\section{Checking Summaries}\label{sec:checking-summary}

Here we explain how $\textmd{CheckSummary} (\prog{P}_k, S[\bullet])$ is achieved,
where $\prog{P}_k$ is an unwound program and $S[\bullet]$ is an array of
function summaries.
Let $G^\fun{f}_k = \langle V, E, \cmd{cmd}^\fun{f}, \overline{\mathtt{u}}^\fun{f}, \overline{\mathtt{r}}^\fun{f},s,e \rangle$ be a
control flow graph for the function $\fun{f}$ in $\prog{P}_k$. In order to check whether the function
summary $S[{\fun{f}}]$ for $\fun{f}$ specifies the relation
between the formal parameters and return values of $\fun{f}$,
we define another control flow graph
$\hat{G}^\fun{f}_{k,S} = \langle V, E, \hat{\cmd{cmd}}^\fun{f}, \overline{\mathtt{u}}^\fun{f}, \overline{\mathtt{r}}^\fun{f},s,e \rangle$ where
\begin{equation*}
  \begin{array}{rcl}
    \hat{\cmd{cmd}}^\fun{f} (\ell, \ell') & = &
    \left\{
      \begin{array}{ll}
        \overline{\mathtt{x}} := \overline{\mathtt{nondet}}; & \\[-8pt]

        \mathtt{assume\ }S[{\fun{g}}][
          \overline{\mathtt{u}}^\fun{g} \mapsto \overline{p},
          \overline{\mathtt{r}}^\fun{g} \mapsto \overline{\mathtt{x}}]
        & \text{ if } \cmd{cmd}^\fun{f} (\ell, \ell') =
          \overline{\mathtt{x}} := \fun{g} (\overline{p}) \\

        \overline{\mathtt{r}}^\fun{f} := \overline{q}
        & \text{ if } \cmd{cmd}^\fun{f} (\ell, \ell') =
          \mathtt{return\ }\overline{q} \\

        \cmd{cmd}^\fun{f} (\ell, \ell')
        & \text{ otherwise}
      \end{array}
    \right.
  \end{array}
\end{equation*}

\begin{figure}[t]
  \centering
    \begin{tikzpicture}[scale=1.2,->,>=stealth',shorten >=1pt,auto,node
      distance=2cm,thick,node/.style={circle,draw,minimum width=0.8cm,inner sep=0}]

      \node[node] (00) at (0, 0)  {$\ell$};
      \node[node] (01) at (0, -2) {$\ell'$};

      \node (arrow_s0) at ( .3, -1) {};
      \node (arrow_e0) at (1.3, -1) {};

      \node[node] (10) at (1.6, 0)  {$\ell$};
      \node[node] (11) at (1.6, -2) {$\ell'$};

      \node[node] (20) at (7.4, 0)  {$\ell$};
      \node[node] (21) at (7.4, -2) {$\ell'$};

      \node (arrow_s1) at (7.8, -1) {};
      \node (arrow_e1) at (8.7, -1) {};

      \node[node] (30) at (9, 0)  {$\ell$};
      \node[node] (31) at (9, -2) {$\ell'$};

      \path
        (00) edge [left]
             node {$\overline{\mathtt{x}} := \fun{g}(\overline{p})$} (01)

        (arrow_s0) edge [dotted]
                  node {} (arrow_e0)

        (10) edge
             node {\small$
               \begin{array}{l}
                 \overline{\mathtt{x}} := \overline{\mathtt{nondet}};\\
                 \mathtt{assume\ }S[\fun{g}]
                 [\overline{\mathtt{u}}^\fun{g} \mapsto \overline{p},
                  \overline{\mathtt{r}}^\fun{g} \mapsto \overline{\mathtt{x}}]
               \end{array}
             $} (11)

        (20) edge [left]
             node {$\mathtt{return\ } \overline{q}$} (21)

        (arrow_s1) edge [dotted]
                  node {} (arrow_e1)

        (30) edge
             node {$\overline{\mathtt{r}}^\fun{g} := \overline{q}$} (31)
             ;
    \end{tikzpicture}

  \caption{Instantiating a Summary}
  \label{figure:instantiating-summary}
\end{figure}

The control flow graph $\hat{G}^{\fun{f}}_{k,S}$ replaces every
function call in $G_k^\fun{f}$ by instantiating a function
summary (Figure~\ref{figure:instantiating-summary}).
Using the Hoare Logic proof rule for recursive functions~\cite{Oheimb99}, we have the
following proposition:
\begin{proposition}
  \label{proposition:check_summary}
  Let $G^\fun{f}_k = \langle V, E, \cmd{cmd}^\fun{f}, \overline{\mathtt{u}}^\fun{f}, \overline{\mathtt{r}}^\fun{f},s,e \rangle$ be the control flow graph for the function
  $\fun{f}$ and $S[\bullet]$ be an array of logic formulae over the formal
  parameters and return variables of each function. If $\assert{\TT}\
  \hat{G}^\fun{g}_{k,S}\ \assert{S[\fun{g}]}$ for every
  function $\fun{g}$ in $\prog{P}$, then $\assert{\TT}\ \overline{\mathtt{r}}^\fun{f} :=
  \fun{f} (\overline{\mathtt{u}}^\fun{f})\ \assert{S[\fun{f}]}$.
\end{proposition}

It is easy to check $\assert{\TT}\ \hat{G}^\fun{g}_{k,S}\
\assert{S[\fun{g}]}$ by program analysis. Let $G_k^{\fun{f}}$ be
the control flow graph for the function $\fun{f}$ and
$\hat{G}^\fun{g}_{k,S} = \langle V, E, \hat{\cmd{cmd}}^\fun{f}, \overline{\mathtt{u}}^\fun{f}, \overline{\mathtt{r}}^\fun{f},s,e \rangle$ as
above. Consider another control flow graph $\tilde{G}^\fun{f}_{k,S} =
\langle \tilde{V}, \tilde{E}, \tilde{\cmd{cmd}}^\fun{f} , \overline{\mathtt{u}}^\fun{f}, \overline{\mathtt{r}}^\fun{f},s,e \rangle$ where
\begin{equation*}
  \begin{array}{rcl}
    \tilde{V} & = & V \cup \{ \tilde{e} \}\\
    \tilde{E} & = & E \cup \{ (e, \tilde{e}) \}\\
    \tilde{\cmd{cmd}}^\fun{f} (\ell, \ell') & = &
    \left\{
      \begin{array}{ll}
        \hat{\cmd{cmd}}^\fun{f} (\ell, \ell') &
        \text{ if } (\ell, \ell') \in E\\
        \mathtt{assert\ } S[\fun{f}] &
        \text{ if } (\ell, \ell') = (e, \tilde{e})
      \end{array}
    \right.
  \end{array}
\end{equation*}

\pagebreak
\begin{corollary}
  Let $G^\fun{f}_k = \langle V, E, \cmd{cmd}^\fun{f}, \overline{\mathtt{u}}^\fun{f}, \overline{\mathtt{r}}^\fun{f},s,e \rangle$ be the control flow graph for the function
  $\fun{f}$ and $S[\bullet]$ be an array of logic formulae over the formal
  parameters and return variables of each function. If $\method{BasicAnalyzer}
  (\tilde{G}^\fun{g}_{k,S})$ returns $\mathit{Pass}$ for every function
  $\fun{g}$ in \prog{P}, then $\assert{\TT}\ \overline{\mathtt{r}}^\fun{f} :=
  \fun{f} (\overline{\mathtt{u}}^\fun{f})\ \assert{S[\fun{f}]}$.
  \label{corollary:check-summary}
\end{corollary}

\begin{algorithm}[t]
\begin{doublespace}
  \KwIn{$\prog{P}_k$ : an unwound program; $S[\bullet]$ : an array of function summaries}
  \KwOut{$\TT$ if all function summaries are valid; $\FF$ otherwise}
  \ForEach{function $G_k^\fun{f} \in \prog{P}_k$}
  {
    \If{$\method{BasicAnalyzer} (\tilde{G}_{k,S}^{\fun{f}}) \neq
      \mathit{Pass}$}
    {
      \Return $\FF$
    }
  }
  \Return $\TT$\;
\end{doublespace}
  \caption{$\textmd{CheckSummary} (\prog{P}_k, S)$}
  \label{algorithm:check-summary}
\end{algorithm}


\documentclass[landscape,twocolumn,letterpaper,9pt,reqno]{article}\usepackage[]{graphicx}\usepackage[]{color}
%% maxwidth is the original width if it is less than linewidth
%% otherwise use linewidth (to make sure the graphics do not exceed the margin)
\makeatletter
\def\maxwidth{ %
  \ifdim\Gin@nat@width>\linewidth
    \linewidth
  \else
    \Gin@nat@width
  \fi
}
\makeatother

\definecolor{fgcolor}{rgb}{0.345, 0.345, 0.345}
\newcommand{\hlnum}[1]{\textcolor[rgb]{0.686,0.059,0.569}{#1}}%
\newcommand{\hlstr}[1]{\textcolor[rgb]{0.192,0.494,0.8}{#1}}%
\newcommand{\hlcom}[1]{\textcolor[rgb]{0.678,0.584,0.686}{\textit{#1}}}%
\newcommand{\hlopt}[1]{\textcolor[rgb]{0,0,0}{#1}}%
\newcommand{\hlstd}[1]{\textcolor[rgb]{0.345,0.345,0.345}{#1}}%
\newcommand{\hlkwa}[1]{\textcolor[rgb]{0.161,0.373,0.58}{\textbf{#1}}}%
\newcommand{\hlkwb}[1]{\textcolor[rgb]{0.69,0.353,0.396}{#1}}%
\newcommand{\hlkwc}[1]{\textcolor[rgb]{0.333,0.667,0.333}{#1}}%
\newcommand{\hlkwd}[1]{\textcolor[rgb]{0.737,0.353,0.396}{\textbf{#1}}}%
\let\hlipl\hlkwb

