基于分离逻辑的程序验证研究综述

上世纪60-70年代以来，虽然有Floyd-Hoare逻辑的出现，但是使用形式化工具对命令式程序的正确性和可靠性进行自动验证一直被认为是极具挑战性、神圣不可及的工作.上世纪末由于更多的科研投入，特别是微软、IBM等大型公司研发部门的大量人力物力的投入，程序验证方面在本世纪初取得了不少进展，例如用于验证空客代码无运行时错误的ASTRÉE工具，用于Windows设备驱动里关于过程调用的协议验证的SLAM工具.但这些工具并没有考虑动态创建的堆（Heap）：ASTRÉE工具假设待验证代码没有动态创建的堆，也没有递归；SLAM假设待验证系统已经有了内存安全性.事实上很多重要的程序，例如Linux内核、Apache、操作系统设备驱动程序等等，都涉及到对动态创建堆的操作.如何对这类操作堆的程序（heap-manipulating programs）进行自动验证仍然是个难题.2001-2002年分离逻辑（separation logic）提出后，其分离（separation）思想和相应的框（frame）规则使得局部推理（local reasoning）可以很好地应用到程序验证中.自2004年以来，基于分离逻辑对操作动态创建堆的程序进行自动验证方面的研究有了很大的进展，取得了很多令人瞩目的成果，例如SpaceInvader/Abductor、Slayer、HIP/SLEEK、CSL等工作.本文将着重对这方面的部分重要工作进行阐述.

Survey of Research on Program Verification via Separation Logic

Since 1960s, automated program verification has been considered as a Holy Grail in Computer Science, despite of the emergence of Floyd-Hoare logic.Since 1990s, with more efforts and resources devoted to this area, especially the contributions from Industry, including Microsoft Research, IBM Research Centre, there has been noticeable progress made in program verification in early this century. Two typical examples include ASTRÉE, used to verify the absence of runtime errors in Airbus code, and SLAM, employed to verify protocol properties of procedural calls in device drivers by Microsoft. However, a missing link in these tools is that none of them considers heap, with ASTRÉE assuming no dynamic pointer allocation and no recursion and SLAM assumes memory safety. Many important programs/systems that exist nowadays, such as Linux, Apache, device drivers, all make frequent use of heap. Automated verification of heap-manipulating programs remains a very challenging topic. The emergence of separation logic in 2001-2002 has shed some light into this area. With the key idea of separation and the elegant frame rule, local reasoning can now be readily employed in program verification. Since 2004, there have been a large body of research work dedicated to automated program verification via separation logic, e.g. SpaceInvader/Abductor, Slayer, HIP/SLEEK, CSL etc. This paper offers a survey on a number of important research work along this line.