\documentclass[12pt]{amsart}
\usepackage[margin=0.5in]{geometry}
	% see geometry.pdf on how to lay out the page. There's lots.
\usepackage{bsymb}
\usepackage{../unitb}
\usepackage{calculational}
\usepackage{ulem}
\usepackage{hyperref}
\normalem
\geometry{a4paper} % or letter or a5paper or ... etc
% \geometry{landscape} % rotated page geometry

% See the ``Article customise'' template for some common
% customisations

\title{}
\author{}
\date{} % delete this line to display the current date

%%% BEGIN DOCUMENT
\setcounter{tocdepth}{4}
\begin{document}

\maketitle
\tableofcontents

\input{main8/machine_m1}
\input{main8/machine_m2}
\newcommand{\stmt}[1]{ $#1$ }
% \newcommand{\comment}[2]{
% 	% \begin{tabular}{|l|l|}
% 	% 	\hline
% 		\begin{description}
% 		\item[{#1}] ~ #2
% 		\end{description}
% 	% 	\hline
% 	% \end{tabular}
% 	}
\newcommand{\commentbox}[1]{
	\begin{block} \item \small{ #1 } \end{block} }
\newcommand{\G}{\text{Val}}
\newcommand{\Req}{\text{Req}}
% \renewcommand{\H}{\text{H}}

\section{Initial model --- Requests}
\input{main8/machine_m0}
\begin{machine}{m0}
	\with{functions}
	\with{sets}
	\newset{\G} \newset{\Req}
	\newevent{req:push:left}{request\_push\_left}
	\newevent{req:push:right}{request\_push\_right}
	\newevent{req:pop:left}{request\_pop\_left}
	\newevent{req:pop:right}{request\_pop\_right}
	\newevent{resp:push:left}{respond\_push\_left}
	\newevent{resp:push:right}{respond\_push\_right}
	\newevent{resp:pop:left}{respond\_pop\_left}
	\newevent{resp:pop:right}{respond\_pop\_right}
	\[\variable{ppL,ppR : \set[\Req] } \]
	\[\variable{psL,psR : \Req \pfun \G }\]
	\[ \dummy{r : \Req} \]
	\[ \dummy{X : \G} \]
    \[ \param{req:push:left}{r : \Req} \]
    \[ \param{req:push:right}{r : \Req} \]
    \[ \param{req:push:left}{x : \G} \]
    \[ \param{req:push:right}{x : \G} \]
    \[ \param{req:pop:left}{r : \Req} \]
    \[ \param{req:pop:right}{r : \Req} \]
\subsection{Issuing requests}

\begin{align}
	&\evguard{req:push:left}{m0:grd0}{ \neg r \in \dom.psL } \\
	&\evbcmeq{req:push:left}{m0:act0}{psL}{ psL \1| r \fun x } \\
	&\evguard{req:push:right}{m0:grd0}{ \neg r \in \dom.psR } \\
	&\evbcmeq{req:push:right}{m0:act0}{psR}{ psR \1| r \fun x } \\
	&\evguard{req:pop:left}{m0:grd0}{ \neg r \in ppL } \\
	&\evbcmeq{req:pop:left}{m0:act0}{ppL}{ ppL \1\bunion \{r\} } \\
	&\evguard{req:pop:right}{m0:grd0}{ \neg r \in ppR } \\
	&\evbcmeq{req:pop:right}{m0:act0}{ppL}{ ppL \1\bunion \{r\} }
\end{align}

\subsection{Requirements}

\begin{align}
	\progress{m0:p0}
		{r \in \dom.psL }
		{ \neg r \in \dom.psL } \\
	\progress{m0:p1}
		{r \in \dom.psR }
		{ \neg r \in \dom.psR } \\
	\progress{m0:p2}
		{r \in ppL }
		{ \neg r \in ppL } \\
	\progress{m0:p3}
		{r \in ppR }
		{ \neg r \in ppR } \\
	\safety{m0:s0}
		{ psL.r = X }
		{ \neg r \in \dom.psL } \\
	\safety{m0:s1}
		{ psR.r = X }
		{ \neg r \in \dom.psR }
\end{align}

\subsection{Addressing the requirements}
\[ \indices{resp:pop:right}{r : \Req} \]
\[ \indices{resp:pop:left}{r : \Req} \]
\[ \indices{resp:push:right}{r : \Req} \]
\[ \indices{resp:push:left}{r : \Req} \]
\begin{align}
	\refine{m0:p0}{ensure}{resp:push:left}{ \index{r}{r' = r} }
	\cschedule{resp:push:left}{m0:sch0}{ r \in \dom.psL } \\
	\evbcmeq{resp:push:left}{m0:act0}{psL}{ \{r\} \domsub psL }
\end{align}
% \removecoarse{resp:push:left}{default}
\begin{align}
	\refine{m0:p2}{ensure}{resp:pop:left}{ \index{r}{r' = r} }
	\cschedule{resp:pop:left}{m0:sch0}{ r \in ppL } \\
	\evbcmeq{resp:pop:left}{m0:act0}{ppL}{ ppL \setminus \{ r \} }
\end{align}
% \removecoarse{resp:pop:left}{default}
\begin{align}
	\refine{m0:p1}{ensure}{resp:push:right}{ \index{r}{r' = r} }
	\cschedule{resp:push:right}{m0:sch0}{ r \in \dom.psR } \\
	\evbcmeq{resp:push:right}{m0:act0}{psR}{ \{r\} \domsub psR }
\end{align}
% \removecoarse{resp:push:right}{default}
\begin{align}
	\refine{m0:p3}{ensure}{resp:pop:right}{ \index{r}{r' = r} }
	\cschedule{resp:pop:right}{m0:sch0}{ r \in ppR } \\
	\evbcmeq{resp:pop:right}{m0:act0}{ppR}{ ppR \setminus \{ r \} }
\end{align}
% \removecoarse{resp:pop:right}{default}
\end{machine}
\section{First Refinement --- Sequence of Values}
\input{main8/machine_m1}
\begin{machine}{m1}
	\refines{m0}
	\with{intervals}
\splitevent{resp:pop:right}{resp:pop:right:empty,resp:pop:right}
\splitevent{resp:pop:left}{resp:pop:left:empty,resp:pop:left}
	\[ \variable{p,q : \Int} \]
	\[ \variable{qe : \Int \pfun \G} \]
	\[ \variable{emp : \Bool } \]
	\[ \variable{ res : \G } \]
\begin{align}
	\invariant{m1:inv0}{ qe \in \intervalR{p}{q} \tfun \G } \\
	\invariant{m1:inv1}{ p \le q } \\
	\initialization{m1:init0}{ qe = \emptyfun } \\
	\initialization{m1:init1}{ p = 0 \land q = 0 } \\
	\evbcmeq{resp:push:right}{m1:act0}{q}{q+1} \\
	\evguard{resp:push:right}{m1:grd0}{ r \in \dom.psR } \\
	\evbcmeq{resp:push:right}{m1:act1}{qe}{ qe \1| q \fun psR.r } \\
	\evbcmeq{resp:pop:right}{m1:act0}{q}{q-1} \\
	\evguard{resp:pop:right}{m1:grd0}{\neg p = q} \\
	\fschedule{resp:pop:right}{m1:sch0}{\neg p = q} \\
	\evbcmeq{resp:pop:right}{m1:act1}{qe}{ \{ q\0-1 \} \domsub qe } \\
	\evbcmeq{resp:pop:right}{m1:act2}{emp}{ \false } \\
	\evbcmeq{resp:pop:right}{m1:act3}{res}{ qe.(q\0-1) } \\
	\fschedule{resp:pop:right:empty}{m1:sch0}{ p = q } \\
	\evguard{resp:pop:right:empty}{m1:grd0}{ p = q } \\
	\evbcmeq{resp:pop:right:empty}{m1:act2}{emp}{ \true } \\
	\evbcmeq{resp:push:left}{m1:act0}{p}{p-1} \\
	\evguard{resp:push:left}{m1:grd0}{ r \in \dom.psL } \\
	\evbcmeq{resp:push:left}{m1:act1}{qe}{qe \1| p\0-1 \fun psL.r} \\
	\evbcmeq{resp:pop:left}{m1:act0}{p}{p+1} \\
	\evguard{resp:pop:left}{m1:grd0}{\neg p = q} \\
	\fschedule{resp:pop:left}{m1:sch0}{\neg p = q} \\
	\evbcmeq{resp:pop:left}{m1:act1}{qe}{ \{ p \} \domsub qe } \\
	\evbcmeq{resp:pop:left}{m1:act2}{emp}{ \false } \\
	\evbcmeq{resp:pop:left}{m1:act3}{res}{ qe.p } \\
	\fschedule{resp:pop:left:empty}{m1:sch0}{ p = q } \\
	\evguard{resp:pop:left:empty}{m1:grd0}{ p = q } \\
	\evbcmeq{resp:pop:left:empty}{m1:act2}{emp}{ \true }
\end{align}
\end{machine}
\begin{machine}{m2}
	\refines{m1}
\end{machine}
\end{document}


%\section{SNoW for MWMR setting}\label{mwmr}
Here present  algorithm  $B$, which satisfies  SNW and "one-version" properties, in MWMR setting where a \rot{} must consist of one version of the data but, possibly, multiple communication trips between the reader and the servers.% We denote the type of object  that satisfies the SNoW properties by $\tilde{\mathcal{O}}_T$.
%Note that $B$ can also tolerate crash failure of writers and readers.
In B, the steps for the writers are shown in Pseudocode~\ref{fig:algo_bc} and for readers and the servers  are presented in Pseudocode~\ref{fig:algo_b}.
We assume  a set of writers $\mathcal{W}$,  a set of readers $\mathcal{R}$ and a set of $k \geq 1$ servers,  $\mathcal{S}$, with ids $s_1, s_2\cdots s_k$ that stores the objects $o_1, o_2, \cdots, o_k$, respectively.  We define  key ${\kappa}$ is defined as a pair $(z, w)$,
where $z \in \mathbb{N}$ and $w \in \mathcal{W}$ the  id of a writer. We use $\mathcal{K}$ to denote the set of all possible keys.
In $B$, the keys are used to uniquely identify each transaction. Also, with each transaction we associate a tag $t \in \mathbb{N}$.
%We assume writers can send message to the reader, i.e., we allow client-to-client messages.
% We assume that each process has a unique id. We assume that each server $s$ stores object $o_s$, due to sharding.  For the sake of simplicity, we assume that the \wots{} issued by a writer are of the form: \emph{ write value $v_1$ to object $o_1$, $v_2$ to $o_2$, and so on}. In other words, we assume that such a  transaction consists of the set of operations $\{ \writeop{o_1}{v^{(1)}}, \writeop{o_2}{v^{(2)}}\cdots \writeop{o_k}{v^{(k)}}\} $, which we denote by $write(v_1, v_2, \cdots, v_k)$.  \wots{} where only a subset of  the objects are updates will be discussed later. We also assume that  the \rots{} are of the form  $\{ \readop{o_1}, \readop{o_2}\cdots \readop{o_k}\}$ consisting of $k$ reads to $k$ distinct objects.

In  $B$, we designate one of the servers as coordinator, denote as $s^*$,
 for the transactions. The $s^*$  maintains the order of the \wots{} and the objects that are updated during the \wot{} in the variable $List$.  %Note that in a system, where there are many objects
%different objects may be use different servers  as coordinators based on some load-balancing rule.

\textit{\textbf{State variables:}} Each of the writers and servers maintain a set of state variables as follows: $(i)$ At  any  \emph{writer $w$}, there is  a counter $z$ to keep track of the
 number of \wot{}  the writer has  invoked, initially $0$. $(ii)$ At any  \emph{server}, $s_i$,
 for $i \in [k]$, there is  a set variable $Vals$
 with elements
 that are  key-value pairs $({\kappa}, v_i) \in \mathcal{K} \times \mathcal{V}_i$. Initially,
  $Vals= \{ ({\kappa}^0, v_i^0)\}$. %This ensures that each \wot{} generates a unique key.
A server also contains an
 ordered list variable $List$  of elements  as $({\kappa}, (b_1, \cdots, b_k))$,  where
 ${\kappa}  \in \mathcal{K}$  and
 $(b_1, \cdots b_k) \in  \{0, 1\}^k$. Initially,
 $List= [ ({\kappa}^0, (1, \cdots 1) ]$, where ${\kappa}^0  \equiv (0, w_0)$,
 where $w_0$ is any
  place holder identifier string for writer id. The elements in $List$ can be identified with an index, e.g.,
  $List[0] =({\kappa}^0, (1, \cdots, 1))$.  Essentially, a $(k+1)$-tuple  $(\kappa, (b_1, \cdots, b_k))$ in $List$ corresponds to a \wot{} and
   identifies the set of objects that are updated during the \wot{}, i.e., if $b_i=1$ then object
   $o_i$ was updated  during  the  \wot{}, otherwise $b_i=0$.
			%labeled with phase names, viz., {\readGetTag}, {\readValueTag}, {\readCompleteTag} and {\writeGetTag}. The server to server messages are labeled as {\readDisperseTag}. Also, in some phases of {\SODA},  the message-disperse primitives {\mdmetaprim} and {\mdvalueprim} are used  as services.

