\documentclass[sans]{beamer}
\usetheme{metropolis}

\usepackage{lmodern}
\usepackage{tikz}
\usepackage{pdfpages}
\usepackage{listings}
\usepackage{multirow}
\usepackage[utf8]{inputenc}
\usepackage{graphicx}
\usepackage{ulem}
\usetikzlibrary{arrows, positioning, shapes.geometric}
\usetikzlibrary{shadows.blur}

% hide the footline navigation
\setbeamertemplate{footline}[frame number]{}
\setbeamertemplate{navigation symbols}{}
%\setbeamertemplate{footline}{}

\tikzset{
    %Define standard arrow tip
    >=stealth',
}

\tikzset{
    invisible/.style={opacity=0,text opacity=0},
    visible on/.style={alt=#1{}{invisible}},
    alt/.code args={<#1>#2#3}{%
      \alt<#1>{\pgfkeysalso{#2}}{\pgfkeysalso{#3}}
    },
}

\tikzset{
  setstyle/.style={#1},
  %bcg/.default={white},
  setstyle on/.style={alt=#1{}{setstyle}},
}

\tikzset{
  background fill/.style={fill=#1},
  background fill/.default={white},
  fill on/.style={alt=#1{}{background fill}},
}

\tikzset{
  background draw/.style={draw=#1},
  background draw/.default={white},
  draw on/.style={alt=#1{}{background draw}},
}

\tikzset{
  background filldraw/.style 2 args={draw=#1, fill=#2},
  background filldraw/.default={white}{white},
  filldraw on/.style={alt=#1{}{background filldraw}},
}

\tikzset{
  background shade/.style={#1},
  background shade/.default={top color=white, bottom color=white},
  shade on/.style={alt=#1{}{background shade}},
}

\tikzset{
  background shadedraw/.style 2 args={draw=#1, #2},
  background shadedraw/.default={white}{top color=white, bottom color=white},
  shadedraw on/.style={alt=#1{}{background shadedraw}},
}

 \lstset{escapeinside={<@}{@>}, columns=fullflexible, basicstyle=\ttfamily}

 \title{Theory Refinement in HiFrog}
 \date {Seminar on Concurrency, 13. 10. 2017}

\begin{document}
  %% -------------------------------------------------------------------
  \maketitle
  %% -------------------------------------------------------------------

\section{HiFrog}
  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{HiFrog}
  \begin{itemize}
    %\setlength\itemsep{1em}
    \item Bounded Model Checker for safety properties
    \item Uses function summaries to speed-up verification
    \item Summaries are stored in a database for future runs
    \item Uses SMT for encoding programs and function summaries
   %\item Three encoding precisions:
   %  \begin{itemize}
   %    \item Unintepreted functions
   %    \item Linear real arithmetic
   %    \item Propositional logic
   %  \end{itemize}
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{SMT Theories}
  These quantifier-free theories can be used for encoding programs:
    \begin{itemize}
      \item Unintepreted functions
      \item Linear real arithmetic
      \item Propositional logic (bit-vectors)
      \item (Uninterpreted functions for programs)
      \item (Bit-vectors for programs)
    \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}[fragile]
  \frametitle{Program Encoding}
  Given an assertion:
  \begin{itemize}
    %\setlength\itemsep{1em}
    \item[1.] Loops in the program are unwound
    \item[2.] Program is symbolically executed function-per-function
    \item[3.] The result is a SSA representation of each involved function
  \end{itemize}
  \pause
  \begin{lstlisting}
      x<@$_0$@> = a
      y<@$_0$@> = x<@$_0$@> + b
      x<@$_1$@> = y<@$_0$@>
      z<@$_0$@> = ...
  \end{lstlisting}

  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}[fragile]
  \frametitle{Program Encoding (cont.)}
  Given an assertion:
  \begin{itemize}
    %\setlength\itemsep{1em}
    \item[4.] SSA representation is sliced w.r.t the given assertion
    \item[5.] Pruned SSA is transformed into a SMT formula in a chosen logic,
              using summaries instead functions where possible
    % Having an SSA representation of each function is good because
    % you can replace it by function summaries
  \end{itemize}
  \pause
  \lstset{escapeinside={<@}{@>}, columns=fullflexible, basicstyle=\ttfamily}
  \begin{tabular}{c p{3mm} c}
  \begin{lstlisting}
      x<@$_0$@> = a
      y<@$_0$@> = x<@$_0$@> + b
      x<@$_1$@> = y<@$_0$@>
      z<@$_0$@> = ...
  \end{lstlisting}
  &&
  \begin{lstlisting}
   (x<@$_0$@> = a) <@$\land$@>
   (y<@$_0$@> = (x<@$_0$@> + b)) <@$\land$@>
   (x<@$_1$@> = x<@$_1$@>) <@$\land$@>
   (z<@$_0$@> = ...)  <@$\land$@> ...
  \end{lstlisting}

  \end{tabular}
  \end{frame}
  %% -------------------------------------------------------------------



  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Function Summaries}
  \begin{itemize}
    %\setlength\itemsep{1em}
    \item Assertions are verified one-by-one
    \item Interpolants derived from successfully verified assertions are stored as summaries
          (for chosen logic)
    \item Summaries are generally an over-approximation $\rightarrow$ spurious errors
    \item Summaries involved in a spurious error are refined (using interpolation)
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------