\usepackage{framed}
\makeatletter
\newenvironment{kframe}{%
 \def\at@end@of@kframe{}%
 \ifinner\ifhmode%
  \def\at@end@of@kframe{\end{minipage}}%
  \begin{minipage}{\columnwidth}%
 \fi\fi%
 \def\FrameCommand##1{\hskip\@totalleftmargin \hskip-\fboxsep
 \colorbox{shadecolor}{##1}\hskip-\fboxsep
     % There is no \\@totalrightmargin, so:
     \hskip-\linewidth \hskip-\@totalleftmargin \hskip\columnwidth}%
 \MakeFramed {\advance\hsize-\width
   \@totalleftmargin\z@ \linewidth\hsize
   \@setminipage}}%
 {\par\unskip\endMakeFramed%
 \at@end@of@kframe}
\makeatother

\definecolor{shadecolor}{rgb}{.97, .97, .97}
\definecolor{messagecolor}{rgb}{0, 0, 0}
\definecolor{warningcolor}{rgb}{1, 0, 1}
\definecolor{errorcolor}{rgb}{1, 0, 0}
\newenvironment{knitrout}{}{} % an empty environment to be redefined in TeX

\usepackage{alltt}

\usepackage{lscape,fancyhdr}

\usepackage{hyperref}

\pagestyle{fancy}

\usepackage{amsmath,epsfig,subfigure,amsthm,amsfonts,epsf,psfrag,rotating,setspace,bm}

\usepackage{verbatim,color} % Allow text colors}

\setlength{\oddsidemargin}{-0.4in}		% default=0in
\setlength\evensidemargin{-0.4in}

\setlength{\textwidth}{9.8in}		% default=9in

\setlength{\columnsep}{0.5in}		% default=10pt

\setlength{\columnseprule}{0pt}		% default=0pt (no line)

\setlength{\textheight}{7.0in}		% default=5.15in

\setlength{\topmargin}{-0.75in}		% default=0.20in

\setlength{\headsep}{0.25in}		% default=0.35in

\setlength{\parskip}{1.2ex}

\setlength{\parindent}{0mm}

\lhead{Course EPIB607: Regression handout 004 (Poisson regression)}
\rhead{jh,sb \ \ \ v. 2018.11.15}
\IfFileExists{upquote.sty}{\usepackage{upquote}}{}
\begin{document}

\section{Malaria control with bednets}

See the 2018 Lancet article \textit{Efficacy of Olyset Duo, a bednet containing pyriproxyfen and permethrin, versus a permethrin-only net against clinical malaria in an area with highly pyrethroid-resistant vectors in rural Burkina Faso: a cluster-randomised
	controlled trial} (\texttt{Bednets.pdf} in \texttt{A9} folder of myCourses) by Tiono et. al. Reproduce the Rate ratio (95\% CI) in Table 2. Calculate the rate difference and 95\% CI comparing PPF-treated to Standard long-lasting insecticidal nets. Check the goodness of fit.

\begin{knitrout}
\definecolor{shadecolor}{rgb}{0.969, 0.969, 0.969}\color{fgcolor}
\begin{verbatim}
##
## Call:
## glm(formula = cases ~ exposure + offset(log(years)), family = poisson(link = log),
##     data = df)
##
## Deviance Residuals:
##     Min       1Q   Median       3Q      Max
## -16.682   -4.732    1.497    3.984   12.024
##
## Coefficients:
##             Estimate Std. Error z value Pr(>|z|)
## (Intercept)  0.68314    0.02432  28.092  < 2e-16 ***
## exposure    -0.26687    0.03286  -8.121 4.62e-16 ***
## ---
## Signif. codes:  0 '***' 0.001 '**' 0.01 '*' 0.05 '.' 0.1 ' ' 1
##
## (Dispersion parameter for poisson family taken to be 1)
##
##     Null deviance: 1381.2  on 23  degrees of freedom
## Residual deviance: 1316.0  on 22  degrees of freedom
## AIC: 1476.7
##
## Number of Fisher Scoring iterations: 5
\end{verbatim}

\end{knitrout}

\clearpage

\section{Population mortality rates in Denmark}
\small

\vspace*{-.1in}

We can fit the following simple (multiplicative) rate ratio model to the
patterns of mortality rates  for 1980-1984 and  2000-2004. The reference cell is females 70-74,   1980-84. $R$ = rate. $M$ = multiplier.

\begin{tabular}{|l c | l l  l  l  | l l l l | l |}
	\hline
	Year  & Age & \multicolumn{3}{c}{Female (F)} & &   \multicolumn{3}{c}{Male (M)} & \\
	\hline
	& 70-74 &  $R_{F}$ & & & & $R_{F}$ & & $\times M_{M}$  & \\
	1980- & 75-79 &  $R_{F}$ & $ \times M_{75}$ & &   & $R_{F}$ & $\times M_{75}$ & $\times M_{M}$ & \\
	1984 & 80-84 & $R_{F}$ & $ \times M_{80}$ &  & &  $R_{F}$ & $ \times M_{80}$ & $ \times M_{M}$ & \\
	& 85-89 & $R_{F}$ & $ \times M_{85}$ &  & &  $R_{F}$ & $ \times M_{85}$ & $ \times M_{M}$ & \\
	\hline
	& 70-74 &  $R_{F}$ &  & & $\times M_{20y}$  &  $R_{F}$ & & $  \times M_{M}$  & $\times M_{20y}$\\
	2000- & 75-79 &  $R_{F} $ & $\times M_{75}$ & & $\times M_{20y}$ &  $R_{F}$ & $ \times M_{75}$ & $ \times M_{M}$& $\times M_{20y}$ \\
	2004      & 80-84 & $R_{F}$ & $ \times M_{80}$ & & $\times M_{20y}$ &   $R_{F}$ & $ \times M_{80}$ & $ \times M_{M}$ & $\times M_{20y}$ \\
	& 85-89 & $R_{F}$ & $ \times M_{85}$ & \ \ \ & $\times M_{20y}$&   $R_{F}$ & $\times M_{85}$ & $\times M_{M}$ & $\times M_{20y}$ \\
	\hline
\end{tabular}

%The array called `r' in the R code ( which fits additive models to the rates and logs of the rates)can be used to calculate ratios.

\begin{knitrout}
\definecolor{shadecolor}{rgb}{0.969, 0.969, 0.969}\color{fgcolor}
\begin{tabular}{l|l|r|r|r|r|r|r}
\hline
Year & Age & Female\_deaths & Female\_PT & Female\_rate & Male\_deaths & Male\_PT & Male\_rate\\
\hline
1980-1984 & 70-74 & 15989 & 586882.8 & 0.0272439 & 23810 & 456908.21 & 0.0521111\\
\hline
1980-1984 & 75-79 & 20838 & 454142.7 & 0.0458843 & 24707 & 300318.92 & 0.0822692\\
\hline
1980-1984 & 80-84 & 24073 & 297678.6 & 0.0808691 & 20319 & 167303.51 & 0.1214499\\
\hline
1980-1984 & 85-89 & 20216 & 147771.7 & 0.1368057 & 13524 & 74295.83 & 0.1820291\\
\hline
2000-2004 & 70-74 & 13912 & 521561.9 & 0.0266737 & 17360 & 436994.92 & 0.0397259\\
\hline
2000-2004 & 75-79 & 19731 & 471945.5 & 0.0418078 & 22477 & 341362.82 & 0.0658449\\
\hline
2000-2004 & 80-84 & 25541 & 369989.9 & 0.0690316 & 22992 & 217929.72 & 0.1055019\\
\hline
2000-2004 & 85-89 & 27135 & 226798.1 & 0.1196439 & 17444 & 104009.58 & 0.1677153\\
\hline
2005-2009 & 70-74 & 12179 & 540568.6 & 0.0225300 & 15782 & 472012.84 & 0.0334355\\
\hline
2005-2009 & 75-79 & 17273 & 444474.2 & 0.0388616 & 19547 & 344351.34 & 0.0567647\\
\hline
2005-2009 & 80-84 & 23513 & 363534.1 & 0.0646789 & 21781 & 230530.24 & 0.0944822\\
\hline
2005-2009 & 85-89 & 26842 & 237877.3 & 0.1128397 & 17811 & 114485.04 & 0.1555749\\
\hline
\end{tabular}

\end{knitrout}

%The equation is for the rate in any given age-group in a given gender in a given calendar period:
\textcolor{white}{text}\newline

\begin{tabular}{c c c c c c c c c}
	Rate = & $\rule{1cm}{0.15mm}$ & $\times \rule{1cm}{0.15mm}$ & $\times \rule{1cm}{0.15mm}$ & $\times \rule{1cm}{0.15mm}$ & $\times \rule{1cm}{0.15mm}$ & $\times \rule{1cm}{0.15mm}$ \\
	& &   if  &  if &  if & if & if & \\
	& &  75-79 & 80-84 & 85-89 & male & 2000-04 \\  \\
	$\log[Rate] =$ & $\rule{1cm}{0.15mm}$ & $+ \rule{1cm}{0.15mm}$ & $+ \rule{1cm}{0.15mm}$ & $+ \rule{1cm}{0.15mm}$ & $+ \rule{1cm}{0.15mm}$ & $+ \rule{1cm}{0.15mm}$ \\
	& &   if  &  if &  if & if & if & \\
	& &  75-79 & 80-84 & 85-89 & male & 2000-04 \\ \\

	$\log[Rate] =$ &$\rule{1cm}{0.15mm}$& $+  \rule{1cm}{0.15mm}$ & $+   \rule{1cm}{0.15mm}$ & $+   \rule{1cm}{0.15mm}$ & $+   \rule{1cm}{0.15mm} $ & $+ \rule{1cm}{0.15mm}$ \\
	& &  $\times$  &  $\times$ &  $\times$ & $\times$ & $\times$ & \\
	& &  $I_{75-79}$ & $I_{80-84}$ & $I_{85-89}$ & $I_{male}$ & $I_{2000-04}$ \\
\end{tabular}

where each $`I'$ is a (0/1) indicator of the category in question. By using both the 0 and 1 values of each $I$, this 6-parameter equation  produces a fitted value for each of the $4\times2\times2=16$ cells.

