build h 1 and h 2 , let us make a few basic observations.

1. Since (s, h) ≈ q α (s , h ), for all i ∈ [1, q], s(x i ) ∈ dom(h) iff s (x i ) ∈ dom(h ).
2. Let C q (s, h) be the cardinal of the set dom(h) \ {s(x 1 ), . . . , s(x q )}. We have

C q (s, h) = C q (s, h 1 ) + C q (s, h 2 ).
Let us define explicitly the heap h 1 and therefore h 2 is defined as the complement heap with respect to the heap h . Moreover, we only need to specify explicitly the domain of h 1 since the images are those from h . There is only one exception in the Case 4 below in which h 2 is defined explicitly instead.

• For every i ∈ [1, q], if s(x i ) ∈ dom(h 1 ), then s (x i ) ∈ dom(h 1 ) by definition.

• So, for every i ∈ [1, q], s (x i ) ∈ dom(h 1 ) iff s(x i ) ∈ dom(h 1 ) and therefore s

(x i ) ∈ dom(h 2 ) iff s(x i ) ∈ dom(h 2 ).
The heap h 1 is further populated depending on cardinality constraints.

Case 1: C q (s, h) ≤ α. Since (s, h) ≈ q α (s , h ), we have C q (s , h ) = C q (s, h) ≤ α too. Let β 1 = C q (s, h 1 ). Since C q (s , h ) = C q (s, h), and β 1 ≤ C q (s , h ), there are β 1 locations l 1 , • • • , l β 1 in dom(h ) \ {s (x 1 ), . . . , s (x q )}. Then {l 1 , . . . , l β 1 } ⊆ dom(h 1 ) by definition. This concludes the construction of h 1 . Case 2: C q (s, h) > α, C q (s, h 1 ) ≥ α 1 and C q (s, h 2 ) ≥ α 2 . Let β 1 = min(α 1 , C q (s, h 1 )) = α 1 . Since min(α, C q (s, h)) = min(α, C q (s , h )) = α and β 1 ≤ min(α, C q (s, h)), then β 1 ≤ min(α, C q (s , h )). Let l 1 < • • • < l β 1 be
the β 1 smallest locations in dom(h ) \ {s (x 1 ), . . . , s (x q )} (for the usual linear ordering on N). Then {l 1 , . . . , l β 1 } ⊆ dom(h 1 ) by definition. This concludes the construction of h 1 .

Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI '15 Case 3: C q (s, h) > α, C q (s, h 1 ) < α 1 and C q (s, h 2 ) > α 2 . Let β 1 = C q (s, h 1 ). Since min(α, C q (s, h)) = min(α, C q (s , h )) = α, β 1 ≤ α and β 1 ≤ min(α, C q (s , h )), let l 1 < • • • < l β 1 be the β 1 smallest locations in dom(h ) \ {s (x 1 ), . . . , s (x q )}. Then {l 1 , . . . , l β 1 } ⊆ dom(h 1 ) by definition. This concludes the construction of h 1 . Case 4: C q (s, h) > α, C q (s, h 1 ) ≥ α 1 and C q (s, h 2 ) < α 2 . This is symmetrical to Case 3 and the only case for which we define explicitly the heap h 2 (and therefore h 1 by complementation). Let

β 2 = C q (s, h 2 ). Since min(α, C q (s, h)) = min(α, C q (s , h )) = α, β 2 ≤ α and β 2 ≤ min(α, C q (s , h )), let l 1 < • • • < l β 2 be
the β 2 smallest locations in dom(h ) \ {s (x 1 ), . . . , s (x q )}. Then {l 1 , . . . , l β 2 } ⊆ dom(h 2 ) by definition. This concludes the construction of h 2 .

Note that after the last three cases, the case C q (s, h 1 ) < α 1 , C q (s, h 2 ) < α 2 is excluded because α = α 1 + α 2 and C q (s, h) > α .

It remains to show that (s, h 1 ) ≈ q α 1 (s , h 1 ) and (s, h 2 ) ≈ q α 2 (s , h 2 ). For the satisfaction of the test formulae of the form x i = x j , alloc(x i ) and x i → x j , the proof is by an easy verification. It remains to check the satisfiability status of the formulae size q ≥ β with β ∈ [0, α]. This amounts to check that min(α 1 , C q (s, h 1 )) = min(α 1 , C q (s, h 1 )) and min(α 2 , C q (s, h 2 )) = min(α 2 , C q (s, h 2 )). The Case 1 is by an easy verification since C q (s, h 1 ) = C q (s , h 1 ) and C q (s, h 2 ) = C q (s , h 2 ) whereas the Case 2 is quite immediate because min(α 1 , C q (s, h 1 )) = min(α 1 , C q (s , h 1 )) = α 1 by construction, and C q (s , h ) -α 1 > α 2 and therefore min(α 2 , C q (s , h 2 )) = α 2 , i.e. min(α 2 , C q (s , h 2 )) is equal to min(α 2 , C q (s, h 2 )).

Below we analyse the Case 3 (we omit the Case 4 since its treatment is symmetrical). C q (s, h 1 ) = C q (s , h 1 ) < α 1 and therefore C q (s , h ) -C q (s , h 1 ) > α 2 . Consequently, C q (s , h 2 ) > α 2 , whence min(α 2 , C q (s , h 2 )) = min(α 2 , C q (s, h 2 )) = α 2 . QED Given a memory state (s, h), we write maxval(s, h) to denote the maximal value max(ran(s) ∪ dom(h) ∪ ran(h)).

Lemma 5.3.4. Let α ∈ N and (s, h), (s , h ) be memory states such that (s, h) ≈ q α (s , h ). For any heap h 1 disjoint from h, there is a heap h 1 disjoint from h such that the conditions below hold: (I) (s, h 1 ) ≈ q α (s , h 1 ).

(II) (s, h h 1 ) ≈ q α (s , h h 1 ).

(III) maxval(s , h 1 ) ≤ maxval(s , h ) + α.

Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI '15 If we give up the condition (III), the condition (I) can be strengthened by: (s, h 1 ) ≈ q β (s , h 1 ) for all β ≥ 0 (i.e. dom(h 1 ) and dom(h 1 ) have the same cardinality).

Proof. Let α, (s, h), (s , h ) and h 1 be defined as in the statement. Let us explain how to build the heap h 1 and then we show that it satisfies the right properties.The heap h 1 is built incrementally and therefore its initial value is naturally the empty heap.

• For every s(x i ) ∈ dom(h 1 ) with i ∈ [1, q], if h 1 (s(x i )) = s(x j ) for some j ∈ [1, q], then h 1 (s (x i )) def = s (x j ), otherwise h 1 (s (x i )) def = max{s (x j ) | j ∈ [1, q]} + 1. Since (s, h) ≈ q α (
s , h ) and, h and h 1 are disjoint, this implies that the current value of h 1 after the addition of all the new memory cells (according to the above definition) is disjoint from h . Moreover, (s, h 1 ) and (s , h 1 ) agree on test formulae of the form x i = x j , x i → x j and alloc(x i ).

• Let β 1 = min(α, C q (s, h 1 )). For every i ∈ [1, β 1 ], we extend h 1 so that h 1 (max{s (x j ) | j ∈ [1, q]} + i) def = max{s (x j ) | j ∈ [1, q]} + i.
Consequently, min(α, C q (s, h 1 )) = min(α, C q (s , h 1 )) and therefore this implies that (s, h 1 ) and (s , h 1 ) agree on the test formulae of the form size q ≥ β with β ∈ [0, α].

From the construction of h 1 , we can conclude that (s, h 1 ) ≈ q α (s , h 1 ) and maxval(s , h 1 ) ≤ maxval(s , h ) + α.

