\documentclass[fleqn]{beamer}


\mode<presentation>
{
  \usetheme{default}
%   \useinnertheme[shadow=true]{rounded}

  \useinnertheme{circles}
  
%    \useoutertheme{infolines}
  % or ...
  \setbeamersize{text margin left=1em,text margin right=1em}

%   \setbeamercovered{transparent}
  % or whatever (possibly just delete it)

  \beamertemplatenavigationsymbolsempty
  
% Display frame numbers in footline
  \setbeamertemplate{footline}[frame number]
}

\usepackage{etex}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage[ngerman]{babel}
\usepackage{amsmath}
% \usepackage{amsthm}
% \usepackage{stmaryrd}
\usepackage{times}
\usepackage{mathpartir}

\usepackage{centernot}

\usepackage{colortbl}
\usepackage{multirow}

\usepackage[purexy]{qsymbols}
\usepackage{graphicx}

\usepackage{listings}
\usepackage{lstautogobble}
\usepackage{relsize}

\usepackage{ifthen}
\usepackage{pgf}
\usepackage{tikz}
\usetikzlibrary{scopes}
\usetikzlibrary{decorations}
  \usetikzlibrary{decorations.pathmorphing}
\usetikzlibrary{arrows}
\usetikzlibrary{automata}
\usetikzlibrary{positioning}
\usetikzlibrary{chains}
\usetikzlibrary{shapes.geometric}
\usetikzlibrary{shapes.callouts}
\usetikzlibrary{shapes.misc}
\usetikzlibrary{shapes.multipart}
\usetikzlibrary{fit}
\usetikzlibrary{calc}
\usepackage{pgfplots}

% \tikzstyle{stack}=[inner sep=0pt,minimum size=2mm]
% \tikzstyle{ssline}=[->,snake=snake,segment amplitude=.2mm,segment length=3mm,line after snake=1mm]
% \tikzstyle{fgnode}=[circle,draw,inner sep=0pt,minimum size=2mm]


\usepackage{packages/isabelle}
\usepackage{packages/isabelletags}
\usepackage{packages/isabellesym}
\usepackage{packages/comment}

% \isabellestyle{it}

\def\isachardoublequote{}%
\def\isachardoublequoteopen{}%
\def\isachardoublequoteclose{}%

\newcommand{\isainnerkeyword}[1]{{\textbf{#1}}}
\newcommand{\isasymexistsA}{\isamath{\exists_{\textsc A}\,}}


\def\isadelimproof{}
\def\endisadelimproof{}
\def\isatagproof{}
\def\endisatagproof{}
\def\isafoldproof{}
\def\isadelimproof{}
\def\endisadelimproof{}

\def\isastylescript{\sl}%


\input{lstisabelle}
\newcommand{\isai}{\lstinline[language=isabelle,basicstyle=\normalsize\ttfamily\slshape]}

\newcommand\CC{C\nolinebreak[4]\hspace{-.05em}\raisebox{.3ex}{\relsize{-1}{\textbf{++}}}}

\newcommand{\eqdef}{\mathrel{{=}_{def}}}
\newcommand{\iffdef}{\mathrel{{\mathord{\iff}\!\!}_{def}}}


\makeatletter
\newcommand*{\overlaynumber}{\number\beamer@slideinframe}
\makeatother

\AtBeginSection[] % Do nothing for \section*
{
  \begin{frame}<beamer>
    \frametitle{Outline}
    \tableofcontents[currentsection]
  \end{frame}
}


\title{Efficient Verified (UN)SAT Certificate Checking}

% \subtitle
% {Subtitle} % (optional)

\author[Peter Lammich]{\underline{Peter Lammich}}
% - Use the \inst{?} command only if the authors have different
%   affiliation.

\institute[TUM] % (optional, but mostly needed)
{ TU M\"unchen %, Institut f\"ur Informatik, Chair for Logic and Verification
}
% - Use the \inst command only if there are several affiliations.
% - Keep it simple, no one is interested in your street address.

\date {August 2017}
% {2008-12-01}


% If you have a file called "university-logo-filename.xxx", where xxx
% is a graphic format that can be processed by latex or pdflatex,
% resp., then you can add a logo as follows:

% \pgfdeclareimage[height=0.5cm]{university-logo}{university-logo-filename}
% \logo{\pgfuseimage{university-logo}}


% Delete this, if you do not want the table of contents to pop up at
% the beginning of each subsection:


% If you wish to uncover everything in a step-wise fashion, uncomment
% the following command: 

%\beamerdefaultoverlayspecification{<+->}

%\mathchardef\-="2D
%\renewcommand\-{\text{-}}

\newcommand{\mc}{\color{blue}}
\newcommand{\term}[1]{{\mc#1}}

\let\olddisplaystyle\displaystyle
\newcommand{\mydisplaystyle}{\olddisplaystyle\mc}
\let\displaystyle\mydisplaystyle

