Tutorial on Separation Logic (Invited Tutorial)

Abstract

Separation logic is an extension of Hoare's logic for reasoning about programs that manipulate pointers. Its assertion language extends classical logic with a separating conjunction operator A*B, which asserts that Aand Bhold for separate portions of memory. In this tutorial I will first cover the basics of the logic, concentrating on highlights from the early work [1,2,3,4]. (i) The separating conjunction fits together with inductive definitions in a way that supports natural descriptions of mutable data structures [1]. (ii) Axiomatizations of pointer operations support in-place reasoning, where a portion of a formula is updated in place when passing from precondition to postcondition, mirroring the operational locality of heap update [1,2]. (iii) Notorious dirty features of low-level programming (pointer arithmetic, explicit deallocation) are dealt with smoothly, even embraced [2,3]. (iv) Frame axioms, which state what does not change, can be avoided when writing specifications [2,3]. These points together enable specifications and proofs of pointer programs that are dramatically simpler than was possible previously, in many cases approaching the simplicity associated with proofs of pure functional programs. I will describe how that is, and where rough edges lie (programs whose proofs are still more complex than we would like).