It remains to show that (s, h h 1 ) ≈ q α (s , h h 1 ). The satisfaction of the test formulae x i = x j is inherited from (s, h) ≈ q α (s , h ) (because the stores are unchanged) whereas the satisfaction of the test formulae x i → x j and alloc(x i ) requires simple arguments by distinguishing four cases:

1. s(x i ) ∈ dom(h), 2. s(x i ) dom(h h 1 ), 3. s(x i ) ∈ dom(h 1 ) and h 1 (s(x i )) {s(x j ) | j ∈ [1, q]} and finally 4. s(x i ) ∈ dom(h 1 ) and h 1 (s(x i )) ∈ {s(x j ) | j ∈ [1, q]}.
Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI '15 Details are omitted. In order to check that (s, h h 1 ) and (s , h h 1 ) agree on test formulae of the form size q ≥ β with β ∈ [0, α], it is sufficient to observe that min(α, C q (s, h)) = min(α, C q (s , h )) and min(α, C q (s, h 1 )) = min(α, C q (s , h 1 )) imply min(α, C q (s, h h 1 )) = min(α, C q (s , h h 1 ))

since C q (s, h h 1 ) = C q (s, h)+C q (s, h 1 ) and C q (s , h h 1 ) = C q (s , h )+C q (s , h 1 ).QED

For each formula ϕ, we define its memory size msize(ϕ) following the clauses below [START_REF] Yang | Local Reasoning for Stateful Programs[END_REF]. This is just a refinement of the size of ϕ when formulae are represented by their syntactic trees.

msize(x

i → x i ) def = 1 msize(x i = x i ) def = 0 msize(emp) def = 1 msize(¬ψ) def = msize(ψ) msize(ψ 1 ∧ ψ 2 ) def = max(msize(ψ 1 ), msize(ψ 2 )) msize(ψ 1 * ψ 2 ) def = msize(ψ 1 ) + msize(ψ 2 ) msize(ψ 1 - * ψ 2 ) def =
max(msize(ψ 1 ), msize(ψ 2 )).

For instance msize(size = 3) = 4 when size = 3 is defined in 1SL0 by the formula below:

((¬emp) * (¬emp) * (¬emp)) ∧ ¬((¬emp) * (¬emp) * (¬emp) * (¬emp)).
The memory size is bounded above by the size when formulae are encoded as trees.

Lemma 5.3.5. For every ϕ in 1SL0, msize(ϕ) is smaller that the size of ϕ, assuming that formulae are encoded as trees.

Below, we state the main result about the equivalence relation ≈ q α : two memory states in the relation cannot be distinguished by formulae of memory size smaller than α.

Theorem 5.3.6. Let ϕ be a formula in 1SL0 built over the program variables x 1 , . . . , x q . For any α ∈ N such that msize(ϕ) ≤ α, and for all memory states (s, h), (s , h ) such that (s, h) ≈ Proof. Suppose that (s, h) ≈ q α (s , h ) and ϕ be a formula with msize(ϕ) ≤ α. By structural induction, we show that (s, h) | = ϕ if and only if (s , h ) | = ϕ. It is sufficient to establish one direction of the equivalence thanks to the symmetry.

The base case with the atomic formulae of the form x i → x j , x i = x j or emp is by an easy verification due to the very definition of the test formulae. Indeed, x i → x j and x i = x j are already test formulae in Test (q, α) whereas emp is logically equivalent to

( i∈[1,q] ¬alloc(x i )) ∧ ¬(size q ≥ 1).
In the induction step, the cases with Boolean connectives are even more straightforward to prove. Case 1: ψ = ψ 1 * ψ 2 . Suppose that (s, h) | = ψ 1 * ψ 2 and msize(ψ 1 * ψ 2 ) ≤ α. There are heaps h 1 and h 2 such that h = h 1 h 2 , (s, h 1 ) | = ψ 1 and (s, h 2 ) | = ψ 2 . As α ≥ msize(ψ 1 * ψ 2 ) = msize(ψ 1 ) + msize(ψ 2 ), there exist α 1 and α 2 such that α = α 1 + α 2 , α 1 ≥ msize(ψ 1 ) and α 2 ≥ msize(ψ 2 ). By Lemma 5.3.3, there exist heaps h 1 and h 2 such that h = h 1 h 2 , (s, h 1 ) ≈ q α 1 (s , h 1 ) and (s, h 2 ) ≈ q α 2 (s , h 2 ). By the induction hypothesis, we get (s , h 1 ) | = ψ 1 and (s , h 2 ) | = ψ 2 . Consequently, we obtain (s , h ) | = ψ 1 * ψ 2 . Case 2: ψ = ψ 1 - * ψ 2 . Suppose that (s, h) | = ψ 1 - * ψ 2 and msize(ψ 1 - * ψ 2 ) ≤ α. Since msize(ψ 1 - * ψ 2 ) = msize(ψ 2 ), we also get that msize(ψ 1 ), msize(ψ 2 ) ≤ α.

Let us prove that (s , h ) | = ψ 1 - * ψ 2 . Let h 1 be a heap disjoint from h such that (s , h 1 ) | = ψ 1 . By Lemma 5.3.4, there is a heap h 1 disjoint from h such that (s, h 1 ) ≈ q α (s , h 1 ) and (s, h h 1 ) ≈ q α (s , h h 1 ). By the induction hypothesis, we conclude that (s, h 1 ) | = ψ 1 . Since (s, h) | = ψ 1 - * ψ 2 , this implies that (s, h h 1 ) | = ψ 2 . By the induction hypothesis, we conclude that (s , h h 1 ) | = ψ 2 . Since h 1 is an arbitrary disjoint heap from h , we obtain (s , h ) | = ψ 1 - * ψ 2 . QED Theorem 5.3.7. Let ϕ be a formula in 1SL0 built over the variables in x 1 , . . . , x q . The formula ϕ is logically equivalent to a Boolean combination of test formulae from Test(q, q + msize(ϕ)).

Theorem 5.3.7 can be viewed as a means to eliminate separating connectives * and - * and this is analogous to quantifier elimination in Presburger arithmetic [START_REF] Presburger | Über die Vollständigkeit eines gewissen Systems der Arithmetik ganzer Zahlen, in welchem die Addition als einzige Operation hervortritt[END_REF] for which periodicity constraints need to be introduced in order to eliminate the quantifiers (see e.g. [START_REF] Cooper | Theorem proving in arithmetic without multiplication[END_REF]). Similarly, the atomic formulae size ≥ k and alloc(x i ) would require the use of the separating connectives to be properly defined in 1SL0 but in the Boolean combinations, these formulae are understood as primitive.

Proof. Let α = msize(ϕ). Given a memory state (s, h), we write LIT(s, h) to denote the following set of literals:

{χ ∈ Test (q, α) | (s, h) | = χ} ∪ {¬χ | (s, h) | = χ with χ ∈ Test (q, α)}.
Since Test (q, α) is a finite set, LIT(s, h) is finite too and let us consider the welldefined formula ψ∈LIT(s,h) ψ. We have the following equivalence:

(s , h ) | = ψ∈LIT(s,h) ψ iff (s, h) ≈ q α (s , h ).

The expression below

ψ def = (s,h)| =ϕ ( ψ∈LIT(s,h) ψ)
is equivalent to a Boolean combination ϕ of formulae from Test (q, α) because LIT(s, h) ranges over the finite set of elements from Test (q, α) (just select a finite amount of disjuncts). By Theorem 5.3.6, the formula ϕ is logically equivalent to ϕ , which concludes the proof since any formula of the form size q ≥ β with β ≤ α is logically equivalent to a Boolean combination of test formulae from Test(q, q + α).

Indeed, suppose that (s, h) | = ϕ. Obviously, this implies that (s, h) | = ψ∈LIT(s,h) ψ and therefore (s, h) | = ϕ . Conversely, suppose that (s, h) | = ϕ . This means that there is a memory state (s , h ) such that (s , h

) | = ϕ and (s, h) | = ψ∈LIT(s,h) ψ. Since (s, h) ≈ q α (s , h ), msize(ϕ) ≤ α and (s , h ) | = ϕ, by Theorem 5.3.6 we get (s, h) | = ϕ. QED
Now, it is possible to establish the small model property.

Corollary 5.3.8. Let ϕ be a satisfiable 1SL0 formula built over x 1 , . . . , x q . There is a memory state (s, h) such that (s, h) | = ϕ and maxval(s, h) ≤ q + msize(ϕ).

The proof is left as Exercise 5.10.

