Separation logic

In computer science, separation logic^[1] is an extension of Hoare logic, a way of reasoning about programs. It was developed by John C. Reynolds, Peter O'Hearn, Samin Ishtiaq and Hongseok Yang,^[1][2][3][4] drawing upon early work by Rod Burstall.^[5] The assertion language of separation logic is a special case of the logic of bunched implications (BI).^[6]

Overview

Separation logic facilitates reasoning about:

• programs that manipulate pointer data structures — including information hiding in the presence of pointers;
• "transfer of ownership" (avoidance of semantic frame axioms); and
• virtual separation (modular reasoning) between concurrent modules.

Separation logic supports the developing field of research described by Peter O'Hearn and others as local reasoning, whereby specifications and proofs of a program component mention only the portion of memory used by the component, and not the entire global state of the system. Applications include automated program verification (where an algorithm checks the validity of another algorithm) and automated parallelization of software.

Assertions: operators and semantics

Separation logic assertions describe "states" consisting of a store and a heap, roughly corresponding to the state of local (or stack-allocated) variables and dynamically-allocated objects in common programming languages such as C and Java. A store $s$ is a function mapping variables to values. A heap $h$ is a partial function mapping memory addresses to values. Two heaps $h$ and $h'$ are disjoint (denoted $h \,\bot\, h'$) if their domains do not overlap (i.e., if for every memory address $\ell$, at least one of $h(\ell)$ and $h'(\ell)$ is undefined).

The logic allows to prove judgements of the form $s, h \models P$, where $s$ is a store, $h$ is a heap, and $P$ is an assertion over the given store and heap. Separation logic assertions (denoted as $P$, $Q$, $R$) contain the standard boolean connectives and, in addition, $\mathbf{e}\mathbf{m}\mathbf{p}$, $e \mapsto e'$, $P \ast Q$, and $P {-\!\!\ast}\, Q$, where $e$ and $e'$ are expressions.

• The constant $\mathbf{e}\mathbf{m}\mathbf{p}$ asserts that the heap is empty, i.e., $s, h \models \mathbf{e}\mathbf{m}\mathbf{p}$ when $h$ is undefined for all addresses.
• The binary operator $\mapsto$ takes an address and a value and asserts that the heap is defined at exactly one location, mapping the given address to the given value. I.e., $s, h \models e \mapsto e'$ when $h([\![e]\!]_{s}) = [\![e']\!]_{s}$ (where $[\![e]\!]_{s}$ denotes the value of expression $e$ evaluated in store $s$) and $h$ is otherwise undefined.
• The binary operator $\ast$ (pronounced star or separating conjunction) asserts that the heap can be split into two disjoint parts where its two arguments hold, respectively. I.e., $s, h \models P \ast Q$ when there exist $h_1, h_2$ such that $h_1 \,\bot\, h_2$ and $h = h_1 \cup h_2$ and $s, h_1 \models P$ and $s, h_2 \models Q$.
• The binary operator $-\!\!\ast$ (pronounced magic wand or separating implication) asserts that extending the heap with a disjoint part that satisfies its first argument results in a heap that satisfies its second argument. I.e,. $s, h \models P -\!\!\ast\, Q$ when for every heap $h' \,\bot\, h$ such that $s, h' \models P$, also $s, h \cup h' \models Q$ holds.

The operators $\ast$ and $-\!\!\ast$ share some properties with the classical conjunction and implication operators. They can be combined using an inference rule similar to modus ponens

$\frac{s, h \models P \ast (P -\!\!\ast\, Q)}{s, h \models Q}$

and they form an adjunction, i.e., $s, h \cup h' \models P \ast Q \Rightarrow R$ if and only if $s, h \models P \Rightarrow Q -\!\!\ast\, R$ for $h \,\bot\, h'$; more precisely, the adjoint operators are $\_ \ast Q$ and $Q -\!\!\ast\, \_$.

Reasoning about programs: triples and proof rules

In separation logic, Hoare triples have a slightly different meaning than in Hoare logic. The triple $\{P\}\ C\ \{Q\}$ asserts that if the program $C$ executes from an initial state satisfying the precondition $P$ then the program will not go wrong (e.g., have undefined behaviour), and if it terminates, then the final state will satisfy the postcondition $Q$. In essence, during its execution, $C$ may access only memory locations whose existence is asserted in the precondition or that have been allocated by $C$ itself.

