\documentclass{amsart}[12pt]
\usepackage{amsmath, amsfonts, tikz, natbib, array}
\usetikzlibrary{patterns}
\oddsidemargin=0in \evensidemargin=0in
\textwidth=6.6in \textheight=8.7in

\title{Map projections between Euclidean and spherical quadrilaterals}
\author{B R S Recht}
\date{April 2020}

\begin{document}
\maketitle
\tableofcontents

\section{Introduction}
A small but persistent trend in creating world maps has been to map onto a
polyhedron, and then unfold the polyhedron into a flat polyhedral net.
Most maps in this category use regular polyhedra, often the cube or the
icosahedron (in Fuller's second Dymaxion map).\cite{gray94} Other polyhedra include the other regular solids and
some Archimedean solids; Fuller used the cuboctahedron for his first Dymaxion
map,\cite{gray95} and the truncated icosahedron was used by
Snyder.\cite{snyder92} Maps between a polygon and a hemisphere
can be considered as polyhedral maps if the dihedron is
allowed.\cite{snyder89}\cite{lambers} The inverse mapping can be used to
inscribe a grid on a sphere, as in the quadrilateralized spherical
cube\cite{chan75}\cite{oneill76} or discrete global grids.\cite{sahr98}

Another is
the field of computer graphics, where there is some interest in functions
between the square to the disk.\cite{fong15}\cite{fong18}
These functions can be composed with an appropriate map
projection from the disk to the hemisphere
to create a map projection between the square and the sphere.\cite{lambers}

Nearly all of the literature on map projections between Euclidean and spherical
polygons, either in general or particular, only deals with regular polygons.
However, geographical features do not follow any regular geometric rules.
Regular polygons are mathematically easier to study, but irregular polygons are
also tractable. In this text, map projections between general Euclidean and
spherical polygons will be described. Some of these are extensions of existing
map projections, while some are new compromise map projections.

\section{Preliminaries}
Let $(u,v)$ be a vector in $\mathbb R^2$, and $\zeta = u + i v$ be the
corresponding complex number in $\mathbb C$ or the Riemann sphere $\mathbb C
\cup \{\infty\}$. Which notation is used will depend on the mapping:
conformal maps are best expressed in terms of complex variables.

\subsection{Spherical geometry with 3-vectors}
Some of the map projections to be discussed are better expressed
in terms of a vector rather than latitude and longitude. This text will only
cover pertinent details: a fuller description can be found in e.g. \cite{gade}.

Let $\phi \in [-\frac{\pi}{2}, \frac{\pi}{2}]$ be latitude, and
$\lambda \in (-\pi, \pi]$ be longitude. Let $\mathbf v = (x, y, z)$ be a vector
in $\mathbb R^3$ and $\mathbf{\hat{v}} = (x, y, z)$ be a unit vector on the
sphere $S^2$ such that $\| \mathbf{\hat{v}} \| = \sqrt{x^2 + y^2 +z^2} = 1$.
To convert from latitude and longitude to a unit vector:
\begin{equation}
  \mathbf{\hat{v}} = \left(\sin (\phi), \sin (\lambda) \cos (\phi),
  -\cos (\lambda) \cos (\phi) \right)
\end{equation}
To convert from the unit vector $\mathbf{\hat{v}}$ to latitude and longitude:
\begin{equation}\begin{split}
  \phi &= \arcsin (x) = \arctan (x, \sqrt{y^2 + z^2}) \\
  \lambda &= \arctan (y, -z)
\end{split}\end{equation}

Often in this text we'll normalize a vector to make it a unit vector.
For brevity,
we'll notate this pre-normalized vector as $\mathbf{\widetilde{v}}$, such that
\begin{equation}
  \mathbf{\hat{v}} = \frac{\mathbf{\widetilde{v}}}{\|\mathbf{\widetilde{v}}\|}
\end{equation}

\subsubsection{Great circles}
The shortest distance (geodesic) between two points in Euclidean space is a
straight line. On the sphere, the shortest distance is an arc of the great
circle between those points. That distance is the central angle $\theta$
between the two points. There are a few vector forms for it, the most
numerically stable one being the one using $\arctan$.
\begin{equation}\begin{split}
\theta &= \arccos \left(\mathbf{\hat{v}}_1 \cdot \mathbf{\hat{v}}_2\right) \\
&= \arcsin \left(\|\mathbf{\hat{v}}_1 \times \mathbf{\hat{v}}_2\| \right) \\
&= \arctan \left( \frac{\|\mathbf{\hat{v}}_1 \times \mathbf{\hat{v}}_2\|}
  {\mathbf{\hat{v}}_1 \cdot \mathbf{\hat{v}}_2} \right)
\end{split}\end{equation}

The great circle is the intersection of the sphere
and a plane passing through the origin. A plane through the origin can be
specified as $\hat{\mathbf n} \cdot \mathbf v = 0$, where $\hat{\mathbf n}$ is
a unit vector normal to the plane; this vector $\hat{\mathbf n}$ can be used to
specify a great circle. Given two points $\mathbf{\hat{v}_1, \hat{v}_2}$ on the
sphere, the $\hat{\mathbf n}$ of the great circle between those two points is
(up to normalization) their cross product:
\begin{equation}
  \mathbf{\widetilde{n}} = \mathbf{\hat{v}}_1 \times \mathbf{\hat{v}}_2
\end{equation}
Two great circles intersect at two antipodal points on the sphere. The points
of intersection can be found as the cross product of the great circle normals:
\begin{equation}
  \mathbf{\widetilde{v}} = \pm \mathbf{\hat{n}}_1 \times \mathbf{\hat{n}}_2
\end{equation}

\subsubsection{Interpolation}
Interpolation in Euclidean space is standard linear interpolation. On the
sphere, interpolation is given by spherical linear interpolation, or slerp.
\begin{equation}
\mathrm{Lerp}(\mathbf{v_1}, \mathbf{v_2}; t) =
       (1-t) \mathbf{v_1} + t \mathbf{v_2}
\end{equation}
\begin{equation}
\mathrm{Slerp}(\mathbf{\hat{v}_1}, \mathbf{\hat{v}_2}; t) =
        \frac{\sin ((1-t)w)}{\sin (w)} \mathbf{\hat{v}_1} +
       \frac{\sin (tw)}{\sin (w)} \mathbf{\hat{v}_2}
\end{equation}
where $w = \arccos \mathbf{\hat{v}_1} \cdot \mathbf{\hat{v}_2}$. If $\mathbf{\hat{v}_1} = \mathbf{\hat{v}_2}$, then define $\mathrm{Slerp}(\mathbf{\hat{v}_1}, \mathbf{\hat{v}_2}; t) =
\mathbf{\hat{v}_1} = \mathbf{\hat{v}_2}$ for all $t$.

\subsubsection{Face normal}
For the purposes of this text, we define the normal to a (Euclidean) polygon as
so, where $n$ is the number of vertices in the polygon and
$i = 0 \dots n-1$ is an index for each vertex:
\begin{equation}
  \mathbf{\widetilde{n}} =
  \sum^{n-1}_i \mathbf{v}_i \times \mathbf{v}_{i+1}
\end{equation}
$i$ should be treated as if it's mod $n$, so that it loops around.
This definition allows for a somewhat sensible extension to skew polygons:
the normal points in a generally reasonable direction when applied to a skew
polygon. The normal will be outward-facing if the points are ordered
counterclockwise, and inward-facing if the points are ordered clockwise.

\subsection{Euclidean spaces and transformations, including $uv$ coordinates}
This text uses barycentric coordinates on Euclidean triangles.
Quadrilaterals are instead specified by \textit{$uv$ coordinates} where
$u$ and $v$ are $\in [-1, 1]$. The subset of the plane $[-1, 1]^2$ is termed
the standard square. Here we discuss transformations of those

\subsubsection{Affine transformation}
Affine transformations are combinations of reflection, scaling, rotation,
shearing, and translation. This can be expressed as $\mathbf v = \mathbf A [u,
v]^T + v_0$, where $\mathbf A$ is a matrix. However, it is often more
convenient to express affine transformations using an augmented matrix like so:
\begin{equation}
  \begin{bmatrix}  x \\  y \\  1 \end{bmatrix}
   = \mathbf M
    \begin{bmatrix}  u \\  v \\  1 \end{bmatrix},\,
    \mathbf M = \begin{bmatrix}
       A_{11} & A_{12} & v_{0x} \\
       A_{21} & A_{22} & v_{0y} \\
       0 & 0 & 1
       \end{bmatrix}
\end{equation}
The transformation is invertible if $\mathbf M$ (or $\mathbf A$) is
invertible. This transformation can also transform between spaces of different
dimension, although then $\mathbf M$ is not a square matrix.

Affine transformations are equal-area in the sense defined earlier if
$|\mathbf M| \ne 0$, so if using an equal-area projection it may be desirable
to limit oneself to affine transformations. If $|\mathbf M| = 1$, then it defines a conformal affine transformation, effectively a combination of translation and rotation.

\subsubsection{Homography}
Homography, or projective transformation, is commonly used in computer vision
and graphics to handle objects seen in perspective, and may be convenient in
some software environments. A homography may be given by:
\begin{equation}
  \begin{bmatrix} xt \\ yt \\ t \end{bmatrix}
  = \mathbf{M} \begin{bmatrix} u  \\ v \\ 1  \end{bmatrix}
\end{equation}
where $\mathbf{M}$ is called the matrix of the homography. The matrix is
defined up to multiplication by a positive constant: $\mathbf{M}$ and
$k\mathbf{M}$ where $k>0$ define the same homography. The inverse of this
transformation is also a projective transformation, with matrix of the
homography $\mathbf{M}^{-1}$. Given 4 points in the $uv$ plane and their target
in the $xy$ plane, $\mathbf{M}$ can be determined as the null-space of this
system:
\begin{equation}
  \begin{bmatrix}
  x_1 & x_1 u_1 & x_1 v_1 & -1 & -u_1 & -v_1 & 0 & 0 & 0 \\
  x_2 & x_2 u_2 & x_2 v_2 & -1 & -u_2 & -v_2 & 0 & 0 & 0 \\
  x_3 & x_3 u_3 & x_3 v_3 & -1 & -u_3 & -v_3 & 0 & 0 & 0 \\
  x_4 & x_4 u_4 & x_4 v_4 & -1 & -u_4 & -v_4 & 0 & 0 & 0 \\
  y_1 & y_1 u_1 & y_1 v_1 & 0 & 0 & 0 & -1 & -u_1 & -v_1 \\
  y_2 & y_2 u_2 & y_2 v_2 & 0 & 0 & 0 & -1 & -u_2 & -v_2 \\
  y_3 & y_3 u_3 & y_3 v_3 & 0 & 0 & 0 & -1 & -u_3 & -v_3 \\
  y_4 & y_4 u_4 & y_4 v_4 & 0 & 0 & 0 & -1 & -u_4 & -v_4
   \end{bmatrix}
   \begin{bmatrix}
  M_{11} \\ M_{12} \\ M_{13} \\
  M_{21} \\ M_{22} \\ M_{23} \\
  M_{31} \\ M_{32} \\ M_{33}
  \end{bmatrix} = \mathbf{0},
\end{equation}
where
\begin{equation}
  \mathbf{M} = \begin{bmatrix}
  M_{11} & M_{12} & M_{13} \\
  M_{21} & M_{22} & M_{23} \\
  M_{31} & M_{32} & M_{33} \end{bmatrix}.
\end{equation}
This transformation can also be adapted to a transform from 2-d $uv$ space to a
plane in 3-d $xyz$ space. The target points must be coplanar, and since the
matrix of the homography is now a 3 by 4 matrix, the inverse transformation is
given by the pseudoinverse instead. Homographies are undefined along the line
where $t=0$, but this rarely becomes an issue in the context of this text.