A model-checking decision procedure

In order to check the satisfiability status of ϕ, only the truth value of formulae in Test (q, msize(ϕ)) matters. That is why, instead of operating on memory states to check satisfiability, it is sufficient to operate on its abstractions (with respect to the basic properties induced by Test (q, msize(ϕ))), whence the introduction of symbolic memory states below. A symbolic memory state sms over (q, α) is a finite structure (P, A, H, n) such that:

1. P is a partition of {x 1 , . . . , x q } (encoding equalities) and A ⊆ P (encoding the subset in the domain).

2. H is a functional relation on P such that dom(H) = A.

3. n ∈ [0, α] and this corresponds to the number of locations in the heap domain that are not equal to the interpretation of some program variables in {x 1 , . . . , x q }. For values strictly greater than α, a truncation is considered.

Given q ≥ 1 and α ∈ N, the number of symbolic memory states over (q, α) is "only" exponential in q+α. Given a memory state (s, h), we define its abstraction Symb[s, h] over (q, α) as the symbolic memory state (P, A, H, n) such that

• n = min(α, card(dom(h) \ {s(x i ) | i ∈ [1, q]})).
• P is a partition of {x 1 , . . . , x q } so that for all x, x , we have s(x) = s(x ) iff x and x belong to the same set in P.

• A = {X ∈ P | there is x ∈ X, s(x) ∈ dom(h)}.

• X H X iff there are x ∈ X and x ∈ X such that h(s(x)) = s(x ).

Note that given a symbolic memory state sms over (q, α), there exists always a memory state (s, h) such that Symb[s, h] is equal to sms. Not only every symbolic memory state has always a concretisation but also symbolic memory states are the right way to abstract memory states when the language 1SL0 is involved, which can be formally stated as follows: (s, h) ≈ q α (s , h ) iff Symb[s, h] = Symb[s , h ]. Definition 5.3.9. Given symbolic memory states sms, sms 1 and sms 2 , we write * s (sms, sms 1 , sms 2 ) whenever there exist a store s and disjoint heaps h 1 and h 2 such that Symb[s, h 1 h 2 ] = sms, Symb[s, h 1 ] = sms 1 and Symb[s, h 2 ] = sms 2 . ∇ 1. if ψ is atomic then return AMC(sms, ψ);

2. if ψ = ¬ψ 1 then return not MC(sms, ψ 1 );

3. if ψ = ψ 1 ∧ ψ 2 then return (MC(sms, ψ 1 ) and MC(sms, ψ 2 ));

4. if ψ = ψ 1 * ψ 2 then return iff there are sms 1 and sms 2 such that * s (sms, sms 1 , sms 2 ) and MC(sms 1 , ψ 1 ) = MC(sms 2 , ψ 2 ) = ; 5. if ψ = ψ 1 - * ψ 2 then return ⊥ iff for some sms and sms such that * s (sms , sms , sms), MC(sms , ψ 1 ) = and MC(sms , ψ 2 ) = ⊥; Given q ≥ 1 and α ∈ N, the ternary relation * s can be decided in polynomial time in q + log(α) for all the symbolic memory states built over (q, α). Indeed, assuming that sms = (P, A, H, n) and sms i = (P i , A i , H i , n i ), the relation * s (sms, sms 1 , sms 2 ) holds exactly when the conditions below are satisfied:

1. P = P 1 = P 2 , 2. A = A 1 ∪ A 2 and A 1 ∩ A 2 = ∅,

3. H = H 1 ∪ H 2 , 4. n = max(α, n 1 + n 2 ).
A formal proof is left as Exercise 5.12. Note that there is no need to specify that H 1 ∩ H 2 = ∅ since this is a consequence of A 1 ∩ A 2 = ∅, dom(H 1 ) ⊆ A 1 and dom(H 2 ) ⊆ A 2 .

Figure 5.1 presents a procedure MC(sms, ψ) returning a Boolean value in {⊥ , } and taking as arguments, a symbolic memory state over (q, α) and a formula ψ whose size is bounded above by α. All the quantifications over symbolic memory states are done over (q, α). A case analysis is provided depending on the outermost connective of the input formula. Its structure is standard and mimicks faithfully the semantics for 1SL0 except that we deal with symbolic memory states. The auxiliary function AMC(sms, ψ) also returns a Boolean value in {⊥, }, makes no recursive calls and is dedicated to atomic formulae (see Figure 5.2). The design of MC is similar to nondeterministic polynomial-space procedures, see e. 1. if ψ is emp then return iff A = ∅ and n = 0; 2. if ψ is x i = x j then return iff x i , x j ∈ X, for some X ∈ P; 3. if ψ is x i → x j then return iff (X, X ) ∈ H where x i ∈ X ∈ P and x j ∈ X ∈ P; Lemma 5.3.10. Let q ≥ 1, α ∈ N, sms be a symbolic memory state over (q, α) and ϕ be in 1SL0 built over x 1 , . . . , x q such that msize(ϕ) ≤ α. We have MC(sms, ϕ) returns iff there exists (s, h) such that Symb[s, h] = sms and (s, h) | = ϕ.

Proof. Let us show the equivalence by structural induction. We omit below the base case with atomic formulae and the case with negated subformulae. First, let us make a basic observation. Indeed, given a symbolic memory state sms, the statements below are equivalent:

• there exists (s, h) such that Symb[s, h] = sms and (s, h) | = ϕ,

• for all memory states (s, h) such that Symb[s, h] = sms, we have (s, h) | = ϕ.

Indeed, Symb[s, h] = Symb[s , h ] implies (s, h) ≈ q α (s , h ) and therefore we conclude (s, h) ≈ q msize(ϕ) (s , h ) by Lemma 5.3.2 since msize(ϕ) ≤ msize(ϕ) ≤ α. By Theorem 5.3.6, we get (s, h) | = ϕ iff (s , h ) | = ϕ. Case 1: ϕ = ϕ 1 ∧ ϕ 2 . Suppose that (s, h) | = ϕ and Symb[s, h] = sms. So, (s, h) | = ϕ 1 and (s, h) | = ϕ 2 , and by the induction hypothesis, both MC(sms, ϕ 1 ) and MC(sms, ϕ 2 ) return (msize(ϕ 1 ), msize(ϕ 2 ) ≤ α too). Hence, MC(sms, ϕ) returns .

Conversely, suppose that MC(sms, ϕ) returns . By definition of MC, we have MC(sms, ϕ 1 ) and MC(sms, ϕ 2 ). For all memory states (s , h ) such that Symb[s , h ] = sms, we have (s , h ) | = ϕ 1 and (s , h ) | = ϕ 2 . We have seen that every symbolic memory state admits a concretisation. Consequently, there is a memory state (s, h) such that Symb We observe that MC(sms, ϕ) runs in space O(d(q + log(α))) where d is the depth of syntactic tree for ϕ since the quantifications are over symbolic memory states over (q, α), there is an exponential amount in q + α and each symbolic memory state can be encoded with space in O(q+log(α)). Moreover, the recursion depth of MC is linear in d, which is itself linear in the size of ϕ. Hence, all the symbolic memory states considered in the algorithm are of polynomial size in the size of ϕ.

For the model-checking problem, it is sufficient to call MC with the abstraction of the memory state. Indeed, (s, h) | = ϕ iff MC(Symb[s, h], ϕ) returns true with α = msize(ϕ) (by Lemma 5.3.10). Now, Symb[s, h] and α can be constructed in polynomial space and MC runs in polynomial space too. QED PSPACE-hardness has been presented in Section 2.1.2. An alternative way to obtain the PSPACE upper bound has been proposed in [START_REF] Hague | Static checkers for tree structures and heaps[END_REF][START_REF] Calcagno | From separation logic to firstorder logic[END_REF] by a logarithmic-space reduction to the first-order theory of equality shown in PSPACE in [START_REF] Stockmeyer | The polynomial-time hierarchy[END_REF] (see also Section 5.4).

Corollary 5.3.12. Given a formula ϕ in 1SL0, computing a Boolean combination of atomic formulae from Test(q, q + msize(ϕ)) logically equivalent to ϕ can be done in polynomial space.

Proof. This is actually a quite direct consequence of the proof of Theorem 5.3.7. Let ϕ be a 1SL0 formula with α = msize(ϕ). By the proof of Theorem 5.3.7 and Corollary 5.3.8, ϕ is logically equivalent to the formula below {( ψ∈LIT(s,h) ψ) | MC(Symb[s, h], ϕ) = and maxval(s, h) ≤ q + α}.