\textit{\textbf{Writer steps:}} A \wot{} updates
			a  list of $p$ objects $o_{i_1}, o_{i_2}, \cdots o_{i_p}$  with values
			 $v_{i_1}, v_{i_2}, \cdots v_{i_p}$, respectively, is invoked at $w$ via the procedure
			$\Writetr{ (o_{i_1}, v_{i_1}), \cdots, (o_{i_p}, v_{i_p}) }$.
We use the notations:  $I \triangleq \{i_1, i_2, \cdots, i_p\}$  and $S_I\triangleq \{s_{i_1}, s_{i_2}, \cdots, s_{i_p}\}$.
This procedure  consists of two phases: {\writeValue} and {\updateCoord}.
%We denote the set of servers involved   in the \wot{}  by  $S_I=\{s_{i_1}, s_{i_2}, \cdots, s_{i_p}\}$.
During the {\writeValue} phase,  $w$ creates a new key ${\kappa}$ as
 $ {\kappa}  \equiv (z + 1, w)$, where $w$ identifies the writer; and also increments the local counter $z$ by one.  Then $w$ sends $(${\writeValueTag}$, ({\kappa}, v_{i}))$ to each server in $S_I$, and awaits {\ackTag}
from all servers in $S_I$.
After receiving {\ackTag} from all servers in $S_I$,  $w$
initiates the {\updateCoord} phase where it sends
(\updateCoordTag, $({\kappa}, (b_{1}, \cdots b_{k})$) to $s^*$, where for any $i \in [k]$,  $b_i=1$ if $s_i \in S_I$,
otherwise $b_i=0$,   and completes then \wot{} after it receive a   ({\ackTag}, $t_w$) from $s^*$.
%	  After receiving message  ({\ackTag}, $t_w$),  $w$ completes the \wot{}.

%At $s^*$, upon receiving  (\updateCoordTag, $({\kappa}, (b_{1}, \cdots, b_{k})$) from $w$ appends
%			 $({\kappa}, (b_{1}, \cdots, b_{k}))$ to its  $List$,  and responds with
%			 {\ackTag} and $t_{w}$ (set to be the number of elements in the local list $List$)  to $w$.
%			 The order of the  elements in  $List$ corresponds to  the order
%the \wots{}, the order of the incoming  {\updateCoordTag} updates,  as seen by $s^*$.
%			  After receiving an ({\ackTag}, $t_w$),  $w$ completes the \wot{}.

\textit{\textbf{Reader steps:}}
We use the same notations for $I$ and $S_I$ as above but the indices can vary across  transactions.
The procedure  \Readtr{$ o_{i_1},  o_{i_2}, \cdots, o_{i_p}$} can be
initiated by  some reader  $r$,   as a \rot{}, intending to read the values of
subset $o_{i_1},  o_{i_2}, \cdots, o_{i_p}$ of the objects. The procedure
consists of two consecutively executed phases of communication rounds
between the $r$ and the  servers, viz.,  {\getTagArray} and {\readValue}.
%
During  the  phase {\getTagArray},  $r$ sends $s^*$ the message  {\getTagArrayTag}
 requesting the  list of the latest added keys for each object.
 Once $r$ receives a list of tags, such as, $(t_r, ({\kappa}_1, {\kappa}_2, \cdots,  {\kappa}_k))$ from $s^*$   the phase completes.
%
%
In the subsequence phase, {\readValue},   $r$ requests each server $s_i$ in $S_I$ by sending the message
$(\text{\readValueTag}, \kappa_i)$.
% Then upon receiving such a request, any server $s_i$ responds with  $(${\readValueTag}$, {\kappa}^{s_i})$, i.e., one version of  $o_i$ corresponding to the key $t_i$ to $r$, stored in its $Vals$.
%
%During  phase {\readValue}, 	 the reader sends to each of the servers in
%$\mathcal{S}$, say $s_i$ the key ${\kappa}^{s_i}$ corresponding
%			 to $(k+1)$-tuple of $List$ with the latest  index $j^*$ such that $b_i =1$ such that
%$i \in I$, where $I \triangleq  \{{i_1},  {i_2}, \cdots, {i_p}\}$,  requesting the corresponding value.
%Any server $s_i$ upon receiving
%such a message with $(${\readValueTag}$, {\kappa}^{s_i})$ responds with $v$ such that $({\kappa}^{s_i}, v_i)$ is in its variable $Vals$.
After  receiving the values $v_{i_1}$, $v_{i_2}, \cdots v_{i_p}$ from the servers in $\mathcal{S_I}$,
 $r$ completes the transaction  by
 returning the tuple of values $(v_{i_1}, \cdots v_{i_p})$.
 % and set the tag $t_r$ as  the latest index in $List$ corresponding to a \wot{} that updated  one of the object in the \rot{}, i.e., $\max_{1 \leq j \leq |List|} \{ j : List[j].b_i = 1 \wedge i \in I\}$.

\textit{\textbf{Server steps:}}
When a server $s_i$ receives a message of type $(${\writeValueTag}$, ({\kappa}, v_{i}))$ from a writer $w$ then
%to each server in $S_I$, and awaits {\ackTag}
%from all servers in $S_I$.
it  adds $({\kappa}, v_i)$ to its set variable
$Vals$ and sends {\ackTag} back to $w$.

If the coordinator $s^*$ receives  (\updateCoordTag, $({\kappa}, (b_{1}, \cdots, b_{k})$) from writer $w$, then it appends
			 $({\kappa}, (b_{1}, \cdots, b_{k}))$ to its  $List$,  and responds with
			 {\ackTag} and $t_{w}$ (set to be the number of elements in the local list $List$)  to $w$.
			 The order of the  elements in  $List$ corresponds to  the order
the \wots{}, the order of the incoming  {\updateCoordTag} updates,  as seen by $s^*$.

When $s^*$  receives  the message  {\getTagArrayTag} from $r$  it responds with
$(\kappa_1, \cdots, \kappa_k)$ such that for each $i \in [k]$, $\kappa_i$ is the key  part of the $(k+1)$-tuple that was modified
last, i.e., 	${\kappa}_i = List[j^*].{\kappa}$ such that 	 $j^* \triangleq\max \{ j : List[j].b_i =1 \}$, and
$t_r$, $t_r \triangleq \max_{1 \leq j \leq |List|} \{ j : List[j].b_i = 1 \wedge i \in I\}$.
%
  	If any server $s_i$ receives a message  $(${\readValueTag}$, {\kappa})$ from a reader $r$ then it responds to $r$ with
   the value $v_i$ corresponding to key with value  $\kappa$ in  $Vals$.

The following result states that algorithm $B$ respects SNW and "one-round" properties.
% and the proof is omitted for now since it is very straightforward. Note that the liveness property of \rot{} and \wot{}  transactions are a part of the SNOW properties.
%Consider any failure-free and fair execution of algorithm $B$.
%For the purpose of proving the $S$ property, for every transaction transaction  $\phi$ in an execution of $B$ we associate a tag $tag(\phi)$ as described below.
% the variable $t_r$ in a reader and $t_w$ in
%a writer are used to associate a tag as described below.
% $ \triangleq \max_{1 \leq j \leq |List|} \{ j : List[j].b_i = 1 \wedge i \in I\}$, which is presented as a comment in the pseudo-code for $A$.
%If $\phi$ is a \wot{} (\rot{}) then  $tag(\phi)$ is the value of the variable $t_w$ ($t_r$) immediately before the
%operation completes.

\begin{theorem} Any well-formed  and fair execution of algorithm $B$  satisfies the SNW and "one-round"  properties. %Algorithm $B$ also tolerates any client crash failures.
\end{theorem}

%	\begin{theorem} Any well-formed  and fair execution of algorithm $B$ is an implementation of  an object of type $\tilde{\mathcal{O}}_T$ in the MWMR setting, 	with no client-to-client communication,  comprising of objects $o_1, o_2, \cdots o_k$ stored in servers $s_1, s_2, \cdots, s_k$, respectively; and it satisfies the SNoW  properties. %Algorithm $B$ also tolerates any client crash failures.\end{theorem}

\remove{
\begin{proof} Below we show that algorithm $B$ satisfies the  SNoW properties.

	\noindent{\emph{\underline{S property:}}}
	Let $\beta$ be any fair execution  of  $B$ and
 suppose all clients in $\beta$ behave in a well-formed
manner. Suppose $\beta$ contains no incomplete transactions and let  $\Pi$ be the set of transactions in $\beta$.  We define an irreflexive partial ordering ($\prec$) in $\Pi$ as follows:  if $\phi$ and $\pi$ are any two distinct transactions in $\Pi$ then we say
	$\phi \prec \pi$ if either $(i)$ $tag(\phi) < tag(\pi)$ or $(ii)$ $tag(\phi) = tag(\pi)$ and $\phi$ is a \wot{} and $\pi$ is a \rot{}. Below we prove the $S$  property of $B$ by showing that  properties $P1$, $P2$, $P3$ and $P4$ of Lemma~\ref{lem:equivalence} hold for $\beta$.

	\emph{P1:}   Clearly, from an inspection of the algorithm,
	 $tag(\pi) \in \mathbb{N}$. From inspection of the algorithm, each \wot{} increases the size of
	 $List$, and the value of the tags are  defined by the size of $List$. Therefore, there can be at
	 most a finite number of \wots{} such that can precede $\pi$ (w.r.t. $\prec$) in $\beta$.
	  On the other hand, if $\pi$ is a \rot{} then since all \rot{}s are invoked by readers  in a well-formed manner,  and there are only finite number of readers
	therefore, there cannot be an infinite number of \rot{}s such that they all
	precede $\pi$ (w.r.t $\prec$).

	\emph{P2:}  Suppose $\phi$ and $ \pi$ are any two transactions in $\Pi$, such that, $\pi$ begins after $\phi$ completes. Then we show that we have  we cannot have $\pi \prec \phi$. Now, we consider four cases, depending on whether $\phi$ and $\pi$ are \rot{}s or \wots{}.
	\begin{enumerate}
	    \item [$(a)$] $\pi$ and $\phi$ are \wots{} invoked by writers $w_{\pi}$ and $w_{\phi}$, respectively. Since the size of $List$, in $s^*$ grows monotonically due to each \wot{}  hence  $w_{\pi}$ receives the  tag  from $s^*$ at least as high as $tag(\phi)$, so $\pi\not \prec \phi$.
	      %
	       \item [$(b)$] $\pi$ is a \rot{}, $\phi$ is a \wot{} invoked by reader  $r_{\pi}$ and writer $w_{\phi}$, respectively.
	        Since the size of $List$, in $s^*$,  grows monotonically,  because  $r_{\pi}$  invokes $\pi$ after $\phi$ completes hence $tag(\pi)$ is at least as high as $tag(\phi)$, so $\pi\not \prec \phi$.
	      %
	        \item[$(c)$]$\pi$ and $\phi$ are both \rot{}s  invoked by readers $r_{\pi}$ and $r_{\phi}$, respectively.
	           Since the size of $List$, in $s^*$, grows monotonically,  because   $w_{\pi}$ invokes $\pi$ after $\phi$ completes hence $tag(\pi)$ is at least as high as $tag(\phi)$, so $\pi\not \prec \phi$.
	        %
	         \item [$(d)$] $\pi$ is a \wot{}, $\phi$ is a \rot{}  invoked by writer $w_{\pi}$ and reader $r_{\phi}$, respectively.
	         This case is simple because new values are added to $List$, in $s^*$,  only  by writers, and $tag(\pi)$  has to be larger than the tag of $\phi$ and hence   $\pi\not \prec \phi$.
	\end{enumerate}

	\emph{P3:} This is from  the fact that any \wot{} always creates a unique tag and all tags are totally ordered since they all belong to $\mathbb{N}$

		\emph{P4:} Consider a \rot{} $\rho$ as $READ(o_{i_1}, o_{i_2}, \cdots, o_{i_q})$, in $\beta$.
Let the returned value from $\rho$ be $\mathbf{v} \equiv $$(v_{i_1}, v_{i_2}, \cdots, v_{i_q})$ such that
$1 \leq {i_1} <  {i_2} <  \cdots <  {i_q} \leq k$, where value  $v_{i_j}$ corresponds to $o_{i_j}$.
	Suppose $tag(\rho) \in \mathbb{N}$ was created during some \wot{}, say $\phi$, i.e., $\phi$ is the \wot{} that
	added the elements in index $(tag(\rho)-1)$ of $List$ at the coordinator $s^*$. Note that element in index $0$ contains the initial value.
	%because \rots{} do not generate new tags as they do not add any new item to the $Vals$ of any server.
	 Now we consider two cases:

	\emph{Case $tag(\rho) = 1$.} We  know that it corresponds the initial default value $v_i^0$ at each sub-object $o_i$, and this equates to $\rho$ returning the default initial value for each sub-object.
	 %
	% Therefore, $tag(\rho) = tag(\phi)$.

	 \emph{Case $tag(\rho) > 1$.} Then we argue that there exists no \wot{}, say $\pi$, that updated object $o_{i_j}$,   in $\beta$, such that,  $\pi \neq \phi$ and $\rho$ returns values written by $\pi$ and $\phi \prec \pi \prec \rho$. Suppose we assume the 	contrary, which means $tag(\phi) < tag(\pi) < tag(\rho)$. The latter implies $tag(\phi)  = tag(\pi)$ which is not possible because
	this contradicts the fact that for any two distinct \wots{} $tag(\phi) \neq tag(\pi)$  in any execution of   $B$.

	\noindent{\emph{\underline{N, o and W properties:}}}  Evident from an inspection of the algorithm.
	% for the  response steps  of the servers to the reader.
	\end{proof}
}


% -*- root: ../main.tex -*-
\chapter{Design\label{chap:design}}

\paragraph{Abstract}

In this chapter we define the way that formal verification can be achieved, for which first we define some notation and definitions.
%
After some generalities about formal verification, we define more concrete aspects of the formal verification we aim to achieve, such us the linked-list theory used.
%
%
%
\section{Program correctness}
%
We are finally ready to apply this concepts to a real word problem. In this \thisworkm we apply those concepts to prove some properties of programs.
%
The remaining task is to define the framework and the conventions we use to formally prove  properties of programs.