\subsubsection{Bilinear Interpolation}
\begin{figure}%[!htbp]
\begin{tikzpicture}
  \draw (0, 0) -- (4, 0) -- (4, 3) -- (1, 4) -- (0, 0);
  \draw[fill] (0, 0) circle [radius=0.05] node[anchor=east] {\tiny 1};
  \draw[fill] (4, 0) circle [radius=0.05] node[anchor=west] {\tiny 2};
  \draw[fill] (4, 3) circle [radius=0.05] node[anchor=west] {\tiny 3};
  \draw[fill] (1, 4) circle [radius=0.05] node[anchor=east] {\tiny 4};
  \draw[dotted] (2, 0) node[anchor=north] {\tiny 1,2}
    -- (2.5, 3.5) node[anchor=south] {\tiny 4,3};
  \draw[dotted] (0.5, 2) node[anchor=east] {\tiny 1,4}
    -- (4, 1.5) node[anchor=west] {\tiny 2,3};
  \draw[fill] (2.25, 1.75) circle [radius=0.05];
\end{tikzpicture}
\caption{Bilinear interpolation, showing intersection of lines.}
\label{fig:uv}
\end{figure}
Another transformation is usually called 'bilinear interpolation' in image processing applications. Let $\mathbf v_1, \mathbf v_2, \mathbf v_3, \mathbf v_4$ be points in 2-d or 3-d (or higher) space. Define:
\begin{equation}\begin{split}
\mathbf v_{1,2} & = \mathrm{Lerp}(\mathbf v_1,\mathbf v_2;\frac{u+1}{2}),\\
\mathbf v_{4,3} & = \mathrm{Lerp}(\mathbf v_4,\mathbf v_3;\frac{u+1}{2}),\\
\mathbf v_{1,4} & = \mathrm{Lerp}(\mathbf v_1,\mathbf v_4;\frac{v+1}{2}),\\
\mathbf v_{2,3} & = \mathrm{Lerp}(\mathbf v_2,\mathbf v_3;\frac{v+1}{2})
\end{split}\end{equation}
Then bilinear interpolation determines the point $\mathbf v$ as:
\begin{equation}\begin{split}
\mathbf v
& = \mathrm{Lerp}(\mathbf v_{1,2}, \mathbf v_{4,3}; \frac{v+1}{2}) \\
& = \mathrm{Lerp}(\mathbf v_{1,4}, \mathbf v_{2,3}; \frac{u+1}{2}) \\
& = \frac{(1-u)(1-v)}{4} \mathbf v_1 +
\frac{(1+u)(1-v)}{4} \mathbf v_2 +
\frac{(1+u)(1+v)}{4} \mathbf v_3 +
\frac{(1-u)(1+v)}{4} \mathbf v_4 \\
&= \mathbf{a} + u \mathbf{b} + v \mathbf{c} + u v \mathbf{d}
\end{split}\end{equation}
where
\begin{equation}\begin{split}
  \mathbf{a} &= \frac{\mathbf v_1 +\mathbf v_2 +\mathbf v_3 + \mathbf v_4}{4},
  \\
  \mathbf{b} &= \frac{-\mathbf v_1 +\mathbf v_2 +\mathbf v_3 - \mathbf v_4}{4},
  \\
  \mathbf{c} &= \frac{-\mathbf v_1 -\mathbf v_2 +\mathbf v_3 + \mathbf v_4}{4},
  \\
  \mathbf{d} &= \frac{\mathbf v_1 -\mathbf v_2 +\mathbf v_3 - \mathbf v_4}{4}
\end{split}\end{equation}
The $uv$ term in the transformation illustrates the choice of name: in 3d, if
the vertices $v_i$ are not coplanar, then the transformation maps the plane to
a hyperbolic paraboloid. Bilinear interpolation preserves evenly spaced points
along an edge of the quadrilateral defined by $v_i$, and avoids the undefined
space of the homography. However, the inverse function is somewhat more
complicated. The inverse of bilinear interpolation,
for $\mathbf{v}_i \in \mathbb{R}^2$, is given by:
\begin{equation}\begin{split}
 u &= \frac{-b_u + \sqrt{b_u^2 - 4 a_u c_u}}{2a_u}\\
 v &= \frac{-b_v + \sqrt{b_v^2 - 4 a_v c_v}}{2a_v}\\
 a_u &= \mathbf{b} \times \mathbf{d}, b_u = \mathbf{a} \times \mathbf{d} + \mathbf{b} \times \mathbf{c}, c_u = \mathbf{a} \times \mathbf{c},\\
 a_v &= \mathbf{c} \times \mathbf{d}, b_v = \mathbf{a} \times \mathbf{d} - \mathbf{b} \times \mathbf{c}, c_v = \mathbf{a} \times \mathbf{b},\\
\end{split}\end{equation}
where the 2d scalar cross product $\mathbf{a} \times \mathbf{b} = a_x b_y - b_x
a_y$ is used here. In more than two dimensions, pick two coordinates and use
those as $x$ and $y$.

If the shape is a planar parallelogram (or a special case of a parallelogram
like a rectangle), then $\mathbf v_1 + \mathbf v_3 = \mathbf v_2 + \mathbf v_4$,
and $\mathbf{d} = 0$. In this case, both the homography and the hyperbolic
paraboloid transformation reduce to an affine transformation. Qualitatively, homographies preserve all lines,
while bilinear interpolation preserves lines of constant $u$ or $v$.

Neither homographies nor bilinear interpolation are amenable to generalization
in the way that barycentric coordinates are. Bilinear interpolation can be
expressed like so:
\begin{equation}
  \mathbf v = \sum^4_{i=1} \alpha_i \mathbf v_i,
\end{equation}
but $\alpha_i$ are not necessarily unique for a given $\mathbf v$. Later we
will see some map projections that are similar in form to bilinear interpolation.

\subsection{Dealing with the ellipsoid}
The Earth is reasonably approximated as a sphere, and better approximated as a
slightly flattened oblate ellipsoid. In general this text will only deal with
the spherical approximation, but here we mention two considerations arising
from that approximation.

The vector form described in \cite{gade} corresponds to the geodetic latitude.
The mapping between the sphere and the ellipsoid using geodetic latitude is not
area-preserving, conformal, or distance-preserving, although the distortion is
small on the Earth ellipsoid. If applying an area-preserving, conformal, or
distance-preserving map projection, and the required precision is fine enough
that the distortion is a concern, the geodetic latitude can be substituted
with the authalic (equal-area), conformal, or rectifying
(equal-distance along meridians) latitude as described in \cite{snyder87}.
These can be calculated from the geodetic latitude,
and the difference is well-approximated by a Fourier series.

Considering polyhedral maps, in this text we require the edges of the polyhedra
to correspond to geodesics. Geodesics on a sphere are not necessarily geodesics
on an ellipse: as proof, geodesics on an ellipse are not necessarily closed,
while geodesics on a sphere are. (Of course, with the Earth ellipsoid, the
difference between the geodesics is small.) The equator and meridians are
geodesics on both surfaces, so if having exact geodesics is a concern,
place your polyhedron edges along the equator or meridians.

\section{Map projections}

\begin{figure}%[!htbp]
\begin{tikzpicture}
  \draw [gray] (9,1) circle [radius=1];
  \draw[pattern=north east lines, pattern color=gray] (8.5, 0.5) to [out=-25, in=205]
  (9.5, 0.5) to [out=90, in=-15]
  (9, 1.5) to [out=125, in=25]
  (8.5, 1.5) to [out=215, in=125]
  (8.5, 0.5);
  \draw[fill] (8.5,0.5) circle [radius=0.05];
  \draw[fill] (9.5,0.5) circle [radius=0.05];
  \draw[fill] (9,1.5) circle [radius=0.05];
  \draw[fill] (8.5,1.5) circle [radius=0.05];

  \draw [<->] (10.25,1) -- (10.75,1);
  \draw[pattern=north east lines, pattern color=gray] (11, 0.5) -- (12, 0.5) -- (12, 1.5) -- (11, 1.5) -- (11, 0.5);
  \draw[fill] (11,0.5) circle [radius=0.05];
  \draw[fill] (12,0.5) circle [radius=0.05];
  \draw[fill] (12,1.5) circle [radius=0.05];
  \draw[fill] (11,1.5) circle [radius=0.05];

  \draw [<->] (12.25,1) -- (12.75,1);
  \draw[pattern=north east lines, pattern color=gray] (13, 0.5) -- (14, 0.5) -- (13.5, 1.5) -- (13, 1.5) -- (13, 0.5);
  \draw[fill] (13,0.5) circle [radius=0.05];
  \draw[fill] (14,0.5) circle [radius=0.05];
  \draw[fill] (13.5,1.5) circle [radius=0.05];
  \draw[fill] (13,1.5) circle [radius=0.05];

\draw (10.5,1) node[anchor=south] {$P$};
\draw (12.5,1) node[anchor=south] {$H$};

\draw (9,0) node[anchor=north] {$R_s \subset S^2$};
\draw (11.5,0) node[anchor=north] {$[u,v]$};
\draw (13.5,0) node[anchor=north] {$R_e \subset \mathbb{R}^2$};

\end{tikzpicture}
\caption{Schematic for the application of most projections listed in this text.
Left: triangles, right: quadrilaterals. $P$ indicates the projection, $A$ is an affine transformation, and $H$ is a homography or bilinear interpolation.}
\label{fig:schematic}
\end{figure}

Figure \ref{fig:schematic} illustrates the general form of application of most
projections in this text. (Exceptions are noted in the relevant sections.) The
transformation from barycentric coordinates to the plane, or from $uv$
coordinates to a quadrilateral, takes the same form for each projection, so in
this section we can ignore that part except when there are special
considerations.

The polygon on the sphere $R_s$ and the polygon in the plane $R_e$ can be
basically anything, within the operating parameters of the projection and any
special considerations that may apply. Even with respect to each other, one
can be a regular polygon while the other is some irregular monster, if that is
desirable. Of course, this will influence the distortion of the map
projection.

The flip side of this freedom is that there is not
necessarily a unique way, given $R_s$, to choose $R_e$. If one is regular,
it may make sense to choose the other to also be regular. For irregular
triangles, one choice may be to choose $R_e$ such that its edges are
proportial in length to those of $R_s$. Another may be to choose $R_e$ to have
angles proportional to those of $R_s$: $\alpha' = \pi
\frac{\alpha}{\alpha+\beta+\gamma}$ etc. For quadrilaterals, it may be
desirable to carry over some quality from $R_s$ to $R_e$, but that may not
uniquely define $R_e$: for instance, a quadrilateral is not uniquely defined
(up to congruence) by its edge lengths alone, or its angles alone. In some
cases, extra conditions make the choice more obvious: for example, if the
spherical quadrilateral has equal sides and equal angles, it makes sense to
map it to a square. If the goal is to minimize overall distortion, one may
choose $R_e$ with that in mind. In the absence of guiding conditions,
aesthetics may be the best guide.

\subsection{Gnomonic}
The gnomonic projection was known to the ancient Greeks, and is the simplest
of the transformations listed here.\cite{snyder87} It has the property that
arcs of great circles are transformed into lines on the plane and vice versa:
that is, geodesics stay geodesics, and (spherical) polygons stay polygons. This
projection is called Method 1 in geodesic dome terminology.\cite{kenner} The
main downside of the gnomonic projection is heavy distortion away from the
center of the projection.

We'll describe this projection in vector form, which is a little unconvential
but will allow us to compare it to other projections later.
Let $\mathbf p$ be a point on a plane given in Hessian normal form by
$\hat{\mathbf n} \cdot \mathbf p = r$. $r$ can be any value except 0.
The gnomonic projection can be described as so:
\begin{equation}
  \widetilde{\mathbf v} = \mathbf p
\end{equation}
\begin{equation}
\mathbf p = \frac{r}
  {\hat{\mathbf n} \cdot \hat{\mathbf v}}\hat{\mathbf v}
\end{equation}
Projection from Euclidean space to the sphere is literally just
normalizing the vector.

\subsection{Snyder equal-area}
The Snyder equal-area projection can be applied to any regular polygon. The
equations in \cite{snyder92} are lengthy, and don't seem to simplify much when
expressed in terms of vectors. The special cases of the hemisphere and the cube
face do have nice simple forms, however.\cite{lambers}\cite{patt} Snyder's
equations won't be repeated here.

The Snyder projection starts by subdividing a regular polygonal face into
isosceles triangles, where two vertices of the new triangles are vertices of
the original polygon, and the third is the center of the polygon. Because of
this interruption, the projection is not differentiable on the lines from the
center to the original vertices. This projection can be applied to faces larger
than a hemisphere, as long as each subdivision triangle is smaller than a
hemisphere.

The Snyder projection does not require the faces of a polyhedron to be the
same, but does require (to maintain the equal-area property between
subdivsions) that the faces be subdividable into identical triangles. In
general, the Snyder equal-area projection cannot be adapted to irregular
polygons while maintaining the equal-area property and not introducing extra
lines of interruption. However, if a polyhedra is made up of identical
isosceles triangles, and those triangles meet at appropriate edges, the map can
be applied directly to those faces without subdivision. (Isosceles triangles of
different dimensions may be allowed if one is willing to abandon either the
equal-area property holding between different faces or the polygons on the
plane fitting together into a net.) An example of an irregular polyhedra that
can be used in this way is an $n$-bipyramid, formed by gluing two $n$-sided
pyramids together at the $n$-gonal base. (This is effectively the same as
applying the subdivision method to a $n$-dihedron.) Other polyhedra would
include the (regular) icosahedron and octahedron and the tetragonal disphenoid
(a stretched form of a tetrahedron with isosceles faces, of which the regular
tetrahedron is a subtype).