Note that Symb[s, h] is computed with q and msize(ϕ).

The non-isomorphic copies of memory states (s, h) such that maxval(s, h) ≤ q + α can be enumerated in polynomial space. Moreover, the model-checking problem for 1SL0 is in PSPACE; so the above formula can be built in polynomial space (but its size may be exponential in the size of ϕ) by taking advantage of the fact that ψ∈LIT(s,h) can be constructed in polynomial space. QED

As by-product, we can also establish the existence of a family of PTIME fragments of 1SL0.

Corollary 5.3.13. Let q ≥ 1. The satisfiability problem for 1SL0 restricted to formulae with at most q program variables can be solved in polynomial time.

Proof. Let ϕ be a formula in 1SL0 with at most q program variables. When q is fixed, the number of symbolic memory states over (q, msize(ϕ)) is polynomial in the size of ϕ. To check the satisfiability status of the formula ϕ, for each symbolic memory state sms, we check whether MC(sms, ϕ) returns . To do so, we use standard principles from dynamic programming and we maintain a table A[sms, ψ] taking values in {unknown, , ⊥} to memorize the value returned by MC(sms, ψ) for each subformula of ψ and for each symbolic memory state sms over (q, msize(ϕ)). All the initial values are equal to unknown. We launch a new call to MC(sms, ψ) only when A[sms, ψ] = unknown. Moreover, before returning a value with MC, we update the table A accordingly. Since the table has a polynomial number of entries in the size of ϕ, we have that ϕ is satisfiable iff there is a symbolic memory state such that A[sms, ϕ] = , which can be verified in polynomial time in the size of ϕ. QED

All the above results can be extended to k > 1 (see Exercise 5.14) by adequately adapting the previous developments.

Translation into QBF

Symbolic memory states abstract memory states and their encoding requires a polynomial amount of bits. In this section, we show how symbolic memory states can be encoded by propositional variables and then how the model-checking algorithm can be expressed as a QBF formula where the quantification over symbolic memory states in MC (from Section 5.3) can be straighforwardly encoded by quantification in QBF. This allows us to reduce easily 1SL0 satisfiability to QBF satisfiability, and then to recall how QBF can be translated into a PSPACE fragment of first-order logic [START_REF] Stockmeyer | The polynomial-time hierarchy[END_REF]. In that way, instead of using an SMT solver as done in Section 5.2 or an ad-hoc algorithm MC based on symbolic memory states, it becomes possible to use either a QBF solver (see e.g. [START_REF] Lonsing | DepQBF: A dependency-aware QBF solver[END_REF][START_REF] Heule | A unified proof system for QBF preprocessing[END_REF]) or a theorem prover for first-order logic (see e.g. [WDF + 09, KV13]) to solve the satisfiability/validity problem for 1SL0, as advocated in [START_REF] Hague | Static checkers for tree structures and heaps[END_REF][START_REF] Calcagno | From separation logic to firstorder logic[END_REF]. Nevertheless, it is fair to observe that the translation into QBF presented below takes advantage of the abstraction made in Section 5.3. It is worth mentioning that an alternative approach has been developped in [START_REF] Bobot | Separation predicates: A taste of separation logic in first-order logic[END_REF] in which concepts from separation logic are directly imported into first-order logic in order to perform program verification.

In order to encode symbolic memory states over (q, α) of the form (P, A, H, n), we consider the following atomic propositions.

• EQ(i, j) (i, j ∈ [1, q]) for encoding whether the program variables x i and x j belong to the same set X ∈ P.

• A(i) (i ∈ [1, q]) for encoding whether there is P ∈ A such that x i ∈ P.

• H(i, j) (i, j ∈ [1, q]) for encoding whether there is a pair (X, X ) such that x i ∈ X, x j ∈ X and (X, X ) belongs to H.

• N(β) (β ∈ [0, α]) for encoding whether n = β. (Of course, a binary encoding is possible but not needed to illustrate the main ideas.)

We write X to denote the above set of atomic propositions (that is parameterised by q and α). So, each symbolic memory state comes with its set of atomic propositions. We write X to denote the set of atomic propositions defined as X except that the atomic propositions are primed. The set X is defined similarly as well as other variants that decorate differently the atomic propositions. Given a propositional valuation v built over the sets X 1 , . . . , X n , we write Symb[v] to denote the unique n-tuple of symbolic memory states, if it is defined, such that the ith element of the tuple is equal to the symbolic memory state corresponding to the interpretation of the atomic propositions from X i . Given a symbolic memory state (P, A, H, n), one can easily design a propositional valuation that encodes it by the truth value of the atomic propositions in X. Similarly, existence of a symbolic memory state corresponding to a propositional valuation over X can be specified by a propositional formula of polynomial size.

Lemma 5.4.1. Let X be a set of atomic propositions possibly encoding a symbolic memory state. There is a propositional formula SMS(X) built over X such that for all propositional valuations v, we have v | = SMS(X) iff there is a symbolic memory state sms such that Symb[v] = sms.

The proof is left as Exercise 5.16. SMS(X) is a conjunction of formulae expressing simple properties. By way of example, there is a conjunct that states that exactly one atomic proposition among N(0), . . . , N(α) holds true.

Lemma 5.4.2. Let X, X and X be three sets of atomic propositions possibly encoding symbolic memory states. There is a propositional formula * p (X, X , X ) such that for all propositional valuations v, we have v | = * p (X, X , X ) iff there are symbolic memory states sms, sms and sms such that * s (sms, sms , sms ) and Symb[v] = (sms, sms , sms ).

Proof. (sketch) The formula * p (X, X , X ) is defined as the conjunction of the propositional formulae below:

1. X, X and X encode a symbolic memory state: SMS(X) ∧ SMS(X ) ∧ SMS(X ).

2. Encoding of 'P = P 1 = P 2 ': i,j∈ [1,q] (EQ(i, j) ⇔ EQ (i, j)) ∧ (EQ (i, j) ⇔ EQ (i, j)).

Encoding of 'A

= A 1 ∪ A 2 and A 1 ∩ A 2 = ∅': i∈[1,q]
(A(i) ⇔ (A (i) ∨ A (i))) ∧ ¬(A (i) ∧ A (i)).

Encoding of 'H

= H 1 ∪ H 2 ': i,j∈[1,q]
(H(i, j) ⇔ (H (i, j) ∨ H (i, j))) ∧ ¬(H (i, j) ∧ H (i, j)). The translation below is a simplification of the translation from Section 1.3.3 by taking into account the structure of the symbolic memory states involved in the algorithm MC from Section 5.3. The map tr is homomorphic for Boolean connectives (X, X and X are sets of atomic propositions possibly encoding symbolic memory states). tr(emp, X) def = N(0) ∧ ¬A(1) ∧ • • • ∧ ¬A(q) tr(x i → x j , X) def = H(i, j) tr(x i = x j , X) def = EQ(i, j) tr(ψ 1 * ψ 2 , X) def = ∃ X , X * p (X, X , X ) ∧ tr(ψ 1 , X ) ∧ tr(ψ 2 , X ) tr(ψ 1 - * ψ 2 , X) def = ∀ X , (∃X * p (X , X, X )) ⇒ (∃X * p (X , X, X ) ∧ (tr(ψ 1 , X ) ⇒ tr(ψ 2 , X )).

All the quantifications involved in the translation introduce new atomic propositions and ∃ {p 1 , . . . , p m } ψ is understood as a shortcut for ∃ p 1 , . . . , ∃ p m ψ. Moreover, the atomic propositions N(0), A(1), . . . , A(q), H(i, j) and EQ(i, j) mentioned above are those from the set X, which is one argument of the translation.

Lemma 5.4.3. Let ϕ be a formula built over the program variables x 1 , . . . , x q and α = msize(ϕ). ∃ X SMS(X) ∧ tr(ϕ, X) is QBF satisfiable iff there is symbolic memory state sms over (q, α) such that MC(sms,ϕ) returns .

