\documentclass{beamer}

\usepackage{fontspec}
\setmainfont[Ligatures=TeX]{Linux Biolinum O}
\setsansfont[Ligatures=TeX]{Linux Biolinum O}

\usepackage[orientation=portrait,size=a0,scale=1.4]{beamerposter}
\usepackage{tikz}

\usepackage{stmaryrd}
\usepackage{mathtools}
% \usepackage{xparse}
\usepackage{etoolbox}
\usepackage{mathpartir}
\usepackage{marvosym}
\usepackage{pifont}
\newcommand{\cmark}{\ding{51}}
\newcommand{\xmark}{\ding{55}}

\usepackage{etoolbox}
\newcommand\ifempty[3]{\expandafter\ifstrempty{#1}{#2}{#3}}
\newcommand\ifnempty[2]{\ifempty{#1}{}{#2}}
\newcommand\defaultempty[2]{\expandafter\ifstrempty{#1}{#2}{#1}}
\newcommand\replaceempty[2]{\ifempty{#1}{#2}{#1}}
\newcommand\ifthenabove[1]{%
    \ifnempty{#1}{^{#1}}%
}

\input{beamer-macros}
\input{colors}
\input{mintedSettings}

\usepackage{array}
\newcolumntype{x}[1]{>{\centering\arraybackslash\hspace{0pt}}p{#1}}

\usepackage[
  backend=biber,
  bibstyle=alphabetic,
  citestyle=alphabetic,
  doi=false,
  sorting=ydnt,
  maxbibnames=999
]{biblatex}
\addbibresource{biblio.bib}
\renewbibmacro{in:}{}
\DeclareFieldFormat[inproceedings]{citetitle}{#1}
\DeclareFieldFormat[inproceedings]{title}{#1}
\DeclareFieldFormat[article]{citetitle}{#1}
\DeclareFieldFormat[article]{title}{#1}

\hypersetup{
  colorlinks,
  citecolor=DarkPlum,
  linkcolor=DarkPlum,
  urlcolor=DarkPlum
}
\setbeamertemplate{bibliography item}[text]
\setbeamertemplate{navigation symbols}{}
\setbeamerfont{frametitle}{size=\VERYHuge}
\setbeamerfont{framesubtitle}{size=\large}

\renewcommand*\bibfont{\small}

\setbeamertemplate{frametitle}[default][center]

\newtcolorbox{pblock}[1]{
  standard,
  colback = white,
  colframe=DarkPlum,
  rounded corners=all,
  arc=1cm,
  boxrule=3mm,
  fonttitle=\large,
  boxsep=4mm,
  title=\hspace{5mm}#1,
  remember
}

\newtcolorbox{sblock}[1]{
  standard,
  colback = white,
  colframe=DarkPlum,
  rounded corners=all,
  arc=1cm,
  boxrule=3mm,
  remember
}

\newcommand*\lsep{\,|\,}
\newcommand*\fsep{\phantom{\lsep}}
\newcommand*\mpar[1]{\left(#1\right)}
\newcommand*\skeyword[1]{\ensuremath{\mathtt{\textcolor{DarkChameleon}{#1}}}}
\newcommand*\seval{\skeyword{eval}}
\newcommand*\letin[3]{%
    \skeyword{let}~#1~%
    \mathtt{=}~#2~%
    \skeyword{in}~#3%
}

\newenvironment{envtt}{\ttfamily\small}{\par}

\title{Skeletal Semantics}
\author{Martin Bodin\inst{1} \and Philippa Gardner\inst{1} \\
        Thomas Jensen\inst{2} \and Alan Schmitt\inst{2}}
\institute{
    \inst{1}Imperial College London
    \and
    \inst{2}Inria}
\date{}

\begin{document}
\begin{frame}[fragile]
  \frametitle{Skeletal Semantics}
  \begin{center}
  %\framesubtitle{
    \textcolor{DarkPlum}{
    \begin{tabular}{x{16cm}x{16cm}x{16cm}x{16cm}}
      Martin Bodin\textsuperscript{1} & Philippa Gardner\textsuperscript{1} &
      Thomas Jensen\textsuperscript{2} & Alan Schmitt\textsuperscript{2}
      \\
      \multicolumn{2}{c}{\textsuperscript{1}\,Imperial College London} &
      \multicolumn{2}{c}{\textsuperscript{2}\,Inria}
    \end{tabular}
    \hspace{2cm}
    \parbox{12cm}{\tiny
      This research has been partially supported by the ANR projects AJACS ANR-14-CE28-0008 and CISC ANR-17-CE25-0014-01,
      as well as the EPSRC programme grant ‘REMS: Rigorous Engineering of Mainstream Systems’, EP/K008528/1.
    }
  }
  \end{center}
  \vfill