In addition to the standard rules from Hoare logic, separation logic supports the following very important rule:

$\frac{ \{P\}\ C\ \{Q\} }{ \{P \ast R\}\ C\ \{Q \ast R\} }~\mathsf{mod}(C) \cap \mathsf{fv}(R) =\emptyset$

This is known as the frame rule (named after the frame problem) and enables local reasoning. It says that a program that executes safely in a small state (satisfying $P$), can also execute in any bigger state (satisfying $P \ast R$) and that its execution will not affect the additional part of the state (and so $R$ will remain true in the postcondition). The side condition enforces this by specifying that none of the variables modified by $C$ occur free in $R$, i.e. none of them are in the 'free variable' set $\mathsf{fv}$ of $R$.

Sharing

Separation logic leads to simple proofs of pointer manipulation for data structures that exhibit regular sharing patterns which can be described simply using separating conjunctions; examples include simply and doubly linked lists and varieties of trees. Graphs and dags and other data structures with more general sharing are more difficult (both for informal and for formal proof, it should be emphasized). Separation logic has, nonetheless, been applied successfully to reasoning about programs with general sharing.

In their POPL'01 paper,^[3] O'Hearn and Ishtiaq explained how the magic wand connective ${-\!\!*}$ could be used to reason in the presence of sharing, at least in principle. For example, in the triple

$\{(x \mapsto 42) {-\!\!*} P\}\ [x] = 42\ \{P\}$

we obtain the weakest precondition for a statement that mutates the heap at location $x$, and this works for any postcondition, not only one that is laid out neatly using the separating conjunction. This idea was taken much further by Yang, who used ${-\!\!*}$ to provide localized reasoning about mutations in the classic Schorr-Waite graph marking algorithm.^[7] Finally, one of the most recent works in this direction is that of Hobor and Villard,^[8] who employ not only ${-\!\!*}$ but also a connective $\cup \,\!\!\!\!\!*$ which has variously been called overlapping conjunction or sepish,^[9] and which can be used to describe overlapping data structures: $P \cup \!\!\!\!\!* Q$ holds of a heap $h$ when $P$ and $Q$ hold for subheaps $h_P$ and $h_Q$ whose union is $h$, but which possibly have a nonempty portion $h_P \cap h_Q$ in common. Abstractly, $P \cup \!\!\!\!\!* Q$ can be seen to be a version of the fusion connective of relevance logic

Concurrent Separation Logic

A Concurrent Separation Logic (CSL), a version of separation logic for concurrent programs, was originally proposed by Peter O'Hearn,^[10] using a proof rule

$\frac{\{P_1\} C_1 \{Q_1\} \quad \{P_2\} C_2 \{Q_2\}}{\{P_1 * P_2\} C_1 \parallel C_2 \{Q_1 * Q_2\}}$

which allows independent reasoning about threads that access separate storage. O'Hearn's proof rules adapted an early approach of Tony Hoare to reasoning about concurrency,^[11] replacing the use of scoping constraints to ensure separation by reasoning in separation logic. In addition to extending Hoare's approach to apply in the presence of heap-allocated pointers, O'Hearn showed how reasoning in concurrent separation logic could track dynamic ownership transfer of heap portions between processes; examples in the paper include a pointer-transferring buffer, and a memory manager.

A model for concurrent separation logic was first provided by Stephen Brookes in a companion paper to O'Hearn's.^[12] The soundness of the logic had been a difficult problem, and in fact a counterexample of John Reynolds had shown the unsoundness of an earlier, unpublished version of the logic; the issue raised by Reynolds's example is described briefly in O'Hearn's paper, and more thoroughly in Brookes's.

At first it appeared that CSL was well suited to what Dijkstra has called loosely connected processes,^[13] but perhaps not to fine-grained concurrent algorithms with significant interference. However, gradually it was realized that the basic approach of CSL was considerably more powerful than first envisaged, if one employed non-standard models of the logical connectives connectives and even the Hoare triples.