\subsection{Fuller}
this entire section needs to be reworked\cite{crider09}
\begin{figure}%[!htbp]
\begin{tikzpicture}
  \draw (2,2) circle [radius=2];

  \draw (0.6, 1) to [out=-25, in=205]
  (3.4, 1) to [out=90, in=-35]
  (2, 3.5) to [out=215, in=90]
  (0.6, 1);
  \draw[fill] (2, 3.5) circle [radius=0.05] node[anchor=west] {\tiny 1};
  \draw[fill] (0.6, 1) circle [radius=0.05] node[anchor=north] {\tiny 2};
  \draw[fill] (3.4, 1) circle [radius=0.05] node[anchor=north] {\tiny 3};
  \draw[dotted] (0.65, 1.5)  node[anchor=east] {\tiny 1,2}
  to [out=-15, in=195] (3.35, 1.5) node[anchor=west] {\tiny 1,3};

  \draw[dotted] (1.8, 0.65) node[anchor=north] {\tiny 3,2}
  to [out=45, in=265] (2.9, 2.7) node[anchor=west] {\tiny 3,1};
  \draw[dotted] (1.6, 3.1) node[anchor=east] {\tiny 2,1}
  to [out=-45, in=105] (2.9, 0.8) node[anchor=north] {\tiny 2,3};
\end{tikzpicture}
\caption{Intersection of great circle arcs inside a spherical triangle,
and the small spherical triangle formed by the arcs. Exaggerated so that the
small triangle is visible; not to scale.}
\label{fig:intlines}
\end{figure}

This method can be extended to the Quadrilateral. Use Slerp to find points on
opposing sides of the quadrilateral, use the cross product to find their
normal, and then use the cross product to find the point of intersection. Since
we draw two intersecting lines, there is only one point of intersection within
the quadrilateral. The formula is:
\begin{equation}\label{eq:gcq}%??? does this reduce to slerp on the edges?
\widetilde{\mathbf v} =
(\mathrm{Slerp}(\mathbf v_1, \mathbf v_2; \frac{u+1}{2})
\times
\mathrm{Slerp}(\mathbf v_4, \mathbf v_3; \frac{u+1}{2}))
\times
(\mathrm{Slerp}(\mathbf v_1, \mathbf v_4; \frac{v+1}{2})
\times
\mathrm{Slerp}(\mathbf v_2, \mathbf v_3; \frac{v+1}{2}))
\end{equation}

This is similar to the Great Circle method, except instead of using the great
circles to calculate the intersections of the lines, we use another spherical
linear interpolation to get a point near the intersection. We effectively use
the Lerp formulas from the section on coordinates, substituting Slerp for Lerp.
Unlike Lerp, Slerp does not commute, so we take the different permutations of
the arguments and combine the different points that result.

(square)
Solve for $u, v$:
\begin{equation}
  \begin{split}
\begin{vmatrix} \mathbf v &
\mathrm{Slerp}(\mathbf v_1, \mathbf v_2; \frac{u+1}{2}) &
\mathrm{Slerp}(\mathbf v_4, \mathbf v_3; \frac{u+1}{2}) \end{vmatrix} &= 0 \\
\begin{vmatrix} \mathbf v &
\mathrm{Slerp}(\mathbf v_1, \mathbf v_4; \frac{v+1}{2}) &
\mathrm{Slerp}(\mathbf v_2, \mathbf v_3; \frac{v+1}{2}) \end{vmatrix} &= 0
\end{split}\end{equation}

\subsection{Naive Slerp}
The Naive Slerp method is derived by a naive analogy with spherical linear
interpolation (Slerp) extended to $uv$ coordinates, thus the
name.

These are two functions that can be derived by analogy with $uv$ coordinates.
Let $w_{ij}$ be the spherical length of the edge between vertices $i$ and $j$.
One:
\begin{equation}\begin{split}\label{eq:nsq1}
   \widetilde{\mathbf v} & = \sum_{i=1}^4\frac{s_i}{\sin(w_u)\sin(w_v)}  \mathbf v_i \\
s_1 & = \sin \left(w_u\frac{1-u}{2}\right)\sin \left(w_v\frac{1-v}{2}\right) \\
s_2 & = \sin \left(w_u\frac{1+u}{2}\right)\sin \left(w_v\frac{1-v}{2}\right) \\
s_3 & = \sin \left(w_u\frac{1+u}{2}\right)\sin \left(w_v\frac{1+v}{2}\right) \\
s_4 & = \sin \left(w_u\frac{1-u}{2}\right)\sin \left(w_v\frac{1+v}{2}\right)
\end{split}\end{equation}
where
\begin{equation}\begin{split}
  w_u &= (1-v) w_{12} + (1+v) w_{34},\\
  w_v &= (1-u) w_{23} + (1+u) w_{14}
\end{split}\end{equation}
Unlike before, the interpolations of $w_u$ and $w_v$ do not have undefined
points. However, they may cause undefined values in the mapping if there is a
point where one is equal to zero.

Two:
\begin{equation}\begin{split}\label{eq:nsq2}
     \widetilde{\mathbf v} & = \sum_{i=1}^4\frac{\sin(w\gamma_i)}{\sin(w)} \mathbf v_i \\
\gamma_1 & = \frac{(1-u)(1-v)}{4} \\
\gamma_2 & = \frac{(1+u)(1-v)}{4} \\
\gamma_3 & = \frac{(1+u)(1+v)}{4} \\
\gamma_4 & = \frac{(1-u)(1+v)}{4}
\end{split}\end{equation}

where
\begin{equation}\begin{split}
  w = \frac{t_{12} w_{12} + t_{23} w_{23} + t_{34} w_{34} + t_{41} w_{41}}
              {t_{12} + t_{23} + t_{34} + t_{41}}\\
  t_{12} &= (1-u)(1-v)(1+u) \\
  t_{23} &= (1-v)(1+u)(1+v) \\
  t_{34} &= (1-u)(1+u)(1+v) \\
  t_{41} &= (1-u)(1-v)(1+v)
\end{split}\end{equation}
Again, this expression is undefined at the vertices, but can be replaced with
any positive value there. If all the edges are equal length, $w$ can be
replaced with that constant edge length.

\subsubsection{Projection of $\widetilde{\mathbf v}$}
The naive slerp methods produces unit vectors along the edges. Because the
projected edges already lie on the sphere, we have freedom in how to adjust
$\widetilde{\mathbf v}$ to lie on the sphere. The easiest is just to centrally
project the vertices, that is, to normalize $\widetilde{\mathbf v}$ like we
have been. Another option is to perform a parallel projection along the
face normal, as defined earlier. We need the parallel distance $p$ from the
vertex to the sphere surface in the direction of the face normal
$\hat{\mathbf n}$, such that $\hat{\mathbf v} =
\widetilde{\mathbf v} + p\hat{\mathbf n}$. $p$ is given by:
\begin{equation}
   p = -\widetilde{\mathbf v} \cdot \hat{\mathbf n} +
   \sqrt{1+\widetilde{\mathbf v} \cdot \hat{\mathbf n}-\widetilde{\mathbf v} \cdot \widetilde{\mathbf v}}
\end{equation}
$p$ can also be approximated as $\widetilde{p} = 1 - \|\widetilde{\mathbf v}\|
\leq p$, which takes fewer operations and doesn't require
calculation of the face normal. Technically, you can project in almost any
direction, not just that of the face normal, but most other choices don't
produce a symmetric result.

Really, the projection can be performed from any point in space. Central
projection uses rays from a point at the center of the sphere, and parallel can
be thought of as using rays from a point at infinity. Instead of specifying the
point, we define a linear combination of the two projections:
\begin{equation}
  \hat{\mathbf v} = \frac{\widetilde{\mathbf v} + kp\mathbf c}{\|\dots\|}
\end{equation}
When $k=0$, that's the central projection: when $k=1$, it's the parallel
projection. $p$ may be replaced by $\widetilde{p}$. If our goal is to optimize
a measurement of the map projection, like conformality or area distortion, we
can do a 1-variable optimization on $k$.

\subsubsection{Spherical rectangle}
Naive slerp 1 simplifies nicely for some particular spherical rectangles and
squares. Let the target rectangle be defined by the points $(-a,-b,c)$,
$(a,-b,c)$, $(a,b,c)$, and $(-a,b,c)$ where $a, b, c$ are in $[0,1]$ and
$a^2 + b^2 + c^2 = 1$. The spherical center of this rectangle, and the face
normal, is $(0,0,1)$. Naive slerp 1 from the standard square to this rectangle
is expressible as so:
\begin{equation}\begin{split}
  \widetilde{x} &= \frac{\sin(\frac{w_u}{2}u) \cos(\frac{w_v}{2}v) }
    {\sqrt{1-b^2}}\\
  \widetilde{y} &= \frac{\cos(\frac{w_u}{2}u) \sin(\frac{w_v}{2}v) }
    {\sqrt{1-a^2}}\\
  \widetilde{z} &=\frac{c}{\sqrt{1-a^2}\sqrt{1-b^2}}
    \cos(\frac{w_u}{2}u) \cos(\frac{w_v}{2}v)
\end{split}\end{equation}
where $cos(w_u) = 1 - 2 a^2$ and $cos(w_v) = 1 - 2 b^2$.

In the case where $a=b$, denote $w = w_u = w_v$,
so the above can be expressed as:
\begin{equation}\begin{split}
  \widetilde{x} &= \frac{\sin\left(\frac{w}{2}(u+v)\right) +
    \sin\left(\frac{w}{2}(u-v)\right)}
    {2\sqrt{1-a^2}}\\
  \widetilde{y} &= \frac{\sin\left(\frac{w}{2}(u+v)\right) -
    \sin\left(\frac{w}{2}(u-v)\right)}
    {2\sqrt{1-a^2}}\\
  \widetilde{z} &=\frac{c}{2-2a^2}\left(\cos\left(\frac{w}{2}(u+v)\right) +
    \cos\left(\frac{w}{2}(u-v)\right)\right)
\end{split}\end{equation}
which demonstrates that this mapping on this polygon preserves diagonal lines.

In the case when $c=0$,
and the spherical rectangle takes up an entire hemisphere, the formula further
reduces to:
\begin{equation}\begin{split}
  \widetilde{x} &= \frac{\sin(\frac{w_x}{2}u) \cos(\frac{w_y}{2}v) }
    {a}\\
  \widetilde{y} &= \frac{\cos(\frac{w_x}{2}u) \sin(\frac{w_y}{2}v) }
    {b}\\
  \widetilde{z} &=0
\end{split}\end{equation}

In the limit where $c=0$ and $b = 0$,
\begin{equation}\begin{split}
  \widetilde{x} &= \sin(\frac{\pi}{2}u) \\
  \widetilde{y} &= v \cos(\frac{\pi}{2}u) \\
  \widetilde{z} &= 0
\end{split}\end{equation}

\subsection{Elliptical}
This quadrilateral map is based on naive slerp 1 on a spherical rectangle, as
described in the previous section. Let the vertices of the rectangle be defined
as before.

$\sin(k x)$ may be approximated as $\sin(k)x$, where the two expressions are
equal at $x=-1,0,1$. Similarly, $\cos(k x)$ may be approximated as
$\sqrt{1 - \sin^2(k) x^2}$. This approximation was applied in \cite{reynolds} to
produce an approximate equal-area homeomorphism, as it maintains the boundary
of the shape where $x=\pm1$ or $y=\pm1$. Applying this approximation
to the equation for naive slerp on a spherical rectangle yields:

\begin{equation}\begin{split}\label{eq:elliptical}
  \widetilde{x} &= au \frac{\sqrt{1-b^2 v^2} }
    {\sqrt{1-b^2}}\\
  \widetilde{y} &= bv \frac{\sqrt{1-a^2 u^2} }
    {\sqrt{1-a^2}}\\
  \widetilde{z} &=c \frac{\sqrt{1-a^2 u^2}\sqrt{1-b^2 v^2} }
    {\sqrt{1-a^2}\sqrt{1-b^2}}
\end{split}\end{equation}

In the case when $c=0$, and the spherical rectangle takes up an entire
hemisphere, the formula reduces to:
\begin{equation}\begin{split}
  \widetilde{x} &= u \sqrt{1-b^2 v^2} \\
  \widetilde{y} &= v \sqrt{1-a^2 u^2} \\
  \widetilde{z} &= 0
\end{split}\end{equation}

When $a=b=\frac{1}{\sqrt{2}}$, this is the Nowell's elliptical function from
the square to the disk.\cite{nowellsq}\cite{fong17} Furthermore, when $c=b=0$,
\begin{equation}\begin{split}
  \widetilde{x} &= u  \\
  \widetilde{y} &= v \sqrt{1 - u^2} \\
  \widetilde{z} &= 0
\end{split}\end{equation}
which is the "squelch" function from the square to the disk in \cite{fong17}.