%You can also think of $I_{75-79},$  $I_{80-84},$ and  $I_{85-89}$ as
%`radio buttons':  at most 1 of them can be `on' at the same time, since there are 4
%age levels in all.

\end{document}


\newpage\subsection{Irreducibility}

\begin{myitemize}
\item \href{https://euclid.ucc.ie/mathenr/IMOTraining/Polynomials2015.pdf}{Summer Camp 2015 Handout}
\item \href{http://yufeizhao.com/olympiad/intpoly.pdf}{Yufei Zhao's Handout}
\end{myitemize}

\begin{take_note*}{What can be showed to prove Irreducibility}
    \begin{itemize}[wide=5pt]
        \item Writing $ f = g\cdot h $ and equating coefficients
        \item If the polynomial involves some prime, it's often useful to try factoring modulo that prime
        \item If the last coefficient is a prime, then there are some obvious bounds on the roots
        \item If there are bounds on the coefficients, then try root bounding
    \end{itemize}
\end{take_note*}

\bigskip

\begin{minipage}[t]{.48\linewidth}
    \lem{Bounds On Roots}{$ P $ is a monic polynomial. Suppose $ P(0)\neq0 $ and at most one complex root of $ P $ has absolute value at least $ 1 $. Then $ P $ is irreducible.\label{lemma:root_irred_1}}
\end{minipage}\hfill%
\begin{minipage}[t]{.48\linewidth}
    \lem{}{$ P $ is a monic polynomial. Suppose that $ |P(0)| $ is prime, and all complex roots of $ P $ have absolute value greater than $ 1 $. Then $ P $ is irreducible.\label{lemma:root_irred_2}}
\end{minipage}

\bigskip

\begin{minipage}[t]{.48\linewidth}
    \lem{Leading Coefficient is LARGE}{Let $ P(x) = b_nx^n + b_{n-1}x^{n-1} + \dots + b_1x + b_0 $ such that
        \[|b_n| > |b_{n-1}| + |b_{n-2}| + \dots + |b_0|\]
        Then every root $ \alpha $ of $ P $ is \textbf{strictly inside of the unit circle}, i.e. $ |\alpha| < 1 $.\\

    i.e. If the first coefficient of the polynomial is very large, then all of the roots lie inside the unit circle.}
\end{minipage}\hfill%
\begin{minipage}[t]{.48\linewidth}
    \lem{Coefficients form a Decreasing Sequence}{Let $ P(x) = a_nx^n + a_{n-1}x^{n-1} + \dots + a_1x + a_0 $ be a real polynomial. Such that,
        \[a_n\ge a_{n-1} \ge \dots \ge a_1 \ge a_0 > 0\]
        Then any complex $ z $ of $ P(x) $ satisfies $ |z|\le 1 $\\

    i.e. If the coefficients form a decreasing sequence then all of the roots lie on or inside the unit circle.}
\end{minipage}

\bigskip

\begin{minipage}[t]{.48\linewidth}
    \lem{Constant is LARGE}{Let $ P(x) = a_nx^n + a_{n-1}x^{n-1} \dots + a_1x + a_0 $ be a polynomial over integers. Where, $ a_0 $ is a prime, and
        \[|a_0| > |a_n| + |a_{n-1}| + \dots + |a_1|\]
    Prove that $ P(x) $ is irreducible.}
\end{minipage}\hfill%
\begin{minipage}[t]{.48\linewidth}
    \theo{https://en.wikipedia.org/wiki/Rouche's_theorem}{Rouché's Theorem}{Let $ f,g $ be analytic functions on and inside a simple closed curve $ \mathcal{C} $. Suppose that \[ |f(z)| > |g(z)| \] for all points $ z $ on $ \mathcal{C} $. Then $ f $ and $ f+g $ have the same number of zeroes (counting multiplicities) interior to $ \mathcal{C} $}
\end{minipage}

\theo{https://artofproblemsolving.com/community/c2562h1422017s3_perrons_irreducibility_criterion}{Perron's Criterion}{Let $ P(x) = x^n + a_{n-1}x^{n-1} + a_{n-2}x^{n-2} \dots a_1x + a_0 $ be a polynomial over integers such that \[|a_{n-1}| > 1 + |a_{n-2}| + |a_{n-3}| + \dots + |a_1| + |a_0|\] Then $ P(x) $ is irreducible.}

\rem{The crucial idea behind the proof is that $ |a_0|\ge 1 $, and if the polynomial is reducible, then there are at least two roots $ |z| \ge 1 $.}

\begin{prooof}[Bounding Roots]
    Let $ P(z) = 0 $ for some $ |z|=1, z\in\mathbb{C} $. That means we have
    \begin{align*}
        -a_{n-1}z^{n-1} &=  z^n + a_{n-2}z^{n-2} \dots a_1z + a_0 \\
        \implies |a_{n-1}| &= |z^n + a_{n-2}z^{n-2} \dots a_1z + a_0|\\
                           &\le |1| + |a_{n-2}| \dots + |a_0|
    \end{align*}
    Which is a contradiction. So $ |z|\ne 1 $.\\

    We know that there exist a root $ z $ that has an absolute value greater than $ 1 $. We prove that there is only one such root of $ P(x) $. \\

    First, let $ P(x)=(x-z)Q(x) $, where $ |z|>1 $, and $ Q(x) = x^{n-1} + b_{n-2}x^{n-2} + \dots + b_1x + b_0 $.

    So we have,
    \begin{align*}
        P(x) &= (x-z)Q(x)\\
        x^n + a_{n-1}x^{n-1} + a_{n-2}x^{n-2} \dots a_1x + a_0 &= x^n + (b_{n-2} - z)x^{n-1} + \dots + (b_0-zb_1)x+ zb_0\\
    \end{align*}%
    \begin{align*}
        \implies |b_{n-2} - z| &> 1 + |b_{n-3} - zb_{n-2}| + \dots + |b_0 - zb_1| + |zb_0|\\[.5em]
        |b_{n-2}| + |z| & > 1 - |b_{n-3}| + |z||b_{n-2}| + \dots |b_0| - |z||b_1| + |z|b_0|\\[.5em]
        |b_{n-2}| + |z| &= (|z|-1)(|b_{n-2}| + |b_{n-3} \dots |b_0|) + |b_{n-2}| + 1\\[.5em]
        1 &> |b_{n-2}| + |b_{n-3} \dots |b_0|
    \end{align*}

    And by \autoref{lemma:Leading Coefficient is LARGE}, $ Q(x) $ does not have any root $ |z|>1 $.
    \end{prooof}

    %	\theo{}{Hensel's Lemma}{Let $ a_0, a_1, \dots , a_n $ be integers, and let $ P(x) =a_nx^n+\dots a_1x+a_0 $, and let $ P'(x) $ denote the derivative of $ P(x) $. Suppose that $ x_1 $ is an integer such that $ P(x_1)\equiv 0\ (\mod\ p) $ and $ P'(x_1)\not\equiv 0\ (\mod\ p) $. Then, for any positive integer $ k $, there exists an unique residue $ x_k\ (\mod\ p^k) $, such that $ P(x_k)\equiv 0\ (\mod\ p^k) $ and $ x_k\equiv x_1 \ (\mod\ p)$.}

    \theo{}{Perron's Criterion's Generalization (Dominating Term)}{Let $ P(z) = a_nz^n + a_{n-1}z^{n-1} + \dots + a_1z + a_0 $ be a complex polynomial, such that its $ a_k $ term is dominant, that is,
        \[|a_k| > |a_0| + |a_1| + \dots |a_{k-1}| + |a_{k+1}| +\dots + |a_{n}|\]
    for some $ 0 \le k \le n $. Then exactly $ k $ roots of $ P $ lies strictly inside of the unit circle, and the other $ n-k $ roots of $ P $ lies strictly outside of the unit circle.}

    \proof{A direct application of \autoref{theorem:Rouché's Theorem}.}

    \newpage

    \lem{Bound on roots}{Let $ f(x) = a_nx^n + a_{n-1}x^{n-1}\dots + a_1x+a_0 $ be an integer polynomial. Suppose that $ a_n\ge 1, a_{n-1}\ge 0 $ and $ a_i\le H $ for some positive constant $ H $ and $ i = 0, 1, \dots n-2 $. Then any complex zero $ \a $ of $ f(x) $ has either \textit{nonpositive real part}, or satisfies
    \[|\a| < \frac{1+\sqrt{1+4H}}{2}\]}