  \begin{columns}[t]
  \begin{column}{.5\linewidth}

  \begin{pblock}{Motivation}
    A lot of large-scale \emph{Coq formalisations of real-world languages}
    have been published in the last years.
    Instances include:
    \begin{itemize}
      \item \(CH_2O\)~\cite{Formalin} for C
        (which can be linked to CompCert~\cite{CompCert, krebbers:hal-00981212}),
      \item JSCert~\cite{JSCert} for JavaScript,
      \item CoqR~\cite{Bodin2018R} for R.
    \end{itemize}
    These formalisations stand out by their large sizes:
    \vspace{-38mm}
    \def\graphnodedistance{8cm}
    \def\graphbarbeforeshift{-1.2}
    \def\graphbaraftershift{2.3}
    \begin{centertikz}[scale=1]

        \node (lambda) {While} ;
        \node [right of = lambda, node distance = \graphnodedistance] (compcert) {CompCert{} C} ;
        \node [right of = compcert, node distance = \graphnodedistance] (jscert) {JSCert{}} ;
        \node [right of = jscert, node distance = \graphnodedistance] (coqR) {CoqR{}} ;

        % Scale: 1 rule/filter = .005.

        \draw [DarkPlum, fill = LightPlum] ($(lambda.north) + (\graphbarbeforeshift, .1)$)
                                           rectangle ++ (\graphbaraftershift, .11) ;
        \node [above = 1mm of lambda] {\(\sim{}20\)~rules} ;

        \draw [DarkPlum, fill = LightPlum] ($(compcert.north) + (\graphbarbeforeshift, .1)$)
                                           rectangle ++ (\graphbaraftershift, 1) ;
        \node [above = 10mm of compcert] {\(\sim{}200\)~rules} ; % 110 in big step + 77 in denotational.
        % Source: estimated from http://compcert.inria.fr/doc/html/Csem.html and http://compcert.inria.fr/doc/html/Cop.html
        % Source: estimated from http://compcert.inria.fr/doc/html/Cop.html

        \draw [DarkPlum, fill = LightPlum] ($(jscert.north) + (\graphbarbeforeshift, .1)$)
                                           rectangle ++ (\graphbaraftershift, 4.5) ;
        \node [above = 45mm of jscert] {\(\sim{}900\)~rules} ; % ~900 in pretty-big-step.

        \draw [DarkPlum, fill = LightPlum] ($(coqR.north) + (\graphbarbeforeshift, .1)$)
                                           rectangle ++ (\graphbaraftershift, 10) ;
        \node [above = 100mm of coqR] {\(\sim{}2{,}000\)~rules} ; % 2028 occurrences of 'let%'.

    \end{centertikz}
    \vspace{-7mm}
    \vspace{-1.9ex}
    \scalebox{.5}{
      \parbox{2\textwidth}{
        \indent
        These formalisations are written in different styles
        and are thus difficult to compare.
        This graph tries to compensate for that
        but it is to be taken with care.
      }
    }\vspace{1ex}

    The size of these formalisations is however not due
    to the complexity of the objects that they manipulate.
    This complexity can be measured by the number of basic actions
    used in the language’s specification,
    pictured below.
    % Here follows an approximation of the number of such actions
    % in each language’s specifications.
    \vspace{.6ex}
    \begin{centertikz}[scale=1]

        \node (lambda) {While} ;
        \node [right of = lambda, node distance = \graphnodedistance] (compcert) {CompCert{} C} ;
        \node [right of = compcert, node distance = \graphnodedistance] (jscert) {JSCert{}} ;
        \node [right of = jscert, node distance = \graphnodedistance] (coqR) {CoqR{}} ;

        % Scale: 1 rule/filter = .005.