The way we approach to assess correctness is by proving properties.
%
There are \concept{liveness}, \concept{safety} and \concept{functional} properties.
%
Safety properties refer, informally, to “bad things never happens”. Proving \textit{ variable x is never 0 } is a safety property.
%
Proving valid this property can assure that a division by zero error will never occur.
%
Whether a program finishes or not is a liveness property, and producing an output for a concrete input is a functional property.

These properties are written in some logic.
%
Liveness properties require the use of temporal logic but we restrict ourselves to use safety properties so no machinery for temporal properties is needed.
%
As the properties are expressed formally in \gls{FOL}, it is necessary to define a formal representation of a program.

\label{def:SPL}
\input{src/spl}

\subsection{Partial correctness (Safety)}

A function (or the whole program) is \textbf{partially correct} if whenever the function's precondition is satisfied on entry, its postcondition is satisfied when the function returns (if it ever does).
%
We present the \concept{inductive assertion method} for proving partial correctness.

Let $\varphi$ be the \gls{FOL} property to study.
%
The procedure is the following:
%
First each function is reduced to a finite set of \gls{FOL} formulae called \concept[Verification condition]{\gls{VC}}.
%
This reduction is done with the basic reducing cases we studied in \ref{def:SPL}.
%
The goal is to prove that $\varphi$ is valid in every state of the execution.
%
\textbf{Induction} is the methodology used.
%
First, we assert $\varphi$ is valid before the program starts (induction base).
%
Then, we assume $\varphi$ in the precondition and prove $\varphi'$ valid (induction step) for every possible transition.

This method is not complex to understand but it requires a lot of work even for simple programs.
%
We illustrate this method with an example in \ref{app:exampleFactorial}.

\vspace{-0.3cm}
\section{Parametrized systems}

The correctness of a program executed by just one thread it is an easier problem because the program runs sequentiality.
%
Multiple threads executing the same program is a different and more difficult problem to solve.
%
An unbounded number of threads executing is another important and difficult extension.
%
If the number of threads is bounded, one could unroll the formula for all the threads in the problem.
%
As this is the usual scenario, we focus the unbounded case.

We are going to study those cases.
%
To do so, we need to parametrize the program executed by multiple threads.
%
Typically we use  $i$,$j$,$k_0$,$k_i$ for threads identifiers.

\vspace{-0.3cm}
\subsubsection{Arbitrary number of threads}

For example, the web servers may not have a bound of the number of clients they can accept.
%
Can we prove correctness when an unbounded number of processes are using the same global variables?

A recent research \citeapos{paperParametrizedInvariants} has proven a very important result.
%
We will present this result new as it is fundamental for this work.
%
We will not formally prove any of the results proven in \citep{paperParametrizedInvariants}.

Before we enunciate the theorem, we need some previous concepts.
%
We need to extend the concept of support to parametrized formulas.

\begin{defn}[Support]
  Let $\psi$, $A$ and $B$ be parametrized formulas, and let $S$ be the
  set of possible substitutions from the set of parametrized variables in $\psi$ ($\Var(\psi)$) into the set of parametrized variables of $(A\Into B)$ ($\Var(A\Into B)$).
%
  We say that $\psi$ supports $(A\Into B)$, whenever
%
  \[ \big( (\bigwedge_{\sigma\in S} \sigma(\psi)\big) \andcond A\big) \Into B \hspace{4em} \text{is valid} \]
%
  We use $\psi\supports(A\Into B)$ as a short notation for
  $\big((\bigwedge_{\sigma\in S} \sigma(\psi)) \andcond A\big) \Into B$.
\end{defn}
Note that if $S'\subseteq S$ is a subset of the substitutions, and
%
  \[ \big( (\bigwedge_{\sigma\in S'} \sigma(\psi)\big) \andcond A\big) \Into B \hspace{4em} \text{is valid} \]
%
then
%
  \[ \big( (\bigwedge_{\sigma\in S} \sigma(\psi)\big) \andcond A\big) \Into B \hspace{4em} \text{is also valid} \]
%
  Essentially, if one succeeds in proving the validity of a formula obtained by removing some of the conjuncts from the antecedent, the validity of the full formula is preserved.
%
  Hence, in practice, it is enough to consider only some of the partial substitutions to show that a support formula is valid.

\begin{itheorem}[Bound an arbitrary number of threads]
	Let $\varphi$ be a thread-parametrized formula, where $\overline{k}=\Var(\varphi)$.
	%
	Let $\tau$ be a transition of $P$ and $\ThetaParam$ the initial condition of $P$.

	To show that $P$ satisfies $\Always\varphi$ (that is, $\varphi$ is an invariant of $P$):
	\hspace{-1em}
	\[
		\begin{array}{r@{\;\;}lr@{\;}@{\;}cl@{\hspace{1em}}l}
			\Premise{S1}. & & \ThetaParam(\overline{k}) &\supports & \varphi & \\

			\Premise{S2}. & \varphi \supports & \tau^{(i)} &\Into& \varphi'  & \text{forall $\tau$ and all $i\in \overline{k}$}\\
			\Premise{S3}. & \varphi\supports & \big(\bigwedge\limits_{x\in\Var(\varphi)} j\neq x \andcond \tau^{(j)} &\Into& \varphi' \big)& \text{forall $\tau$ and one fresh $j\notin\overline{k}$}\\ \hline
			& \multicolumn{4}{c}{\hspace{3em} \Always \varphi} &
		\end{array}
	\]
\label{thm:biggest}
\end{itheorem}

Using this powerful result, we have reduced an arbitrary number of processes sharing the same variables to a finite number of threads sharing the variable.
%
The proof of this result can be found in \citeapos{paperParametrizedInvariants}.
%
We will refer to $\Premise{S1}$ as \concept{initiation} because it depends on the initial condition.
%
$\Premise{S2}$ will be referred as \concept{self-consecution} because it captures the execution of one of the threads mentioned in the formula.
%
Finally, $\Premise{S3}$ will be referred as \concept{others-consecution} because it captures the execution of threads which do not appear in the formula.
%
The example included in appendix \ref{app:exampleFactorial} illustrate the concept of support.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{A Theory of Linked Lists}

\subsection{Description}

In order to work with linked lists in a context with multiple thread using the same list
there are two possible approaches.
%
A thread could lock the entire list, work with the list and then release the lock.
%
There could be some optimizations in this approach, such as a writer-reader system.
%
However, this is extremely unefficient although it could more secure in terms of preventing deadlocks.
%
The other approach is locking and unlocking each node of the list, so multiple threads can work simultaneously using the same list as long as they do not need to use the same node.
%
This approach is called lock-coupling lists.

\begin{defn}[Lock-coupling linked list]
A lock-coupling concurrent list is
a concurrent data type that implements a set by maintaining in the heap an
ordered single-linked list with non-repeating elements.
%
Each node in the list is protected by a lock which guarantees that a
single thread can access the node at the same time.
%
\end{defn}

The way a thread iterates over the list is the following.
%
The thread acquires the lock of the node
that it visits and after that tries to acquire the next node.
The first lock is only released after the lock of the
second node has been successfully acquired.
%
This technique of protecting cells with locks (instead of protecting
the whole data-structure with a single coarse-grain lock) is known as
\concept{fine-grained locking}.

The nodes of a concurrent lock-coupling list are instances of the following
\ListNode class:
%
\[
	  \class \;\Node  \;\left\{
				Elem \:\;\; data; \;
				Addr \:\;\; next; \;
				Lock \:\;\; lock; \;
		\right\}
\]
%
Where the fields are:
\begin{itemize}
		\item \fData: the value stored in the node. This field is also used to keep
			the list ordered.
		\item \fNext: a pointer that stores the address of the next node in
			the list.
		\item \fLock: the lock protecting the node.
\end{itemize}

We assume that the operating system provides the atomic operations \fLock
and \fUnlock.

We will use \concept[Ghost variable]{ghost variables} which are variables that are not present in the program but are added to aid in the verification process.
%
The implementation of concurrent lock-coupling lists has 3 global variables.
%
Two of them are global addresses \head and \tail, and one ghost global variable \region.
%%
The variable \head, an address points to the first node of the list which has the lowest possible value ($-\infty$).
%
The variable \tail, an address points to the last node of the list  which has the lowest possible value ($+\infty$).
%
Finally, the variable \region, a set of addresses, is used to keep track of the portion of the heap whose cells form the list.
%
In Figure \ref{fig:listcode} we present the code of the implementation chosen.

\begin{figure}
	\centering
	\label{fig:listcode}
	\includegraphics[scale=0.4]{listcode}
	\caption{Code of the implementation chosen.}
\end{figure}
%
There are three procedures, \Search, \Insert and \Remove which traverses through the list the way it was explained.

\subsection{TL3}
To prove verification conditions generated in the proof of invariants of lock-coupling lists we need a theory of lists to work with, and axioms in order to prove \gls{FOL} formulas.

\emph{Theory of Linked Lists with Locks}: \TLLpL, is the theory we use for describing linked-list heap memory layouts.
%
\TLLpL is a multi-sorted first-order theory.
%
It is multi-sorted because it has multiple types for its variables (address, element,...).
%
It is a first-order theory because only variables are quantifiable, as in unsorted \gls{FOL}.

In this section we briefly present \TLLpL.
%
A more complete and formal definition of \TLLpL can be found in \citeapos{paperAle} and \citep[6.2]{thesisAle}.

Although some functions are originally defined \citep{thesisAle} in suffix notation (\fNext,\fData and \fLock fields), preffix-notation has been used to describe the theory.
%
The reason for this modification is to be consistent with the syntax of \spass.
%
Furthermore, we use subset of \TLLpL.
%
In the same way \gls{FOL} can be expressed with $\neg,\vee$ but sometimes $\implies$ is included but $\dimplies$ is not,
%
a few functions of \TLLpL have not been used because they can be expressed using others functions in the theory.
%
We proceed to describe the subset of \TLLpL used.

\TLLpL is a composition of theories. The \textbf{sorts} used among this theories are:
%
\cell (representing the nodes of the list),
%
\elem (representing elements),
%
\addr (representing address),
%
\tid (representing thread id),
%
\mem (representing the memory also called heap, represented as maps of \addr to \cell ),
%
\path (representing a finite sequence of address),
%
\sSetTid, \sSetAddr, \sSetElem to represent sets of \tid,\addr or \elem respectively.

For each sort, there is a theory containing its constants, functions and predicates.
%
There is one more theory, $\Sigma_{Bridge}$ is a \emph{bridge theory} containing auxiliary
functions, for example, that allow to map paths of addresses to set of
addresses, or to obtain the set of addresses reachable from a given
address following a chain of \fNext fields.

\subsection{Signature}

We proceed to describe the signature of each theory, listing the sorts used and explaining its functions, predicates and constants.
%
Every theory includes the equality theory \ref{theory:equality}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%					TID

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%\begin{center}\rule{4cm}{0.4pt} $\Sigma_{\tid}$ \rule{4cm}{0.4pt}\end{center}
\paragraph{$\Sigma_{\tid}$ : }
%
The sort used is \tid. The “no-thread” value is represented with \fNoThread.
%
Apart from the equality theory, this theory does not have any other predicates or functions.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%					ELEM

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%\begin{center}\rule{4cm}{0.4pt} $\Sigma_{\elem}$ \rule{4cm}{0.4pt}\end{center}
\paragraph{$\Sigma_{\elem}$ : }
%
The sort used is \elem.
%
There is a total order which allows to order every set of \elem.
%
In addition, this sort is upper and lower bounded.
%
 The top block contains the functions and the lower block lists the predicates.

\begin{center}
\begin{tabular}{|rrl|}
  \hline
\fHighest & \elem & Maximum value an \elem can take.\\
\fLowest & \elem & Minimum value an \elem can take.\\
\hline\hline
\fLselem & \elem$\times$\elem & Total order relation between \elem.
\\\hline
\end{tabular}
%\caption{\textbf{Signature of $\Sigma_{\ensuremath{\mathit{elem}}}$.} The top block contains the functions and the lower block lists the predicates.}
%\label{table:elem_signature}
\end{center}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%					CELL

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%\begin{center}\rule{4cm}{0.4pt} $\Sigma_{\cell}$ \rule{4cm}{0.4pt}\end{center}
\paragraph{$\Sigma_{\cell}$ : }
%
The sorts used are \cell,\;\elem,\;\addr,\;\tid.

\begin{center}
\begin{tabular}{|rrl|}
  \hline
\fMkcell & $\elem\times\addr\times\tid \to \cell$ & Constructor\\
\fNext & $\cell \to \addr$ & Getter of \fNext field \\
\fData & $\cell \to \elem$ & Getter of \fData field \\
\fLockID & $\cell \to \tid$ & Getter of \fLockID field \\
\fLock & $\cell\times\tid\to\cell$ & Construct a new \cell with \fData and \fNext \\
&&\;\;\;								values of the given \cell, \\
&&\;\;\;				using the \tid for the \fLockID field.\\
\fError & $\cell$ & Constant value used to model \\
&&\;\;\;				incorrect memory deference.
\\\hline
\end{tabular}
%\caption{\textbf{Functions of $\Sigma_{\cell}$} theory.}
%\label{table:cell_signature}
\end{center}