    \proof{Suppose $ z $ is a root such that $ |z|>1 $ and $ \mathrm{Re}\ z >0 $. Then we have
        \begin{align*}
            \left|\frac{f(z)}{z^n}\right| &\ge \left(a_n - \frac{a_{n-1}}{z}\right) - H\left(\frac{1}{|z|^2} + \frac{1}{|z|^3} \dots \frac{1}{|z|^n}\right)\\[1em]
                &> \mathrm{Re\ }\left(a_n+\frac{a_{n-1}}{z}\right) - \frac{H}{|z|^2-|z|}\\[.5em]
                &\ge 1 - \frac{H}{|z|^2-|z|}\\[1em]
                & = \frac{|z|^2-|z| - H}{|z|^2-|z|}\\[.2em]
                & \ge 0
            \end{align*}
            Whenever \[|z| \ge \frac{1+\sqrt{1+4H}}{2}\]
        }

        \theo{https://en.wikipedia.org/wiki/Cohn's_irreducibility_criterion}{Cohn's Criterion}{Suppose $ p $ is a prime number, expressed as $ \overline{p_np_{n-1}\dots p_1p_0} $ in base $ b\ge 2 $. Then the polynomial
            \[f(x) = p_nx^n + p_{n-1}x^{n-1} \dots +p_1x + p_0\]
        is irreducible.}

        \prob{https://artofproblemsolving.com/community/c6h82906p475370}{ISL 2005 A1}{E}{Find all pairs of integers $a,b$ for which there exists a polynomial $P(x) \in \mathbb{Z}[X]$ such that product $(x^2+ax+b)\cdot P(x)$ is a polynomial of a form \[ x^n+c_{n-1}x^{n-1}+\cdots+c_1x+c_0 \] where each of $c_0,c_1,\ldots,c_{n-1}$ is equal to $1$ or $-1$.}

        \solu{The idea of bounding the roots using the coefficients.}

        \prob{}{}{EM}{Let $ P(x) $ be a polynomial with real coefficients, and $ P(x)\geq 0 $ for all $ x\in \R $. Prove that there exists two polynomials $ R, S \in \Q $ such that
        \[P(x) = R(x)^2 + Q(x)^2\]}

        \prob{https://artofproblemsolving.com/community/c6h84391p488980}{Romanian TST 2006 P2}{M}{Let $p$ a prime number, $p\geq 5$. Find the number of polynomials of the form
        \[ x^p + px^k + p x^l + 1, \quad k > l, \quad k, l \in \left\{1,2,\cdots,p-1\right\}, \] which are irreducible in $\mathbb{Z}[X]$.}

        \solu{Taking mod $ p $, we have that $ x^p+1\equiv (x+1)^p (\mod\ p) $. Now we can try equating terms or plug in some values to check for equality.}

        \prob{https://artofproblemsolving.com/community/c6h53271p334363}{Romanian TST 2003 P5}{M}{Let $f\in\mathbb{Z}[X]$ be an irreducible polynomial over the ring of integer polynomials, such that $|f(0)|$ is not a perfect square. Prove that if the leading coefficient of $f$ is 1 (the coefficient of the term having the highest degree in $f$) then $f(X^2)$ is also irreducible in the ring of integer polynomials.}

        \solu{If $ f(x^2) = g(x)h(x) $, plugging $ -x $ gives us $ g(x)h(x) = g(-x)h(-x) $. So we should look at the common roots of $ h(x) $ and $ h(-x) $. And it is straightforward from here.}

        \solu{}


\chapter{Machine Learning}
\begin{margintable}\vspace{.8in}
    In this chapter

    \begin{tabularx}{\marginparwidth}{|X}
    Review and Overview\\
    Formulation of supervised learning\\
    Regression problems \\and squared loss\\
    Linear regression under squared loss\\
    \end{tabularx}
\end{margintable}

\newcommand{\cX}{\mathcal{X}}
\newcommand{\cY}{\mathcal{Y}}

\section{Review and Overview}
In this lecture we delineate a mathematical framework for supervised learning. We focus on regression problems and define the notion of the loss/risk associated with a model. We then analyze a particular loss function (the squared loss) in a general setting, then specialize our result to the case of linear models. We next define the notion of parameterized families of hypotheses and the maximum likelihood estimate, and we conclude with an asymptotic result relating the training MLE to the true maximum likelihood parameter.

\section{Formulation of supervised learning}
We begin by constructing a mathematical framework for prediction problems. Our framework consists of the following elements:
\begin{enumerate}
	\item A space of possible data points $\cX$.
	\item A space of possible labels $\cY$.
	\item A joint probability distribution $P$ on $\cX\times \cY$. We assume that our training data consists of $n$ points $$(x^{(1)}, y^{(1)}), \: \ldots, \: (x^{(n)}, y^{(n)}) \: \iid \: P$$ each drawn independently from $P$.
	\item A prediction function/model $f: \cX\rightarrow \cY$.
	\item A loss function $\ell: \cY\times \cY\rightarrow \mathbb{R}$. We will usually assume that $\ell$ is bounded below by some constant, typically $0$.
\end{enumerate}
Given the prediction function $f$ and the loss function $\ell$, the loss of an example is $\ell(f(x),y)$. We can then define the \textit{expected risk} (or \textit{expected loss}, or \textit{population risk})
$$L(f) \defn \E_{(x,y)\sim P} [\ell(f(x),y)].$$ Our goal will be to obtain a small expected loss. Often it will be infeasible to consider all possible models $f$, so we may restrict ourselves to a certain family of hypotheses $\mathcal{F}$. In this case, we define the \textit{excess risk} of a model $f$ as $$L(f) - \inf_{g\in\mathcal{F}} L(g).$$ This gives us a measure of how well our model fits the data relative to the best we can hope to do within our set of options $\mathcal{F}$.

Within this framework, there are two main types of problems we will consider: \textit{regression} problems, where the set of labels is $\cY=\mathbb{R}$; and \textit{classification} problems, where the set of labels is some finite set $\cY=\{1,\ldots,k\}$. We will focus on regression problems in this lecture.

\section{Regression problems and squared loss}
We consider the regression problem of predicting $y$ given $x$. We take as our loss function the \textit{squared loss} $$\ell(\hat{y},y) = (\hat{y}-y)^2, \hspace{.5in} L(f) = \E_{(x,y)\sim P}[(f(x)-y)^2].$$ In this setting, we can decompose the risk in a very informative way.
\begin{lemma}[Decomposition of loss] \label{decomp}
Under the squared loss, we have the decomposition $$L(f) = \E_{x\sim P_x} [(f(x)-\E[y \: | \: x])^2] + \E_{x\sim P_x}[\Var(y\: | \:x)]$$ where $P_x$ is the marginal distribution of $x$.
\end{lemma}

The second term in this expansion is the intrisic variable of the label; it gives a lower bound on the loss we can achieve. Since the first term in the decomposition is nonnegative, it is an immediate corrolary that the optimal model is $f(x) = \E[y \: | \: x]$.

In order to prove Lemma 1, we make use of the following claim.
\begin{center}
    If $Z$ is a random variable and $a$ is a constant, then $$\E[(Z-a)^2] = (\E[Z]-a)^2 + \Var(Z).$$
\end{center}

The proof of this claim is left as an exercise on HW 0. We are now ready to prove Lemma 1.
\begin{proof}[Proof of Lemma \ref{decomp}]
We have
\begin{align*}
    L(f) &= \E[(f(x)-y)^2] \\
    &= \E_{x\sim P_x}[\E_{P_{y \; | \;x}}[(f(x)-y)^2\: | \: x]] & \mathrm{(Law~{} of~{} total~{} expectation)} \\
    &= \E_{x\sim P_x}[(f(x)-\E[y \: | \: x])^2 + \Var(y \: | \: x)]. & \mathrm{(Claim~{} \ref{claim:variance})}
\end{align*}
Note that Claim \ref{claim:variance} holds in the third equation since $f(x)$ is a constant when we have conditioned on $x$. The desired result follows from linearity of expectation.
\end{proof}
Lemma \ref{decomp} gives us a general lower bound on risk under squared loss. If we impose more structure on the set of hypotheses $\mathcal{F}$ from which we can select $f$, we can gain more information on the risk.

\section{Linear regression under squared loss}
A commonly used choice of hypotheses is the set of linear functions: $$\mathcal{F} = \{f: \mathbb{R}^d \rightarrow \mathbb{R} \: | \: f(x) = w^\top x, \: w\in \mathbb{R}^d\}.$$ For $f\in\mathcal{F}$, we then have $$L(f) = L(w) = \E[(w^\top x-y)^2].$$ Henceforth, we will denote $w^* \in \mathrm{argmin}_{w\in\mathbb{R}^d} L(w)$ and $\hat{w}$ will denote a model learned from training data.

One may ask why we have only allowed linear functions with $0$ instead of allowing a nonzero intercept. Actually, the framework we have outlined above is enough to accomodate nonzero intercepts. If we wish to analyze the function $w^\top x + b$, we can simply set $\tilde{x} = (x,1)$ and $\tilde{w} = (w,b)$. Then $\tilde{w}^\top \tilde{x} = w^\top x + b$ and we have reduced to the case of $0$ intercept.