\subsection{Grid-based}

\subsubsection{Inversion}

\subsubsection{Repeated subdivision}
Method 3 in geodesic dome terms

\section{Analysis}
\subsection{From the sphere to the plane}

\subsection{From the plane to the sphere}

\section{Conclusion}

\bibliographystyle{plain}
\bibliography{references}

\end{document}


\chapter{Introduction}

%\parbf{What is reactive synthesis?}
{\small
\noindent
\li
\-[Dave:~] Hey, Elli, how can I calculate the week number from the date?
\vspace{-3mm}
\-[Elli:~] ...prints the C-function.
\vspace{-3mm}
\-[Dave:~] Great. Can this function also output three last requested dates?
\vspace{-3mm}
\-[Elli:~] ...prints another C-function.
\vspace{-3mm}
\-[Dave:~] Thanks. Can you also make it output the name of the requesting person?
\vspace{-3mm}
\-[Elli:~] I am sorry, Dave, I am afraid I can't do that.
\il
}

In synthesis,
we describe the required behaviour and ask the computer to find the solution
with such a behaviour.
(In the dialog above,
 Dave asks Elli to find a function that,
 given a date, outputs the week number to which the date belongs.)
In \emph{reactive} synthesis, we are interested not in simple ``do-and-forget'' functions,
but rather in functions that interact with the user
akin to functions with an internal state.
(In the dialog above, the second C-function is reactive.)
It is not always possible to find a solution,
in which case the synthesizer (Elli) outputs ``specification is unrealizable''.
(In the last dialogue request, the specification became unrealizable,
 because the person name is not available to the function to be synthesized.)
%To summarise, reactive synthesis is an automatic way
%to translate a human intention expressed in some language
%into a system of some kind.

%\parbf{What is reactive synthesis problem?}

In 1963, Alonzo Church introduced the reactive synthesis problem~\cite{Church63}:
given a formula in Monadic Second Order Logic of One Successor,
and the inputs and the outputs of a circuit,
find such a circuit such that all behaviors of the circuit satisfy the formula.
(The circuit behaviour is an infinite string of inputs combined with the outputs.)
Church's problem was solved by Rabin~\cite{Rabin69} and
by B\"uchi and Landweber~\cite{BL69} in 1969.\ak{how?}

%\parbf{Recent progress of reactive synthesis}

Recent research in reactive synthesis focused on specifications
given in Linear Temporal Logic (LTL),
introduced by Pnueli~\cite{pnueli1977temporal} in 1977.
LTL has temporal operators, like $\G$ (always) and $\F$ (eventually),
and allows one to state properties like ``every request is eventually granted'':
$\G(r \impl \F g)$.
A system satisfies a given LTL property if all its computations satisfy it.
Pnueli and Rosner proved~\cite{DBLP:conf/popl/PnueliR89}
that the LTL synthesis problem is 2EXPTIME-complete.
Their approach translates a given LTL formula into a nondeterministic B\"uchi automaton,
then determinises it into a deterministic parity automaton
with the aid of involved Safra construction~\cite{Safra},
turns the automaton into a game, and solves the game.
Recent research focused on how to overcome the high complexity and Safra construction:
the work~\cite{Bloem12} considered the synthesis for a subset of LTL called GR(1),
the work~\cite{BS,KupfermanV05} considered bounding the system size and gave a name to Bounded Synthesis,
by combining the previous bounding with efficient data structures---Anti-chains Synthesis~\cite{Filiot11}.
The SYNTCOMP competition~\cite{syntcomp} is another recent initiative
with the goal to advance efficient synthesisers and popularise reactive synthesis.

%\parbf{The issues with reactive synthesis}

Despite substantial progress,
reactive synthesis is not as widespread as model checking.
The major reason, I believe,
is that writing the specifications---especially \emph{complete} specifications---is hard.
The issue is less pronounced in model checking,
because we do not need all the properties,
only those to model check.

%\parbf{In light of this issue, two directions to proceed}

In light of this issue, there are two directions to proceed.
First, we can develop synthesis approaches for richer logics,
which can ease writing the specifications.
Second, we can find application contexts where high specification costs are acceptable.
This thesis targets both directions:
we develop new synthesis approaches for the logic called \CTLstar,
and we delve into synthesis of distributed algorithms.

\subsection*{Part I: Excursion into Branching Logic}

%\parbf{when was CTL introduced?}

Computation Tree Logic (CTL)~\cite{ctl-origin}
was introduced by Emerson and Clarke in 1981
to circumvent the high complexity (PSPACE-complete) of the LTL model checking problem
and to be able to specify structural properties.
In 1986 Emerson and Halpern introduced a generalization,
Computation Tree Star Logic (\CTLstar)~\cite{ctlstar-origin},
that subsumes both CTL and LTL.

%\parbf{what is \CTLstar?}

In contrast to LTL, which reasons about (linear) computation runs,
\CTLstar reasons about (branching) computation trees.
We can get such a tree by unfolding the system transition structure.
\CTLstar has---in addition to temporal operators---path quantifiers:
$\A$ (on all paths) and $\E$ (there exists a path).
Such path quantifiers allow us to reason about branching structure of trees,
not just about their ``linear'' paths.
For example, \CTLstar formula ``$\AGEF reset$'' says:
``on all tree paths, from every tree node,
  there should be a path into a node where `reset' holds''.
We cannot express such a property using LTL alone.

%\parbf{what advantages does CTL* have over LTL?}

Despite \CTLstar being more expressible than LTL,
the complexity of \CTLstar synthesis (2EXPTIME-complete)
stays the same.
This prompted us to look into approaches to \CTLstar synthesis.

%\parbf{what is the standard solution to CTL*?}

The standard solution~\cite{informatio} to \CTLstar synthesis
turns the \CTLstar formula into an alternating hesitant tree automaton,
removes nondeterminism and derives a universal co-B\"uchi tree automaton,
determinises it using Safra construction~\cite{Safra} into a parity tree automaton,
and, finally, checks its non-emptiness.
If it is empty, then the specification is unrealisable,
otherwise we can extract the system from the proof of the non-emptiness.
This approach is hard to implement correctly and efficiently,
due to the involved Safra construction%
\footnote{It was a common belief that the Safra construction
  is difficult to implement and results in impractical algorithms.
  However, the belief might be wrong,
  as SYNTCOMP~\cite{syntcomp} in 2017 showed:
  the LTL synthesiser {\tt ltl-synt} that used Safra construction performed very well.}.

%\parbf{what is our contribution to CTL* synthesis?}

Part I contribution is two practical approaches to \CTLstar synthesis.

\subsubsection*{Contribution I.1: \CTLstar Bounded Synthesis}

We developed two bounded synthesis approaches for the \CTLstar specifications.
Let us recall how the SMT-based bounded synthesis by Schewe and Finkbeiner~\cite{BS} works:
we bound the system size, and
encode the resulting synthesis problem into an SMT query\footnote{%
  Satisfiability Modulo Theory (SMT)~\cite{SMT} query is a
  set of constraints over in a given theory.
  For example, in Linear Integer Arithmetic theory,
  the constraints talk about integer variables,
  use operations plus, minus, and the comparison relations.
  Such a query asks whether there are values for integer variables
  that make the constraint true.}.
The query encodes the model checking question:
whether a system---which is yet unknown---is accepted by the automaton.
Bounding the system size makes it possible to encode such a model checking query
into an SMT query.
To solve such a query,
an SMT solver efficiently enumerates every possible system of a given size,
and checks if it is correct.
Thus, if the SMT query is satisfiable, then we extract the system (of the given size),
otherwise increase the system size and repeat.
The loop stops when the bound on the system size%
---provided by the user or from the theory---is reached.

Our first bounded synthesiser for \CTLstar
resembles bottom-up \CTLstar model checking~\cite{PrinciplesMC}:
it introduces an atom for each subformula of the \CTLstar formula,
and encodes into an SMT query whether the atom holds in a system state,
for every state.
We also require the top-level atom, representing the whole \CTLstar formula,
to hold in the initial system state,
Hence, if the SMT query is satisfiable,
then there is a system of the given size,
which satisfies the \CTLstar formula.
Otherwise, increase the system size and repeat.

Our second bounded synthesiser for \CTLstar uses the automata framework~\cite{ATA}:
translate the \CTLstar formula into an alternating hesitant automaton,
then encode into an SMT query
whether there is a system of a given size that is accepted by the automaton.
Conceptually, the approach is the same as the previous one,
except that we do not introduce atoms for subformulas explicitly
and instead use their automata representation.

The results constitute Chapter~\ref{chap:bosy:ctlstar} and were published in:
\li
\-[\cite{CTLstarCAV}]
   \emph{Bounded Synthesis for Streett, Rabin, and \CTLstar},
   by Ayrat Khalimov and Roderick Bloem,
   at CAV conference, 2017
\il

\subsubsection*{Contribution I.2: \CTLstar-via-LTL Synthesis}

We reduce synthesis for \CTLstar properties to synthesis for LTL.
In the context of model checking this is impossible%
---\CTLstar is more expressive than LTL.
Yet, in synthesis we have knowledge of the system structure
\emph{and} we can add new outputs.
These outputs can be used to encode witnesses of
the satisfaction of \CTLstar subformulas directly into the system.
This way, we construct an LTL formula, over old and new outputs and original inputs,
which is realisable if, and only if, the original \CTLstar formula is realisable.
The \CTLstar-via-LTL synthesis approach preserves the problem complexity,
although it might produce systems that are larger than necessary.
Furthermore,
the approach directly benefits from the performance advances of LTL synthesisers.
The results constitute Chapter~\ref{chap:ctl-via-ltl} and were published in:
\li
\-[\cite{CTLsynt-via-LTLsynt}]
  \emph{\CTLstar Synthesis via LTL Synthesis},
  by Roderick Bloem and Sven Schewe and Ayrat Khalimov,
  at SYNT workshop, 2017
\il

\subsection*{Part II: Excursion into Parameterized Systems}

%\parbf{why do we consider parameterized systems?}

Modern systems become more and more distributed.
Distributed systems are hard to implement and even harder to debug.
Yet, the failure of such systems may be unacceptable.
Thus, substantial efforts are devoted to ensure the correctness of distributed systems.
In Part II,
we look into the hard task of automatic synthesis of distributed parameterized systems.

%\parbf{what is the parametrized synthesis problem?}

Most distributed systems, algorithms, and data structures are \emph{parameterized}:
they should work for a varied, not a priori fixed, number of the components.
%We call such systems parameterized (by the number of components).
The parameterized synthesis problem~\cite{JB14} asks, given
a parameterized specification, to find a process template,
that can be cloned to form a correctly behaving system of any size.
An example parameterized specification is:
\[ \begin{array}{ll}
  \forall i \neq j.~ & \G \neg ( g_i \land g_j ) \land \\
  \forall i.~ & \G (r_i \impl \F g_i).
  \end{array}
\]
The synthesizer should find a process template, having input $r$ and output $g$,
such that a system composed of any number of such processes,
satisfies the above specification.
The related question is that of parametrized model checking
where the process template is given.
The intrinsic parameter,
hidden in the parameterized synthesis problem,
is how the processes are connected and how they communicate,
i.e., the system architecture.
The survey of existing cutoff and decidability results
for many different system architectures can be found in~\cite{BloemETAL15}.
We focus on two system architectures: guarded systems and token-ring systems.

%\parbf{what is the standard solution to parameterized synthesis problem?}

A common approach to solve the parameterized synthesis and model checking problems
is to use the cutoff reduction~\cite{Emerso03}:
reduce reasoning about systems with an arbitrary number of processes
to reasoning about systems of a fixed cutoff size.
For example,
if we consider the parameterized specification mentioned above and token-ring systems,
then it is enough to consider a system with 4 processes:
if it is correct, then any larger system is correct.