The function \fUnlock could be considered. Actually, \cite{thesisAle} includes it in the theory but it has not been included in this work.
%
The reason is justified because to \fUnlock a \cell is equivalent to \fLock a \cell with \fNoThread value.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%					MEMORY

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%\begin{center}\rule{4cm}{0.4pt} $\Sigma_{\mem}$ \rule{4cm}{0.4pt}\end{center}
\paragraph{$\Sigma_{\mem}$ : }
%
The sorts used are \mem,\cell and \addr.

\begin{center}
\begin{tabular}{|rrl|}
  \hline
\fNull & $\addr$ & Null address \\
\fRd & $\mem\times\addr\to\cell$ & Models memory deference. \\
&&								\;\;\; Returns the value from the \mem the \cell \\
&&								\;\;\; stored in the \addr.\\
\fUpd & $\mem\times\addr\times\cell\to\mem$ & Creates a new \mem from the given one
\\\hline
\end{tabular}
%\caption{\textbf{Functions of $\Sigma_{\mem}$} theory}
\label{table:memory_signature}
\end{center}

A function related with \mem theory is \fMalloc, used in the \insertprg procedure.
%
The function \fMalloc does not belongs to \gls{SPL} or \TLLpL but it can be translated as a conjunction of assignments and assignments are allowed in both theories.
%
The function \fMalloc returns a new fresh address different to every other address in use, so the \freshaddr returned by \fMalloc is not equal to \head, nor \tail, etc.
%
\fMalloc formal representation correspond to a big conjunction of all the formulas stating \freshaddr is not equal to \addr, for all \addr appearing in the formula (except itself).
%\[\forall x,y. [x\neq y \andcond x=\fMalloc(h) \implies h(x)\neq h(y)]\]

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%					SETADDR

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%\begin{center}\rule{4cm}{0.4pt} $\Sigma_{\sSetAddr}$ \rule{4cm}{0.4pt}\end{center}
\paragraph{$\Sigma_{\sSetAddr}$ : }
%
It models the usual set theory.
%
We preferred a prefix version of each function and predicate to be consistent with Section \ref{ax::fulllist}.
%

The intersection function and the subset predicate have not been included, even tough \citep{thesisAle} uses them.
%
They were not used because they were redundant.

\begin{center}
\begin{tabular}{|rrl|}
  \hline
\fEmptyset & \sSetAddr & Empty set\\
\fSingl & $\addr\to\sSetAddr $& Constructor of a single-element set.\\
\fUnion & $\sSetAddr\times\sSetAddr\to\sSetAddr$&\\
\fSetdiff & $\sSetAddr\times\sSetAddr\to\sSetAddr$&\\
\hline\hline
\pIn & $\sAddr\times\sSetAddr $&
\\\hline
\end{tabular}
%\caption{\textbf{Signature of $\Sigma_{\sSetAddr}$.} The top block contains the functions and the lower block lists the predicates.}
\label{table:setaddr_signature}
\end{center}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%					SETELEM

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%\begin{center}\rule{4cm}{0.4pt} $\Sigma_{\sSetElem}$ \rule{4cm}{0.4pt}\end{center}
\paragraph{$\Sigma_{\sSetElem}$ : }
%
Again, it models the usual set theory.
%
The signature is described in Table \ref{table:setelem_signature}.

\begin{center}
\begin{tabular}{|rrl|}
  \hline
\fEmptysetElem & $\sSet $& Empty set\\
\fSinglElem & $\elem\to\sSet $& Constructor of a single-element set.\\
\fUnionElem & $\sSet\times\sSet\to\sSet$&\\
\fSetdiffElem & $\sSet\times\sSet\to\sSet$&\\
\hline\hline
\pInElem & $\sAddr\times\sSet $&
\\\hline
\end{tabular}
%\caption{\textbf{Signature of $\Sigma_{\sSetElem}$.} The top block contains the functions and the lower block lists the predicates.}
\label{table:setelem_signature}
\end{center}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%					SETTID

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%\begin{center}\rule{4cm}{0.4pt} $\Sigma_{\sSetTid}$ \rule{4cm}{0.4pt}\end{center}
\paragraph{$\Sigma_{\sSetTid}$ : }
%
The signature is described in Table \ref{table:settid_signature}.

\begin{center}
\begin{tabular}{|rrl|}
  \hline
\fEmptysetTid & $\sSetAddr $& Empty set\\
\fSinglTid & $\addr\to\sSetAddr $& Constructor of a single-element set.\\
\fUnionTid & $\sSetAddr\times\sSetAddr\to\sSetAddr$&\\
\fSetdiffTid & $\sSetAddr\times\sSetAddr\to\sSetAddr$&\\
\hline\hline
\pInTid & $\sAddr\times\sSetAddr$ &
\\\hline
\end{tabular}
%\caption{\textbf{Signature of $\Sigma_{\sSetAddr}$.} The top block contains the functions and the lower block lists the predicates.}
\label{table:settid_signature}
\end{center}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%					BRIDGE

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%\begin{center}\rule{4cm}{0.4pt} $\Sigma_{Bridge}$ \rule{4cm}{0.4pt}\end{center}
\paragraph{$\Sigma_{Bridge}$ : }
%
This theory is much more extensive in \cite{thesisAle}.
%
However, aiming for simplicity, we do not include every function and predicate because we do not use them in our proofs.
%
The only function used in the proofs is:
\begin{center}
\begin{tabular}{|rrl|}
  \hline
\fAddrToSet & $\mem\times\addr\to\sSetAddr $& Returns the set of \addr reachable from the \addr given.\\
\hline
\end{tabular}
%\caption{\textbf{Signature of $\Sigma_{\sSetAddr}$.}}
\label{table:bridge_signature}
\end{center}


\subsection{Multiple box and whiskers}


\documentclass{beamer}
\usepackage{appendixnumberbeamer}

\mode<presentation>{\usetheme[subsectionpage=progressbar,block=fill,numbering=none]{metropolis}}

\usepackage[sfdefault]{FiraSans} %% option 'sfdefault' activates Fira Sans as the default text font
\usepackage[english]{babel}
% \usepackage[utf8]{inputenc}

\usepackage{graphicx} % Allows including images
\usepackage{caption}
\usepackage{booktabs} % Allows the use of \toprule, \midrule and \bottomrule in tables
\usepackage{multicol}

% Math packages
\usepackage{amsmath}
\usepackage{mathtools}
\usepackage{amssymb}
\usepackage{mathpartir}
\usepackage{stmaryrd}
\usepackage{centernot}
\usepackage[normalem]{ulem}

%% Coding
\usepackage[outputdir=build]{minted}

% Coloured boxes
\usepackage{tcolorbox}
\colorlet{alert}{mLightBrown}
\colorlet{mLightBrownTransparent}{white!70!mLightBrown}
\newtcolorbox{alertbox}
{standard jigsaw, opacityback=0,colframe=alert}
\newtcolorbox{tbox}
{standard jigsaw, opacityback=0,opacityframe=0}

%% Quotes with author
\usepackage{xparse}

\let\oldquote\quote
\let\endoldquote\endquote

\RenewDocumentEnvironment{quote}{o}
  {\oldquote}
  {\IfValueT{#1}{\par\nobreak
   \hfill--- #1}\endoldquote\addvspace{\smallskipamount}}

\newcommand{\dotcup}{\mathbin{\mathaccent\cdot\cup}}
\newcommand{\fromto}[2]{\{#1,\dotsc,#2\}}
\newcommand{\denot}[1]{\llbracket#1\rrbracket}
\newcommand{\listt}[1]{\mathsf{List}~#1}
\newcommand{\map}{\mathsf{map}}
\newcommand{\haskell}[1]{\mintinline{haskell}{#1}}
\newcommand{\vint}[1]{\mathcal{V}\denot{#1}}
\newcommand{\tint}[1]{\mathcal{E}\denot{#1}}
\newcommand{\wt}[1]{\mathsf{wt}_{#1}}
\newcommand{\rels}{\mathcal{R}}
\newcommand{\values}{Val}
\newcommand{\bool}{\mathsf{Bool}}
\newcommand{\nat}{\mathsf{Nat}}
\newcommand{\zero}{\mathsf{0}}
\newcommand{\suc}{\mathsf{succ}}
\newcommand{\pair}{\mathsf{pair}}
\newcommand{\true}{\mathsf{true}}
\newcommand{\false}{\mathsf{false}}
\newcommand{\nil}{\mathsf{nil}}
\newcommand{\cons}{\mathsf{cons}}
\newcommand{\length}{\mathsf{length}}
\newcommand{\eq}{\mathsf{eq}}
\newcommand{\cmp}{\mathsf{cmp}}
\newcommand{\nf}[1]{#1{\downarrow}}
\newcommand{\eqnf}{=^*}

\title{Theorems for Free!} % the title on the title page
\subtitle{by Philip Wadler}

\author{Kevin Kappelmann} % Your name
\institute[TU Munich]{Technical University of Munich}
\date{May 27, 2021} % Date, can be changed to a custom date

\begin{document}

\maketitle

%------------------------------------------------
\section{Type Systems and Polymorphism}
% \begin{frame}[fragile]{Haskell Has Types}

% \begin{minted}{haskell}
% appTwice :: (Int -> Int) -> Int -> Int
% appTwice f x = f (f x)
% \end{minted}

% \pause
% \centering What is the result of\dotso

% \begin{uncoverenv}<3>
% \begin{onlyenv}<1-3>
% \begin{minted}{haskell}
% appTwice (*2) 1 = ?
% \end{minted}
% \end{onlyenv}
% \end{uncoverenv}

% \begin{onlyenv}<4>
% \begin{minted}{haskell}
% appTwice (*2) 1 = 4
% \end{minted}
% \end{onlyenv}

% \begin{onlyenv}<5>
% \begin{minted}{haskell}
% appTwice (*2) 1 = 4
% appTwice (*2) "bogus" = ?
% \end{minted}
% \end{onlyenv}

% \begin{onlyenv}<6>
% \begin{minted}{haskell}
% appTwice (*2) 1 = 4
% appTwice (*2) "bogus" = ...
% \end{minted}
% \begin{alertbox}
% \begin{minted}[escapeinside=??]{bash}
% • Couldn?'?t match expected type ‘Int’ with
  % actual type ‘[Char]’
% • In the second argument of ‘appTwice’,
  % namely ‘"bogus"’
  % In the expression: appTwice (*2) "bogus"...
% \end{minted}
% \end{alertbox}
% \end{onlyenv}
% \end{frame}

% \begin{frame}
% \centering
% \Huge Thank you, type system!
% \end{frame}

% \begin{frame}{What is a Type System?}

% {\Large Type systems are mechanisms that guarantee the absence of certain programming errors.}

% \pause
% \vspace{3\baselineskip}
% \centering{\alert{\large \dotso is there a catch?}}
% \end{frame}

\begin{frame}[fragile]{Sigh, Just Apply It Twice!}
\begin{minted}{haskell}
appTwice :: (Int -> Int) -> Int -> Int
appTwice f x = f (f x)
\end{minted}

\centering What is the result of\dotso

\begin{onlyenv}<1-2>
\begin{uncoverenv}<2>
\begin{minted}{haskell}
appTwice (*2) 1 = ?
\end{minted}
\end{uncoverenv}
\end{onlyenv}

\begin{onlyenv}<3>
\begin{minted}{haskell}
appTwice (*2) 1 = 4
\end{minted}
\end{onlyenv}

\begin{onlyenv}<4>
\begin{minted}{haskell}
appTwice (*2) 1 = 2
appTwice (*2) "bogus" = ?
\end{minted}
\end{onlyenv}

\begin{onlyenv}<5>
\begin{minted}{haskell}
appTwice (*2) 1 = 2
appTwice (*2) "bogus" = ...
\end{minted}
\end{onlyenv}

\begin{onlyenv}<1-5>
\begin{uncoverenv}<5>
\begin{alertbox}
\begin{minted}[escapeinside=??]{bash}
• Couldn?'?t match expected type ‘Int’ with
  actual type ‘[Char]’
• In the second argument of ‘appTwice’,
  namely ‘"bogus"’
  In the expression: appTwice (*2) "bogus"...
\end{minted}
\end{alertbox}
\end{uncoverenv}
\end{onlyenv}

\begin{onlyenv}<6>
\begin{minted}{haskell}
appTwice (*2) 1 = 2
appTwice (++"l") "haske" = ?
\end{minted}
\end{onlyenv}

\begin{onlyenv}<7>
\begin{minted}{haskell}
appTwice (*2) 1 = 2
appTwice (++"l") "haske" = ...
\end{minted}
\end{onlyenv}

\begin{onlyenv}<6->
\begin{uncoverenv}<7->
\begin{alertbox}
\begin{minted}[escapeinside=??]{bash}
• Couldn?'?t match type ‘[Char]’ with ‘Int’
  Expected type: Int -> Int
  Actual type: [Char] -> [Char]
• In the first argument of ‘appTwice’,
  namely ‘(++"l")’
  In the expression: appTwice (++"l") "haske"...
\end{minted}
\end{alertbox}
\end{uncoverenv}
\end{onlyenv}

\end{frame}

% \begin{frame}[fragile]{Do Not Repeat Yourself}
% Well then, let us fix this problem:

% \begin{onlyenv}<1-3>
% \begin{uncoverenv}<2-3>
% \begin{minted}{haskell}
% appTwiceInt :: (Int -> Int) -> Int -> Int}
% appTwiceInt f x = f (f x)

% appTwiceString :: (String -> String) -> String -> String
% appTwiceString f x = f (f x)
% \end{minted}
% \end{uncoverenv}
% \end{onlyenv}

% \begin{onlyenv}<4>
% \begin{minted}[highlightlines={2,5},highlightcolor=mLightBrownTransparent]{haskell}
% appTwiceInt :: (Int -> Int) -> Int -> Int}
% appTwiceInt f x = f (f x)

% appTwiceString :: (String -> String) -> String -> String
% appTwiceString f x = f (f x)
% \end{minted}
% \end{onlyenv}
% \only<1-3>{\uncover<3>{And we are happy again:}}
% \only<4>{And we are \sout{happy} \alert{unhappy} again:}

% \begin{uncoverenv}<3->
% \begin{minted}{haskell}
% appTwiceInt (*2) 1 = 4
% appTwiceSting (++"l") "haske" = "haskell"
% \end{minted}
% \end{uncoverenv}
% \end{frame}

% \begin{frame}{The \emph{Abstraction Principle}}
% \begin{quote}[Benjamin Pierce]
% Each significant piece of functionality in a program should be implemented in just one place in the source code. Where similar functions are carried out by distinct pieces of code, it is generally beneficial to combine them into one by abstracting out the varying parts.
% \end{quote}
% \end{frame}

\begin{frame}[fragile]{Polymorphism to the Rescue!}
Haskell knows \emph{parametric polymorphism}: we
can abstract over types by using type variables.