Again, the proof is omitted but one can establish a correspondence between the QBF quantifications and the quantifications in MC. As a corollary, ϕ in 1SL0 is satisfiable iff ∃ X SMS(X) ∧ tr(ϕ, X) is QBF satisfiable. Since the translation requires only logarithmic space, this provides a PSPACE upper bound for 1SL0. More importantly, we have presented a technique to decide separation logic via a QBF solver and therefore we can take advantage of all the breakthroughs made recently, see e.g. [START_REF] Lonsing | DepQBF: A dependency-aware QBF solver[END_REF][START_REF] Heule | A unified proof system for QBF preprocessing[END_REF].

Furthermore, we can also regain a translation into first-order logic restricted to the equality predicate as done in [START_REF] Hague | Static checkers for tree structures and heaps[END_REF][START_REF] Calcagno | From separation logic to firstorder logic[END_REF]. Actually, the previous translation composed with the final translation presented below leads again to a polynomial-space decision procedure. However, we believe that we have simplified the reduction while we have been able to provide an intermediate step in QBF that has not been explored and investigated so far.

Let χ = Q 1 p 1 • • • Q n p n ϕ be a QBF formula with {Q 1 , . . . , Q n } ⊆ {∃, ∀} and ϕ is a propositional formula built over the atomic propositions in {p 1 , . . . , p n } Let us consider the translated formula below and the translation tr is homomorphic for Boolean connectives. ∃ x 0 , x 1 (x 0 x 1 ) ∧ tr (χ) tr (∃ p ψ) def = ∃ x p (x p = x 0 ∨ x p = x 1 ) ∧ tr (ψ)

x p is a fresh variable tr (∀ p ψ) def = ∀ x p (x p = x 0 ∨ x p = x 1 ) ⇒ tr (ψ)

x p is a fresh variable tr (p) def = (x p = x 1 ).

It is easy to establish the result below.

Lemma 5.4.4. χ is QBF satisfiable iff ∃ x 0 , x 1 (x 0 x 1 ) ∧ tr (χ) is satisfiable in first-order logic restricted to the equality predicate.

As promised, we have regained the existence of a simple translation from 1SL0 into a PSPACE fragment of first-order logic. Actually, this is essentially the translation designed in [START_REF] Calcagno | From separation logic to firstorder logic[END_REF] but presented in a different way and with an intermediate step in QBF (see also [START_REF] Chawdhary | Translating separation logic to first order logic[END_REF]Chapter 4]). Alternatively, matching logic, that is a first-order dialect with patterns built-in, can easily encode separation logic, see the survey paper [START_REF] Rosu | Matching Logic -Extended Abstract[END_REF].

Most probably, it would be possible to design a (labelled) sequent-style calculus for 1SL0 that mimicks a sequent-style calculus for QBF [START_REF] Egly | On sequent systems and resolution for QBFs[END_REF], by taking into account the correspondence between propositional valuations and symbolic memory states. This may add some theoretical value but we doubt that in practice, this provides decision procedures more efficient than the ones obtained by translation into QBF and then use an QBF solver.

Bibliographical References about Proof Systems

In the previous sections, we have seen that for any k ≥ 1, the set of valid formulae for kSL is not recursively enumerable and therefore there is no hope to design finite axiomatization for kSL and to design nice sequent-style proof systems. Nevertheless, calculi exist for abstract separation logics, mostly because first-order conditions are involved in separation models, see e.g. the conditions in [START_REF] Hou | Proof search for propositional abstract separation logics via labelled sequents[END_REF]. Similarly, display calculi for bunched logics can be found in [START_REF] Brotherston | Bunched logics displayed[END_REF]. The recent work [START_REF] Hou | Automated theorem proving for assertions in separation logic with all connectives[END_REF] also presents a sound (but necessarily incomplete) labelled sequent calculus for the logic 2SL that repairs the deficiencies of previous calculi.

Hilbert-style axiomatizations can be also found in [START_REF] Brotherston | Parametric completeness for separation theories[END_REF] by using nominals but again this involves mainly abstract separation models and does not deal with concrete heaps as in kSL. Still, it is possible to design complete proof systems for propositional logics, such as the tableaux-style calculus for 2SL0 in [START_REF] Galmiche | Tableaux and resource graphs for separation logic[END_REF] but completeness for full 2SL is not possible (see Theorem 1.3.5). The literature contains also a few attempts to design complete proof systems for some kSL. Graph-based decision procedures can be found in [START_REF] Haase | SeLoger: A tool for graph-based reasoning in separation logic[END_REF], which goes beyond 1SL0 (see also an NP-complete fragment of separation logic that can be decided using a model-theoretical decision procedure [START_REF] Enea | Compositional invariant checking for overlaid and nested linked lists[END_REF]).

Exercises

Exercise 5.1. Let A = (N, h) be the structure such that h : N → N, h(0) = 1 and for all i ≥ 1, h(i) = i. Exercise 5.2. Let ϕ s = ϕ 1 s * ϕ 2 s be a spatial formula in SLLB such that ϕ 1 s is a non-empty separating conjunction of equalities or inequalities and ϕ 2 s is a nonempty separating conjunction of reachability atomic formulae. Show that ϕ s is satisfiable in SLLB iff ϕ 1 s ∧ ϕ 2 s is satisfiable in 1SL0 augmented with the strict reachability predicate sreach.

Exercise 5.3. Prove Lemma 5.2.3.

Exercise 5.4. Show the statements in Lemma 5.2.4.

Exercise 5.5. Show Lemma 5.2.5.

Exercise 5.6. Construct the translation of the SLLB formula ¬(x 1 → x 2 * x 3 → x 4 ) into GRASS (by eliminating also adequatly the existential quantifications over set variables).

Exercise 5.7. Prove Lemma 5.2.7.

Exercise 5.8. Show Lemma 5.3.1.

Exercise 5.9. Proof Lemma 5.3.2.

Exercise 5.10. Show Corollary 5.3.8. Exercise 5.11. Compute the abstraction over (q, α) with q = 4 and α = 3 for the three memory states presented in Figure 1.1.

Exercise 5.12. Given symbolic memory states sms, sms 1 and sms 2 , show that * s (sms, sms 1 , sms 2 ) iff the conditions below hold:

Chapter 6

CONCLUSION

In this document, we have presented a puristic version of separation logics in which the set of locations (resp. values) is equal to the set of natural numbers and most of the time, the fragments satisfy simple syntactic closure properties. Our main object of study are fragments of the form kSLk , i.e. first-order separation logic with k record fields and at most k quantified variables in formulae. Several proof techniques have been introduced to establish decidability, undecidability, computational complexity characterisation and expressiveness (see Figure 6.1 for a partial overview of results). Some of the results are quite standard and have been proved at the early age of separation logics (see e.g. [Yan01, COY01, Loz04a]) whereas we have also presented more recent results about expressiveness (see e.g. [START_REF] Brochenin | On the almighty wand[END_REF][START_REF] Demri | Expressive completeness of separation logic with two variables and no separating conjunction[END_REF]) and decision procedures, for instance those based on the SMT framework (see e.g. [START_REF] Piskac | Automating separation logic using SMT[END_REF]) or QBF. Moreover, we have provided formal relationships with other classes of logics introduced with possibly different motivations such as, logic of bunched implications [START_REF] O'hearn | The logic of bunched implications[END_REF][START_REF] Pym | The Semantics and Proof Theory of the Logic of Bunched Implications[END_REF], data logics [BMS + 06, FS09], interval temporal logics [START_REF] Moszkowski | Reasoning about digital circuits[END_REF], modal logics [START_REF] Demri | Two-variable separation logic and its inner circle[END_REF] or first-order logic [START_REF] Calcagno | From separation logic to firstorder logic[END_REF]. The material in the different chapters has been designed so that unified notations are used and pointers to the literature are provided as much as possible. Nevertheless, even though the document deals with separation logics, it focuses on a selection of logical investigations and does not say much about other aspects of such logics; the format of an ESSLLI course justifies however the necessity of such a choice. References to analytic proof systems for (abstract or concrete) separation logics are provided in Section 5.5 but this topic would deserve more developments. Besides, the document provides motivations about separation logics related to formal verification by extending Floyd-Hoare logic (see e.g. Section 1.1). Certainly, the document could be completed along these lines by proving program properties by using separation logics and its proof systems. We invite the reader to consult [O'H12, Gor14, Jen13a] to have first-class developments about formal verification with separation logics. Similarly, the emerging use of SMT solvers to decide separation logics (see e.g. Section 5.1.3) witnesses the power of such a framework (Section 5.2 is nevertheless related to it). Other aspects about program verification have been quickly presented in order to focus instead on fundamental properties of separation logics. However, in full generality and in order to illustrate the practical use of separation logics, more material about data values could be considered (see e.g. [BDES09, BBL09, MPQ11]) as well as about the use of inductive predicates such as those related to lists, trees, etc. (see e.g. [START_REF] Iosif | The tree width of separation logic with recursive definitions[END_REF][START_REF] Brotherston | A decision procedure for satisfiability in separation logic with inductive predicates[END_REF]). We also refer the reader to the slides by P. O'Hearn from the invited talk given at the "SIGPLAN Programming Languages Mentoring Workshop (PLMW)", Roma 2013, for current trends in the mechanisation of proofs for formal verification.