        \draw [DarkSkyBlue, fill = LightSkyBlue] ($(lambda.north) + (\graphbarbeforeshift, .1)$)
                                                 rectangle ++ (\graphbaraftershift, .05) ;
        \node [above = 1mm of lambda] {\(\sim{}10\)~actions} ;

        \draw [DarkSkyBlue, fill = LightSkyBlue] ($(compcert.north) + (\graphbarbeforeshift, .1)$)
                                                 rectangle ++ (\graphbaraftershift, 0.6) ;
        \node [above = 6mm of compcert] {\(\sim{}120\)~actions} ; % 68 value constructors, 56 utility functions.
        % Source: estimated from http://compcert.inria.fr/doc/html/Cop.html

        \draw [DarkSkyBlue, fill = LightSkyBlue] ($(jscert.north) + (\graphbarbeforeshift, .1)$)
                                                 rectangle ++ (\graphbaraftershift, 0.4) ;
        \node [above = 4mm of jscert] {\(\sim{}80\)~actions} ; % 44 value constructors, 8 records (counts double), 23 monadic binders.

        \draw [DarkSkyBlue, fill = LightSkyBlue] ($(coqR.north) + (\graphbarbeforeshift, .1)$)
                                                 rectangle ++ (\graphbaraftershift, 0.8) ;
        \node [above = 9mm of coqR] {\(\sim{}160\)~actions} ; % 51 value constructors, 17 records (counts double), 77 monadic binders.

    \end{centertikz}

    Instead, the large sizes of these formalisations come from \emph{semantic exceptions}:
    special behaviours for some values, leading to additional rules in the formalisation.
    For instance, most JavaScript operations on numbers are actually defined on all sorts of objects,
    not only numbers.
    Convoluted heuristics convert these objects to get a result,
    and these heuristics are fully part of the language specification,
    and thus of its formalisation.
    There is for instance no string involved in the following example,
    yet changing \jsinline{toString} has an effect somehow:
    \vspace{.6ex}
\begin{jscode}
console.log (+[18]) ; // Prints 18.
Array.prototype.toString = function (){ return 42 } ;
console.log (+[18]) // Prints 42.
\end{jscode}

    The size of these semantics has two implications:
    \begin{itemize}
      \item Mistakes are easy to be made when writing
        an interpreter or an analyser for these languages.
        There is thus a \emph{need to formally prove such programs}.
      \item Such proofs are themselves impractical to be built
        as they are based on huge language specifications.
    \end{itemize}
  \end{pblock}

  \begin{pblock}{Our Solution}
    Our solution is to step away from the corner-cases of the specification
    by \emph{formalising the specification language itself}.
    Interpreters and analysers can then be written and proven
    \emph{generically}, for any such specification.
    These generic interpreters, analysers, and proofs rely on the language-specific parts:
    basic actions.
    These actions have to be implemented for each language.
    \begin{centertikz}
      \node [locnode yellow] (skel) {\parbox{5em}{\centering Skeletal semantics}};
      \node [locnode, left = 5cm of skel] (pl) {While};
      \node [locnode, above = 2cm of pl] (wh) {$\lambda$-calculus};
      \node [locnode, below = 15mm of pl] (lam) {\parbox{8em}{\centering Any programming language}};
      \draw [->, very thick, Plum] (wh.-25) to [bend right] (skel.175);
      \draw [->, very thick, Plum] (pl) -- (skel);
      \draw [->, very thick, Plum] (lam.25) to [bend left] (skel.-175);
      \node [locnode, above right = 3cm of skel, yshift = -15mm] (concr) {\parbox{6em}{\centering Concrete Interpretation}};
      \node [locnode, below right = 3cm of skel, yshift = 9mm] (abs) {\parbox{6em}{\centering Abstract Interpretation}};
      \draw [->, very thick, Plum] (skel.3) to [in=-180, out=0] (concr);
      \draw [->, very thick, Plum] (skel.-3) to [in=180, out=0] (abs);
      % \node [locnode, right = 2cm of skel] (interp) {...};
      % \draw [->, thick, Plum] (skel.east) -- (interp.west);
      \draw [<->, double, very thick, Plum] (concr.-10) to [bend left = 70] node[above, rotate=-90] (consistency) {Consistency} (abs.10);
      \node [rounded corners = 3mm, rectangle, dashed, draw = DarkChameleon, very thick,
             fit = (concr) (abs) (consistency) (skel)] (once) {} ;
      \node [above = 0pt of once, DarkChameleon, yshift = -1mm] {Defined and proven once and for all} ;
    \end{centertikz}

    We first formalised how JSCert is specified~\cite{cpp2015},
    then generalised it:
    \emph{skeletal semantics} and skeletons~\cite{Skeletons}
    are now much simpler and more general.
    Skeletons have been designed to facilitate the definition
    of interpreters, analysers, but also semantics.
    Skeletons are indeed associated with a general notion of \emph{interpretation},
    of which the usual concrete and abstract interpretations are instances.
    We were able to relate the concrete and abstract interpretations
    \emph{in general}, only assuming small lemmas about each basic action.