%\parbf{what is our contribution?}

\subsubsection*{Contribution II.1: Cutoffs for Parameterized Guarded Systems}

Guarded systems~\cite{EmersonK03} are inspired by cache coherence protocols found
in most modern processors.
A cache coherence protocol is usually described by states,
where transitions between states happen depending on whether or not
there is a processor in a particular state.
I.e., the transitions are guarded.
Inspired by this, in guarded systems,
processes transitions are enabled or disabled depending
on the existence of other processes in certain local states.
Our contribution concerns both parameterized synthesis and parameterized verification.
Our work stems from the observation that
existing cutoff results for guarded systems
(i) are restricted to closed systems, and
(ii) are of limited use for liveness properties
because reductions do not preserve fairness.
We close these gaps and obtain new cutoff results for open systems with
liveness properties under fairness assumptions.
Furthermore, we obtain cutoffs for the detecting deadlocks,
which are of paramount importance in synthesis.
Finally, we prove tightness or asymptotic tightness for the new cutoffs.
The results constitute Chapter~\ref{chap:guarded-systems}
and were published in:
\li
\-[\cite{AJK16}]
   \emph{Tight Cutoffs for Guarded Protocols with Fairness},
   by Simon Au{\ss}erlechner and Swen Jacobs and Ayrat Khalimov,
   at VMCAI conference, 2016
\il

%\parbf{what is the problem with the existing parameterized synthesis?}

\subsubsection*{Contribution II.2: Case Study of Parameterized Token-ring AMBA}

In token-ring systems, a single token circulates in the system.
A process possessing the token knows that no other process has the token.
Based on this information, the process can, for example, raise the grant signal.
If all processes raise the grant only when they posses the token,
then the grants will be mutually exclusive.
Thus, the token serves as the resource token.

The experiments with the existing parameterized synthesis method~\cite{JB14}
showed that it does not scale to large specifications.
First, we optimize the method by refining the cutoff reduction.
The experiments show speed-ups of several orders of magnitude.
Second, we perform parameterized synthesis case study
on the industrial arbiter protocol AMBA~\cite{AMBAspec}.
We describe new cutoff extension and decompositional synthesis tailored to AMBA
that, together with the previously mentioned optimizations,
allowed us to synthesize AMBA in parameterized setting, for the first time.
The results constitute Chapter~\ref{chap:token-systems}
and were published in:
\li
\-[\cite{Khalimov13}]
   \emph{Towards Efficient Parameterized Synthesis},
   by Ayrat Khalimov and Swen Jacobs and Roderick Bloem,
   at VMCAI conference, 2013
\-[\cite{party}]
   \emph{PARTY: Parameterized Synthesis of Token Rings},
   by Ayrat Khalimov and Swen Jacobs and Roderick Bloem,
   at CAV conference, 2013
\-[\cite{BJK14}]
   \emph{Parameterized Synthesis Case Study: AMBA AHB},
   by Ayrat Khalimov and Swen Jacobs and Roderick Bloem,
   at SYNT workshop, 2014
\il

\subsection*{Other Results}

Here are the results that did not make their way into the thesis:
\li
\-[\cite{BloemETAL15}]
   \emph{Decidability of Parameterized Verification},
   book of 170 pages,
   by Roderick Bloem and
               Swen Jacobs and
               Ayrat Khalimov and
               Igor Konnov and
               Sasha Rubin and
               Helmut Veith and
               Josef Widder.\\
In this book we consider the important case of systems parameterized by the number of processes in the system
and where each process is independent of that number.
The literature in this area produced a wealth of computational models for systems based on token passing,
broadcast communication, guarded transitions, and other communication primitives.
We introduce a computational model that unites the central synchronization and
communication primitives of many models.
We survey existing decidability and undecidability results,
and provide a systematic overview of the basic problems in this research area.

\-[\cite{DBLP:journals/sigact/BloemJKKRVW16}]
   \emph{Decidability in Parameterized Verification},
   the journal version of the above book; appeared in SIGACT News in 2016.

\-[\cite{DBLP:journals/corr/Khalimov16}]
   \emph{Specification Format for Reactive Synthesis Problems},
   by Ayrat Khalimov,
   at SYNT workshop, 2015.\\
To do synthesis, we need a specification.
Writing specifications is hard.
In this paper, we propose a user-friendly format to ease
the specification work, in particularly, that of specifying partial implementations.
Also, we provide scripts to convert specifications in the new format into the SYNTCOMP format,
thus benefiting from state of the art synthesizers.

\-[\cite{AJKR14}]
   \emph{Parameterized Model Checking of Token-Passing Systems},
   by Benjamin Aminof and
               Swen Jacobs and
               Ayrat Khalimov and
               Sasha Rubin,
   at VMCAI conference, 2014.\\
In this paper, we revisit the parameterized model checking problem for token-passing
systems and specifications in indexed $\CTLstarmX$.
%In foundational work, Emerson and Namjoshi (1995, 2003) showed that
%parameterized model checking of indexed \CTLstarmX in uni-directional token rings
%can be reduced to checking rings up to some cutoff size.
%Clarke et al. (2004) showed a similar result for general topologies and indexed \LTLmX,
%provided processes cannot choose the directions for sending or receiving the token.
We unify and substantially extend the results of Emerson and Namjoshi~\cite{Emerso95b,Emerso03}
and Clarke et al.~\cite{Clarke04c}
by systematically exploring fragments of indexed \CTLstarmX with respect to general network topologies.
For each fragment we establish whether a cutoff exists,
and for some concrete topologies, such as rings, cliques and stars, we infer small cutoffs.
Finally, we show that the problem becomes undecidable, and thus no cutoffs exist,
if processes are allowed to choose the directions in which they send or from which they receive the token.

\-[\cite{2017arXiv171204291K}]
  \emph{OpenSEA: Semi-Formal Methods for Soft Error Analysis},
  by Patrick Klampfl and Robert K\"onighofer and Roderick Bloem and Ayrat Khalimov and
  Aiman Abu-Yonis  and Shiri Moran,
  on arxiv, 2017.\\
Due to alpha-particles and cosmic rays, modern circuits are prone to bit flips.
To alleviate the problem, designers develop protection circuits,
but they are hard to implement right.
This leads to bugs: an undetected fault can bring miscalculations,
the protection that alarms about harmless faults incurs performance penalty.
In this paper, we use formal methods on designer’s input tests, while keeping time-location open.
This idea is at the core of the tool OpenSEA.
OpenSEA can
(i) find latches vulnerable to and protected against faults,
(ii) find tests that exhibit checker false alarms,
(iii) use fixed and open inputs, and
(iv) use environment assumptions.
Evaluation on a number of industrial designs shows that OpenSEA produces valuable results.
\il


\section{Toric Code}
Last time I talked about $U(1)$ and $\ZZ_2$ lattice gauge theory,
and I said that we can make the Gauss law constraint an energetic constraints.
I emphasised that this is dramatic change to the system,
because it's not just change the Hamiltonian but fundamentally changes the
Hilbert space.
Before we had a constrained Hilbert space,
whereas afterwards,
our Hilbert space is just that of a many-spin system.
Our Hilbert space decomposes into a tensor product of qubits on sites
and qubits on links.
\begin{align}
    \mathcal{H}
    =
    \underbrace{\bigotimes_{i\in\mathrm{sites}} \CC^2}_{\text{matter}}
    \otimes
    \underbrace{\bigotimes_{i\in\mathrm{links}} \CC^2}_{\text{gauge field}}
\end{align}
This is an important conceptual shift.
Before you think gauge theory is something special and were does it come
from.Gauge theory was put on some crazy pedestal.
Once you understand this point,
you can think of the gauge field as just some phase of a many-body spin system.
You automatically have an emergent gauge field that is dynamical and so on.
You realise that gauge theory can emerge from some interacting spin system.

In a way,
this addresses one of the great fundamental question in physics,
and we now understand gauge theory can come from pretty many any many-body system
emerging dynamically.

\begin{question}
    Can we create a QED theory from this?
\end{question}
Yes.
You could get nonce normalizable gauge theories.

We removed the constraint entirely,
but we have some particular term in the Hamiltonian that enforces.

\begin{question}
    Is this a computational or conceptual advance?
\end{question}
It's more a conceptual advance,
but we could simulate spin system.so
It convinces us that gauge theories can emerge from a system that has no gauge
fields.
Whether the standard model arises from this is its own question.
The standard model has Lorentz invariance,
there are a lot of gapless particles and they all have the same speed.
It's not obvious how to get that.

You can show that for some systems if you go to low energy Lorentz invariance
can emerge,
but it's slow and logarithmic so people are not convinced.
But gravity is nowhere here.

People think it can emerge if the cosmological spacetime is anti-de Sitter
space,
but that's a different story.

Last time,
we went to pure $\ZZ_2$ lattice gauge theory
with Gauss law implemented energetically.
And we had a Hamiltonian on plaquettes and vertices.
\begin{align}
    H &=
    -K \sum_{\square} B_{\square}
    - J \sum_{+} A_{+}
    - h\sum_{l} \sigma_l^{x}
\end{align}
where
\begin{align}
    B_{\square} &=
    \prod_{l \in \square}
    \sigma_l^z\\
    A_{+} &=
    \prod_{l\in +}
    \sigma_l^x
\end{align}
If we set $h=0$,
this model is the famous $\ZZ_2$ toric code model of Kitaev.
And what's special about his $h=0$ limit is that every term commutes with each
other and the mole becomes exactly solvable.

From now on,
I will only talk about the $h=0$ limit that is exactly solvable because
the $B$'s and the $A$'s all commute with each other.
It's easy to see that because if you take a plaquette and a vertex star,
if they don't overlap they obviously commute.
But if they overlap,
they will always share two links with two $\sigma_x$ and $\sigma_z$.

Thus we can simultaneously diagonalize every operator here.
Because they are all Paulis,
$B^2=1$ and $A^2=1$,
so we can just go into  some basis that simultaneously diagonalises these and the
star is just labelled by the eigenvalues $\pm 1$ of these operators.
Excited states would correspond to flipping these eigenvalues.

We can actually add a constant to this Hamiltonian and make it a sum of
commuting projectors.
We can define the projector for a plaquette as
\begin{align}
    P_{\square}
    &=
    \frac{1}{2}\left(
    1 - B_{\square}
    \right)
\end{align}
so that $P_{\square}^2 = p_{\square}$
and similarly for the vertices
\begin{align}
    P_{+}
    &=
    \frac{1}{2}\left( 1 - A_+ \right)
\end{align}
and so the Hamiltonian is just a sum of commuting projectors
\begin{align}
    H &=
    \frac{K}{2} \sum_{\square} P_{\square}
    +
    \frac{J}{2} \sum_{+} P_{+}
\end{align}
Before in the AKLT it was as sum of projectors but he projectors weren't
commuting.
There's a whole world here.

A nice way to think of the ground star of this model is basically as a loop gas,
a sum over all loop configurations.

Pick a basis for $\sigma_z$.
Let's say $\sigma^z = +1$ is the absence of a string on an edge.
And if it's $-$ it's  the presence of a string on an edge.
The product of $\prod_{l\in\square}\sigma_l^z=1$
means that there should be an even number of links that have strings.
Then what does $\prod_+ \sigma_l^x$ on a star do?
If I have no strings on a star,
then it's going to create strings on the star when you apply it.

Actually, I got it backwards.

If $\sigma^z = +1$ for a link,
it means that there is a string that crosses it.
If $\prod_{l\in\square} \sigma_l^z = 1$ then that means there is an even number
of strings on a plaquette.
This means that the strings on the dual lattice do not end.

You can think of $\prod_{l\in +} \sigma_l^$ as it as a plaquette on the dual
lattice.

If we have an even number of strings around the plaquettes of the dual lattice,
I better have a string somewhere else,
basically the strings cannot end and have to keep going.

So basically we have to have closed strings on a dual lattice,
and this other term says that if I apply it I get another closed string.
So the $+1$ eigenstate of
$\sum_{\square}B_{\square}$
is the uniform superposition state of only closed loops on the dual lattice.

And the $+1$ eigenstate of the $A_+$ operator is a uniform superposition of all
closed loop configurations.
It's not every closed loop,
but only loops that can be made by deforming a single operator.

At least in the situation where $K$ and $J$ are positive,
we can think of the ground state as a uniform superposition of closed loops.
For $K,J>0$,
the ground state is a uniform superposition of closed loops.

A basis of $\sigma^z$ is loops on the dual lattice.
$\sigma^x$ is loops on the primal lattice,
but it's just a change in perspective depending on which basis you pick.