\pause

\begin{minted}{haskell}
appTwice :: (a -> a) -> a -> a
appTwice f x = f (f x)
\end{minted}

\pause
And we are happy:

\begin{minted}{haskell}
appTwice (*2) 1 = 4
appTwice (++"l") "haske" = "haskell"
\end{minted}

\pause
\centering {\large End of the story? \pause \alert{Of course not!}}

\end{frame}

\begin{frame}
\centering {\Huge Polymorphism comes with another twist!}
\end{frame}

\begin{frame}[fragile]{Black Magic}
I show you a term's type but not its definition.
You tell me the possible results:
\footnote{Let us forget about \mintinline{haskell}{undefined} for a moment.}

% \begin{uncoverenv}<2>
% \begin{onlyenv}<1-2>
% \begin{minted}{haskell}
% f :: a -> b -> a
% -- def. of f hidden

% f 42 "hi" = ?
% f "hi" 42 = ?
% \end{minted}
% \end{onlyenv}
% \end{uncoverenv}

% \begin{onlyenv}<3>
% \begin{minted}{haskell}
% f :: a -> b -> a
% -- def. of f hidden

% f 42 "hi" = 42
% f "hi" 42 = "hi"
% \end{minted}
% \end{onlyenv}

% \begin{onlyenv}<4>
% \begin{minted}{haskell}
% f :: a -> b -> a
% f x y = x

% f 42 "hi" = 42
% f "hi" 42 = "hi"
% \end{minted}
% \end{onlyenv}

\begin{uncoverenv}<2>
\begin{onlyenv}<1-2>
\begin{minted}{haskell}
g :: (a -> a) -> a -> a
-- def. of g hidden

g (*2) 1 =? 1
g (*2) 1 =? 2
g (*2) 1 =? 3
g (*2) 1 =? 16
g (*2) 1 =? 42
\end{minted}
\end{onlyenv}
\end{uncoverenv}

\begin{onlyenv}<3-4>
\begin{minted}[highlightlines={4,5,7},highlightcolor=mLightBrownTransparent]{haskell}
g :: (a -> a) -> a -> a
-- def. of g hidden

g (*2) 1 =? 1
g (*2) 1 =? 2
g (*2) 1 /= 3
g (*2) 1 =? 16
g (*2) 1 /= 42
\end{minted}
\end{onlyenv}

\begin{onlyenv}<5>
\begin{minted}[highlightlines={7},highlightcolor=mLightBrownTransparent]{haskell}
g :: (a -> a) -> a -> a
-- def. of g hidden

g (*2) 1 /= 1
g (*2) 1 /= 2
g (*2) 1 /= 3
g (*2) 1 = 16
g (*2) 1 /= 42
\end{minted}
\end{onlyenv}

\begin{onlyenv}<6>
\begin{minted}[highlightlines={7},highlightcolor=mLightBrownTransparent]{haskell}
g :: (a -> a) -> a -> a
g f x = f (f (f (f x)))

g (*2) 1 /= 1
g (*2) 1 /= 2
g (*2) 1 /= 3
g (*2) 1 = 16
g (*2) 1 /= 42
\end{minted}
\end{onlyenv}

\uncover<4-6>{
What if I told you that \mintinline{haskell}{g (++"I") "" = "IIII"}?
}
\end{frame}

\begin{frame}
\Large Polymorphic functions are defined once and for all for any type and as such must work uniformly on values of any type.

\pause

\Large From the type of a polymorphic function,
we can derive a theorem that it satisfies.
\end{frame}

\begin{frame}
\centering \huge Polymorphic types provide us \emph{theorems for free}.
\end{frame}

\section{Technical Development}

\begin{frame}{System F}

The polymorphic lambda calculus aka System F:

\pause
Types:
\begin{equation*}
\tau \Coloneqq  \alpha \mid \tau \to \tau \mid \forall \alpha.\ \tau
\end{equation*}

\pause
Terms:
\begin{equation*}
t \Coloneqq x \mid \lambda x : \tau.\ t \mid t\, t \mid \Lambda \alpha.\ t \mid  t\,[\tau]
\end{equation*}

\pause
Values:
\begin{equation*}
v \Coloneqq x\mid \lambda x : \tau.\ t \mid \Lambda \alpha.\ t
\end{equation*}

\pause
Here is our \mintinline{haskell}{appTwice} function:
\begin{align*}
&\Lambda \alpha.\,\lambda f : \alpha\to\alpha.\,\lambda x : \alpha.\, f\ (f\, x) : \forall \alpha.\, (\alpha\to\alpha)\to\alpha\to\alpha
\end{align*}

\pause

We can call it like this: \mintinline{haskell}{appTwice [Int] (+1) 0}
\end{frame}

\begin{frame}[fragile]{Types as Relations}
\only<1>{It is natural to interpret a type $\tau$ as a set $\denot{\tau}$ containing all values of type $\tau$, e.g. $\denot{\mintinline{haskell}{Bool}}=\{\mintinline{haskell}{True,False}\}$ in Haskell.}
\only<2>{\sout{It is natural to interpret a type $\tau$ as a set $\denot{\tau}$ containing all values of type $\tau$, e.g. $\denot{\mintinline{haskell}{Bool}}=\{\mintinline{haskell}{True,False}\}$ in Haskell.}}

% \pause

% The key idea to derive free theorems is to instead interpret a \emph{type as a relation} that
% \begin{enumerate}[<+->]
% \item relates terms of the given type and
% \item whose membership is preserved under eliminating forms.
% \end{enumerate}

\vspace{\baselineskip}

\uncover<2>{\centering \Large New slogan: \alert{types relate terms and related terms lead to related results.}}
\end{frame}

\begin{frame}{Types as Relations: Examples}
\begin{columns}
	\column{\dimexpr\paperwidth-10pt}
\begin{itemize}[<+->]
  \item Base types are interpreted as their identity relation,
    e.g.\
    $\denot{\haskell{Bool}}=\{(\haskell{True,True}),(\haskell{False,False})\}$.
  \item Two pairs are related if their components are related, i.e.
\vspace{-0.5\baselineskip}
\begin{equation*}
	\bigl((t_1,t_2),(t_1',t_2')\bigr)\in\denot{(\tau_1,\tau_2)} \iff (t_1,t_1')\in\denot{\tau_1}\land (t_2,t_2')\in\denot{\tau_2}.
\end{equation*}
  \item Two lists are related if they have the same length and their elements are related, i.e.
\vspace{-0.5\baselineskip}
\begin{align*}
&\bigl([t_1,\dotsc,t_n],[t_1',\dotsc,t_{n'}']\bigr)\in \denot{\listt{\tau}}\\
\iff&n = n' \land \forall i\in\fromto{1}{n}.\ (t_i,t_i')\in \denot{\tau}.
\end{align*}
  \item Two functions are related if they map related arguments to related results, i.e.
\vspace{-0.5\baselineskip}
\begin{equation*}
	(f,f')\in \denot{\tau_1 \to \tau_2} \iff \forall (t,t')\in \denot{\tau_1}.~\bigl(f\, t, f'\, t'\bigr)\in\denot{\tau_2}.
\end{equation*}
\end{itemize}
\end{columns}
\end{frame}

\begin{frame}{Recipe for Logical Relations}
A \emph{logical relation} $R\denot{\tau}$ is an inductive family of relations indexed by types.

\pause
If we want to prove a property $P$ for the terms of our language,
we construct $R\denot{\tau}$ in a way such that:
\begin{enumerate}[<+->]
  \item If $R\denot{\tau}\bigl(t_1,\dotsc,t_n\bigr)$ then
  \begin{enumerate}
    \item $\vdash t_i : \tau$ for $1\leq i \leq n$ (we write $\wt{\tau}(t_1,\dotsc,t_n)$)
    \item $P\bigl(t_1,\dotsc,t_n\bigr)$
  \end{enumerate}
  \item The conditions of the relation are preserved by eliminating forms.
\end{enumerate}

\end{frame}

\begin{frame}{Our Logical Relation}
We split our logical relation into two parts:
\begin{enumerate}
\item $\vint{\tau}$ on values
\item $\tint{\tau}$ on general terms
\end{enumerate}

\pause
\begin{align*}
  \tint{\tau}\coloneqq\bigl\{(t_1,t_2)\mid
  \wt{\tau}(t_1,t_2)\land (\nf{t_1},\nf{t_2})\in\vint{\tau}\bigr\}
\end{align*}

\end{frame}

\begin{frame}{Relating Functions}

If we had a $\haskell{Bool}$ base type, we would first define:
\begin{equation*}
  \vint{\haskell{Bool}}\coloneqq\{(\haskell{True,True}),(\haskell{False,False})\}
\end{equation*}

\pause
And then continue with function types:
\begin{align*}
  \vint{\tau_1\to\tau_2}\coloneqq
  \Bigl\{&(\lambda x : \tau_1.\ t_1, \lambda x : \tau_1.\ t_2) \mid\\
  \onslide<3->{&\phantom{\land\, }\wt{\tau_1\to\tau_2}(\lambda x : \tau_1.\ t_1, \lambda x : \tau_1.\ t_2)\\}
  \onslide<4->{&\land\forall (v_1,v_2)\in\vint{\tau_1}.\ \bigl(t_1[v_1/x],t_2[v_2/x]\bigr)\in\tint{\tau_2}} \Bigr\}
\end{align*}
% \begin{align*}
  % \vint{\tau_1\to\tau_2}_\rho\coloneqq
  % \Bigl\{&\bigl(\lambda x : \rho(\tau_1).\ t_1, \lambda x : \rho(\tau_1).\ t_2\bigr) \mid\\
  % &\phantom{\land\, }\wt{\rho(\tau_1)\to\rho(\tau_2)}\bigl(\lambda x : \rho(\tau_1).\ t_1, \lambda x : \rho(\tau_1).\ t_2\bigr)\\
  % & \land \forall (v_1,v_2)\in\vint{\tau_1}_\rho.\ \bigl(t_1[v_1/x],t_2[v_2/x]\bigr)\in\tint{\tau_2}_\rho \Bigr\}
% \end{align*}
\end{frame}

\begin{frame}{Relating Type Abstractions: First Try}
\begin{align*}
  \vint{\forall \alpha.\ \tau}\coloneqq
  \Bigl\{&(\Lambda \alpha.\ t_1, \Lambda \alpha.\ t_2) \mid\\
  \onslide<2->{&\phantom{\land\, }\wt{\forall \alpha.\, \tau}(\Lambda \alpha.\ t_1, \Lambda \alpha.\ t_2)\\}
  \onslide<3->{&\land\forall \tau_1,\tau_2.\ \bigl(t_1[\tau_1/\alpha],t_2[\tau_2/\alpha]\bigr)\in\tint{\tau[?/\alpha]}} \Bigr\}
\end{align*}

\uncover<4>{
\alert{Under which type should $t_1[\tau_1/\alpha]$ and $t_2[\tau_2/\alpha]$ be related under?}
}

\end{frame}

\begin{frame}{Relating Type Abstractions: Second Try}
Trick: keep track of the chosen types in a substitution $\rho$
\pause
\begin{align*}
  \vint{\forall \alpha.\ \tau}_{\alert{\rho}}\coloneqq
  \Bigl\{&(\Lambda \alpha.\ t_1, \Lambda \alpha.\ t_2) \mid\\
   &\phantom{\land\, }\wt{\forall \alpha.\, \alert{\rho(\tau)}}(\Lambda \alpha.\ t_1, \Lambda \alpha.\ t_2)\\
 &\land\forall \tau_1,\tau_2.\ \bigl(t_1[\tau_1/\alpha],t_2[\tau_2/\alpha]\bigr)\in\alert{\tint{\tau}_{\rho[\alpha\mapsto(\tau_1,\tau_2)]}} \Bigr\},
\end{align*}

\end{frame}

\begin{frame}{Relating Variables: First Try}
\begin{align*}
\vint{\alpha}_\rho\coloneqq
  \Bigl\{&(v_1,v_2) \mid\\
  \onslide<2->{&\phantom{\land\, }\wt{\rho(\alpha)}(v_1,v_2)}\\
 &\onslide<3->{\land\ \alert{?}}\hspace{5cm}\Bigr\}
\end{align*}