    \vspace{2ex}
    Skeletons thus enable users to only focus on what matters:
    how computations are performed at the level of basic actions.
    All the semantic exceptions are faded away at this level,
    leading to much simpler lemmas to prove
    to get a particular theorem about the considered programming language.

    \vspace{2ex}
    Skeletons also enable formalisations to scale with specification changes:
    only lemmas about basic actions that have been changed
    need to be proven again to get a result about the new specification.
  \end{pblock}

  \end{column}
  \begin{column}{.5\linewidth}

  \begin{pblock}{Skeletons and Skeletal Semantics}
    Skeletal Semantics~\cite{Skeletons} is a format to specify the semantics of a programming language.
    A skeletal semantics is guided by syntax:
    a skeleton is defined for each term constructor of the language.
    A skeleton is a sequence of declarations involving
    either (language-specific) basic actions,
    inductive calls to the skeletal semantics,
    or non-deterministic branchings.
    This enables to express a wide range of programming languages.
    %
    % \begin{minipage}{.3\textwidth}
    % \begin{align*}
    %   S \Coloneqq
    %   & \fsep \letin{x}{B}{S} \\
    %   & \lsep x
    % \end{align*}
    % \end{minipage}
    % \begin{minipage}{.7\textwidth}
    % \begin{align*}
    %   B \Coloneqq
    %   & \fsep \seval~x_i~t & \text{Call the term~\(t\) with input~\(x_i\)} \\
    %   & \lsep A~x_i & \text{Call the action~\(A\) with input~\(x_i\)} \\
    %   & \lsep \mpar{S_1 \ldots S_n} & \text{Non-deterministic branching} \\
    % \end{align*}
    % \end{minipage}
    %
    Here follows an example of skeletal semantics for a small While language.
    \hfill\scalebox{.5}{(See full example in the artefact.)}

    \begin{sblock}{}
      \newcommand*\sindent{\phantom{aa}}
    \begin{envtt}
      \anchorp{type1}\skeyword{type} stmt = \\
      | Skip \\
      | Assign of ident * expr \\
      \anchorp{type2}| While of expr * stmt \\
      \\
      \anchorp{val1}\skeyword{val} write : ident * value * state -> state \\
      \skeyword{val} isTrue : bool -> \skeyword{unit} \\
      \skeyword{val} isFalse : bool -> \skeyword{unit} \\
      \anchorp{val2}\skeyword{val} isBool : value -> bool \\
      \\
      \anchorp{eval}\seval{} (s : state) : stmt -> state = \\
      | Skip -> s \\
      | Assign (x, e) -> \\
      \anchorp{evalc}\sindent{}\skeyword{let} v = \seval{} s e \skeyword{in} \\
      \anchorp{write}\sindent{}write x v s \\
      | While (e, t) -> \\
      \sindent{}\skeyword{let} v = \seval{} s e \skeyword{in} \\
      \anchorp{isBool}\sindent{}\skeyword{let} b = isBool v \skeyword{in} \\
      \anchorp{branch1}\sindent{}\skeyword{branch} \\
      \sindent{}\sindent{}\skeyword{let} () = isTrue b \skeyword{in} \\
      \sindent{}\sindent{}\skeyword{let} s' = \seval{} s t \skeyword{in} \\
      \sindent{}\sindent{}\seval{} s' (While (e, t)) \\
      \sindent{}\skeyword{or} \\
      \anchorp{branch2}\sindent{}\sindent{}\skeyword{let} () = isFalse b \skeyword{in} s
    \end{envtt}
    \end{sblock}
    \begin{tikzpicture}[overlay, remember picture]
      \def\localx{23.5cm}
      \def\localy{147mm}

      \draw [DarkPlum, line width = 1mm,
             decorate, decoration = {brace, amplitude = 10pt}]
            ($(type1.north) + (\localx, \localy)$)
            -- node [DarkPlum, right = 5mm] {\parbox{135mm}{\centering{}\small
                 Declaration of terms\\and their constructors.}}
            ($(type2.south) + (\localx, \localy)$) ;