\section{Theory Refinement}

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Function Summaries}
  \begin{itemize}
    %\setlength\itemsep{1em}
    \item Summaries are refined int the chosen logic
    \item If the logic is insufficient, we need to change the logic
    \item Idea: change the logic on-demand only in parts of SMT formula
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Theory Refinement -- Idea}
  \begin{itemize}
    %\setlength\itemsep{1em}
    \item Use the simplest theory as possible for program encoding
    \item On spurious error, refine parts of the formula that need more precise theory
    \item Refined parts of the formula are identified based on counter-examples (CEGAR)
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Theory Refinement -- Practice}
  \begin{itemize}
    %\setlength\itemsep{1em}
    \item Set of theories (partially) ordered w.r.t their precision
    \item Needs support in SMT solver
    \item In HiFrog -- two new theories:
    \begin{itemize}
      \item uninterpreted functions for programs (UFP)
      \item bit-vectors for programs (BVP)
    \end{itemize}
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Uninterpreted Functions for Programs}
  \begin{itemize}
    %\setlength\itemsep{1em}
    \item Based on theory of quantifier free uninterpreted functions with equality
    \item Adds integer and real constants
    \item Adds commutativity of some known functions ($*$, +, $\&$, ...)
    \item Terms encoded in UFP are indexed by $u$, e.g.: $t^u$
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Bit-vectors for Programs}
  \begin{itemize}
    %\setlength\itemsep{1em}
    \item Based on theory of quantifier free bit-vectors
    \item We denote $b_i$ the $i$th bit of bitvector $b$, $b_1$ being the
     {\it least significant bit}.
    \item Terms encoded in BVP are indexed by $b$, e.g.: $t^b$
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}[fragile]
  \frametitle{Combining UFP and BVP}
  \begin{itemize}
    %\setlength\itemsep{1em}
    \item For a term $t$ we say that it is \emph{bound} in formula $F$, if
          both $t^u$ and $t^b$ are present in $F$.
  \end{itemize}
  \pause
  \begin{center}
  \begin{tabular}{c p{3mm} c}

  \begin{lstlisting}
c  = ((a % 2) +
      (b % 2)) % 2
c' = (a + b) % 2
d  = f * e * c
d' = e * f * c'
  \end{lstlisting}
  &&
  \begin{lstlisting}
(c<@$^b$@>  = ((a<@$^b$@> % 2<@$^b$@>) +
       (b<@$^b$@> % 2<@$^b$@>)) % 2<@$^b$@>) <@$\land$@>
(c'<@$^b$@> = (a<@$^b$@> + b<@$^b$@>) % 2<@$^b$@>) <@$\land$@>
(d<@$^u$@>  = f<@$^u$@> * e<@$^u$@> * c<@$^u$@>) <@$\land$@>
(d'<@$^u$@> = e<@$^u$@> * f<@$^u$@> * c'<@$^u$@>)
  \end{lstlisting}

  \end{tabular}
  \end{center}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Combining UFP and BVP (cont.)}
  \begin{itemize}
    \item Given a set of all bound statements from a formula $F$,
          we define the \emph{binding} formula $F_B$ as follows:
    \[
    F_B = \bigwedge\limits_{t,t' \in B} (t^u = t'^u) \leftrightarrow
           ((t_1^b \leftrightarrow t_1^{'b}) \land \cdots \land
            (t_n^b \leftrightarrow t_n^{'b}))
    \]
    where $n$ is the bitwidth of $t$.
    \item Use $F \land F_B$ when mixing theories
  \end{itemize}
  \end{frame}

  %% -------------------------------------------------------------------
  \begin{frame}[fragile]
  \frametitle{Combining UFP and BVP (cont.)}
  \begin{center}
  \begin{tabular}{c p{3mm} c}

  \begin{lstlisting}
c  = ((a % 2) +
      (b % 2)) % 2
c' = (a + b) % 2
d  = f * e * c
d' = e * f * c'
  \end{lstlisting}
  &&
  \begin{lstlisting}
(c<@$^b$@>  = ((a<@$^b$@> % 2<@$^b$@>) +
       (b<@$^b$@> % 2<@$^b$@>)) % 2<@$^b$@>) <@$\land$@>
(c'<@$^b$@> = (a<@$^b$@> + b<@$^b$@>) % 2<@$^b$@>) <@$\land$@>
(d<@$^u$@>  = f<@$^u$@> * e<@$^u$@> * c<@$^u$@>) <@$\land$@>
(d'<@$^u$@> = e<@$^u$@> * f<@$^u$@> * c'<@$^u$@>) <@$\land$@>
<@\pause@>
(c<@$^u$@> = c'<@$^u$@> <@$\leftrightarrow$@>
      ((c<@$_1^b \leftrightarrow$@>c'<@$ _1^b$@>)  <@$\land$@>
      <@$\cdots$@>
      <@$\land$@> (c<@$_n^b \leftrightarrow$@>c'<@$ _n^b$@>)))



  \end{lstlisting}

  \end{tabular}
  \end{center}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Counter-Example-Guided Theory Refinement}
  \begin{itemize}
    \item[1.] Encode program in UFP (get formula $F$), set $F_B = \top$
    \item[2.] If $F \land F_B$ is unsat, return {\bf safe}, else get counter-example $CE^b$
    \item[3.] Take first/some/subset of/every clause $c$ from $F$ which is encoded in UFP and 
              if $c^b \land CE^b$ is unsat, refine $c^u$ to $c^b$, update $F_B$ and goto 2
    \item[4.] If F is all in BVP, return {\bf unsafe}
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Experiments}
  \centering
  In the paper ;)
  \end{frame}
  %% -------------------------------------------------------------------







\end{document}