\newcommand{\smc}{\everymath{\mc}}
\smc

\lstset{basicstyle=\color{blue}}

% \newcommand<>{\btikzset}[2]{\alt#3{\tikzset{#1}}{\tikzset{#2}}}

\tikzset{onslide/.code args={<#1>#2}{%
  \only<#1>{\pgfkeysalso{#2}} % \pgfkeysalso doesn't change the path
}}

\tikzset{>=latex}


\lstset{autogobble}

\newcommand{\natN}{{\text{nat}_{\mathord{<}N}}}


\begin{document}
% \input{macros}

\begin{frame}
  \titlepage
\end{frame}


# SAT
%   *<+-> Find solution to cnf formula
%     * Widely used, e.g. in hardware verification
%     * NP-complete (intractable)
  *<+-> SAT solvers
    * Elaborate optimizations + heuristics
    * Highly complex $\implies$ error prone
    * Safety critical
  *<+-> Certification
    * SAT solver produces certificate
    * Checked by simpler program
  *<+-> SAT certificate
    * Valuation, almost trivial to check
  *<+-> UNSAT certificate
    * De-facto standard: DRAT
    * Demanded by SAT competitions
    * Supported by most modern SAT solvers
    
# DRAT-Certificate
  *<+-> List of clause additions (lemmas) and deletions
  *<+-> Each lemma is \emph{redundant} wrt. current clauses
    *<+-> Must have RAT property
  *<+-> Last lemma is empty clause
    
  \uncover<+->{  
  \begin{definition}
    Clause $C$ has RAT wrt.\ formula $F$ iff 
      *{}: $(F \wedge \neg C)^{\textrm u} = \{\square\}$
      *or: $\exists l\in C.~\forall D\in F.~\neg l\in D \implies ((F\wedge \neg C)^{\textrm u}\wedge\neg D)^{\textrm u} = \{\square\}$
    where $F^{\textrm u}$ means \emph{unit propagation}.
  \end{definition}
  }
    
    
# DRAT in Practice
  *<+-> Unit propagation and finding RAT candidates
    * Computationally expensive
  *<+-> Requires highly optimized code and data structures
    * Error prone + hard to (formally) verify
  *<+-> drat-trim (Heule et al.) 
    * Standard tool used in SAT competitions
    * Written in C, highly optimized, and many features
    * Two-watched-literals, backwards checking, core-first, ...
    * Sat/Unsat, trimming, unsat core, resolution graph, ...
%     * Optimizations: 2wl, bwd checking, core-first, ...
%     * Features: Sat/Unsat, trimming, unsat core, resolution graph, ...
    *<+-> We found a few bugs (now mostly fixed)
      * Erroneous pivot literal check
      * Numeric overflows in parser
      * Buffer overflows
      

# Story of GRAT      
  *<+-> I was verifying fast DRAT-checker (in Isabelle)
  *<+-> Heard about GRIT [Cruz-Filipe et al., TACAS'17]
    * Two-phase checker, but only for DRUP
    * First phase: adapted drat-trim tool
    * Second phase: verified in Coq
    * Both phases: Approx. 2x slower than drat-trim
  *<+-> Re-targeted my work to extend this to full DRAT
    * Adding multi-threading to first phase
    * Using my powerful refinement tools for fast second phase
    * My tool was on par with drat-trim, albeit formally verified
  *<+-> After CADE-deadline
    * Added novel optimizations
    * Now significantly faster than drat-trim
    * New results included in this talk + proceedings paper
  *<+-> Independently: LRAT was developed
    * Cruz-Filipe, Heule, et al.
      
    
# Enriched Certificates
  \begin{onlyenv}<1>
  \begin{tikzpicture}[node distance = 1.5cm, auto]
    \tikzstyle{tool}=[shape=rectangle,draw, minimum size = 5mm]
    \tikzstyle{artf}=[minimum size = 5mm]
    
    \node[artf] (drat) {DRAT certificate};
    \node[tool] (drat-trim) [below of = drat] {drat-trim};
    \node[artf] (cnf) [left of = drat-trim, anchor=east] {CNF formula};
    \node[artf] (res) [right of = drat-trim, anchor=west] {s UNSAT / s ERROR};
  
    \draw[->] (cnf) to (drat-trim);
    \draw[->] (drat) to (drat-trim);
    \draw[->] (drat-trim) to (res);
  \end{tikzpicture}  
  \end{onlyenv}
  
  \begin{onlyenv}<2->
  \begin{tikzpicture}[node distance = 1.5cm, auto]
    \tikzstyle{tool}=[shape=rectangle,draw, minimum size = 5mm]
    \tikzstyle{artf}=[minimum size = 5mm]
    