When we restrict to linear models, we can further decompose the risk under squared loss.
\begin{lemma} \label{lin}
With $w^*\in \mathrm{argmin}_{w\in \mathbb{R}^d}L(w)$, we have \begin{equation}\label{decomp2}L(\hat{w}) = \E_x [\Var(y \: | \: x)] + \E_x[(\E[y\: | \: x]-w^{*\top} x)^2] + \E_x[(w^{*\top} x-\hat{w}^\top x)^2].\end{equation}
\end{lemma}
The second term in equation (\ref{decomp2}) can be thought of as the approximation error incurred by linear models. The third term can be interpreted as the estimation error we incur from having only a finite sample.
\begin{proof}
Define $g(\hat{w}) \defn \E[(\E[y\: | \: x]-\hat{w}^\top x)^2]$. By Lemma \ref{decomp}, \begin{equation}\label{lem1}L(\hat{w}) = \E[\Var(y\: | \: x)] + g(\hat{w}).\end{equation} Observe that since $w^*\in \mathrm{argmin} L(w)$, $\nabla L(w^*)=0$. Furthermore, since $\E_x[\Var(y\: | \: x)]$ is a constant with respect to $w$, we have
\begin{align*}
    \nabla L(w) &= \nabla g(w) \\
    &= \E[\nabla_w(\E(y\: | \: x) -w^\top x)^2] \\
    &= 2\E[(\E(y\: | \: x) - w^\top x)x].
\end{align*}
Since $\nabla L(w^*)=0$ we have \begin{equation}\label{vanish}\E[(\E[y \: | \: x]-w^{*\top}x)x]=0.\end{equation} Next, we expand:
\begin{align*}
    g(\hat{w}) &= \E[(\E[y\: | \: x]-\hat{w}^\top x)^2] \\
    &= \E[((\E[y\: | \:x]-w^{*\top}x)-(\hat{w}^\top x-w^{*\top}x))^2] \\
    &=\E[(\E[y\: | \: x] - w^{*\top}x)^2 + (\hat{w}^\top x - w^{*\top}x)^2] \\
    &\hspace{.25in} -2\E[(\E[y \: | \: x] - w^{*\top}x)(\hat{w}^\top x-w^{*\top}x)].
\end{align*}
Finally, observe that $$\E[(\E[y\: | \:x] - w^{*\top}x)(\hat{w}^\top x - w^{*\top}x)] = (\hat{w}^\top - w^{*\top})\E[(\E[y\:|\:x]-w^{*\top}x)x].$$ By equation (\ref{vanish}), this quantity vanishes and it follows that
\begin{equation}\label{g}g(\hat{w}) = \E[(\E[y\: | \: x] - w^{*\top}x)^2] + \E[(\hat{w}^\top x - w^{*\top}x)^2].\end{equation} Combining equations (\ref{lem1}) and (\ref{g}) gives the desired result.
\end{proof}

\section{Parameterized families of hypotheses}
Linear models are one type of \textit{parameterized family} of hypotheses. In general, a parameterized family is given by a parameter space $\Theta$. For each $\theta\in\Theta$ there is a hypothesis $f_\theta(x)$, sometimes written $f(\theta; x)$. In this case we may write the loss function as $$\ell(f_\theta(x),y) = \ell((x,y),\theta).$$ In the special case of linear functions, our parameter space is $\Theta = \mathbb{R}^d$ and for $\theta \in \Theta$ we have $f_\theta(x) = \theta^\top x.$

\subsection{Well-specified case and maximum likelihood}
In the well-specified case, $P_\theta(y\: | \: x)$ is a family of distributions parameterized by $\theta\in\Theta$, and $y\: | \: x \sim P_{\theta^*}(y\: | \: x)$ is distributed according to some ground truth parameter $\theta^*$. We define the \textit{maximum likelihood} loss function by $$\ell((x,y),\theta) = -\log P_\theta(y\: | \: x),$$ so that minimizing the loss function is equivalent to maximizing the likelihood of the data.

For example, suppose that $y\: | \: x$ is Gaussian distributed with mean $\theta^{*\top}x$ and variance $1$, i.e. $y\: | \: x \sim N(\theta^{*\top}x, 1)$. The likelihood is then
\begin{align*}
    \ell((x,y),\theta) &= -\log P_\theta(y\: | \:x) \\
    &= -\log \exp\left(-\frac{(y-\theta^\top x)^2}{2}\right) + c \\
    &= \frac{(y-\theta^\top x)^2}{2} + c
\end{align*}
where $c$ is the log of the normalizing constant. This computation shows that in the Gaussian setting, minimizing the squared loss actually recovers the MLE.

\section{Training loss}
Often we do not know the true underlying distribution $P$ with which to compute the expected loss. In these cases we need to use an approximation based on the data we do have. This motivates our definition of the \textit{training loss} $$\hat{L}(\theta) \defn \frac1n \sum_{i=1}^n \ell((x^{(i)},y^{(i)}),\theta).$$ In the special case of maximum likelihood, we have $\hat{L}(\theta) = -\frac1n \sum_{i=1}^n \log p_\theta(y^{(i)}\: | \:x^{(i)})$. We define the \textit{maximum likelihood estimator} $$\hat{\theta}_{\mathrm{MLE}} \in \mathrm{argmin}_{\theta\in\Theta} \hat{L}(\theta).$$ This approximation is ``good" in the sense that as $n\rightarrow\infty$, the minimizer of the training loss $\hat{\theta}_\mathrm{MLE}$ approaches the true maximum likelihood parameter $\theta^*$. The following theorem quantifies this fact.
\begin{theorem}[Asymptotic of MLE] \label{mle}
  Assume $\nabla^2 L(\theta^*)$ is full rank. Let $\hat{\theta} = \hat{\theta}_{\mathrm{MLE}}$ and $$Q \defn \E_{(x,y)\sim P}[\nabla_\theta(\log p_\theta(y\: | \: x))(\theta^*) \nabla_\theta(\log p_\theta(y\: | \: x)(\theta^*)^\top].$$
  Assuming that $\hat{\theta}=\hat{\theta}_n\stackrel{\tiny p}{\rightarrow}\theta^\star$ (i.e. consistency) and under appropriate regularity conditions,  $$\sqrt{n}(\hat{\theta}-\theta^*)\stackrel{\tiny d}{\rightarrow} N(0, Q^{-1}) \textup{ and } n(L(\hat{\theta}) - L(\theta^*))\stackrel{\tiny d}{\rightarrow} \frac12 \chi^2(p).$$ as $n\rightarrow\infty$, where $p$ is the dimension of $\theta$ and $\chi^2(p)$ is the distribution of the sum of the squares of $p$ i.i.d. standard Gaussian random variables.
\end{theorem}

\begin{remark}
    The positive definiteness of the Hessian $\nabla^2 L(\theta^\ast)$ guarantees that identifiability holds \emph{locally} (in a neighborhood of $\theta^\ast$), but does not imply identifiability because of a lack of \emph{global} information.

To give a counter-example, suppose $\theta^\ast$ is the global minimizer of $L$ and the Hessian is positive definite, but there exists a sequence of $\theta_n$ such that $\|\theta_n-\theta^\ast\|=n$ but $L(\theta_n)=L(\theta^\ast)+1/n$, then the identifiability is violated: the inf is not strictly greater than but equal to $L(\theta^\ast)$. The reason is that the Hessian does not reveal information about $L$ outside an infinitesimal neighborhood of $\theta^\ast$.

One way to exclude such adversarial case is to assume convexity: when $L$ is convex, a local strong growth implies global growth and thus identifiability
\end{remark}

% \begin{example}[fasd]
%     sdadasd
% \end{example}


\chapter{Systems of sides}

Now we will consider a common generalization of (some of pointfree) funcoids and (some of) Galois connections.
The main purpose of this is general theorem~\ref{neg-prod} below.

First consider some properties of Galois connections:

\section{More on Galois connections}

Here I will denote $\supfun{f}$ the lower adjoint of a Galois connection~$f$. \fxnote{Switch to this notation in the book?}

Let $\mathsf{GAL}$ be the category of Galois connections.
\fxwarning{Need to decide whether use $\mathsf{GAL}(A,B)$ or $A\otimes B$.}

I will denote $(f,g)^{-1}=(g,f)$ for a Galois connection~$(f,g)$.

We will order Galois connections by the formula
\[ f\sqsubseteq g \Leftrightarrow \supfun{f}\sqsubseteq\supfun{g} \Leftrightarrow \supfun{f^{-1}}\sqsupseteq\supfun{g^{-1}}. \]

\begin{obvious}
This defines a partial order on the set of Galois connections between any two (fixed) posets.
\end{obvious}

\begin{prop}\label{gal-fjoin-x}
If $f$ and~$g$ are Galois connections (between a join-semilattice~$\mathfrak{A}$ and a meet-semilattice~$\mathfrak{B}$),
then there exists a Galois connection~$f\sqcup g$
determined by the formula~$\supfun{f\sqcup g}x = \supfun{f}x\sqcup\supfun{g}x$.
\end{prop}

\begin{proof}
It is enough to prove that
\[ (x\mapsto\supfun{f}x\sqcup\supfun{g}x, y\mapsto\supfun{f^{-1}}y\sqcap\supfun{g^{-1}}y) \]
is a Galois connection that is that
\[ \supfun{f}x\sqcup\supfun{g}x\sqsubseteq y\Leftrightarrow x\sqsubseteq\supfun{f^{-1}}y\sqcap\supfun{g^{-1}}y \] for all relevant~$x$ and~$y$.