As conclusion, let us mention a few research directions related to logical investigations of separation logics. First, for the first time, SMT-COMP 2014 run a competition with SMT solvers for separation logic as an "off" event, see e.g. [START_REF] Sighireanu | Report on SL-COMP 2014[END_REF]. A promising direction consists in developing further SMT-based decision procedures for separation logics allowing even more combinations with other logical theories. Besides, there is still some need and interest to design even more tractable fragments useful for formal verification. As far as we know, it is open whether 1SL0 + sreach is decidable (both separating connectives * and - * belong to such a fragment), see e.g. its use in [START_REF] Thakur | Satisfiability modulo abstraction for separation logic with linked lists[END_REF]. Finally, designing proof systems for separation logics from which decision procedures can be designed (when possible) remains quite open. For instance, as far as we know, no label-free sequent-style calculus exists for 1SL0 that can lead to a decision procedure that runs in polynomial space. These are only a few possible directions.

Index

Contents 1 . 1

 11 Floyd-Hoare Logic and Separation Logic . . . . . . . . . . 1.1.1 Hoare triples . . . . . . . . . . . . . . . . . . . . . . 1.1.2 Weakest preconditions . . . . . . . . . . . . . . . . . 1.1.3 Adding pointers . . . . . . . . . . . . . . . . . . . . . 1.1.4 The birth of separation logic . . . . . . . . . . . . . . 1.2 A Core Version of Separation Logic . . . . . . . . . . . . . 1.2.1 Basic definitions . . . . . . . . . . . . . . . . . . . . 1.2.2 Expressing properties with separation logic . . . . . . 1.2.3 Deduction rules in a Floyd-Hoare proof system . . . . 1.2.4 Classes of formulae . . . . . . . . . . . . . . . . . . . 1.2.5 Decision problems . . . . . . . . . . . . . . . . . . . 1.3 Relationships with Other Logics . . . . . . . . . . . . . . . 1.3.1 Logic of bunched implications and its Boolean variant 1.3.2 First-order logic with second-order features . . . . . . 1.3.3 Translation into dyadic second-order logic . . . . . . . 1.3.4 Undecidability . . . . . . . . . . . . . . . . . . . . . 1.3.5 Modal logics with updates . . . . . . . . . . . . . . . 1.4 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

  {ϕ ∧ B} C {ϕ} {ϕ} while B do C {ϕ ∧ ¬B} while rule {ϕ ∧ B} C 1 {ψ} {ϕ ∧ ¬B} C 2 {ψ} {ϕ} if B then C 1 else C 2 {ψ} conditional rule

  := e, ψ) def = ψ[e/x] wp(C 1 ; C 2 , ψ) def = wp(C 1 , wp(C 2 , ψ)) wp(if B then C 1 else C 2 , ψ) def = (B = ∧ wp(C 1 , ψ)) ∧ (B =⊥ ∧ wp(C 2 , ψ))wp(while B do C, ψ) def = I ∧ ∀ y 1 , . . . , y k (((B = ∧ I) ⇒ wp(C, I)) ∧ ((B =⊥ ∧I) ⇒ ψ))[y i /x i ]

  in the graphical representation of the heap h corresponds to a unique edge in the graphical representation of either h 1 or h 2 . For every k ≥ 1, formulae of kSL are built from expressions of the form e ::= x | u where x ∈ PVAR and u ∈ FVAR, and atomic formulae of the form π ::= e = e | e → e 1 , . . . , e k | emp | ⊥ . Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15

Figure 1

 1 Figure 1.1: Disjoint memory states with one record field.

  [e] := e leads to the following local rule (small axiom): {∃ u e → u} [e] := e {e → e } local mutation Note that the precondition and the postcondition are now expressed in 1SL. The global rule can be also derived by application of the frame rule. {(∃ u e → u) * ϕ} [e] := e {e → e * ϕ} global mutation Similarly, for performing backward reasoning, one can obtain the following rule: {(∃ u e → u) * (e → e - * ϕ)} [e] := e {ϕ} backwards reasoning mutation Global rules for deallocation and allocation are provided below: {(∃ u e → u) * ϕ} dispose(e) {ϕ} {ϕ} x := cons(e) {(x → e) * ϕ} where x is not free in e and in ϕ. Small axioms for allocation and deallocation are the following ones: {∃ u e → u} dispose(e) {emp} {emp} x := cons(e) {x → e}

π

  ::= e = e | e → e 1 , . . . , e k | P(e 1 , . . . , e n ) | emp | ⊥ . Formulae of kWSOL are defined by the grammar ϕ, ψ ::= π | ϕ ∧ ψ | ¬ϕ | ∃ u ϕ | ∃ P ϕ

  Strictly speaking, a classical version of kSL0 should admit atomic formulae of the form e → e instead, but for kSL0, this does not make a subtantial difference in the classical framework. Now, let us restrict ourselves to the formulae below: ϕ, ψ ::= e → e | e = e | e e | | ϕ ∧ ψ | ϕ ∨ ψ | ϕ ⇒ ψ | ϕ * ψ | ϕ - * ψ | ∀ u ϕ Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15

  to emphasise the separation model in use. The satisfaction relation on BBI-models is clearly defined following the same schema (see Section 1.3.1). A formula ϕ is valid in the separation model (M, •, U) def ⇔ for all m ∈ M and for all valuations V, we have m | = V ϕ. Similarly, a formula ϕ is satisfiable in the separation model (M, •, U) def ⇔ there exist m ∈ M and a valuation V such Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15

Figure 2 .

 2 Figure 2.1 illustrates how the configuration (4, 3, 2) can be encoded as a set with the corresponding valuation.The formula ϕ M has the following form:

  def ⇔ (fb1) dom(h) ∅, Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15

Figure 3

 3 Figure 3.3: A segmented heap and collections of knives.

Figure 3 . 4 :

 34 Figure 3.4: How to get a u-3cut -Decomposition in two stages.

  and Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15 (w) l 2 = 0.

Figure 3 . 7 :

 37 Figure 3.7: How the translation ofP i (u j , u k ) works (j < i < k): (l, l ) ∈ V h (P i ).

Contents 4 . 1

 41 Data Logics . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1.1 Separation logic with data . . . . . . . . . . . . . . . 4.1.2 Undecidability for separation logic with data . . . . . 4.1.3 A decidable fragment . . . . . . . . . . . . . . . . . . 4.1.4 First-order data logics . . . . . . . . . . . . . . . . . 4.2 Interval Temporal Logics . . . . . . . . . . . . . . . . . . . 4.2.1 The logic PITL . . . . . . . . . . . . . . . . . . . . . 4.2.2 A correspondence between words and heaps . . . . . . 4.2.3 A reduction and its three ways to chop . . . . . . . . . 4.3 Modal Logics . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.1 A modal logic for heaps . . . . . . . . . . . . . . . . 4.3.2 A refinement with the modal fragment of 1SL2( * ) . . . 4.4 Monadic Second-Order Logic . . . . . . . . . . . . . . . . 4.5 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . .

  1. The satisfiability problem for the logic 1SL3( * )[Z, =] with data values in Z is undecidable (Theorem 4.1.1) [BBL09, Theorem 3] . The proof is obtained by reducing an undecidable version of linear-time temporal logic LTL with the freeze operator [FS09].

  banish the magic wand operator and provide even further restrictions. Let 1SL sdc < be the fragment of 1SL( * )[Z, ≤, =] (without magic wand) such that the atomic formulae about data values can only occur in subformulae of the one of the forms below: e → e ∧ (e ≤ e ) e → e ∧ (e ≤ e)

  Proposition 4.1.2. [BBL09, Corollary 1] The satisfiability problem for 1SL sdc < is decidable. It remains open to characterize a significant class of data domains for which the extension of 1SL( * ) with data from those data domains would lead to decidability too. Other decidability results about 1SL( * ) extended with data values can be found in [BBL09, Section 5.2].

  The satisfiability problem for α≥1 FO2 α,0 (<, +1, =) is NEXPTIME-complete[START_REF] Etessami | First-order logic with two variables and unary temporal logics[END_REF] (see also[START_REF] Ph | Expressiveness and Succinctness of First-Order Logic on Finite Words[END_REF] Corollary 2.2.4]). (II) The satisfiability problem for α≥1 FO2 α,1 (<, +1, =, ∼) is decidable and closely related to the reachability problem for Petri nets [BDM + 11, Dav09, Theorem 3]. (III) The satisfiability problem for α≥1 FO2 α,2 (<, +1, =, ∼) is undecidable [BDM + 11, Proposition 27][Dav09]. (IV) The satisfiability problem for α≥1 FO2 α,1 (<, +1, =, ∼, ≺) is undecidable [BDM + 11, Dav09].

  Lemma 4.1.4. Let ϕ be a formula in FO2 α,1 (<, +1, =, ∼, ≺). (I) For every data word dw in ([1, α] × N) + , dw | = ϕ iff h dw | = dw(α, 1) ∧ tr(ϕ). Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15

Figure 4 . 2 :

 42 Figure 4.2: The correspondence between PITL's chop 'C' and separation logic's separating conjunction ' * ' (before and after).

Demri,

  Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15 • t(a) a def = and t(b) a def =⊥ for every letter b ∈ Σ \ {a}.

Exercise 4. 3 .

 3 Show Lemma 4.2.5. Exercise 4.4. With the abbreviation [U] introduced in Section 4.3, show that M, l | = [U]ϕ iff for all l ∈ N, we have M, l | = ϕ.

Exercise 4. 7 .

 7 Let SL ( * ) be the extension of 1SL( * ) in which the separating implication can used but only in a very restricted way, typically in formulae of the form ((size ≤ k) ∧ ϕ) - * ϕ . Show that the satisfiability problem for SL ( * ) is decidable by using the decidability of 1SL( * ). Versus Translation Approach . . . . . . . . . . . . . 139 5.1.1 Direct approach versus translation for deciding modal logics . . . . . . . . . . . . . . . . . . . . . . . . . . 139 5.1.2 Translation versus specialised algorithms for separation logic . . . . . . . . . . . . . . . . . . . . . . . . 139 5.1.3 The SMT framework . . . . . . . . . . . . . . . . . . 140 5.2 Translation Into a Reachability Logic . . . . . . . . . . . . 141 5.2.1 A target logic combining reachability and sets . . . . . 142 5.2.2 A variant separation logic interpreted on GRASS-models145 5.2.3 A logarithmic-space translation . . . . . . . . . . . . 146 5.3 Direct Approach: An Example . . . . . . . . . . . . . . . . 149 5.3.1 Expressiveness . . . . . . . . . . . . . . . . . . . . . 150 5.3.2 A model-checking decision procedure . . . . . . . . . 157 5.4 Translation into QBF . . . . . . . . . . . . . . . . . . . . . 162 5.5 Bibliographical References about Proof Systems . . . . . . 166 5.6 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

1.

  Presentation of the NP upper bound for the satisfiability problem for SLLB relying on an SMT-based translation into the logic GRASS defined from the combination of two logical theories [PWZ13] (Corollary 5.2.8). 2. Characterisation of the expressiveness of 1SL0 by using Boolean combinations of test formulae (Theorem 5.3.7). This follows and refines developments from [Yan01, Loz04a, DGLWM14]. 3. Presentation of the PSPACE upper bound for the satisfiability and modelchecking problems for 1SL0 (Theorem 5.3.11) based on techniques developped in [Yan01, COY01, Loz04a].

qα

  (s , h ), we have (s, h) | = ϕ iff (s , h ) | = ϕ.Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15

Figure 5

 5 Figure 5.1: Function MC(sms, ψ)

  g. [Lad77, Spa93, COY01, Dem03]. Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15

Figure 5 . 2 :

 52 Figure 5.2: Function AMC(sms, ψ)

  [s, h] = sms. By the induction hypothesis, (s, h) | = ϕ 1 and (s, h) | = ϕ 2 and therefore (s, h) | = ϕ. Case 2: ϕ = ϕ 1 * ϕ 2 . Suppose that (s, h) | = ϕ and Symb[s, h] = sms. So, there are subheaps h 1 and h 2 such that h = h 1 h 2 , (s, h 1 ) | = ϕ 1 and (s, h 2 ) | = ϕ 2 . By the induction hypothesis, Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15

5.

  Encoding of 'n = max(α, n 1 + n 2 )':β,β ∈[0,α] (N (β) ∧ N (β )) ⇒ N(min(α, β + β )).

  a) Check that A is a GRASS-model. b) Given a variable assignment f, characterise the set {x.x = x} \ S A,f in terms of S A,f .c) Given terms T 1 , . . . , T N , design a term S such that for all A and f, we have{ T 1 A,f , . . . , T N A,f } = S A,f .

1SL≡

  1DSOL ≡ 1WSOL ≡ 1SL(- * ), undec.[START_REF] Brochenin | On the almighty wand[END_REF]

Figure 6

 6 Figure 6.1: A few results about decidability and complexity

  * iff ϕ is satisfiable. Conclude that the model-checking problem for L is NP-hard. c) By using Corollary 2.1.8, show that if ϕ in L is satisfiable, then ϕ holds true

ψ where x, y ∈ PVAR. a) Explain why the satisfiability problem for L is NP-hard.

b) Given a propositional formula ϕ built over atomic propositions in {p 1 , . . . , p n } in which negation occurs only in front of atomic propositions, we write tr(ϕ) to denote the formula in L obtained from ϕ by substituting every occurrence of p i by the atomic formula alloc(x i ). We define the memory state (s, h) such that for all i ∈ [1, n], we have s(x i ) def = i and h(i) def = i. Show that (s, h) | = tr(ϕ) on a memory state (s, h) with ran(s) ∪ dom(h) ∪ ran(h) ⊆ [0, p(|ϕ|)] for some polynomial p(•). d) Given a memory state (s, h) and a formula ϕ in L, define a witness of polynomial size so that checking whether the witness guarantees that (s, h) | = ϕ can be done in polynomial time. Conclude that the model-checking problem for L is NP-complete.

  where the formulae ψ i 1 (Y i ) and ψ i 2 (Y i ) are defined from the previous table with the atomic formula ϕ i s , and Y 1 , . . . , Y n are fresh set variables. Similarly,

	tr(¬(ϕ 1 s

This work has been partially supported by the EU Seventh Framework Programme under grant agreement No. PIOF-GA-2011-301166 (DATAVERIF).

Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI'15

2. If a location l encodes the value for the counter c j in a configuration with instruction I (i.e., l ≥ α + 3 and the jth ancestor of l has I + 2 predecessors) and h 3 (l) is defined, then l + 1 = h 3 (l).

3. Similarly, if a location l encodes the value for the counter c 3-j (i.e., the counter c 3-J is not updated after instruction I) in a configuration with instruction I (i.e., l ≥ α + 3 and the jth ancestor of l has I + 2 predecessors) and h 3 (l) is defined, then l = h 3 (l).

The properties can be expressed by the formula χ I below:

((

(( u ≥ α + 3) ∧ ( u j-3 = I + 2) ⇒ ( u = u +3 ))].

Each subformula decorated by a curly bracket with (i) expresses exactly the property (i) above. Note that u +3 = J + 2 states that the number of predecessors of h 3 (f(u)) is J + 2, which is quite easy to express in 1SL2 (see Section 1.2.2). By contrast, the formula u = u +3 -1 states that the number of predecessors of h 3 (f(u)) is equal to the number of predecessors of f(u) plus one, which requires the more sophisticated formulae introduced in Section 3.2 and in Section 3.3.1.