\onslide<3>{
\alert{How should we relate values of possibly different types?}
}
\end{frame}

\begin{frame}{Relating Type Abstractions: Final Version}

Idea: whenever we pick two types $\tau_1,\tau_2$, we also pick a relation on $\tau_1$ and $\tau_2$.
\pause
\begin{align*}
  \vint{\forall \alpha.\ \tau}_\rho\coloneqq
  \Bigl\{&(\Lambda \alpha.\ t_1, \Lambda \alpha.\ t_2) \mid\\
  &\phantom{\land\, }\wt{\forall \alpha.\, \rho(\tau)}(\Lambda \alpha.\ t_1, \Lambda \alpha.\ t_2)\\
  &\land \forall \tau_1,\tau_2,\alert{R\in\rels(\tau_1,\tau_2)}.\ \\
  &\quad\bigl(t_1[\tau_1/\alpha],t_2[\tau_2/\alpha]\bigr)\in\tint{\tau}_{\rho[\alert{\alpha\mapsto(\tau_1,\tau_2,R)}]} \Bigr\},
\end{align*}
\pause
where $R$ is just a relation of closed, well-typed values:
\begin{equation*}
\rels(\tau_1,\tau_2)\coloneqq\bigl\{R\in\mathcal{P}(\values\times \values)\mid \forall(v_1,v_2)\in R.\ \wt{\tau_1}(v_1)\land\wt{\tau_2}(v_2)\bigr\}.
\end{equation*}
\end{frame}

\begin{frame}{Final Updates}
\begin{equation*}
  \vint{\alpha}_\rho\coloneqq
  \bigl\{(v_1,v_2) \in R \mid
  \wt{\rho(\alpha)}(v_1,v_2) \land \rho(\alpha)=(\tau_1,\tau_2,R) \bigr\}
\end{equation*}
\pause
\begin{align*}
  \vint{\tau_1\to\tau_2}_{\alert{\rho}}\coloneqq
    \Bigl\{&\bigl(\lambda x : \alert{\rho(\tau_1)}.\ t_1, \lambda x : \alert{\rho(\tau_1)}.\ t_2\bigr) \mid\\
&\phantom{\land\, }\wt{\alert{\rho(\tau_1)}\to\alert{\rho(\tau_2)}}\bigl(\lambda x : \alert{\rho(\tau_1)}.\ t_1, \lambda x : \alert{\rho(\tau_1)}.\ t_2\bigr)\\
& \land \forall (v_1,v_2)\in\vint{\tau_1}_{\alert{\rho}}.\ \bigl(t_1[v_1/x],t_2[v_2/x]\bigr)\in\tint{\tau_2}_{\alert{\rho}} \Bigr\}
\end{align*}
\begin{align*}
  \tint{\tau}_{\alert{\rho}}\coloneqq\bigl\{(t_1,t_2)\mid
  \wt{\alert{\rho(\tau)}}(t_1,t_2)\land (\nf{t_1},\nf{t_2})\in\vint{\tau}_{\alert{\rho}}\bigr\}
\end{align*}
\end{frame}

\begin{frame}{Parametricity Theorem}
\begin{theorem}[Parametricity Theorem]
  If $\vdash t : \tau$ then
  $(t,t\bigr)\in\tint{\tau}_\emptyset$.
\end{theorem}

\large In other words: \alert{every closed, well-typed term is related to itself.}

\end{frame}

\section{Examples of Free Theorems}

% \begin{frame}{Natural Numbers}
% Assume we have a base type $\mathbb{N}$ with $\suc : \mathbb{N}\to\mathbb{N}$.

% \pause
% Assume we are given some value $t : \forall \alpha.\, (\alpha\to\alpha)\to\alpha\to\alpha$, a type $\tau$, and values $s : \tau\to\tau$ and $z : \tau$.
% What is the result of $t\,[\tau]\,s\,z$?

% \pause
% Set $R\coloneqq \bigl\{(n,\nf{(s^n\, z)})\mid n\in\mathbb{N}\bigr\}$ and note that $(\suc, s)\in\vint{\alpha\to\alpha}_{[\alpha\mapsto(\mathbb{N},\tau,R)]}$:\\
% \pause If $(v_1,v_2)\in\vint{\alpha}_{[\alpha\mapsto(\mathbb{N},\tau,R)]}$
% then $(v_1,v_2)=\bigl(n,\nf{(s^n\, z)}\bigr)$ for some $n$.
% Thus $(\suc\,v_1,s\,v_2)\eqnf\bigl(n+1,\nf{(s^{n+1}\, z)}\bigr)\in R$.

% \pause
% Hence, $\bigl(t\,[\mathbb{N}]\,\suc\, 0,t\,[\tau]\,s\,z\bigr)\in\tint{\alpha}_{[\alpha\mapsto(\mathbb{N},\tau,R)]}$ by the Parametricity Theorem.
% \pause So there is $v' : \mathbb{N}$ and $v : \tau$ such that
% $t\,[\mathbb{N}]\,\suc\, 0\to^*v'$ and $t\,[\tau]\,s\,z\to^*v$ and $(v',v)\in R$.
% \pause Hence $v \eqnf s^n\, z$ where $n$ is determined by $t\,[\mathbb{N}]\,\suc\, 0\to^*v'\eqnf n$.
% \end{frame}

\begin{frame}{Rearranging Lists}
Assume we are given a value
$t : \forall \alpha.\, \listt{\alpha}\to\listt{\alpha}$.

\pause
We show that
\begin{equation*}
  \forall \alpha,\alpha',(f : \alpha\to\alpha'),(xs : \listt{\alpha}).\, \map\,f\,(t\,[\alpha]\,xs)\eqnf t\,[\alpha']\,(\map\,f\,xs)
\end{equation*}

\pause
Pick any $\tau,\tau',f : \tau\to\tau'$.
\pause
By the Parametricity Theorem, for any $R$ and $(xs,xs')\in\vint{\listt{\alpha}}_{[\alpha\mapsto(\tau,\tau',R)]}$, we have $(t\,[\tau]\, xs,t\,[\tau']\, xs')\in\tint{\listt{\alpha}}_{[\alpha\mapsto(\tau,\tau',R)]}$.

\pause
If we specialise $R=\bigl\{(v,\nf{(f\, v)})\mid \wt{\tau}(v)\bigr\}$,
the property $(xs,xs')\in\vint{\listt{\alpha}}_{[\alpha\mapsto(\tau,\tau',R)]}$
translates to $xs'\eqnf \map\, f\, xs$.

\pause
Similarly,
$\bigl(t\,[\tau]\, xs,t\,[\tau']\, xs'\bigr)\in\tint{\listt{\alpha}}_{[\alpha\mapsto(\tau,\tau',R)]}$
translates to
$t\, [\tau']\,xs' \eqnf \map\,f\,(t\,[\tau]\, xs)$.

\pause
Putting it together: $t\, [\tau']\,(\map\, f\, xs) \eqnf \map\,f\,(t\,[\tau]\, xs)$.
\end{frame}

\begin{frame}{Negative Results}
Note that in Haskell \haskell{undefined :: forall a. a}.
Can we define such a term in System F?

\pause
Assume there is a value $u : \forall \alpha.\, \alpha$.
Pick any $\tau,\tau'$ and set $R=\emptyset$.
\pause
Then by the Parametricity Theorem,
$\bigl(u\,[\tau],u[\tau']\bigr)\in R=\emptyset$,
which is impossible.

\end{frame}

\section{Going Beyond System F}
\begin{frame}{Further Applications and Extensions}
\begin{enumerate}[<+->]
\item Representation independence of abstract data types
\item Free Theorems for non-total extensions with general recursion
\item Free Theorems for recursive data types
\item Free Theorems for type constructors and type classes
\item Free Theorems for pure type systems (and hence in particular for dependent type systems)
\item Free Theorems for gradually typed systems
\item Free Theorems in interactive theorem provers (Isabelle: transfer)
\end{enumerate}
\end{frame}

\begin{frame}

\begin{quote}[Wadler]
\Large How useful are the [free] theorems so generated? Only time and experience will tell\dots
\end{quote}

\pause
\vspace{\baselineskip}
\begin{quote}[Me]
It kicked off much fruitful research and the results can indeed be very useful in formal verification.
\end{quote}
\end{frame}

%------------------------------------------------
\begin{frame}[standout]
\Large{\alert{Any questions?}}

\includegraphics[scale=0.49]{wadlers.jpg}
\end{frame}
%----------------------------------------------------------------------------------------
%\begin{frame}[allowframebreaks]{References}
  %\bibliography{../paper/sources.bib}
  %\bibliographystyle{abbrv}
%\end{frame}

% \begin{frame}[allowframebreaks]{Image Sources}
% \begin{itemize}
% \end{itemize}
% \end{frame}

\begin{frame}{Natural Numbers}
Assume we have a base type $\mathbb{N}$ with $\suc : \mathbb{N}\to\mathbb{N}$.

\pause
Assume we are given some value $t : \forall \alpha.\, (\alpha\to\alpha)\to\alpha\to\alpha$, a type $\tau$, and values $s : \tau\to\tau$ and $z : \tau$.
What is the result of $t\,[\tau]\,s\,z$?

\pause
Set $R\coloneqq \bigl\{(n,\nf{(s^n\, z)})\mid n\in\mathbb{N}\bigr\}$ and note that $(\suc, s)\in\vint{\alpha\to\alpha}_{[\alpha\mapsto(\mathbb{N},\tau,R)]}$:\\
\pause If $(v_1,v_2)\in\vint{\alpha}_{[\alpha\mapsto(\mathbb{N},\tau,R)]}$
then $(v_1,v_2)=\bigl(n,\nf{(s^n\, z)}\bigr)$ for some $n$.
Thus $(\suc\,v_1,s\,v_2)\eqnf\bigl(n+1,\nf{(s^{n+1}\, z)}\bigr)\in R$.

\pause
Hence, $\bigl(t\,[\mathbb{N}]\,\suc\, 0,t\,[\tau]\,s\,z\bigr)\in\tint{\alpha}_{[\alpha\mapsto(\mathbb{N},\tau,R)]}$ by the Parametricity Theorem.
\pause So there is $v' : \mathbb{N}$ and $v : \tau$ such that
$t\,[\mathbb{N}]\,\suc\, 0\to^*v'$ and $t\,[\tau]\,s\,z\to^*v$ and $(v',v)\in R$.
\pause Hence $v \eqnf s^n\, z$ where $n$ is determined by $t\,[\mathbb{N}]\,\suc\, 0\to^*v'\eqnf n$.
\end{frame}

\begin{frame}{Negative Results II}
We cannot define a polymorphic equality function $\eq : \forall \alpha.\, \alpha\to\alpha\to\bool$:

We would get $\eq\,[\tau]\,v_1\,v_2 \eqnf \eq\,[\tau']\,(f\,v_1)\,(f\,v_2)$ for any $f : \tau\to\tau',v_1 : \tau,v_2 : \tau$.
\end{frame}

\end{document}


\section{\src{dyn_vert_adv_limiter}}
\label{dyn_vert_adv_limiter}

\subsection{Description}

Kernel \src{dyn_vert_adv_limiter} is taken from the original
subroutine \src{vertical_limiter_thuburn} in \NICAM.
%
This subroutine is originally defined in \src{mod_src_tracer}, that is
to contain several subroutines for tracer advection.
%
Subroutine \src{vertical_limiter_thuburn} is to ensure distribution of
tracer quantities' monotonicity in advection scheme, using the flux
limitter proposed by \cite{Thuburn:1996in}.
%
This subroutine is for vertical advection only and horizontal advection
is treated by other subroutine \src{horizontal_limiter_thuburn}, which
is also kernelized in this pacakage (See \autoref{dyn_horiz_adv_limiter}).
%
See section 4. in \cite{Tomita2010ecmwf} for details of the tracer scheme in \NICAM.

\subsection{Discretization and code}

Argument lists and local variables definition part of this subroutine is
as follows.

\begin{LstF90}[name=vertical_limiter_thuburn]
subroutine vertical_limiter_thuburn( &
     q_h, q_h_pl, &
     q,   q_pl,   &
     d,   d_pl,   &
     ck,  ck_pl   )
!ESC!    use mod_const, only: &
!ESC!       CONST_HUGE, &
!ESC!       CONST_EPS
!ESC!    use mod_adm, only: &
!ESC!       ADM_have_pl, &
!ESC!       ADM_gall,    &
!ESC!       ADM_gall_pl, &
!ESC!       ADM_lall,    &
!ESC!       ADM_lall_pl, &
!ESC!       ADM_kall,    &
!ESC!       ADM_kmin,    &
!ESC!       ADM_kmax
  implicit none

  real(RP), intent(inout) :: q_h   (ADM_gall   ,ADM_kall,ADM_lall   )
  real(RP), intent(inout) :: q_h_pl(ADM_gall_pl,ADM_kall,ADM_lall_pl)
  real(RP), intent(in)    :: q     (ADM_gall   ,ADM_kall,ADM_lall   )
  real(RP), intent(in)    :: q_pl  (ADM_gall_pl,ADM_kall,ADM_lall_pl)
  real(RP), intent(in)    :: d     (ADM_gall   ,ADM_kall,ADM_lall   )
  real(RP), intent(in)    :: d_pl  (ADM_gall_pl,ADM_kall,ADM_lall_pl)
  real(RP), intent(in)    :: ck    (ADM_gall   ,ADM_kall,ADM_lall   ,2)
  real(RP), intent(in)    :: ck_pl (ADM_gall_pl,ADM_kall,ADM_lall_pl,2)

  real(RP) :: Qout_min_k
  real(RP) :: Qout_max_k
  real(RP) :: Qout_min_km1(ADM_gall)
  real(RP) :: Qout_max_km1(ADM_gall)
  real(RP) :: Qout_min_pl(ADM_gall_pl,ADM_kall)
  real(RP) :: Qout_max_pl(ADM_gall_pl,ADM_kall)

  real(RP) :: Qin_minL, Qin_maxL
  real(RP) :: Qin_minU, Qin_maxU
  real(RP) :: qnext_min, qnext_max
  real(RP) :: Cin, Cout
  real(RP) :: CQin_min, CQin_max
  real(RP) :: inflagL, inflagU
  real(RP) :: zerosw

  integer  :: gall, kmin, kmax
  real(RP) :: EPS, BIG

  integer  :: g, k, l
  !---------------------------------------------------------------------------
\end{LstF90}
%
Here \src{q_h} is $q$ at half level of the vertical layer, which modified by the flux limiter.
%
\src{q} is $q$ at grid point,
\src{ck} is Courant number,
\src{d} is a correction factor derived from an artificial viscosity for the total density.
%
Note that \src{ck} has the 4th dimension whose size is 2, which specify
lower/upper face, i.e. half integer level.

