Separation Logic
John Reynolds
Carnegie-Mellon University

John C. Reynolds gave a brief presentation on Separation logic,
an extension of Hoare logic for reasoning about shared mutable
data structres that was discovered independently by him and
Peter O'Hearn.

A simple example of the advantage of the logic is the invariant
of a program for in-place reversal of a list.  In Hoare logic,
one would have to write

   Exists x,y. list x i and list y j 
      and compose(reflect(y),x) = x0
      and forall k. reachable i k and reachable j k
                                        implies k = nil

where list x i asserts that i is a list representing the
sequence x, and the final conjunct asserts that only nil
is reachable from both i and j, i.e. that the lists i and j
do not share storage.

In separation logic, however, one can write

   Exists x,y. (list x i * list y j)
            and compose(reflect(y),x) = x0

where * is a "separating conjunction" that asserts that its
components hold for disjoint areas of storage.

A central feature of the logic is the "frame rule":

     {p}c{q}
   -----------  when c assigns to no variable free in r.
   {p*r}c{q*r}

Using this rule, one can limit the proof of a program
fragment c to a specification {p]c{q} that only describes
the storage actually used by c, and then infer that c will
leave unchanged any property r of a disjoint storage area.

The setting of separation logic is a low-level imperative
programming language without garbage collection.  All proofs
preclude any dereferencing of dangling pointers.  It is also
possible to prove the absence of memory leaks, say by proving

   {p and empty}c{q and empty}

where empty asserts that the heap storage is empty.

The accomplishments of separation logic include the specification
and (manual) proof of the Schorr-Waite marking algorithm and the
Cheney copying garbage collector, as well as numerous simpler
programs.  There is also an extension of the logic to shared-
variable concurrency which is capable of treating, for example,
processes that communicate storage ownership through a shared
buffer, or concurrent quicksort.  A further extension permits
read-only sharing via Boyland's fractional permissions.

Reynolds refused to claim that any problems were "nearly solved"
(since such a claim once boomeranged on him).  As unsolved
problems, he mentioned data structures with rich sharing, such
as cyclic graphs, the need to move towards richer programming
languages, and the need for automation.

He provided the following list of researchers in the area:

   London:          Peter O'Hearn
                    Richard Bornat
                    Samin Ishtiaq
                    Cris Calcagno
                    Josh Berdine
                    Ivana Mijajlovic
                    Dino DeStefano

   Cambridge (UK):  Matthew Parkinson
                    Gavin Bierman

   Copenhagen:      Lars Birkedal
                    Noah Torp-Smith
                    Bodil Biering

   Seoul:           Hong Seok Yang

   Pittsburgh:      John Reynolds
                    Aleks Nanevski