Similarly, let I be the instruction "I: if c j = 0 then goto J 1 else (c j := c j -1; goto J 2 )" then χ I is defined as follows:

When h is X-well-formed, we write h = h B h V such that dom(h V ) is made of entries and parentheses of degree d ≥ l 0 for some l 0 ∈ N such that h | = [u →l 0 ] indmin(u) (i.e., l 0 is the index of the left 0-parenthesis with the maximal degree). By Definition 3.4.9, we have spect(h) = indspect(h V ) and clearly the decomposition is unique since l 0 is unique.

Again, well-formed heaps can be characterised by formulae in 1SL2(- * ) whose size is linear in K.

Proof. We consider the conjunction of the formulae below, each of them deals with one of the four conditions. Condition (1) is obviously taken care by the formula awfh X (see the proof of Lemma 3.4.6). Condition (2) is dealt with the formula below:

Note that since the heap is already X-almost-well-formed, at most one location can satisfy the above existential quantification for each FO variable index i j . Similarly, Condition (3) is taken care by the formula below (see the proof of Lemma 3.4.8 and more specifically Condition (6) in that proof with indices from second-order variables):

whenever there are locations l and l and a disjoint heap h such that:

1. l is the unique large 0-parenthesis in h and l is isolated in h,

It is clear that such objects exist by considering the above construction. The proof in the other direction (i.e.

) is actually very similar since most of the above implications are indeed equivalences.

(and therefore R involves some isolated locations in h B ), we pick another R (of same cardinality β) that does not involve locations in Y. It is then easy to show that h

without any loss of generality, below we assume that R does not involve locations in Y (see also [BDL12, Lemma 2.1]).

Let us build h i V and an assignment f such that:

Assume that max(X) = j and m be the degree of the right j-parenthesis with greatest degree. It is easy to define a local i-valuation h i V disjoint from h such that 1. the degree of the left i-parenthesis is m + 1, 2. the degree of the right i-parenthesis is (m + 1) + 3β + 1 for some β ≥ 0, 3. there are 2β entries, 4. for every pair (l, l ) in R, there are two entries of consecutive degrees whose elements are l and l respectively. This is always possible since dom(h) ∪ ran(h) and R are finite. It is not difficult to check that h i V and f satisfy the above conditions. Since h h i V is (X ∪ {i})-well-formed by construction, by Lemma 3.4.12, we have

ψ and by the induction hypothesis, we get

However, it is easy to conclude then that h | = t X, ψ . Indeed, h satisfies the formula below

whenever there are locations l and l and a disjoint heap h such that:

1. l is the unique large 0-parenthesis in h and l is isolated in h, 2. h is an i-local valuation such that the index of the left i-parenthesis is l , h h is (X ∪ {i})-well-formed, 3. l is the left 0-parenthesis in h h and l is the left i-parenthesis in h h ,

It is clear that such objects exist by considering the above construction. The proof in the other direction (i.e. h | = t X, ψ implies h B | = V h ∃ P i ψ ) is actually very similar since most of the above implications are indeed equivalences.

QED

Here is the major expressiveness result.

Theorem 3.4.14. For every sentence ϕ in 1DSOL, for every heap h, we have

, so WSOL and 1SL2(- * ) have the same expressive power.

The proof of Theorem 3.4.14 is left as Exercise 3.3. Observe that T(ϕ) can be computed in logarithmic space in the size of ϕ (to do this, one must also check the size of all the formulae built in the previous proofs). So, the restriction to two variables in 1SL2(- * ) does not reduce the expressive power, unlike restrictions in [Ven91, EVW97] but we know also other from material and results in [Yan01, COY01, Loz04a] (see also some subsequent developments in [START_REF] Demri | Separation logic with one quantified variable[END_REF]).

Expressiveness

Given q ≥ 1 and α ∈ N, we write Test(q, α) to denote the following set of atomic formulae:

Here, alloc(x i ) and size ≥ β are not anymore shortcuts as defined in Section 1.2.2 but these expressions should be understood as primitive formulae (at least to build Boolean combinations from it). We recall that size ≥ β holds true when the heap domain has cardinal at least β. Hence, formulae from Test(q, α) state very basic properties on memory states.

We can also use size q ≥ β as an abbreviation for the Boolean combination of test formulae defined below that characterises the memory states such that the cardinal of the heap domain is at least β even if we remove from it the locations that are interpreted by a program variable among x 1 , . . . , x q : X⊆{x 1 ,...,x q } ( x∈X alloc(x)) ∧ ( x∈{x 1 ,...,x q }\X ¬alloc(x)) ∧ size ≥ (card(X) + β).

Alternatively, we write Test (q, α) to denote the variant set of Test(q, α) in which test formulae of the form size ≥ β are replaced by size q ≥ β (understood as primitive formulae this time).

Lemma 5.3.1. Let (s, h) be a memory state and h h (i.e. h is a conservative extension of h). For all ψ ∈ Test (q, α), (s, h)

The proof is left as Exercise 5.8. We write (s, h) ≈ q α (s , h ) (q ≥ 1, α ∈ N) whenever the memory states (s, h) and (s , h ) agree on the satisfaction of the test formulae in Test (q, α). The equivalence relation is actually an indistinguishability relation with respect to a finite set of formulae parameterised by syntactic resources based on q and α. Note that, above size q ≥ β is used instead of size ≥ β, which shall simplify a few forthcoming technical developments (this is therefore a bit different from what has been done in [Yan01, Loz04a, BDL09] for instance). However, this is irrelevant for expressiveness, see also Exercise 5.13. So, for some sms and sms such that * s (sms , sms , sms), we get MC(sms , ϕ 1 ) = and MC(sms , ϕ 2 ) = ⊥, whence MC(sms, ϕ) returns ⊥.

Conversely, suppose that MC(sms, ϕ) returns ⊥. For some sms and sms such that * s (sms , sms , sms) and MC(sms , ϕ 1 ) = and MC(sms , ϕ 2 ) = ⊥. By definition of * s , there exist a store s and disjoint heaps h 1 and h 2 such that Symb[s, h 1 h 2 ] = sms , Symb[s, h 1 ] = sms, Symb[s, h 2 ] = sms . By the induction hypothesis and by using that preliminary equivalence, we have (s,

For the correction of the proof of the last case, we crucially need to use that msize(ϕ 1 - * ϕ 2 ) ≤ α implies that msize(ϕ 2 ) ≤ α but also msize(ϕ 1 ) ≤ α -this last inequality would not necessarily hold with the size function msize(•). QED Consequently, we get the following complexity characterisation Theorem 5.3.11. [COY01] Model-checking and satisfiability problems for 1SL0 are in PSPACE.

Proof. PSPACE upper bound is a consequence of Lemma 5.3.10 by recalling that ϕ is satisfiable iff there is a memory state (s, h) such that (s, h) | = ϕ iff there is a symbolic memory state sms over (q, msize(ϕ)) such that MC(sms, ϕ) = . It is sufficient to guess sms and then check whether MC(sms, ϕ) returns . All of this can be done in non-deterministic polynomial space and by Savitch's Theorem [START_REF] Savitch | Relationships between nondeterministic and deterministic tape complexities[END_REF], we get the PSPACE upper bound. Exercise 5.13. Let β ≥ 0. Define a Boolean combination of test formulae from Test(q, β) that is logically equivalent to size q ≥ β.

Exercise 5.14. For every k > 1, show that the satisfiability and model-checking problems for kSL0 can be solved in PSPACE.

Exercise 5.15. Explain why the satisfiability and model-checking problems for 1SL0 remains in PSPACE even if the formulae are encoded as DAGs (instead of trees, as it is implicitly assumed all over the chapter).

Exercise 5.16. Prove Lemma 5.4.1. For instance, the formula SMS(X) should enforce that 'EQ' is an equivalence relation, 'EQ' is a congruence for 'A' and 'H', etc.

Demri, Deters: Logical Investigations on Separation Logics (Draft) -September 8, 2015-ESSLLI '15