This means that on this torus there are 4 topologically degenerate states,
given by whether you have an even or odd number of closed loops around each
cycle.

This is an example of a non-invertible topological phase,
because we have this topological degeneracy.
You can in fact not need to define it on a square lattice,
but could have used any graph with the same basic properties,
planar graph,
then you can also define it on any triangulation on a genius $g$ surface,
and you would have $2^{2g}$ different sectors.
So you can define a similar model on any triangulation of genus $g$ surface with
$2^{2g}$ topologically degenerate ground states.

\subsection{Excitations}
This model is basically $\ZZ_2$ lattice gauge theory,
and you should know what the excitations are.

You can think of creating excitations by applying local operators.

Suppose you apply a $\sigma^x$ operator to a single link.
That's going to flip the eigenvalues of the $B_{\square}$ operator on nearby
plaquettes.
If I apply an $\sigma^x$ on a link,
that's going at flip the eigenvalues next to it.
If you apply a product of $\sigma^x$ operators along some string $\gamma$,
then this think creates $2$ plaquette excitations far away
\begin{align}
    W_m(\hat{\gamma}) &= \prod_{l\in \hat{\gamma}} \sigma_l^x
\end{align}
And the energy cost is just $2K$ at one end and $2K$ at the other end,
and we can separte them arbitrarily far apart.
These are deconfined excivations because they can be separated arbtrarily far
without using energy besides the initial creation.
These are $m$ particles.
We say $\hat{\gamma}$ denotes a string on the dual lattice.
Then

Similarly,
we can apply $\sigma^z$ to a link and that does exactly the same thing,
except on the dual lattice.
Creating it on the original lattice creates a star excitation.
\begin{align}
    W_e\left( \gamma \right)
    &=
    \prod_{l\in \gamma} \sigma_l^z
\end{align}
These are $e$ excitations.
No local operator can create any individual one,
and you cannot convert one to another by local operators either,
so they are topologically distinct.
The way we think about it is this.

\subsection{Topological classes of excitations}
We have topologically classes of excitations.
1, $e$, $m$, and the composite particle $\epsilon = e\times m$.
These are 4 topological distinct excivations.
And we have fusion rules for these,
whch tell us how different topological excivations fuse together to give other
classes of topolgoical excitaitons.
\begin{align}
    e\times e &= 1\\
    m\times m &= 1\\
    \epsilon \times \epsilon &= 1\\
\end{align}

They have fractional statiics if yo utake these particls around each other and
you have intersting phases.
Imagine applying a string operator that creates a pair of $m$ particles
using $W_m\left( \hat{\gamma} \right)$,
and then we take $W_e\left( \gamma \right)$ around one of the $m$ particles.

And then I consider the order they apply
\begin{align}
    W_e\left( \gamma \right) W_{m}^{\hat{\gamma}}
    \ket{\mathrm{g.s.}}
    &=
    -W_m\left( \hat{\gamma} \right)
    W_e\left( \gamma \right)
    \ket{\psi_{\mathrm{g.s.}}}
\end{align}
This $-$ sign is the mutual statistics between $e$ and $m$.

One more thing to mention.
If $\gamma$ is a closed loop,
then
\begin{align}
    W_e\left( \gamma \right)
    \ket{\psi_{\mathrm{g.s.}}}
    &=
    \ket{\psi_{\mathrm{g.s.}}}
\end{align}
and if $\hat{\gamma}$ is a closed loop then
\begin{align}
    W_m\left( \hat{\gamma} \right)
    \ket{\psi_{\mathrm{g.s.}}}
    &=
    \ket{\psi_{\mathrm{g.s.}}}
\end{align}
So we have these loop operators that keep the ground state invariant.
So actually the ground state has a symmetry,
but it's a strange kind that is generated by loop operators.
The reason we have this symmetry because we actuallyhad it microsocpially,
and these operators commute with the Hamiltonian.

$H$ also commutes with $W_e\left( \gamma \right)$ and $W_{m}\left( \hat{\gamma}
\right)$
if $\gamma$ and $\hat{\gamma}$ are closed.

Comapred to conventional symmetries,
like flipping spins,
this Hamiltonian has a spcial clsass of symmetreis,
called $1$-symmetries,
becaue thyeare dimension-1 operators.

Even if we broke the symmetry they the level few the Hamiltonian by adding some
perturbation,
for example the $h \sigma^x$ perturbation,
then we would break the $W_m$ symmetry.
We could also add terms to break the $W_e$ symmetry.
The Hamiltonian will still have these loop symmetries,
but these operators will be slightly different.

So the existence of these loop symmetries is a \emph{stable} property.
These days we say that these have an emergent 1-form symmetry.

There exist loop operators associated with $e$ and $m$ particles even if those
symmetries don't exist in in the original Hamiltonian.
At least  the toric code Hamiltonian,
those statements are certainly true.

Coming back here,
we have these mutual statistics between $e$ and $m$.
The exact form of the operators may change,
but you can think of topologically orderd phases as being characterisd by
topological order,
but they can also be cahactersied by these emergent symmetries,
which are just lop operators for hte non-trivial topological operators.

For example,
here we but the $m$ loop open to get an $m$ segement,
and we go through it with a $W_e$ loop.
So you cna in general get signs and phases,
and more complicated things can happen.
In general,
they not even be invertible,
and that leads at the concept of non-invertible symmetries.

That you have a minus sign n the mutual statistics is just a property of the
toric code.

You can imagine a different gound satte with $e$ particles
The point is that as $r\to\infty$,
$E(r)\to\mathrm{const}$..
Don't tkae the gneral thing I said too literally.

Now the $e$ and the $m$ partio
$e,m$ are bososns.
$\epsilon$ is a fermion.
You could do an exchange to find out  the phase.
Or you can find out if you did a $2\pi$ rotation,
locally this guy goes around itself.

Thisis all I wantd to say about $\ZZ_2$ lattice gauge theory.

\begin{question}
    Is it a loop?
\end{question}
You can have a more non-trivial algebra so they don't multiple = t

We noted how these can come form lattice guage htoery,
and pure lattice gauge theory without magnteic field,
that'sj s t Kitaev toric code.
There are 4 topological excitations,
generated by the $\ZZ_2$ charge $e$
and the $\ZZ_2$ flux $m$.

\ssection{Parton/Slave particle approach}
What I want to do now is to discuss another approach for describing spin
liquids.
The phrase slave-particle has been cancelled,
so it's called Parton, projected construction.
XG-Wen 2004 Chapter 9 has a good description of this.

Where gauge theory comes from in a spin model,
you stat with microscopic spins,
embed the 2-state Hilbert space in a larger Hilbert space with a constraint.
The idea here is that we parametrize microscopic Hilbert space in a real way by
expanding the Hilbert space and adding a constraint.

So let me say what I mean by the way.
At the opeartor level,
take my spin operator and represent it in terms of other operaotrs,
for example.

\begin{align}
    \vec{S} &=
    \begin{cases}
        \frac{1}{2}f^\dagger \vec{\sigma} f\\
        \frac{1}{2}z^\dagger \vec{\sigma} z
    \end{cases}
\end{align}
$f$ is a 2-component operator and it's a fermion.
\begin{align}
    f &=
    \begin{pmatrix}
        f_1\\
        f_2
    \end{pmatrix}
\end{align}
sometimes called a slave-fermion or
Schwinger fermion.
Meanwhile,
\begin{align}
    z &=
    \begin{pmatrix}
        z_1\\
        z_2
    \end{pmatrix}
\end{align}
is a complex calar that describes boson,
sometimes called ``slave boson'' or Schwinger bosons.

This i the Fermionic parton.
So we can write
\begin{align}
    S^\dagger &=
    S^x + iS^y\\
    &=
    \begin{pmatrix}
        f_1^\dagger & f_2
    \end{pmatrix}
    \begin{pmatrix}
        0 & 1\\
        0 & 0
    \end{pmatrix}
    \begin{pmatrix}
        f_1\\
        f_2
    \end{pmatrix} \\
    &=
    f_1^\dagger f_2
\end{align}
and then
\begin{align}
    S^z &=
    \frac{1}{2}
    \left(
    f_1^\dagger f_1
    -
    f_2^\dagger f_2
    \right)
    S^-\\
    &=
    f_2^\dagger f_1
\end{align}
It is an exercise to check that
\begin{align}
    \left[ S^a, S^b \right]
    &=
    2i \epsilon^{abc} S^c
\end{align}
There are two states $\ket{\uparrow}$ and $\ket{\downarrow}$.
But in the fermionic picture,
there are 4 states
$\ket{00}, \ket{01}, \ket{10}, \ket{11}$.
So then $\ket{\uparrow}=\ket{10}$ and $\ket{\downarrow}=\ket{01}$
and we consider $\ket{00}$ and $\ket{11}$ to be unphysical state.
To remove these unphysical states,
we enforce the constraint that there is just one fermion on each site.
\begin{align}
    n_1 + n_2 = 1\\
    n_1 &= 1- n_2
\end{align}

We can think of the number of $f_1$s being equal to the number of holes of
$f_2$.

Constraints on a Hilbert space is the same as saying there's a gauge redundancy
invovled.
We can introduce a gauge transformation such that the physcial states are
invariatn undergauge transfomraiotn,
but the unphysical states are not.
And the gauge transformation is just to project on to the gauge invariant
states.

\subsection{Gauge redundancy}
Consider the $U(1)$ gauge redundancy.
\begin{align}
    f_{\alpha}
    &\to
    e^{i\theta} f_{\alpha}
\end{align}
which keeps $\vec{S}$ invariant.

I have introduced these Fock states for the fermions,
and consider how they transform.
\begin{align}
    \ket{0}_{f_1} &\to \ket{0}_{f_1}\\
    \ket{1}_{f_1} =
    f^\dagger \ket{0}_{f_1}
    &\to
    e^{-i\theta} f_1^\dagger f_1^\dagger \ket{0}_{f_1}
    =
    e^{-i\theta}\ket{1}_{f_1}
\end{align}
Menawhile
\begin{align}
    \ket{0}_{f_2} &\to e^{i\theta} \ket{0}_{f_2}\\
    \ket{1}_{f_2} &\to \ket{1}_{f_2}
\end{align}
So that means $\ket{01}$ and $\ket{10}$ are gauge invaritn but $\ket{00}$ and
$\ket{11}$ are not gauge invariant.
That meansa the physical space is equal to the gauge invariant subspace of the
fermions.

It turns out the redundancy is not just $U(1)$,
but we actually ahve $SU(2)$ gauge redunancy.
Let me just tell you what it is.

If we consider
\begin{align}
    \begin{pmatrix}
        f_1\\
        f_2^\dagger
    \end{pmatrix}
    &\to
    W
    \begin{pmatrix}
        f_1\\
        f_2^\dagger
    \end{pmatrix}
\end{align}
for some $W\in SU(2)$,
then the spin vector $\vec{S}$ will be invariant.
Let me rewrite this as
\begin{align}
    S^+
    &=
    f_1^\dagger f_2\\
    &=
    \frac{1}{2} \epsilon_{\alpha\beta} \tilde{f}_{\alpha} \tilde{f}_{\beta}
\end{align}
noting that
\begin{align}
    \tilde{f}_1 &= f_1^\dagger\\
    \tilde{f}_2 &= f_2
\end{align}
THis is paritcle-hole tranfomaitno.
Because fermions anticommute,
I just do this with the $\epsilon$ tensor and put in $\frac{1}{2}$.
If we do it in this langgue

And then we can write this as
\begin{align}
    \begin{pmatrix}
        \tilde{f}_1^\dagger\\
        \tilde{f}_2
    \end{pmatrix}
    &\to
    W
    \begin{pmatrix}
        \tilde{f}_1^\dagger\\
        \tilde{f}_2^\dagger
    \end{pmatrix}
\end{align}
which I can write as a shorthand
\begin{align}
    \tilde{f} \to W \tilde{f}
\end{align}
And what that tells us is that
\begin{align}
    S^\dagger &\to
    \frac{1}{2} \epsilon_{\alpha\beta} W_{\alpha\alpha'}
    W_{\beta\beta'} \tilde{f}_{\alpha'}
    \tilde{f}_{\beta'}
\end{align}
and for $W\in SU(2)$,
we have
\begin{align}
    \epsilon_{\alpha\beta}
    W_{\alpha\alpha'}
    W_{\beta\beta'}
    &=
    \epsilon_{\alpha'\beta'}\\
    W_{1\alpha'}
    W_{2\beta'}
    -
    W_{2\alpha'}
    W_{1\beta'}
\end{align}
For $\alpha',\beta'=1$,
\begin{align}
    W_{11}W_{21} - W_{21}W_{11} &=0
\end{align}
and for
$\alpha'=1$ and $\beta'=2$,
\begin{align}
    W_{11} W_{22} - W_{21} W_{12} &= |W| = 1
\end{align}
So the spin operator is kept invariant by this $SU(2)$ transformation.
The point is that once you write it in this way with the expanded Hilbert space,
that gives you access to new kinds of approximations you didn't have access to
before,
in particular new types of mean field theory.