    \node[artf] (drat) {DRAT certificate};
    \node[tool] (gratgen) [below of = drat] {gratgen};
    \node[artf] (cnf) [left of = gratgen, anchor=east] {CNF formula};
    \node[artf] (grat) [below of = gratgen] {GRAT certificate};
    \node[tool] (gratchk) [below of = grat] {gratchk};
    \node[artf] (res) [right of = gratchk, anchor=west] {s UNSAT / s ERROR};
    
  
    \draw[->] (cnf) to (gratgen);
    \draw[->] (drat) to (gratgen);
    \draw[->] (gratgen) to (grat);
    \draw[->] (grat) to (gratchk);
    \draw[->] (gratchk) to (res);
    \draw[->] (cnf) |- (gratchk);
    
    \begin{uncoverenv}<3->
    \node[rectangle callout, draw, callout absolute pointer=(gratgen.east), above right = of gratgen, align=left] {Expensive \\ Complex \\ Highly optimized};
    \end{uncoverenv}
    \node<4->[rectangle callout, draw, callout absolute pointer=(gratchk.east), above right = of gratchk, align=left] {Cheap \\ Simple \\ Formally verified};
    
  \end{tikzpicture}  
  \end{onlyenv}
  
# Moving Complexity to gratgen
  *<+-> Checking direction
    * gratgen works in backwards mode, trims certificate
    * gratchk works in forward mode
  *<+-> Unit propagation
    * gratgen outputs unit/conflict clauses
    * gratchk only checks that clauses are unit/conflict
    * Cruz-Filipe et al. [TACAS'17]
  *<+-> RAT candidate counts
    * gratgen gathers RAT candidates, and outputs RAT counts
    * gratchk only checks that candidates are exhaustive
      * maintaining candidate lists based on RAT counts
    
# gratgen
  *<+-> Initially: Clone of drat-trim's backwards mode
    * Uses two-watched literals, core-first unit propagation
    * Implemented in \CC11
  *<+->+: Separate watchlists: Faster core-first propagation
  *<+->+: RAT-run heuristics: Faster RAT-candidate finding
  *<+->+: Optional multithreading: Parallel checking of lemmas
    
# gratchk
  *<+-> Streaming for lower memory footprint
    * Unit/conflict clauses and deletion information not kept in memory
  *<+-> Formally verified with Isabelle/HOL
%     * LCF-style prover, reducing trust to small logical inference kernel
%   * Uses imperative data structures
%     * quite fast for verified program!
  *<+-> Verification uses stepwise refinement approach
    
# Stepwise Refinement    
  *<+-> Abstract description of algorithm
    * Easy to verify
  *<+-> Refine towards implementation
    * Small, independent, correctness preserving steps
  *<+-> Goal: Modularization of proofs
    * Efficient implementation does not affect abstract correctness proof
    * Making big proofs manageable in first place
  *<+-> Isabelle Refinement Framework
    * Powerful tool support for refinement proofs
    * Library of verified (imperative) data structures
    
#! Refinement of gratchk --- Checker State
  \begin{uncoverenv}<1->
  Abstract: Using Sets and Functions
  \begin{lstlisting}
    literal = Pos var | Neg var
    clause = literal set  
    clausemap = (id => clause option) \<times> (literal => id set option)
    state = id \<times> clausemap \<times> (var => bool option)
  \end{lstlisting}
  \end{uncoverenv}
    
  \begin{uncoverenv}<2->
  Refinement \#1: Using iterators for clauses, lists for RAT candidates  
  \begin{lstlisting}
    clausemap1 = (id => $\color{red}\textsf{it}$) \<times> (literal => id $\color{red}\textsf{list}$ option)
    state1 = id \<times> clausemap1 \<times> (var => bool option)
  \end{lstlisting}
  \end{uncoverenv}
    
  \begin{uncoverenv}<3->
  Refinement \#2: Iterators as indexes into array, literals as integers, functions as arrays
  \begin{lstlisting}
    clausedb2 = $\color{red}\textsf{int array}$
    clausemap2 = $\color{red}\textsf{nat array}$ \<times> id list option $\color{red}\textsf{array}$
    state2 = id \<times> clausemap2 \<times> $\color{red}\textsf{nat array}$
  \end{lstlisting}
  \end{uncoverenv}
    