The first section of the subroutine is as follows.

\begin{LstF90}[name=vertical_limiter_thuburn]
  call DEBUG_rapstart('____vertical_adv_limiter')

  gall = ADM_gall
  kmin = ADM_kmin
  kmax = ADM_kmax

  EPS  = CONST_EPS
  BIG  = CONST_HUGE

  do l = 1, ADM_lall
     !$omp parallel default(none), &
     !$omp private(g,k,zerosw,inflagL,inflagU,Qin_minL,Qin_minU,Qin_maxL,Qin_maxU, &
     !$omp         qnext_min,qnext_max,Cin,Cout,CQin_min,CQin_max,Qout_min_k,Qout_max_k),  &
     !$omp shared(l,gall,kmin,kmax,q_h,ck,q,d,Qout_min_km1,Qout_max_km1,EPS,BIG)

!OCL XFILL
       !$omp do
       do g = 1, gall
          k = kmin ! peeling

          inflagL = 0.5_RP - sign(0.5_RP,ck(g,k  ,l,1)) ! incoming flux: flag=1
          inflagU = 0.5_RP + sign(0.5_RP,ck(g,k+1,l,1)) ! incoming flux: flag=1

          Qin_minL = min( q(g,k,l), q(g,k-1,l) ) + ( 1.0_RP-inflagL ) * BIG
          Qin_minU = min( q(g,k,l), q(g,k+1,l) ) + ( 1.0_RP-inflagU ) * BIG
          Qin_maxL = max( q(g,k,l), q(g,k-1,l) ) - ( 1.0_RP-inflagL ) * BIG
          Qin_maxU = max( q(g,k,l), q(g,k+1,l) ) - ( 1.0_RP-inflagU ) * BIG

          qnext_min = min( Qin_minL, Qin_minU, q(g,k,l) )
          qnext_max = max( Qin_maxL, Qin_maxU, q(g,k,l) )

          Cin      = (        inflagL ) * ck(g,k,l,1) &
                   + (        inflagU ) * ck(g,k,l,2)
          Cout     = ( 1.0_RP-inflagL ) * ck(g,k,l,1) &
                   + ( 1.0_RP-inflagU ) * ck(g,k,l,2)

          CQin_min = (        inflagL ) * ck(g,k,l,1) * Qin_minL &
                   + (        inflagU ) * ck(g,k,l,2) * Qin_minU
          CQin_max = (        inflagL ) * ck(g,k,l,1) * Qin_maxL &
                   + (        inflagU ) * ck(g,k,l,2) * Qin_maxU

          zerosw = 0.5_RP - sign(0.5_RP,abs(Cout)-EPS) ! if Cout = 0, sw = 1

          Qout_min_k = ( ( q(g,k,l) - qnext_max ) + qnext_max*(Cin+Cout-d(g,k,l)) - CQin_max ) &
                     / ( Cout + zerosw ) * ( 1.0_RP - zerosw )                                 &
                     + q(g,k,l) * zerosw
          Qout_max_k = ( ( q(g,k,l) - qnext_min ) + qnext_min*(Cin+Cout-d(g,k,l)) - CQin_min ) &
                     / ( Cout + zerosw ) * ( 1.0_RP - zerosw )                                 &
                     + q(g,k,l) * zerosw

          Qout_min_km1(g) = Qout_min_k
          Qout_max_km1(g) = Qout_max_k
       enddo
       !$omp end do

       do k = kmin+1, kmax
!OCL XFILL
          !$omp do
          do g = 1, gall
             inflagL = 0.5_RP - sign(0.5_RP,ck(g,k  ,l,1)) ! incoming flux: flag=1
             inflagU = 0.5_RP + sign(0.5_RP,ck(g,k+1,l,1)) ! incoming flux: flag=1

             Qin_minL = min( q(g,k,l), q(g,k-1,l) ) + ( 1.0_RP-inflagL ) * BIG
             Qin_minU = min( q(g,k,l), q(g,k+1,l) ) + ( 1.0_RP-inflagU ) * BIG
             Qin_maxL = max( q(g,k,l), q(g,k-1,l) ) - ( 1.0_RP-inflagL ) * BIG
             Qin_maxU = max( q(g,k,l), q(g,k+1,l) ) - ( 1.0_RP-inflagU ) * BIG

             qnext_min = min( Qin_minL, Qin_minU, q(g,k,l) )
             qnext_max = max( Qin_maxL, Qin_maxU, q(g,k,l) )

             Cin      = (        inflagL ) * ck(g,k,l,1) &
                      + (        inflagU ) * ck(g,k,l,2)
             Cout     = ( 1.0_RP-inflagL ) * ck(g,k,l,1) &
                      + ( 1.0_RP-inflagU ) * ck(g,k,l,2)

             CQin_min = (        inflagL ) * ck(g,k,l,1) * Qin_minL &
                      + (        inflagU ) * ck(g,k,l,2) * Qin_minU
             CQin_max = (        inflagL ) * ck(g,k,l,1) * Qin_maxL &
                      + (        inflagU ) * ck(g,k,l,2) * Qin_maxU

             zerosw = 0.5_RP - sign(0.5_RP,abs(Cout)-EPS) ! if Cout = 0, sw = 1

             Qout_min_k = ( ( q(g,k,l) - qnext_max ) + qnext_max*(Cin+Cout-d(g,k,l)) - CQin_max ) &
                        / ( Cout + zerosw ) * ( 1.0_RP - zerosw )                                 &
                        + q(g,k,l) * zerosw
             Qout_max_k = ( ( q(g,k,l) - qnext_min ) + qnext_min*(Cin+Cout-d(g,k,l)) - CQin_min ) &
                        / ( Cout + zerosw ) * ( 1.0_RP - zerosw )                                 &
                        + q(g,k,l) * zerosw

             q_h(g,k,l) = (        inflagL ) * max( min( q_h(g,k,l), Qout_max_km1(g) ), Qout_min_km1(g) ) &
                        + ( 1.0_RP-inflagL ) * max( min( q_h(g,k,l), Qout_max_k      ), Qout_min_k      )

             Qout_min_km1(g) = Qout_min_k
             Qout_max_km1(g) = Qout_max_k
          enddo
          !$omp end do
       enddo

     !$omp end parallel
  enddo

\end{LstF90}
%
In the long $l$-loop, there seems to be two blocks, but they are almost
the same, except that the first one is only for \src{kmin}, that is the
lowest level, and the second one is the rest of \src{k} to the top level.
%
\src{inflagL} and \src{inflagU} are flag that takes the value $1$ if there is an
incoming flux to the current layer through the lower/upper face.
%
\src{Qin_*} are the smaller/larger values of $q$ at lower/upper
neighboring layer, that is meaningful only if inflag at lower/upper is $1$.
%
\src{Cin} and \src{Cout} are the sum of Courant number at both face of
the layer, for example, \src{Cin} is the sum of \src{ck} at lower face
and upper face, if both of \src{inflagL} and \src{inflagU} is $1$, which
means that there are inflow through both lower/upper face.
%
\src{CQin_*} are the min/max of \src{Cin} times \src{Qin_*}, which
specify the minimun/maximum of inflow.
%
Then \src{CQout_*} are calculated.
%
Finaly \src{q_h} is calculated, which is bounded by \src{Qout_*}.

The second section of this subroutine is as follows.

\begin{LstF90}[name=vertical_limiter_thuburn]
  if ( ADM_have_pl ) then
     do l = 1, ADM_lall_pl

        do k = ADM_kmin, ADM_kmax
          do g = 1, ADM_gall_pl
             inflagL = 0.5_RP - sign(0.5_RP,ck_pl(g,k  ,l,1)) ! incoming flux: flag=1
             inflagU = 0.5_RP + sign(0.5_RP,ck_pl(g,k+1,l,1)) ! incoming flux: flag=1

             Qin_minL = min( q_pl(g,k,l), q_pl(g,k-1,l) ) + ( 1.0_RP-inflagL ) * BIG
             Qin_minU = min( q_pl(g,k,l), q_pl(g,k+1,l) ) + ( 1.0_RP-inflagU ) * BIG
             Qin_maxL = max( q_pl(g,k,l), q_pl(g,k-1,l) ) - ( 1.0_RP-inflagL ) * BIG
             Qin_maxU = max( q_pl(g,k,l), q_pl(g,k+1,l) ) - ( 1.0_RP-inflagU ) * BIG

             qnext_min = min( Qin_minL, Qin_minU, q_pl(g,k,l) )
             qnext_max = max( Qin_maxL, Qin_maxU, q_pl(g,k,l) )

             Cin      = (        inflagL ) * ( ck_pl(g,k,l,1) ) &
                      + (        inflagU ) * ( ck_pl(g,k,l,2) )
             Cout     = ( 1.0_RP-inflagL ) * ( ck_pl(g,k,l,1) ) &
                      + ( 1.0_RP-inflagU ) * ( ck_pl(g,k,l,2) )

             CQin_max = (        inflagL ) * ( ck_pl(g,k,l,1) * Qin_maxL ) &
                      + (        inflagU ) * ( ck_pl(g,k,l,2) * Qin_maxU )
             CQin_min = (        inflagL ) * ( ck_pl(g,k,l,1) * Qin_minL ) &
                      + (        inflagU ) * ( ck_pl(g,k,l,2) * Qin_minU )

             zerosw = 0.5_RP - sign(0.5_RP,abs(Cout)-EPS) ! if Cout = 0, sw = 1

             Qout_min_pl(g,k) = ( ( q_pl(g,k,l) - qnext_max ) + qnext_max*(Cin+Cout-d_pl(g,k,l)) - CQin_max ) &
                              / ( Cout + zerosw ) * ( 1.0_RP - zerosw )                                       &
                              + q_pl(g,k,l) * zerosw
             Qout_max_pl(g,k) = ( ( q_pl(g,k,l) - qnext_min ) + qnext_min*(Cin+Cout-d_pl(g,k,l)) - CQin_min ) &
                              / ( Cout + zerosw ) * ( 1.0_RP - zerosw )                                       &
                              + q_pl(g,k,l) * zerosw
          enddo
          enddo

        do k = ADM_kmin+1, ADM_kmax
        do g = 1, ADM_gall_pl
           inflagL = 0.5_RP - sign(0.5_RP,ck_pl(g,k,l,1)) ! incoming flux: flag=1

           q_h_pl(g,k,l) = (        inflagL ) * max( min( q_h_pl(g,k,l), Qout_max_pl(g,k-1) ), Qout_min_pl(g,k-1) ) &
                         + ( 1.0_RP-inflagL ) * max( min( q_h_pl(g,k,l), Qout_max_pl(g,k  ) ), Qout_min_pl(g,k  ) )
        enddo
        enddo

     enddo
  endif

  call DEBUG_rapend  ('____vertical_adv_limiter')

  return
end subroutine vertical_limiter_thuburn
\end{LstF90}
%
This section is for the pole region, and doing almost the same procedure
with the regular region.

\subsection{Input data and result}

Max/min/sum of input/output data of the kernel subroutine are output as
a log.
%
Below is an example of \src{$IAB_SYS=Ubuntu-gnu-ompi} case.

\begin{LstLog}
 ### Input ###
 +check[q_h_prev        ] max=  7.2663804548391786E+00,min=  0.0000000000000000E+00,sum=  2.4959084727640115E+06
 +check[q_h_prev_pl     ] max=  6.4080655438269076E+00,min=  0.0000000000000000E+00,sum=  1.8117616747458535E+03
 +check[check_q_h       ] max=  7.3763287914601054E+00,min=  0.0000000000000000E+00,sum=  2.4996023860691669E+06
 +check[check_q_h_pl    ] max=  7.0217121722230473E+00,min=  0.0000000000000000E+00,sum=  1.8122948877569047E+03
 +check[q               ] max=  7.3763287914601054E+00,min=  0.0000000000000000E+00,sum=  2.4959084727641600E+06
 +check[q_pl            ] max=  7.0217121722230473E+00,min=  0.0000000000000000E+00,sum=  1.8117616747458526E+03
 +check[d               ] max= -0.0000000000000000E+00,min= -0.0000000000000000E+00,sum=  0.0000000000000000E+00
 +check[d_pl            ] max=  0.0000000000000000E+00,min=  0.0000000000000000E+00,sum=  0.0000000000000000E+00
 +check[ck              ] max=  3.1666977358687308E-02,min= -3.3842023700197510E-02,sum= -3.3888707532669278E+00
 +check[ck_pl           ] max=  2.8817336749971920E-02,min= -3.0878557008837175E-02,sum= -2.9483051886829596E-02
 ### Output ###
 +check[q_h             ] max=  7.3763287914601054E+00,min=  0.0000000000000000E+00,sum=  2.4996023860691669E+06
 +check[q_h_pl          ] max=  7.0217121722230473E+00,min=  0.0000000000000000E+00,sum=  1.8122948877569047E+03
 ### Validation : point-by-point diff ###
 +check[check_q_h       ] max=  0.0000000000000000E+00,min=  0.0000000000000000E+00,sum=  0.0000000000000000E+00
 +check[check_q_h_pl    ] max=  0.0000000000000000E+00,min=  0.0000000000000000E+00,sum=  0.0000000000000000E+00
 *** Finish kernel
\end{LstLog}

Check the lines below \src{``Validation : point-by-point diff''} line,
that shows difference between calculated output array and
pre-calculated reference array.
These should be zero or enough small to be acceptable.