Really,
\begin{multline*}
\supfun{f}x\sqcup\supfun{g}x\sqsubseteq y \Leftrightarrow
\supfun{f}x\sqsubseteq y\land\supfun{g}x\sqsubseteq y \Leftrightarrow \\
x\sqsubseteq\supfun{f^{-1}}y\land x\sqsubseteq\supfun{g^{-1}}y \Leftrightarrow
x\sqsubseteq\supfun{f^{-1}}y\sqcap\supfun{g^{-1}}y.
\end{multline*}
\end{proof}

\fxnote{Describe infinite join of Galois connections.}

\begin{prop}\label{a-bot}
If $\mathfrak{A}$ is a poset with least element, then $\supfun{a}\bot=\bot$.
\end{prop}

\begin{proof}
$\supfun{a}\bot\sqsubseteq y\Leftrightarrow \bot\sqsubseteq\supfun{a^{-1}}y\Leftrightarrow 1$.
Thus $\supfun{a}\bot$ is the least element.
\end{proof}

\begin{prop}
$(\mathfrak{A}\times\{\bot^\mathfrak{B}\}, \mathfrak{B}\times\{\top^\mathfrak{A}\})$ is the least Galois connection from
a poset~$\mathfrak{A}$ with greatest element to a poset~$\mathfrak{B}$ with least element.
\end{prop}

\begin{proof}
Let's prove that it is a Galois connection. We need to prove
\[ (\mathfrak{A}\times\{\bot^\mathfrak{B}\})x\sqsubseteq y \Leftrightarrow x\sqsubseteq (\mathfrak{B}\times\{\top^\mathfrak{A}\})y. \]
But this is trivially equivalent to $1\Leftrightarrow 1$. Thus it's a Galois connection.

That it the least is obvious.
\end{proof}

\begin{cor}
$\supfun{\bot}x=\bot$ for Galois connections from
a poset~$\mathfrak{A}$ with greatest element to a poset~$\mathfrak{B}$ with least element.
\fxwarning{Clarify.}
\end{cor}

\begin{thm}\label{gal-bound}
If $\mathfrak{A}$ and $\mathfrak{B}$ are bounded posets, then $\mathsf{GAL}(\mathfrak{A}, \mathfrak{B})$ is bounded.
\end{thm}

\begin{proof}
That $\mathsf{GAL} (\mathfrak{A}, \mathfrak{B})$ has least element was proved
above. I will demonstrate that $(\alpha , \beta)$
is the greatest element of $\mathsf{pFCD} (\mathfrak{A}, \mathfrak{B})$ for
\[ \alpha X = \begin{cases}
     \bot^{\mathfrak{B}} & \text{if } X = \bot^{\mathfrak{A}}\\
     \top^{\mathfrak{B}} & \text{if } X \neq \bot^{\mathfrak{A}}
   \end{cases} ; \quad
   \beta Y = \begin{cases}
     \top^{\mathfrak{A}} & \text{if } Y = \top^{\mathfrak{B}}\\
     \bot^{\mathfrak{A}} & \text{if } Y \neq \top^{\mathfrak{B}}
   \end{cases} . \]
First prove $Y \sqsubseteq \alpha X \Leftrightarrow X \sqsubseteq \beta Y$.

Really $\alpha X\sqsubseteq Y \Leftrightarrow X=\bot^{\mathfrak{A}}\lor Y=\top^{\mathfrak{B}} \Leftrightarrow X \sqsubseteq \beta Y$.

That it is the greatest Galois connection between~$\mathfrak{A}$ and~$\mathfrak{B}$ easily follows from proposition~\ref{a-bot}.
\end{proof}

\begin{thm}\label{gal-id-ex}
  For every brouwerian lattice $x \mapsto c \sqcap x$ is a lower adjoint.
\end{thm}

\begin{proof}
  By dual of theorem~\bookref{cobrow-adj}.
\end{proof}

\begin{xca}
  Describe the corresponding upper adjoint, especially for the special case of
  boolean lattices.
\end{xca}

\section{Definition}

\begin{defn}
\emph{System of presides} is
a functor $\Upsilon = (f\mapsto\supfun{f})$ from an ordered category
to the category of functions between (small) bounded lattices,
such that (for all relevant variables):
\begin{enumerate}
  \item Every Hom-set of~$\Src\Upsilon$ is a bounded join-semilattice.

  \item $\supfun{a}\bot = \bot$.

  \item $\supfun{a \sqcup b} X = \supfun{a} X \sqcup \supfun{b} X$ (equivalent to $\Upsilon$ to be a join-semilattice homomorphism,
    if we order functions between small bounded lattices component-wise).
\end{enumerate}
I call morphisms of such categories \emph{sides}.\footnote{The idea for the name is that we consider one ``side''~$\supfun{f}$ of a funcoid instead of both sides~$\supfun{f}$ and~$\supfun{f^{-1}}$.}
\end{defn}

\begin{rem}
We could generalize to functions between small join-semilattices with least elements instead of bounded lattices only, but this is not really necessary.
\end{rem}

\begin{defn}
I will call objects of the source category of this functor simply \emph{objects of the presides}.
\end{defn}

\begin{defn}
\emph{Bounded} system of presides is system of presides from an ordered category with bounded Hom-sets
such that $X,Y\in\Ob\Src\Upsilon$ the following additional axioms hold for all suitable~$a$:
\begin{enumerate}
  \item $\supfun{\bot^{\Hom(X,Y)}} a = \bot$.

  \item $\supfun{\top^{\Hom(X,Y)}} a = \top$ unless $a = \bot$
\end{enumerate}
\end{defn}

\begin{defn}
\emph{System of presides with identities} is a system of presides with
a morphism $\id_a\in\Src\Upsilon$ for every object $\mathfrak{A}$ of~$\Src\Upsilon$ and $a\in\mathfrak{A}$
and the following additional axioms:
\begin{enumerate}
  \item $\id_c \sqsubseteq 1_{\mathfrak{A}}$ for every $c \in \mathfrak{A}$
    where $\mathfrak{A}$ is an object of~$\Src\Upsilon$.

  \item $\supfun{\id_c} = (\lambda x \in \mathfrak{A}: x \sqcap c)$ for every $c \in \mathfrak{A}$
    where $\mathfrak{A}$ is an object of~$\Src\Upsilon$
\end{enumerate}
\end{defn}

\begin{defn}
\emph{System of sides} is a system of presides which is both bounded and with identities.
\end{defn}

\begin{prop}
$\supfun{1^{\Src\Upsilon}_\mathfrak{A}} a = a$ for every system of presides.
\end{prop}

\begin{proof}
By properties of functors.
\end{proof}

\begin{defn}
I call a system of \emph{monotone} presides a system of presides with additional axiom:
\begin{enumerate}
\item $\supfun{a}$ is monotone.
\end{enumerate}
\end{defn}

\begin{defn}
I call a system of \emph{distributive} presides a system of presides with additional axiom:
\begin{enumerate}
\item $\supfun{a}(X\sqcup Y) = \supfun{a}X\sqcup\supfun{a}Y$.
\end{enumerate}
\end{defn}

\begin{obvious}
Every distributive system of presides is monotone.
\end{obvious}

\begin{prop}
$\supfun{a \sqcap b} X \sqsubseteq \supfun{a} X \sqcap \supfun{b} X$ for monotone systems of sides
if Hom-sets are lattices.
\end{prop}

\begin{defn}
A system of presides \emph{with correct identities} is a system of presides with identities with additional axiom:
\begin{enumerate}
\item $\id_b\circ\id_a = \id_{a\sqcap b}$.
\end{enumerate}
\end{defn}

\begin{prop}
Every faithful system of presides with identities is with correct identities.
\end{prop}

\begin{proof}
$\supfun{\id_b\circ\id_a}x = (\supfun{\id_b}\circ\supfun{\id_a})x = \supfun{\id_b}\supfun{\id_a}x = b\sqcap a\sqcap x = \supfun{\id_{b\sqcap a}}x$.
Thus by faithfulness $\id_b\circ\id_a = \id_{b\sqcap a} = \id_{a\sqcap b}$.
\end{proof}

\begin{defn}
\emph{Restricting} a side~$f$ to an object~$X$ is defined by the formula $f|_X = f\circ\id_X$.
\end{defn}

\begin{defn}
\emph{Image} of a preside is defined by the formula $\im f=\supfun{f}\top$.
\end{defn}

\begin{defn}
Protofuncoids \emph{over} a set~$X$ of functors is a protofuncoid~$f$
such that $\supfun{f}\in X\land\supfun{f^{-1}}\in X$.
\end{defn}

\section{Concrete examples of sides}

\begin{obvious}
The category~$\mathbf{Rel}$ with $\supfun{f}=\rsupfun{f}$ for $f\in\mathbf{Rel}$ and usual $\id_c$ defines a distributive system of sides with correct identities.
\end{obvious}

\subsection{Some subsides}

\begin{defn}
\emph{Full subsystem} of a system~$\Upsilon$ of presides is the functor~$\Upsilon$ restricted to a full subcategory of~$\Src\Upsilon$.
\end{defn}

\begin{obvious}
Full subsystem of a system of presides is always a system of presides.
\end{obvious}

\begin{obvious}
Full subsystem of a bounded system of presides is always a bounded subsystem of presides.
\end{obvious}

\begin{obvious}
~
\begin{enumerate}
\item Full subsystem of a system of presides with identities is always with identities.
\item Full subsystem of a system of presides with correct identities is always with correct identities.
\end{enumerate}
\end{obvious}

\begin{obvious}
Full subsystem of a distributive system of presides is always a distributive system of presides.
\end{obvious}

\begin{obvious}
Full subsystem of a system of sides is always a system of sides.
\end{obvious}

\subsection{Funcoids and pointfree funcoids}

\begin{prop}
The category of pointfree funcoids between starrish join-semilattices with usual~$\supfun{f}$ defines a system of presides.
\end{prop}

\begin{proof}
Theorem~\bookref{pf-fin-join}.
\end{proof}

\begin{prop}
The category of pointfree funcoids between bounded starrish join-semilattices with usual~$\supfun{f}$ defines a system of
bounded presides.
\end{prop}

\begin{proof}
Take the proof of theorem~\bookref{pfcd-bound} into account.
\end{proof}

\begin{prop}
The category of pointfree funcoids from a starrish join-semilattices to a separable starrish join-semilattices
defines a distributive system of presides.
\end{prop}

\begin{proof}
Theorem~\bookref{pf-dist-func}.
\end{proof}

\begin{prop}
The category of pointfree funcoids between starrish lattices with usual~$\supfun{f}$ and usual $\id_c$ defines a system of presides with correct identities.
\end{prop}

\begin{proof}
That it is with identities is obvious.