#! Final Correctness Statement    
  \begin{uncoverenv}<+->
  \begin{lstlisting}
      <DBi |->$_a$ DB> 
        verify_unsat_impl DBi F_end it prf
      <\<lambda>r. DBi |->$_a$ DB * \<up>(r ==> /@formula_unsat_spec@/ DB F_end)>
  \end{lstlisting}
  \end{uncoverenv}

  \begin{uncoverenv}<+->
  where
  \begin{lstlisting}
    /@formula_unsat_spec@/ :: "int list => nat => bool"
    /@formula_unsat_spec@/ DB F_end == (
      let lst = tl (take F_end DB) in
        1 < F_end \<and> F_end \<le> length DB \<and> last lst = 0 
        \<and> (\<nexists>\<sigma>. /@assn_consistent@/ \<sigma> \<and> (\<forall>C\<in>set (tokenize 0 lst). \<exists>l\<in>set C. \<sigma> l)))
  \end{lstlisting}
  \end{uncoverenv}

  \begin{uncoverenv}<+->
  where
  \begin{lstlisting}
    /@assn_consistent@/ :: "(int => bool) => bool"
    "/@assn_consistent@/ \<sigma> = (\<forall>x. x\<noteq>0 ==> \<not> \<sigma> (-x) = \<sigma> x)"
  \end{lstlisting}
  \end{uncoverenv}

  \begin{uncoverenv}<+->
  Trusted base: Hoare triples + standard list functions  
  \end{uncoverenv}
    
#! Generating gratchk
  *<+-> Export from Isabelle to Standard/ML 
    * Trusted: Isabelle code generator (extended pretty printing)
  *<+-> Add parser and command line interface
    * Trusted: Parsing DIMACS to int array (<100 LOC, simple)
      * Standard ML detects overflows by design
    * Trusted: CLI (straightforward)
  *<+-> Compile with MLton
    * Trusted: Compiler

\newcommand{\annot}[1]{{\footnotesize\color{red}{#1}}}

\newcommand{\uc}[2]{\uncover<#1->{#2}}  


# Benchmark Results
  \begin{uncoverenv}<1->
  Using 2016 SAT competition main track:
    * cmsat: 110 UNSAT, 64 SAT  (many RAT lemmas)
    * riss6: 128 UNSAT          (Silver medalist, but only RUP) 
  \end{uncoverenv}  

  \vfill
    
    
  \begin{uncoverenv}<2->
  \begin{tabular}{c|c|c|c|c|}
            & lrat*                             & drat-trim                         & grat/1          & grat/8                    \\\hline
      cmsat & \uc{3}{51h \annot{2xT/O, 1xSEGF}} & \uc{4}{42h \annot{2xT/O, 1xSEGF}} & \uc{5}{17h}     & \uc{6}{7h               } \\\hline
      riss6 & \uc{3}{42h}                       & \uc{4}{30h                      } & \uc{5}{26h}     & \uc{6}{14h \annot{1xOOM}} \\\hline\hline
    $\Sigma$& \uc{3}{93h}                       & \uc{4}{72h                      } & \uc{5}{44h}     & \uc{6}{21h              } \\\hline
  \end{tabular}
  {\tiny\vspace*{1em}}
  
  {\tiny Wall-clock times, excluded the 3 certificates that drat-trim failed on\\
  \begin{tabular}{ll}
  {\color{red} T/O} &--- Timeout after 20.000s \\
  {\color{red} SEGF} &--- crashed with SIGSEGV \\
  {\color{red} OOM} &--- out of memory (128GiB) \\
   {*} &--- Incremental version, [Heule et al., ITP'17] \\
  \end{tabular}
  }
  \end{uncoverenv}  
  
  \vfill
  \begin{uncoverenv}<7->
  gratchk time: 12\% (cmsat: 6\%, riss6: 16\%)
  \end{uncoverenv}  
  
  \vfill
  
  \begin{uncoverenv}<8->
  SAT mode: cmsat: 40s
  \end{uncoverenv}  

# Conclusions
  Fast SAT solver certification tool
  * SAT and UNSAT certificates
  * Strong formal correctness guarantees
    * formally verified down to int array representing formula
  * Available under BSD-style license
    
  \vfill 
  \center \url{http://www21.in.tum.de/~lammich/grat/}
    
  \vfill
  Tool Paper on SAT'2017
    
    
    
%   
% # Enriched Certificates
%   * Idea: Replace unit-propagation by unit checking
%     * Cruz-Filipe et al. [TACAS'17]: For (weaker) DRUP certificates
%   * During certificate checking: $(F \wedge \neg C)^{\textrm u} = \lightning$
%     * Output list of clauses in order they become unit
%     * Output conflict clause
%     * Trim certificate
%   * Then run 2nd checker
%     * Against original formula, using enriched certificate
%     * Only check that clauses are actually unit/conflict
%     * Simple + cheap $\implies$ amenable to formal verification
%     
    
    
\end{document}