      \draw [DarkPlum, line width = 1mm,
             decorate, decoration = {brace, amplitude = 10pt}]
            ($(val1.north) + (\localx, \localy)$)
            -- node [DarkPlum, right = 5mm] {\parbox{135mm}{\centering{}\small
                 Declaration of basic actions.\\
                 Note that some are partial.}}
            ($(val2.south) + (\localx, \localy)$) ;

      \node (ev) at ($(eval) + (\localx, \localy)$) {} ;
      \node [DarkPlum, right = 5mm of ev] (evp)
        {\parbox{135mm}{\centering{}\small
                 Declaration of the skeletal semantics of statements.}} ;
      \draw [DarkPlum, line width = 1mm] (evp) -- ++ (-11, 0) ;

      \node (evc) at ($(evalc) + (\localx, \localy)$) {} ;
      \node [DarkPlum, right = 5mm of evc] (evcp)
        {\parbox{135mm}{\centering{}\small
                 Inductive call\\to the skeletal semantics.}} ;
      \draw [DarkPlum, line width = 1mm] (evcp) -- ++ (-19, 0) ;

      \node (bo) at ($(isBool) + (\localx, \localy)$) {} ;
      \node [DarkPlum, right = 5mm of bo] (bop)
        {\parbox{135mm}{\centering{}\small
                 Call to a basic action.}} ;
      \draw [DarkPlum, line width = 1mm] (bop) -- ++ (-19, 0) ;

      \draw [DarkPlum, line width = 1mm,
             decorate, decoration = {brace, amplitude = 10pt}]
            ($(branch1.north) + (\localx, \localy)$)
            -- node [DarkPlum, right = 5mm] {\parbox{135mm}{\centering{}\small
                 Non-deterministical branching. \\
                 % The partiality of the filters \texttt{isTrue} and \texttt{isFalse}
                 % prevents both branch from being executable at the same time.
                 % (Although skeletons do not forbid non-determinism.)
                 \tiny
                 (In this particular case,
                 it is actually deterministic
                 thanks to the partiality of \texttt{isTrue} and \texttt{isFalse}.)
                 }}
            ($(branch2.south) + (\localx, \localy)$) ;

    \end{tikzpicture}
    %
    This skeletal semantics looks like an interpreter, but it is not.
    Indeed, one can extract from this skeletal semantics \emph{both a concrete and an abstract semantics}.
    More generally, a wide range of interpretations can be derived from a skeletal semantics.
    Crucially, given a set of basic actions, these interpretations are defined and related one with each other
    \emph{once and for all}.
    This makes skeletons scale with large specification sizes,
    but also with specification changes.

    \vspace{2ex}
    The interpretations that we provide in our paper~\cite{Skeletons}
    are only examples.
    The \emph{simplicity of skeletons} makes it easy to define new interpretations,
    forcing us to focus on the interesting parts
    (typically the memory model and its associated operations)
    instead of being lost in a sea of semantic exceptions.
    %
    Future works include exploring specific interpretations for separation logic,
    certified compilation, etc.,
    as well as building real-world skeletal semantics.
  \end{pblock}

  \begin{pblock}{Artefact}
  The artefact can be found at \href{http://skeletons.inria.fr}{\nolinkurl{skeletons.inria.fr}}:
  \begin{itemize}
    \item \emph{Coq formalisation} of skeletons,
    \item \emph{Proof of correctness} of the abstract interpretation
          with respect to the concrete interpretation,
    \item \emph{OCaml tool} to manipulate skeletons,
    \item \emph{Various examples} of skeletal semantics.
  \end{itemize}

  \vspace{5mm}
  \begin{center}
      \href{http://skeletons.inria.fr}{\includegraphics[height=5cm]{images/skeletonsQRCode.png}}
      ~
      \includegraphics[height=5cm]{images/artifacts_available.png}
      ~
      \includegraphics[height=5cm]{images/artifacts_evaluated_reusable.png}
      ~
      \includegraphics[height=5cm]{images/CoqStamp.png}
  \end{center}
  \end{pblock}

  \begin{pblock}{References}
    {\tiny
    \printbibliography}
  \end{pblock}

  \end{column}
  \end{columns}

\end{frame}

\end{document}