That it is with correct identities is obvious.
\end{proof}

\begin{obvious}
The category of pointfree funcoids between bounded starrish lattices with usual~$\supfun{f}$ and usual $\id_c$ defines a system of sides with correct identities.
\end{obvious}

\begin{prop}
The category of funcoids with usual~$\supfun{f}$ and usual $\id_c$ defines a system of sides with correct identities.
\end{prop}

\begin{proof}
Because it can be considered a full subsystem of
the category of pointfree funcoids between bounded starrish lattices with usual~$\supfun{f}$.
\end{proof}

\subsection{Galois connections}

\begin{prop}
The category of Galois connections between (small) lattices with least elements together with usual~$\supfun{f}$
defines a distributive system of presides.
\end{prop}

\begin{proof}
Propositions~\ref{gal-fjoin-x} and~\ref{a-bot} for a system of presides.

It is distributive because lower adjoints preserve all joins.
\end{proof}

\begin{prop}
The category of Galois connections between (small) bounded lattices together with usual~$\supfun{f}$
defines a bounded system of presides.
\end{prop}

\begin{proof}
Theorem~\ref{gal-bound}.
\end{proof}

\begin{prop}
The category of Galois connections between (small) Heyting lattices together with usual~$\supfun{f}$
defines a system of sides with correct identities.
\end{prop}

\begin{proof}
Theorem~\ref{gal-id-ex} ensures that they a system of sides with identities. The identities are correct due to faithfulness.
\end{proof}

\subsection{Reloids}

\begin{prop}
Reloids with the functor $f\mapsto\supfun{\tofcd f}$ and usual $\id_c$ form a system of sides with correct identities.
\end{prop}

\begin{proof}
It is really a functor because
$\supfun{\tofcd g}\circ\supfun{\tofcd f} = \supfun{\tofcd g\circ\tofcd f} = \supfun{\tofcd(g\circ f)}$
for every composable reloids~$f$ and~$g$.

$\supfun{a}\bot = \supfun{\tofcd a}\bot = \bot$;
\begin{multline*}
\supfun{a\sqcup b}X = \supfun{\tofcd(a\sqcup b)}X = \supfun{\tofcd a\sqcup\tofcd b)}X = \\
\supfun{\tofcd a}X\sqcup\supfun{\tofcd b}X = \supfun{a}X\sqcup\supfun{b}X;
\end{multline*}
thus it is a system of presides.

That this is a bounded system of presides follows from the formulas
$\tofcd\bot^{\mathsf{RLD}(A,B)}=\bot$ and $\tofcd\top^{\mathsf{RLD}(A,B)}=\top$.

It is with identities, because proposition~\bookref{fcd-id}.
It is with correct identities by proposition~\bookref{rld-id-comp}.
\end{proof}

\fxnote{Also for pointfree reloids.}

\fxnote{These examples works for (dagger) systems of sides with binary product.}

\section{Product}

\begin{defn}
\emph{Binary product} of objects of presides with identities is defined by the formula $X\times Y=\id_Y\circ\top\circ\id_X$.
\end{defn}

\begin{defn}
System of presides with identities is \emph{with correct binary product} when $f\sqcap(X\times Y) = \id_Y\circ f\circ\id_X$
for every preside~$f$.
\end{defn}

\begin{prop}
$\supfun{A\times B}X = \begin{cases}\bot&\text{ if }X\asymp A\\B&\text{ if }X\nasymp A\end{cases}$
\end{prop}

\begin{proof}
~
\begin{multline*}
\supfun{A\times B}X = \supfun{\id_B\circ\top\circ\id_A}X =
\supfun{\id_B}\supfun{\top}\supfun{\id_A}X = \\
B\sqcap\supfun{\top}(X\sqcap A) =
B\sqcap\begin{cases}\bot&\text{ if }X\asymp A\\\top&\text{ if }X\nasymp A\end{cases} =
\begin{cases}\bot&\text{ if }X\asymp A\\B&\text{ if }X\nasymp A\end{cases}
\end{multline*}
\end{proof}

\begin{defn}
I will call a system of sides \emph{with correct meet} when
\[ (X_0\times Y_0)\sqcap(X_1\times Y_1) = (X_0\sqcap X_1)\times(Y_0\sqcap Y_1). \]
\end{defn}

\begin{prop}
Faithful systems of presides with identities are with correct meet.
\end{prop}

\begin{proof}
$(X_0\times Y_0)\sqcap(X_1\times Y_1) = \id_{Y_1}\circ(X_0\times Y_0)\circ\id_{X_1}$.
Thus
\begin{multline*}
\supfun{(X_0\times Y_0)\sqcap(X_1\times Y_1)} P = \supfun{\id_{Y_1}}\supfun{X_0\times Y_0}\supfun{\id_{X_1}} P = \\
\supfun{\id_{Y_1}}\begin{cases}\bot&\text{ if }X_0\asymp\supfun{\id_{X_1}}P\\Y_0&\text{ if }X_0\nasymp\supfun{\id_{X_1}}P\end{cases} =
\begin{cases}\bot&\text{ if }X_0\sqcap X_1\asymp P\\Y_0\sqcap Y_1&\text{ if }X_0\sqcap X_1\nasymp P\end{cases} = \\
\supfun{(X_0\sqcap X_1)\times(Y_0\sqcap Y_1)} P.
\end{multline*}
So $(X_0\times Y_0)\sqcap(X_1\times Y_1) = (X_0\sqcap X_1)\times(Y_0\sqcap Y_1)$ follows by full faithfulness.
\end{proof}

\begin{prop}
Systems of presides with correct identities are with correct meet.
\end{prop}

\begin{proof}
$(X_0 \times Y_0) \sqcap (X_1 \times Y_1) = \id_{Y_1} \circ (X_0 \times
Y_0) \circ \id_{X_1} = \id_{Y_1} \circ (\id_{Y_0} \circ \top
\circ \id_{X_0}) \circ \id_{X_1} = \id_{Y_0 \sqcap Y_1}
\circ \top \circ \id_{X_0 \sqcap X_1} = (X_0 \sqcap X_1) \times (Y_0
\sqcap Y_1)$.
\end{proof}

For some sides holds the formula $f\circ(X\times Y) = X\times\supfun{f}Y$.
I refrain to give a name for this property.

\section{Negative results}

The following negative result generalizes theorem~3.8 in~\cite{tprod-dist-lat}.

\begin{thm}\label{neg-prod}
  The element $1^{(\Src\Upsilon)(\mathfrak{A}, \mathfrak{A})}$ is not
  complemented if $\mathfrak{A}$ is a non-atomic boolean lattice,
  for every monotone system of sides.
\end{thm}

\begin{proof}
  Let $T = 1^{(\Src\Upsilon)(\mathfrak{A}, \mathfrak{A})}$.

  Let's suppose $T \sqcup V = \top$ for $V \in (\Src\Upsilon) (\mathfrak{A},
  \mathfrak{A})$ and prove $T \sqcap V \neq \bot$.

  Then $\supfun{T \sqcup V} a = \top$ for all $a \neq \bot$ and thus $\supfun{V}
  a \sqcup a = \top$.

  Consequently $\supfun{V} a \sqsupseteq \neg a$ for all $a \neq \bot$.

  If $a$ isn't an atom, then there exists $b$ with $0 \sqsubset b \sqsubset a$
  and hence $\supfun{V} a \sqsupseteq \supfun{V} b \sqsupseteq \neg b \sqsupset \neg a$;
  thus $\supfun{V} a \sqsupset \neg a$.

  There is such $c\sqsubset\top$ that $a \sqsubseteq c$ for every atom $a$. (Really,
  suppose some element $p \neq \bot$ has no atoms. Thus all atoms are in $\neg
  p$.)

  For $a \nsqsubseteq c$ we have $\supfun{V} a \sqcap a \sqsupset \bot$
  for all $a \sqsubseteq \neg c$ thus $\supfun{T \sqcap V} a \sqsupseteq
  \supfun{V} a \sqcap a \sqsupset \bot$. Thus $\supfun{(T \sqcap V) \circ
  \id_{\neg c}} a \sqsupset \bot$

  So $T \sqcap V \sqsupseteq (T \sqcap V) \circ \id_{\neg c} \sqsupset
  \bot$. So $V$ is not a complement of $T$.
\end{proof}

\begin{cor}
  $(\Src\Upsilon)(\mathfrak{A}, \mathfrak{A})$ is not boolean if $\mathfrak{A}$
  is a non-atomic boolean lattice.
\end{cor}

\section{Dagger systems of sides}

\begin{prop}
~
\begin{enumerate}
\item For a partially ordered dagger category, each of Hom-set of which has least element, we have $\bot^\dagger = \bot$.
\item For a partially ordered dagger category, each of Hom-set of which has greatest element, we have $\top^\dagger = \top$.
\end{enumerate}
\end{prop}

\begin{proof}
$\forall f\in\Hom(A,B):\bot^\dagger\sqsubseteq f \Leftrightarrow
\forall f\in\Hom(A,B):\bot\sqsubseteq f^\dagger \Leftrightarrow
\forall f\in\Hom(A,B):\bot\sqsubseteq f \Leftrightarrow 1$. Thus $\bot^\dagger$ is the least.