This parton decomposition gives access to new mean-field approximations.
To see this,
consider the usual mean field theory on the Heisenberg model
\begin{align}
    H
    &=
    \sum_{ij} J_{ij} \vec{S}_{i} \cdot \vec{S}_{j}
\end{align}
and you just replace the $S$ with its expectation value,
so the mean-field Hamiltonian is
\begin{align}
    H_{\mathrm{m.f.}}
    &=
    \sum_{ij}
    J_{ij}
    \left(
    \langle\vec{S}_i\rangle
    \cdot
    \vec{S}_j
    +
    \vec{S}_i\cdot
    \langle \vec{S}_j \rangle
    -
    \langle\vec{S}_i\rangle
    \cdot
    \langle\vec{S}_j\rangle
    \right)
\end{align}
But you want to enforce consistency with
\begin{align}
    \langle \vec{S}_i \rangle
    &=
    \bra{\Phi_{mf}}
    \vec{S}_i
    \ket{\Phi_{mf}}
\end{align}
This is useful a lot of the time,
but this is useless for $\langle S_i \rangle=0$,
because everything is just zero.

So this could only be useful for ordered states of spins.
If I want to describe states that have topological order,
usual mean field theory is no good.
But if I rewrite in terms of partons,
that goes me a new way of doing mean-field theory,
which gives me a window into describing a whole new class of phases of matter
that I couldn't have described just by talking about expectation values of $S$.

Let me just write it down and analyse it next time.
For the parton mean field,
I replace the $S$ with my fermion operators.
\begin{align}
    H &=
    \sum_{ij}
    J_{ij}
    \vec{S}_i
    \cdot
    \vec{S}_j\\
    &=
    \sum_{ij}
    \sum_{a}
    J_{ij}
    f_{i\alpha}^\dagger
    f_{i\beta}
    f_{i\gamma}^\dagger
    f_{i\delta}
    \sigma_{\alpha\beta}^{a}
    \sigma_{\gamma\delta}^{a}
\end{align}
and the identity to use here from QFT class is
\begin{align}
    \sum_{a}
    \sigma_{\alpha\beta}
    \sigma_{\delta\gamma}
    &=
    2\delta_{\alpha\beta'}
    \delta_{\alpha'\beta}
    -
    \delta_{\alpha\beta}
    \delta_{\alpha'\beta'}
\end{align}
and the Hamiltonian simplifies to
\begin{align}
    H &=
    \sum_{ij}
    \left[
    -\frac{1}{2}
    J_{ij}
    f_{i\alpha}^\dagger
    f_{j\alpha}
    f_{j\beta}^\dagger
    f_{i\beta}
    +
    J_{ij}
    \left(
    \frac{1}{2} n_i
    -
    \frac{1}{4} n_i n_j
    \right)
    \right]
\end{align}
with a constraint that
\begin{align}
    n_i = 1
\end{align}
So far this is just an exact rewriting.

\begin{question}
    ???
\end{question}
In gauge theory,
you could have defined our gague field in the spin sstem,
and eery time the Guass law is violated
I'm going to call that thing matter,
and then you can exacly embed the gague field sapce with matter,
and it becomes and exat mapping.
But if you want pure gauge theory,
it always has to be a subset.
Here there is a mtter field.
Thera is a conjecture.
If you want ot exactly map the gauge field to a spin mdoel,
you need to mave am tter field,
that's the completeness conjecture.
But you're right,
it seems like I embeeed it in hte larger space,
but there's this other thing yo ucould do,
and that is call every Gauss law violation ``matter''
and that maps on to the Hilbert space.

\begin{question}
    Do these necesasrily follow fermionic commutation relations?
\end{question}
I don't know.
It's not entirely obvious how you would define that.
You're thiknig of oeprators htat create a aprticular fluctuation and what its
properties are.
It oden'st have to be bosonic or fermionic.
I might be able to talk about that level fo genearlity.
I would have some gauge field,
and I would have some matter,
so I can't decompose anything,
I can only talk about the whole of what's happening.
In this particular relation,
I can decompose what I call matter and what I call gauge field and it might be
tricky to do that.
So I don't have a good answer.

Certainly in the theories we write down,
it's gauge fields the couple to matter that is fermionic or bosonic.

\begin{question}
    If bosonic matter,
    you could call any violation of the Gauss law constraint bosonic,
    because yo can have as many bosons at a site as you want?
\end{question}
I think there will be fermionic and bosonic violations.


% !TEX root = report.tex
\section{Model In Alloy Analyzer}

Alloy Analyzer is a tool for modeling objects with specifications regarding their related structure, and formally verifying whether some properties hold for such objects based on some other pre-asserted properties. Alloy has its own specification language as well as integrated development environment (\textsc{ide}), which includes a visualizer. The tool was developed by Daniel Jackson and his team at the Massachusetts Institute of Technology (\textsc{mit}). See Alloy manual in his book \cite{Jackson:2012:SAL:2141100} or on the Alloy website {\small\url{http://alloy.mit.edu/alloy/documentation.html}}.

To solve the \textsc{drc} query safety check problem, we rephrase the queries in terms of Alloy verification tasks. In this section, we explain the essential components of the model to we need to construct in Alloy specification language.

\subsection{Model overview}

The main question of this project is that, given a database schema and a \textsc{drc} query as input, we need to be able to translate the input into a verification task to be solved by Alloy Analyzer. Specifically, our Alloy model would consist of the following components.

\begin{itemize}[topsep=0.5pc,itemsep=0.25pc]
    \item  Since we need to show whether a \textsc{drc} query is domain-dependent, we need to be able to model multiple \textbf{domain sets} (see \sectionref{sub:goal}), each with different \textbf{scalar values} in the set.
    \item  The model needs to be able to model \textbf{database instances} (i.e., collection of table instances) based from the given database schema, using \textbf{scalar values} mentioned above.
    \item  The given \textsc{drc} query should be translated to a \textbf{query function} in Alloy language. The function should output a result given a \textbf{domain set} and a \textbf{database instance}.
    \item  As per the main goal in \sectionref{sub:goal}, we need an \textbf{Alloy predicate} which would solve for two distinct domains which yield two distinct query results based on a common database instance.
    \item \emph{Optional.} For visualization, we need a \textbf{placeholder for results} in the Alloy model, declared as a model signature.
\end{itemize}
We discuss the details for each of these components in depth in the subsequent subsections.

\subsection{Domain sets and values}

As previously mentioned, we need to be able to consider different domain sets in order to ultimately determine if a query is domain-dependent. In \autoref{src:domain},

\begin{itemize}[topsep=0.5pc,itemsep=0.25pc]
    \item  \textbf{\alloy{Superparticle}}:\; a set of all possible scalar values across all domains.
    \item  \textbf{\alloy{Universe}}:\; a collection of exactly two domains (or alternatively, \emph{universes}): \alloy{UniverseAlpha} and \alloy{UniverseBeta}. \; Each domain (i.e., \emph{universe}) has one attribute called \alloy{Element}, representing the subset of \alloy{Superparticle}s which belong to that domain. We can refer to the first domain set as \alloy{UniverseAlpha.Element}, for example.
    \item  \textbf{\alloy{Particle}}:\; is the domain set of \emph{allowable} scalar values in the actual model of database instances, which is restricted to the intersection of each of the two domain sets.
\end{itemize}

\begin{lstlisting}[language=alloy,float=t,caption={Alloy model signature for domain sets (\emph{universes}) and their elements (\emph{particles}). This stencil code will always be present in all Alloy models. The fact assert on \autoref{li:domain-cond} ensures that each \alloy{Superparticle} must be present in at least one domain, for the sake of conciseness of models generated by Alloy.},label={src:domain}]
sig Superparticle {} {
	Superparticle = Universe.Element <|\label{li:domain-cond}|>
}

abstract sig Universe { Element: some Superparticle }
one sig UniverseAlpha, UniverseBeta extends Universe {}

some sig Particle in Superparticle {} {
	Particle = UniverseAlpha.Element & UniverseBeta.Element
}
\end{lstlisting}

\subsection{Database instances}

Because database instances will heavily depend on the schema, instead of creating a static Alloy model, we need a method to translate the given database schema into additional Alloy model signatures. We provide a framework procedure of how it could be done.

\smallskip
\begin{procedure}
    \label{proc:tables}
    Let $R_1, R_2, \ldots, R_k$ be database tables, each with $n_1, n_2, \ldots, n_k$ columns, respectively. We create the following Alloy signature.

    % Code placeholder variables
    \newrobustcmd\fieldsigfortable[1]{%
        \textnormal{\small\color{CodeVariable}
            <\hrsp{\itshape field signature #1}\hrsp>}}

\begin{lstlisting}[language=alloy,numbers=none]
one sig Table {
    R_1: <|\fieldsigfortable{$R_1$}|>,
    R_2: <|\fieldsigfortable{$R_2$}|>,
               <|$\vdots$|>
    R_<|$k$|>: <|\fieldsigfortable{$R_k$}|>
}
\end{lstlisting}

    \newpage\phantomsection
    \label{psec:foot-dummy}
    \marginnote{\llap{\normalsize* }The reason why we need a dummy signature \alloy{Table} is that it is impossible in Alloy to create a relation with each column consisting of object with only pre-defined signatures. Hence, this is a workaround.}
    \noindent
    where
    \[
        \text{\fieldsigfortable{$R_i$}} = \begin{cases}
            \;\text{\small\alloy{set Particle}}
                & \text{if $n_i = 1$} \\
            \;\underbrace{\text{\small\alloy{Particle -> Particle ->} $\ldots$ \alloy{-> Particle}}}_\text{repeated $n_i$ times}
                & \text{if $n_i > 1$}
        \end{cases}
    \]
    In other words, each field \alloy{R_}$i$ is an Alloy relation with $n_i$ columns (ignoring the first dummy column of the \alloy{Table} signature\hrsp{\hyperref[psec:foot-dummy]{\color{OrangeRed4}*}}), and \alloy{Table.R_}$i$ is the syntax which represents table $R_i$ itself.

    Note that the unary signature (i.e., table with single column) requires the keyword \alloy{set} in order to override the default behavior which is that \alloy{Table.R_}$i$ would have contained a single row of data instead of any number of rows.
\end{procedure}

\marginhead{Example of translation of database schema}
To illustrate how the above procedure works, we consider the following example.

\smallskip
\begin{example}
    Suppose that a database schema consists of three tables named \rel{A}, \rel{B}, and \rel{C}. Table \rel{A} has a single column of integers; Table \rel{B} contains two columns of integers followed by a column of string values; and Table \rel{C} contains two columns of string values.

    Using \autoref{proc:tables}, all of the tables above are translated into Alloy signature as follows.
\begin{lstlisting}[language=alloy,numbers=none]
one sig Table {
    A: set Particle
    B: Particle -> Particle -> Particle
    C: Particle -> Particle
}
\end{lstlisting}
\end{example}

\begin{note}
    You may have probably noticed from the example above that we make \emph{no distinction} between different types of data, whether it be an integer or a string (or any other types). Since data types do not make any differences in this project, they can be safely disregarded.
\end{note}

\subsection{Query function}

Suppose that a (simplified) \textsc{drc} query has the form
\begin{equation}
    Q = \{x_1,x_2,\ldots,x_m \mid P(x_1,x_2,\ldots,x_m)\} \label{eq:query}
\end{equation}
where each $x_i$ represents a variable for scalar value and $P$ is a boolean expression, which could be

\begin{itemize}[topsep=0.5pc,itemsep=0.25pc]
    \item  a boolean predicate in terms of table name (see \hyperref[psec:table-name-pred]{page~\pageref*{psec:table-name-pred} under \emph{table names as predicates}});
    \item  an equality predicate ($=$) between two values;
    \item  a conjunction ($\wedge$), a disjunction ($\vee$), a negation ($\neg$\hrsp), a conditional ($\Rightarrow$), or a bi-conditional ($\Leftrightarrow$) of other boolean expressions; or
    \item  a first-order, universal ($\forall$) or existential ($\exists$) quantification of other boolean expressions where a new variable also represents a scalar value.
\end{itemize}

In addition, each variable in the boolean expression $P$ must be \emph{binded}. That is, either the variable must be one of $x_1,x_2,\ldots,x_m$; or it must be introduced via first-order quantification in which the variable is used.