An abstract version of separation logic was proposed that works for Hoare triples where the preconditions and postconditions are formulae interpreted over an arbitrary partial commutative monoid instead of a particular heap model.^[14] Later, by suitable choice of commutative monoid, it was surprisingly found that the proofs rules of abstract versions of concurrent separation logic could be used to reason about interfering concurrent processes, for example by encoding the rely-guarantee technique which had been originally proposed to reason about interference.;^[15] in this work the elements of the model were considered not resources, but rather "views" of the program state, and a non-standard interpretation of Hoare triples accompanies the non-standard reading of pre and postconditions. Finally, CSL-style principles have been used to compose reasoning about program histories instead of program states, in order to provide modular techniques for reasoning about fine-grained concurrent algorithms .^[16]

Versions of CSL have been included in many interactive and semi-automatic (or "in-between") verification tools as described in the next section. But, although steps have been made,^[17] as of yet CSL-style reasoning has been included in comparatively few tools in the automatic program analysis category (and none mentioned in the next section).

Verification and Program Analysis Tools

Tools for reasoning about programs fall on a spectrum from fully automatic program analysis tools, which do not require any user input, to interactive tools where the human is intimately involved in the proof process. Many such tools have been developed; the following list includes a few representatives in each category.

• Automatic Program Analyses. These tools typically look for restricted classes of bugs (e.g., memory safety errors) or attempt to prove their absence, but fall short of proving full correctness.
  • A current example is Facebook's Infer tool for static analysis of Java, C, and Objective-C, based on separation logic and bi-abduction as its foundation.^[18] As of 2015 hundreds of bugs per month were being found by Infer and fixed by developers before being shipped to Facebook's mobile apps^[19]
  • Other examples include SpaceInvader (one of the first SL analyzers), Predator (which has won several verification competitions), MemCAD (which mixes shape and numerical properties) and Slayer (from Microsoft Research, focussed on data structures found in device drivers)
• Interactive Proof. Proofs have been done using embeddings of Separation Logic into interactive theorem provers such as the Coq proof assistant and HOL (proof assistant). In comparison to the program analysis work, these tools require more in the way of human effort but prove deeper properties, up to functional correctness.
  • A proof of the FSCQ file system^[20] where the specification includes behaviour under crashes as well as normal operation. This work won the best paper award at the 2015 Symposium on Operating System Principles.
  • Verification of an OpenSSL implementation of a cryptographic authentication algorithm,^[21] utilizing verifiable C
  • Other examples include the Ynot^[22] library for the Coq proof assistant; the Holfoot embedding of Smallfoot in HOL; Fine-grained Concurrent Separation Logic, and Bedrock (a Coq library for low-level programming).
• In Between. Many tools require more user intervention than program analyses, in that they expect the user to input assertions such as pre/post specs for functions or loop invariants, but after this input is given they attempt to be fully or almost fully automatic; this mode of verification goes back to classic works in the 1970s such as J King's verifier, and the Stanford Pascal Verifier. This style of verifier has recently been called auto active verification, a term which intends to evoke the way of interacting with a verifier via an assert-check loop, analogous to the interaction between a programmer and a type-checker.
  • The very first Separation Logic verifier, Smallfoot, was in this in-between category. It required the user to input pre/post specs, loop invariants, and resource invariants for locks. It introduced a method of symbolic execution, as well as an automatic way to infer frame axioms. Smallfoot included Concurrent Separation Logic.
  • SmallfootRG is a verifier for a marriage of separation logic and the classic rely/guarantee method for concurrent programs.
  • Heap Hop implements a separation logic for message passing, following the ideas in [Singularity_(operating_system)]
  • Verifast is an advanced current tool in the in-between category. It has demonstrated proofs ranging from object-oriented patterns to highly concurrent algorithms and to systems programs.
  • The Mezzo Programming Language and Asynchronous Liquid Separation Types include ideas related to CSL in the type system for a programming language. The idea to include separation in a type system has earlier examples in Alias Types and Syntactic Control of Interference.

The distinction between interactive and in-between verifiers is not a sharp one. For example, Bedrock strives for a high degree of automation, in what it terms mostly-automatic verification, where Verifast sometimes requires annotations that resemble the tactics (little programs) used in interactive verifiers.

