---
title: 'ViperCore: Core IVL for Separation Logic'
url: https://www.emergentmind.com/topics/vipercore
type: topic
---

# ViperCore: Core IVL for Separation Logic

ViperCore is a core intermediate verification language (IVL) designed to serve as a precise semantic foundation for verification frameworks targeting variations of separation logic, most notably the Viper verification infrastructure. By capturing the essence of resource management and heap-manipulating assertions in a minimal, algebraic setting, ViperCore enables rigorous reasoning about the soundness of both front-end translations and back-end verifiers for complex, resource-aware program logics. The framework includes two provably equivalent semantic interpretations—operational and axiomatic—providing a formally verified substrate for automated verification tools [2407.20002].

## 1. Syntax and Structural Elements

ViperCore is defined over a semantic state space $\Sigma$ constructed atop an IDF algebra, encoding both the program store and permission-aware heap states. The language manipulates:

- **Variables** $x, y \in Var$
- **Values** $v \in Val$
- **Field names** $f \in FieldName$
- **Assertions** $A\subseteq\Sigma$, interpreted as sets of states
- **Commands** $C$ generated by the grammar:
  $$
  C ::= inhale~A~|~exhale~A~|~havoc~x~|~x := e~|~skip~|~C;C~|~if~b~then~C_1~else~C_2~|~custom~C'
  $$
Here, \textit{inhale} and \textit{exhale} manipulate resources (heap and permissions), \textit{havoc} non-deterministically assigns a variable, \textit{assign} performs deterministic state updates, and \textit{custom} permits extensibility with user-supplied primitives (such as field updates).

Assertions and expressions ($e, b$) are semantic: they range over partial functions $\Sigma \to Val$ (for computations and predicates) and subsets of $\Sigma$ (for state properties), respectively.

## 2. Operational Semantics: Angelic and Demonic Choice

The operational semantics of ViperCore, given by the relation $C, \omega \Downarrow S$, models both angelic and demonic forms of non-determinism:

- **Angelic choice** occurs in \textit{exhale}, allowing arbitrary selection of witness resources to consume, thus favoring success of the verification obligation.
- **Demonic choice** is present in \textit{inhale}, where all possible ways of producing resources are considered, possibly leading to branching or failure.

The heap-permission algebra is formalized by a partial, commutative, associative operator $\oplus : \Sigma \times \Sigma \rightharpoonup \Sigma$. States must satisfy $\textit{stable}(\omega)$—the heap value map and heap permission map agree on domains.

Operational rules include:

- **Inhale**: $inhale~A,~\omega \Longrightarrow \{\omega\oplus\alpha~|~\alpha\in A \wedge \textit{stable}(\omega\oplus\alpha)\}$
- **Exhale**: $exhale~A,~\omega \Longrightarrow \{\omega'~|~\exists\alpha\in A.~\omega = \omega'\oplus\alpha \wedge \textit{stable}(\omega')\}$
- **Assignment**: $x:=e, \omega \Longrightarrow \{\omega[x\mapsto v]\}$ if $e(\omega)=v$
- **Havoc**: $havoc~x, \omega \Longrightarrow \{\omega[x\mapsto v]~|~v\in Val\}$

Sequential composition and conditionals propagate both forms of non-determinism, reflecting their interaction with heap and permission state.

## 3. Axiomatic Semantics: Hoare-Separation Logic

Axiomatic semantics are captured by triples $\langle P \rangle C \langle Q \rangle$ for assertions $P, Q \subseteq \Sigma$. The semantics is strengthened by self-framing: assertions must be closed under resource erasure for irrelevant heap locations, ensuring modular reasoning à la separation logic.

The principal rules include:

- **Skip/Sequence**: Standard, subject to self-framing
- **Inhale**: $\langle P \rangle inhale~A \langle P!*A \rangle$, where $frames_P(A)$ holds
- **Exhale**: $\langle P \rangle exhale~A \langle Q \rangle$ if $P \models Q!*A$, again requiring self-framing
- **Assign/Havoc**: Capture standard update and existential quantification over possible values
- **Conditionals**: Respect framing and propagate logical conjunction/disjunction on state predicates
- **Frame Rule**: Supports modular extension by unrelated resources

These rules abstract away operational branching by summarizing all executions that remain within the resource boundaries prescribed by the assertions.

## 4. Semantic Equivalence and Correctness

The formal relationship between operational and axiomatic semantics underpins the foundation for tool soundness:

- **Soundness**: If $C$ is operationally correct in all $\omega$, there exists $Q$ such that $\langle \top \rangle C \langle Q \rangle$ holds.
- **Completeness**: If $\langle P \rangle C \langle Q \rangle$ and $\omega\in P$, then $C, \omega \Downarrow S$ with $S\subseteq Q$.

The equivalence is established by inductively relating the set of reachable states (operational) to the satisfaction of assertion triples (axiomatic), accounting for both angelic and demonic choices. This enables meta-theoretic reasoning about both front-end translation correctness and back-end prover reliability [2407.20002].

## 5. Instantiation for Viper: The ViperCore Model

ViperCore specializes $\Sigma$ to model Viper’s heap and permission structures. The IDF (Indivisible, Discardable, Fractional) algebra is realized as:

- $\Sigma_{IDF} = (H \rightharpoonup Val) \times (H \rightharpoonup [0,1])$
- Heaps are merged pointwise, summing permissions up to 1, and heap values at locations with zero permission are erased.
- $\textit{stable}(h, \pi)$ iff $\text{dom}(h) = \{\ell~|~\pi(\ell)>0\}$.

States are extended to tuples with a Store component, with “agreement” ensuring that inhale/exhale affect only heap and permissions, not local variables. A custom command $e_r.f := e_v$ models field updates, operationally requiring full permission.

Translation from Viper’s AST involves mapping each program statement to ViperCore’s primitive commands, rendering the semantics of high-level verification logic directly in terms of ViperCore [2407.20002].

## 6. Connections to Verification Back-Ends

ViperCore serves as the semantic pivot between front-end verifiers (e.g., concurrent separation logic) and back-ends for automated program proof:

- **Symbolic Execution Back-End**: An Isabelle/HOL function $sexec : Stmt \rightarrow Cont \rightarrow bool$ implements Viper’s symbolic execution over symbolic states (store, permission chunks), using produce/consume to model inhale/exhale and CPS for control. Angelic choice in exhale matches the operational semantics: to exhale a wildcard permission, some positive quantity is removed. The following is shown: $sexec(C,K) = true \implies$ $C$ is operationally correct in all concrete states conforming to the symbolic state.
- **Verification Condition Generation (VCG) Back-End**: A big-step semantics $VCGSem$ for Viper’s Boogie-style VCG employs a total heap, modeling demonic selection for resource removal. Each ViperCore execution $\omega\Downarrow S$ corresponds to a family of $VCGSem$ executions, making precise the translation between concrete execution and VCG-style proof obligations [2407.20002].

## 7. Formalization and Applications

All technical results for ViperCore, covering the semantic models, operational and axiomatic equivalence, instantiations for Viper’s heap and permission system, and the correctness of two disparate back-ends, are formalized in Isabelle/HOL. The framework provides a uniform, verified foundation for reasoning about translational separation logic verifiers, enabling systematic proofs of soundness for toolchains that integrate different verification back-ends or accommodate front-end logics such as concurrent separation logic [2407.20002]. A plausible implication is that ViperCore facilitates modular extension and reliable meta-theoretic analysis of diverse program verification workflows involving heap, permission, and resource-based invariants.

Source: https://www.emergentmind.com/topics/vipercore