\smallskip
The procedure to transform a query in \textsc{drc} into an Alloy function is described as follows.

\smallskip
\begin{procedure}
    \label{proc:query-function}
    Given a specific \alloy{Universe} (i.e., domain set) called $u$ as an input, we rewrite the query $Q$ as defined in \eqref{eq:query} as a new Alloy function (using a comprehension syntax) as shown.

    % Code placeholder variables
    \newrobustcmd\setcomppred{%
        \textnormal{\small\color{CodeVariable}
            <\hrsp{\itshape predicate expression}\hrsp>}}
    \newrobustcmd\resultsig{%
        \textnormal{\small\color{CodeVariable}
            <\hrsp{\itshape output signature}\hrsp>}}
    % Make an escape within string
    \newrobustcmd\escinstr[1]{{\color{Purple4!80!black}\$\{#1\}}}

\begin{lstlisting}[language=alloy,numbers=none]
fun query[u: Universe]: <|\resultsig|> {
    { x_1,x_2,<|$\ldots$|>,x_<|$m$|>: u.Element | <|\setcomppred|> }
}
\end{lstlisting}
    The \setcomppred{} above corresponds to the almost one-to-one translation of the boolean expression $P$ (from the query $Q$ as shown in \eqref{eq:query}) into an Alloy predicate syntax string. The recursive translational algorithm is outlined below.

\SuppressNumber
\begin{lstlisting}[language=pseudocode,escapeinside={<|}{|>},emph={TranslateBooleanExp},emphstyle={\bfseries\color{Identifier}}]
TranslateBooleanExp($P$):  <|\ReactivateNumber|>
if $P$ is a table-name predicate $T(x_1, x_2, \ldots, x_m)$:
    return "<|\escinstr{$x_1$}|> $\color{String}\rightarrow$ <|\escinstr{$x_2$}|> $\color{String}\rightarrow$ $\ldots$ $\color{String}\rightarrow$ <|\escinstr{$x_m$}|> in Table.<|\escinstr{$T$}|>"
else if $P$ is the equality predicate $x_1 = x_2$:
    return "(<|\escinstr{$x_1$}|> = <|\escinstr{$x_2$}|>)"
else if $P$ has the form $\neg Q$:
    return "(not <|\escinstr{TranslateBooleanExp($Q$)}|>)"
else if $P$ has the form $Q \vee R$:
    return "(<|\escinstr{TranslateBooleanExp($Q$)}|> or <|\escinstr{TranslateBooleanExp($R$)}|>)"
else if $P$ has the form $Q \wedge R$:
    return "(<|\escinstr{TranslateBooleanExp($Q$)}|> and <|\escinstr{TranslateBooleanExp($R$)}|>)"
else if $P$ has the form $Q \Rightarrow R$:
    return "(<|\escinstr{TranslateBooleanExp($Q$)}|> implies <|\escinstr{TranslateBooleanExp($R$)}|>)"
else if $P$ has the form $Q \Leftrightarrow R$:
    return "(<|\escinstr{TranslateBooleanExp($Q$)}|> iff <|\escinstr{TranslateBooleanExp($R$)}|>)"
else if $P$ has the form $\exists\,y[Q]$:
    return "(some <|\escinstr{$y$}|>: u.Element | <|\escinstr{TranslateBooleanExp($Q$)}|>)"
else if $P$ has the form $\forall y[Q]$:
    return "(all <|\escinstr{$y$}|>: u.Element | <|\escinstr{TranslateBooleanExp($Q$)}|>)"
\end{lstlisting}

    \newpage\noindent
    In other words, the translation propagates down through each boolean subexpressions, except for the case of table-name predicates in which we use ``arrow products'' (\alloy{->}) and ``subset comparison operator'' (\alloy{in}) to check if a tuple belongs to the given table. Hence, this procedure is straightforward.

    For the \resultsig{}, we use the syntax similar to that in \autoref{proc:tables}.
    \[
        \text{\resultsig} = \begin{cases}
            \;\text{\small\alloy{set Superparticle}}
                & \text{if $m = 1$} \\
            \;\underbrace{\text{\small\alloy{Superparticle -> Superparticle ->} $\ldots$ \alloy{-> Superparticle}}}_\text{repeated $m$ times}
                & \text{if $m > 1$}
        \end{cases}
    \]

\end{procedure}

\newpage
\marginhead{Example of translation of query functions}
The following example demonstrates how we can translate one instance of \textsc{drc} query into an Alloy function.

\smallskip
\begin{example}
    Suppose that there exists a table $\rel{T}(\field{a, b})$ and we have a \textsc{drc} query $Q$ such that
    \[
        Q = \{ x, y \mid (x = y) \vee \rel{T}(x, y) \vee \exists z [\rel{T}(x, z) \wedge \rel{T}(z, y)] \}
    \]
    Using \autoref{proc:query-function}, query $Q$ can be rewritten as an Alloy function as follows.

\begin{lstlisting}[language=alloy]
fun query[u: Universe]: Superparticle -> Superparticle {
    { x, y: u.Element |
        ((x = y) or (x -> y in Table.T) or
         (some z: u.Element | (x -> z in Table.T) and
                              (z -> y in Table.T))) }
}
\end{lstlisting}
\end{example}

We have discussed earlier at the end of \sectionref{psec:explicit-domain} about how the domain of a \textsc{drc} query is \emph{not} explicit. In an attempt to make the domain more explicit, we provide the following definition and notation.

\smallskip
\begin{definition}
    \label{def:query-interp}
    Let $Q$ be a \textsc{drc} query as mentioned in \eqref{eq:query}. If the domain set is $D$, then $Q[D]$ denotes
    \[
        Q[D] = \{(x_1,x_2,\ldots,x_m) \in D^m \mid P(x_1,x_2,\ldots,x_m)\}
    \]
    That is, each row of $Q[D]$ will be a tuple of $m$ scalar values from the domain $D$.

    We also sometimes interpret $Q[D]$ as the \textbf{result} of the query $Q$ where $D$ is the domain. This interpretation directly corresponds to how the \alloy{query} function works as defined by \autoref{proc:query-function}
\end{definition}

\subsection{Query safety verification}

Let us revisit the definition of the ``\textit{safety} of \textsc{drc} query'' as described in \sectionref{sub:goal}. We rephrase the definition slightly so that it exactly fits the Alloy verification framework.

\begin{definition}
    Suppose there exists a database schema $S$ and a \textsc{drc} query syntax $Q$ (as defined in \eqref{eq:query}). The query $Q$ is \textbf{safe} \emph{if and only if}
    \begin{itemize}[topsep=0.5pc,itemsep=0.25pc]
        \item  \textit{for all} two domain sets $D_1$ and $D_2$, and
        \item  \textit{for every} database instances $I$ based on the schema $S$, which are also valid under both domains $D_1$ and $D_2$ (i.e., all scalar values in $I$ must belong to both sets $D_1$ and $D_2$)
    \end{itemize}
    we have $Q[D_1] = Q[D_2]$ \;(i.e., the result of query $Q$ under $D_1$ and $D_2$ are the same).
\end{definition}

\smallskip
The definiton of query safety can be translated into an Alloy assertion statement as shown on the first three lines in \autoref{src:safety}. The \hyperref[li:check-assert]{last line} invokes the Alloy Analyzer to verify such assertion statement. The hightlighted number \alloy{4} indicates the upper limit of the number of objects of each model to be constructed by Alloy Analyzer. This number could be changed to a larger or smaller amount. The larger the amount, the more likely that Alloy Analyzer finds the answer, but in exchange for more computation resources.

\begin{lstlisting}[language=alloy,float={t},caption={Alloy assertion statement indicating that the \alloy{query} is true.},label={src:safety}]
assert queryIsSafe {
    all u, u': Universe | query[u] = query[u']
}
check queryIsSafe for <|\hll{check-assert-num}|>4<|\hlr{check-assert-num}\label{li:check-assert}|>
\end{lstlisting}

\begin{note}
    \marginhead{Caveat of Alloy Analyzer}
    It is vital to point out that Alloy Analyzer will only attempt to find a counterexample of a given assertion statement. If Alloy Analyzer fails to find such counterexample, it does \emph{not} imply that the assertion is true. That is, the Alloy Analyzer is \textbf{not complete}.
\end{note}

\smallskip
So far we have discussed all essential ingredients of our Alloy model to analyze the safety of a \textsc{drc} query input. However, when the query safety assertion statement has a counterexample, and we would like to see the explicit visualization of the query result of the counterexample, we will need to provide the Alloy model signature for the result objects too.

\subsection{Results placeholder}

As we have previously discussed in \autoref{def:query-interp} that the query result is the interpretation of a query for a given domain set. Considering from the mathematical point of view, it is easy to see that the query result actually has the same anatomy as database tables. That is, a \textbf{query result} is a mathematical relation with a positive number of columns of scalar values. Therefore, we can use the syntax similarly to the declaration signature of table objects.

However, there is one major difference: for each query, we need two query results, one for domain \alloy{UniverseAlpha} and another for \alloy{UniverseBeta}. In Alloy, we use the following procedure to translate the \textsc{drc} query to the Alloy object signature as shown below.

\smallskip
\begin{procedure}
    Let $Q$ be a given \textsc{drc} query as defined in \eqref{eq:query}. That is, each row of the result has $m$ columns. We create Alloy objects with the following signatures.

    \newrobustcmd\fieldsigforresult{%
        \textnormal{\small\color{CodeVariable}
            <\hrsp{\itshape field signature}\hrsp>}}

\begin{lstlisting}[language=alloy,numbers=none]
abstract sig Result {
    Output: <|\fieldsigforresult|>
}
one sig ResultAlpha, ResultBeta extends Result {} {
    ResultAlpha.@Output = query[UniverseAlpha]
    ResultBeta.@Output = query[UniverseBeta]
}
\end{lstlisting}
    where
    \[
        \text{\fieldsigforresult} = \begin{cases}
            \;\text{\small\alloy{set Superparticle}}
                & \text{if $m = 1$} \\
            \;\underbrace{\text{\small\alloy{Superparticle -> Superparticle ->} $\ldots$ \alloy{-> Superparticle}}}_\text{repeated $m$ times}
                & \text{if $m > 1$}
        \end{cases}
    \]

    Notice that there are two separate results of the query (called the \alloy{Output}) from applying \alloy{query} function to each domain.
\end{procedure}


\section{Retaining Topology}
\label{sct_topology}

There are cases when one is more interested in the tree's structure than in the
branch lengths, maybe because lengths are irrelevant or just because they are
so short that they obscure the branching order. Consider the following tree,
\texttt{vrt1.nw}:
\begin{samepage}
\verbatiminput{topol_1_txt.out}
\end{samepage}
Its structure is not evident, particularly in the upper half. This is because
many branches are short in relation to the depth of the tree, so they are not
well resolved. A better-resolved tree can be obtained by discarding branch
lengths altogether:
\verbatiminput{topol_2_txt.cmd}
\begin{samepage}
\verbatiminput{topol_2_txt.out}
\end{samepage}
This effectively produces a \emph{cladogram}, that is, a tree that represents
ancestry relationships but not amounts of evolutionary change. The inner nodes
are evenly spaced over the depth of the tree, and the leaves are aligned, so
the branching order is more apparent.

Of course, \ascii{} trees have low resolution in the first place, so I'll show
both trees look in \svg. First the original:
\verbatiminput{topol_3_svg.cmd}
\includegraphics{topol_3_svg.pdf} \\

\noindent{}And now as a cladogram:
\verbatiminput{topol_4_svg.cmd}
\includegraphics{topol_4_svg.pdf} \\
As you can see, even with \svg{}'s much better resolution, it can be useful to
display the tree as a cladogram.

\topology{} has the following options: \texttt{-b} keeps the branch lengths (obviously, using this option alone has no effect); \texttt{-I} discards inner node labels, and \texttt{-L} discards leaf labels. An extreme example is the following, which discards everything \emph{but} topology:
\verbatiminput{topol_5_txt.cmd}
This produces the following tree, which is still valid Newick:
\verbatiminput{topol_5_txt.out}
Let's look at it as a radial tree, for a change:
\verbatiminput{topol_6_svg.cmd}
\begin{center}
\includegraphics{topol_6_svg.pdf}
\end{center}