References

1. Reynolds, John C. (2002). "Separation Logic: A Logic for Shared Mutable Data Structures" (PDF). LICS.
2. Reynolds, John C. (1999). "Intuitionistic Reasoning about Shared Mutable Data Structure". In Davies, Jim; Roscoe, Bill; Woodcock, Jim. Millennial Perspectives in Computer Science, Proceedings of the 1999 Oxford–Microsoft Symposium in Honour of Sir Tony Hoare. Palgrave.
3. Ishtiaq, Samin; O'Hearn, Peter (2001). "BI as an Assertion Language for Mutable Data Structures". POPL (ACM).
4. O'Hearn, Peter; Reynolds, John C.; Yang, Hongseok (2001). "Local Reasoning about Programs that Alter Data Structures". CSL.
5. Burstall, R. M. (1972). "Some techniques for proving programs which alter data structures". Machine Intelligence 7.
6. O'Hearn, P. W.; Pym, D. J. (June 1999). "The Logic of Bunched Implications". Bulletin of Symbolic Logic 5 (2): 215–244.
7. Yang, Hongseok (2001). "An Example of Local Reasoning in BI Pointer Logic: the Schorr−Waite Graph Marking Algorithm". Proceedings of the 1st Workshop on Semantics‚ Program Analysis‚ and Computing Environments for Memory Management.
8. Hobor, Aquinas; Villard, Jules (2013). "The Ramifications of Sharing in Data Structures" (PDF). POPL'13: 523–536. doi:10.1145/2480359.2429131.
9. Gardner, Philippa; Maffeis, Sergio; Smith, Hareth (2012). "Towards a program logic for JavaScript" (PDF). POPL'12: 31–44. doi:10.1145/2103656.2103663.
10. O'Hearn, Peter (2007). "Resources, Concurrency and Local Reasoning" (PDF). Theoretical Computer Science 375 (1-3): 271–307. doi:10.1016/j.tcs.2006.12.035.
11. Hoare, C.A.R. (1972). "Towards a theory of parallel programming". Operating System Techniques. Academic Press.
12. Brookes, Stephen (2007). "A Semantics for Concurrent Separation Logic" (PDF). Theoretical Computer Science 375 (1-3): 227–270. doi:10.1016/j.tcs.2006.12.034.
13. Dijkstra, Edsger W. Cooperating sequential processes (EWD-123). E.W. Dijkstra Archive. Center for American History, University of Texas at Austin. (original; transcription) (September 1965)
14. Calcagno, Cristiano; O'Hearn, Peter; Yang, Hongseok (2007). "Local Action and Abstract Separation Logic" (PDF). 22nd Annual IEEE Symposium on Logic in Computer Science. doi:10.1109/LICS.2007.30.
15. Dinsdale-Young, Thomas; Birkedal, Lars; Gardner, Philippa; Parkinson, Matthew; Yang, Hongseok (2013). "Views: Compositional Reasoning for Concurrent Programs" (PDF). Proceedings of the 40th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages. doi:10.1145/2480359.2429104.
16. Sergey, Ilya; Nanevski, Aleksandar; Banerjee, Anindya (2015). "Specifying and Verifying Concurrent Algorithms with Histories and Subjectivity" (PDF). 24th European Symposium on Programming.
17. Gotsman, Alexey; Berdine, Josh; Cook, Byron; Sagiv, Mooly (2007). "Thread Modular Shape Analysis" (PDF). PLDI: 266–277. doi:10.1007/978-3-540-93900-9_3.
18. Separation logic and bi-abduction, page, Infer project site.
19. Open-sourcing Facebook Infer: Identify bugs before you ship. C Calcagno, D DIstefano and P O'Hearn. 11 June 2015
20. Using Crash Hoare Logic for Certifying the FSCQ File System, H Chen et al, SOSP'15
21. Verified correctness and security of OpenSSL HMAC. Lennart Beringer, Adam Petcher, Katherine Q. Ye, and Andrew W. Appel. In 24th USENIX Security Symposium, August 2015
22. The Ynot Project homepage, Harvard University, USA.