There are sample output log files in \file{reference/}
in each kernel program directory, for reference purpose.

\subsection{Sample of perfomance result}

Here's an example of the performance result part of the log output.
Below is an example executed with the machine environment described in \autoref{s:measuring_env}.
%
Note that in this program kernel part is iterated one time.

\begin{LstLog}
 *** Computational Time Report
 *** ID=001 : MAIN_dyn_vert_adv_limiter        T=     0.032 N=      1
 *** ID=002 : ____vertical_adv_limiter         T=     0.032 N=      1
\end{LstLog}


\documentclass{article} % For LaTeX2e
\usepackage{format/nips13submit_e}
\nipsfinalcopy % Uncomment for camera-ready version
\usepackage{times}
\usepackage{hyperref}
\usepackage{url}
\usepackage{color}
\definecolor{mydarkblue}{rgb}{0,0.08,0.45}
\hypersetup{
    pdfpagemode=UseNone,
    colorlinks=true,
    linkcolor=mydarkblue,
    citecolor=mydarkblue,
    filecolor=mydarkblue,
    urlcolor=mydarkblue,
    pdfview=FitH}

\usepackage{graphicx, amsmath, amsfonts, bm, lipsum, capt-of}

\usepackage{natbib, xcolor, wrapfig, booktabs, multirow, caption}

\usepackage{float}

\def\ie{i.e.\ }
\def\eg{e.g.\ }

\title{An automatic report for the dataset : 01-airline}

\author{
James Robert Lloyd\\
University of Cambridge\\
Department of Engineering\\
\texttt{jrl44@cam.ac.uk}
\And
David Duvenaud\\
University of Cambridge \\
Department of Engineering \\
\texttt{dkd23@cam.ac.uk}
\And
Roger Grosse\\
M.I.T.\\
Brain and Cognitive Sciences \\
\texttt{rgrosse@mit.edu}
\And
Joshua B. Tenenbaum\\
M.I.T.\\
Brain and Cognitive Sciences \\
\texttt{jbt@mit.edu}
\And
Zoubin Ghahramani\\
University of Cambridge \\
Department of Engineering \\
\texttt{zoubin@eng.cam.ac.uk}
}

\newcommand{\fix}{\marginpar{FIX}}
\newcommand{\new}{\marginpar{NEW}}

\setlength{\marginparwidth}{0.9in}
\input{include/commenting.tex}

%% For submission, make all render blank.
%\renewcommand{\LATER}[1]{}
%\renewcommand{\fLATER}[1]{}
%\renewcommand{\TBD}[1]{}
%\renewcommand{\fTBD}[1]{}
%\renewcommand{\PROBLEM}[1]{}
%\renewcommand{\fPROBLEM}[1]{}
%\renewcommand{\NA}[1]{#1}  % Note, NA's pass through!

\begin{document}

\allowdisplaybreaks

\maketitle

\begin{abstract}
This report was produced automatically by the Gaussian process structure search algorithm.
See \url{http://arxiv.org/abs/1302.4922} for a preliminary paper and see \url{https://github.com/jamesrobertlloyd/gpss-research} for the latest source code.
\end{abstract}

\section{Executive summary}

The raw data and full model posterior with extrapolations are shown in figure~\ref{fig:rawandfit}.

\begin{figure}[H]
\newcommand{\wmgd}{0.5\columnwidth}
\newcommand{\hmgd}{3.0cm}
\newcommand{\mdrd}{figures/01-airline}
\newcommand{\mbm}{\hspace{-0.3cm}}
\begin{tabular}{cc}
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_raw_data} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_all}
\end{tabular}
\caption{Raw data (left) and model posterior with extrapolation (right)}
\label{fig:rawandfit}
\end{figure}

The structure search algorithm has identified four additive components in the data.
The  first 2 additive components explain 99.3\% of the variation in the data as shown by the coefficient of determination ($R^2$) values in table~\ref{table:stats}.
After the first 3 components the cross validated mean absolute error (MAE) does not decrease by more than 0.1\%.
This suggests that subsequent terms are modelling very short term trends, uncorrelated noise or are artefacts of the model or search procedure.
Short summaries of the additive components are as follows:
\begin{itemize}

  \item \input{figures/01-airline/01-airline_1_short_description.tex}

  \item \input{figures/01-airline/01-airline_2_short_description.tex}

  \item \input{figures/01-airline/01-airline_3_short_description.tex}

  \item \input{figures/01-airline/01-airline_4_short_description.tex}

\end{itemize}

\begin{table}[htb]
\begin{center}
{\small
\begin{tabular}{|r|rrrrr|}
\hline
\bf{\#} & {$R^2$ (\%)} & {$\Delta R^2$ (\%)} & {Residual $R^2$ (\%)} & {Cross validated MAE} & Reduction in MAE (\%)\\
\hline
- & - & - & - & 280.30 & -\\

1 & 86.2 & 86.2 & 86.2 & 32.42 & 88.4\\

2 & 99.3 & 13.1 & 95.1 & 9.57 & 70.5\\

3 & 99.8 & 0.5 & 68.1 & 7.54 & 21.2\\

4 & 100.0 & 0.2 & 100.0 & 7.54 & 0.0\\

\hline
\end{tabular}
\caption{
Summary statistics for cumulative additive fits to the data.
The residual coefficient of determination ($R^2$) values are computed using the residuals from the previous fit as the target values; this measures how much of the residual variance is explained by each new component.
The mean absolute error (MAE) is calculated using 10 fold cross validation with a contiguous block design; this measures the ability of the model to interpolate and extrapolate over moderate distances.
The model is fit using the full data so the MAE values cannot be used reliably as an estimate of out-of-sample predictive performance.
}
\label{table:stats}
}
\end{center}
\end{table}

\section{Detailed discussion of additive components}

\subsection{Component 1 : A very smooth monotonically increasing function}

\input{figures/01-airline/01-airline_1_description.tex}

This component explains 86.2\% of the total variance.
The addition of this component reduces the cross validated MAE by 88.4\% from 280.3 to 32.4.

\begin{figure}[H]
\newcommand{\wmgd}{0.5\columnwidth}
\newcommand{\hmgd}{3.0cm}
\newcommand{\mdrd}{figures/01-airline}
\newcommand{\mbm}{\hspace{-0.3cm}}
\begin{tabular}{cc}
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_1} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_1_cum}
\end{tabular}
\caption{Posterior of component 1 (left) and the posterior of the cumulative sum of components with data (right)}
\label{fig:comp1}
\end{figure}

\subsection{Component 2 : An approximately periodic function with a period of 1.0 years and with approximately linearly increasing amplitude}

\input{figures/01-airline/01-airline_2_description.tex}

This component explains 95.1\% of the residual variance; this increases the total variance explained from 86.2\% to 99.3\%.
The addition of this component reduces the cross validated MAE by 70.47\% from 32.42 to 9.57.

\begin{figure}[H]
\newcommand{\wmgd}{0.5\columnwidth}
\newcommand{\hmgd}{3.0cm}
\newcommand{\mdrd}{figures/01-airline}
\newcommand{\mbm}{\hspace{-0.3cm}}
\begin{tabular}{cc}
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_2} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_2_cum}
\end{tabular}
\caption{Posterior of component 2 (left) and the posterior of the cumulative sum of components with data (right)}
\label{fig:comp2}
\end{figure}

\subsection{Component 3 : A smooth function}

\input{figures/01-airline/01-airline_3_description.tex}

This component explains 68.1\% of the residual variance; this increases the total variance explained from 99.3\% to 99.8\%.
The addition of this component reduces the cross validated MAE by 21.22\% from 9.57 to 7.54.

\begin{figure}[H]
\newcommand{\wmgd}{0.5\columnwidth}
\newcommand{\hmgd}{3.0cm}
\newcommand{\mdrd}{figures/01-airline}
\newcommand{\mbm}{\hspace{-0.3cm}}
\begin{tabular}{cc}
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_3} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_3_cum}
\end{tabular}
\caption{Posterior of component 3 (left) and the posterior of the cumulative sum of components with data (right)}
\label{fig:comp3}
\end{figure}

\subsection{Component 4 : Uncorrelated noise with linearly increasing standard deviation}

\input{figures/01-airline/01-airline_4_description.tex}

This component explains 100.0\% of the residual variance; this increases the total variance explained from 99.8\% to 100.0\%.
The addition of this component reduces the cross validated MAE by 0.00\% from 7.54 to 7.54.
This component explains residual variance but does not improve MAE which suggests that this component describes very short term patterns, uncorrelated noise or is an artefact of the model or search procedure.

\begin{figure}[H]
\newcommand{\wmgd}{0.5\columnwidth}
\newcommand{\hmgd}{3.0cm}
\newcommand{\mdrd}{figures/01-airline}
\newcommand{\mbm}{\hspace{-0.3cm}}
\begin{tabular}{cc}
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_4} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_4_cum}
\end{tabular}
\caption{Posterior of component 4 (left) and the posterior of the cumulative sum of components with data (right)}
\label{fig:comp4}
\end{figure}

\section{Extrapolation}

Summaries of the posterior distribution of the full model are shown in figure~\ref{fig:extrap}.
The plot on the left displays the mean of the posterior together with pointwise variance.
The plot on the right displays three random samples from the posterior.

\begin{figure}[H]
\newcommand{\wmgd}{0.5\columnwidth}
\newcommand{\hmgd}{3.0cm}
\newcommand{\mdrd}{figures/01-airline}
\newcommand{\mbm}{\hspace{-0.3cm}}
\begin{tabular}{cc}
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_all} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_all_sample}
\end{tabular}
\caption{Full model posterior. Mean and pointwise variance (left) and three random samples (right)}
\label{fig:extrap}
\end{figure}

\subsection{Component 1 : A very smooth monotonically increasing function}

Some discussion about extrapolation.

\begin{figure}[H]
\newcommand{\wmgd}{0.5\columnwidth}
\newcommand{\hmgd}{3.0cm}
\newcommand{\mdrd}{figures/01-airline}
\newcommand{\mbm}{\hspace{-0.3cm}}
\begin{tabular}{cc}
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_1_extrap} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_1_sample} \\
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_1_cum_extrap} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_1_cum_sample}
\end{tabular}
\caption{Posterior of component 1. Mean and pointwise variance (left) and three random samples from this distribution (right)}
\label{fig:extrap1}
\end{figure}

\subsection{Component 2 : An approximately periodic function with a period of 1.0 years and with approximately linearly increasing amplitude}

Some discussion about extrapolation.

\begin{figure}[H]
\newcommand{\wmgd}{0.5\columnwidth}
\newcommand{\hmgd}{3.0cm}
\newcommand{\mdrd}{figures/01-airline}
\newcommand{\mbm}{\hspace{-0.3cm}}
\begin{tabular}{cc}
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_2_extrap} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_2_sample} \\
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_2_cum_extrap} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_2_cum_sample}
\end{tabular}
\caption{Posterior of component 2. Mean and pointwise variance (left) and three random samples from this distribution (right)}
\label{fig:extrap2}
\end{figure}

\subsection{Component 3 : A smooth function}

Some discussion about extrapolation.

\begin{figure}[H]
\newcommand{\wmgd}{0.5\columnwidth}
\newcommand{\hmgd}{3.0cm}
\newcommand{\mdrd}{figures/01-airline}
\newcommand{\mbm}{\hspace{-0.3cm}}
\begin{tabular}{cc}
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_3_extrap} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_3_sample} \\
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_3_cum_extrap} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_3_cum_sample}
\end{tabular}
\caption{Posterior of component 3. Mean and pointwise variance (left) and three random samples from this distribution (right)}
\label{fig:extrap3}
\end{figure}

\subsection{Component 4 : Uncorrelated noise with linearly increasing standard deviation}

Some discussion about extrapolation.

\begin{figure}[H]
\newcommand{\wmgd}{0.5\columnwidth}
\newcommand{\hmgd}{3.0cm}
\newcommand{\mdrd}{figures/01-airline}
\newcommand{\mbm}{\hspace{-0.3cm}}
\begin{tabular}{cc}
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_4_extrap} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_4_sample} \\
\mbm \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_4_cum_extrap} & \includegraphics[width=\wmgd,height=\hmgd]{\mdrd/01-airline_4_cum_sample}
\end{tabular}
\caption{Posterior of component 4. Mean and pointwise variance (left) and three random samples from this distribution (right)}
\label{fig:extrap4}
\end{figure}

\end{document}


\section{Constrainted non-linear optimisation}