The other items is dual.
\end{proof}

\begin{defn}
\emph{Dagger system of presides with identities} is system of presides with identities with category~$\Src\Upsilon$ being
a partially ordered dagger category
and $(\id_X)^\dagger = \id_X$ for every~$X$.
\end{defn}

\begin{prop}
For a system of sides we have $(X\times Y)^\dagger = Y\times X$.
\end{prop}

\begin{proof}
$(X\times Y)^\dagger = (\id_Y\circ\top\circ\id_X)^\dagger = \id_X^\dagger\circ\top^\dagger\circ\id_Y^\dagger =
\id_X\circ\top\circ\id_Y = Y\times X$.
\end{proof}

\fxnote{Which properties of pointfree funcoids can be generalized for sides?}


% !TeX root = ../main.tex
% Add the above to each chapter to make compiling the PDF easier in some editors.

\chapter{Introduction}\label{chapter:introduction}

An important topic in computer science is the study of the
\textit{functional correctness} of an algorithm.
It states whether an algorithm satisfies specified
input/output behavior.
Proving correctness of an algorithm
becomes especially interesting when it is be applied
to directly executable code and even more so if it is machine checked.
Unfortunately, with both, the task becomes
significantly more complex.
Even in an abstract specification, where topics such as
memory management may be abstracted away,
machine checked proofs of non-trivial properties
are hard.
Furthermore for concrete implementations,
low-level decisions about memory allocation or
the eligibility of reusing variables need to be
reasoned about.
In this thesis we provide a computer assisted proof in the interactive
theorem prover Isabelle/HOL \parencite{DBLP:books/sp/NipkowPW02} for the functional
correctness of an imperative implementation of the B-tree data-structure
and present how we dealt with the above mentioned issues.

In \Cref{chapter:introduction}, we have a brief overview on related
work and introduce common variations of B-trees and
the definition that is most promising for our approach.
We first design a functional, abstract implementation.
Together with a proof of its functional correctness,
it is presented in \Cref{chapter:abs-set}.
On this level, functional correctness means that we show the specifications
implement an abstract set interface for linearly ordered element.
This interface supports membership queries as well as insertion and deletion operations.
From the functional specification, an imperative implementation is derived in \Cref{chapter:imp-set}.
Its functional correctness is shown by proving that it refines the functional specification.
Thus the proof obligation for the imperative implementation
is reduced to a proof of equivalence between the output of the
functional and the imperative implementation.
This allows for small optimizations with regard to a na\"ive translation.
Finally, we present learned lessons, compare the results with related work and suggest potential future
research in \Cref{chapter:conclusion}.

% TODO related work?
% mfp/fielding: not mechanized, different approaches
% Ernst: more automation, but actually similar approach to ours (except for used structure)
% Malecha: less automation, similar structure

\section{The Isabelle Proof Assistant}

Isabelle/HOL is an interactive theorem prover that allows
to reason, among other things,
in Higher Order Logic.
It is built in ML, which influences the syntax of functional
programs written in it \parencite{DBLP:books/sp/NipkowPW02}.
Isabelle source files are divided in so called theories,
corresponding to code modules in common programming languages.
A theory consists of the specification of data types,
typed definitions and theorems with proofs.

\subsection{Notation and proofs in Isabelle}

Functions, predicates, etc. are all expressed in
a functional manner.
The keyword \textbf{definition} denotes classical definitions.
The term \textbf{abbreviation} is used to define simple shorthands for more complex expressions,
similar to a macro.
The word \textbf{fun} precedes recursively defined total functions.
It is only a valid definition if it incorporates a proof of termination.
Usually this proof is derived automatically by the system.
If a termination can not be guaranteed for all inputs,
a function may be defined via \textbf{partial\_function}.
As cycle freeness of heap pointers can not be guaranteed for all inputs
on imperative programs, many imperative definitions are given
as partial functions.
As a consequence from potential non-termination,
we may only show partial correctness for these functions \parencite{DBLP:conf/itp/Krauss10}.
However this is implied by the Hoare Logic that we will use to reason about imperative programs.

Mathematical propositions can be expressed in a similar manner
as they would be written in a mathematical textbook.
They begin with the keyword \textbf{lemma}, \textbf{theorem} or \textbf{corollary},
followed by an expression or predicate and a proof.
Wherever possible and readable, we will try to reflect the actual
syntax of the Isabelle system, however compromise in order to
keep the notation of obtained lemmata and theorems
close to conventional notation.
To prove a theorem correct, the system basically provides two different
proof styles.

\begin{enumerate}
    \item Structured proofs in the Isar language:
    The user outlines a proof, supplying intermediate goals
    and telling the system which proof method to apply to
    resolve each step.
    This style is usually preferred as it is more readable and usually
    faster on the system side.
    All complex proofs in \Cref{chapter:abs-set} are hence written in this style.
    \item Apply style: the user tells the system which proof method
    to apply to modify the current goal.
    Examples are the application of a rule
    or simplification using equivalences.
    This is practical if the number of assumptions
    is high or the goal is large and writing the full terms
    out would be impractical.
    Since this is the case for the proofs of the imperative programs,
    almost all proofs in \Cref{chapter:imp-set} are written in this style.
\end{enumerate}

The system provides a number of proof methods,
based on different manipulation tools
such as logical reasoning or simplification.
In this work we will not present the proofs as written in the actual
proof files but rather outline the structure of the proofs.
When mentioning \textit{automatic} proofs, we mean a proof that
comprises very few ($\le 5$) apply style
invocations of proof methods.
A method that commonly allows for such proofs is the \textit{auto} method,
a combination of logical reasoning and repeated simplification,
but also allowing automatic case distinctions and destructive rule application.

It is possible to specify functions, predicates
and theorems with respect to some abstracted constants
(which may also be functions).
Inside the resulting \textbf{locale}, only certain assumptions,
but no concrete definitions are known about the abstracted constant.
By providing definitions that satisfy
the assumptions, we may \textit{instantiate}
the locale, potentially yielding computable results.
We implement the set interface concretely by
instantiating a set locale from the standard library.
But also the definition of functional and imperative
B-tree operations will be in locales that assume
the existence of a node-navigating operation.

\subsection{Examples and basics of the Isabelle language}

Datatypes may be defined recursively.
The following shows as an example the internal definition of the list data type.\footnote{
    The actual definition is worded slightly different but this is of no importance here.
}

\begin{lstlisting}[mathescape=true, language=Isabelle,label=lst:list-def]
datatype 'a list = [] | 'a # 'a list
\end{lstlisting}

In natural language this means that either a list is the empty list,
or it is an element prepended to another list.
As usual in ML like languages, we may apply pattern matching to function argument.
In addition, the type $'t$ of any expression $e$ can be
made explicit by writing \textit{e :: 't}.
Functions that take values of type $'a$ and return values of type $'b$
have type \textit{'a $\Rightarrow$ 'b}.
For functions that take several arguments,
currying is applied.
The Isabelle internal list catenation function "@" serves as
an example for a function definition with explicit type.

\begin{lstlisting}[mathescape=true, language=Isabelle,label=lst:append-def]
fun (@) :: 'a list $\Rightarrow$ 'a list $\Rightarrow$ 'a list where
    [] @ ys = ys |
    (x#xs) @ ys = x # (xs @ ys)
\end{lstlisting}

% TODO include?
% locales
% set specification

Further details on notation, proof techniques and more in Isabelle/HOL
may be found in Chapter 1 of \parencite{DBLP:books/sp/NipkowK14}.

\section{The B-Tree Data Structure}

B-trees were first proposed by Bayer in \parencite{DBLP:journals/acta/BayerM72},
as a data-structure to efficiently retrieve and manipulate
indexed data stored on storage devices with slow memory access.
They are $n$-ary balanced search trees.
As such B-trees are generally said to implement a map interface,
mapping indices to data and supporting map updates and deletions.
They may also be specified as implementing a set interface,
where the indices form the actual content of the set.
B-trees are a generalization of 234-trees and a specialization of (a,b)-trees.

A commonly implemented variation is the B$^+$-tree, where the inner nodes
only contain separators to guide the recursive navigation through the tree.
In B$^+$-trees, all data is stored in the leaves \parencite{DBLP:journals/csur/Comer79}.
Further the leaves are often implemented so as to contain pointers
to the next leaf in order, allowing for efficient range queries.

Nodes are generally thought to be implemented by
containing a number of indices, data corresponding to each index
and a number of children.

\begin{figure}
    \centering
    \includegraphics[width=0.5\linewidth]{figures/btree-basic-nopair.pdf}
    \caption[A small example B-Tree]{A small balanced, sorted B-tree of order $2$ and
    height $2$ containing $3$ nodes and $6$ elements.
    In subsequent depictions, leafs will be depicted
    by empty circles.}
    \label{fig:btree-basic-nopair}
\end{figure}

\subsection{Definitions}
\label{sec:data_structure_defs}

Every node contains a list of \textit{keys} (also \textit{separators}, \textit{index elements}), and \textit{subtrees} (\textit{children}),
that represent further B-tree nodes.
The separators and subtrees may be considered interleaved within a node,
such that we can speak of a subtree to the left of a separator and
a subtree to the right of a separator,
where for a separator at index $i$ we mean the subtree in the respective
subtree list at index $i$ and $i+1$ respectively.
Note that this already implies that the list of subtrees is one
longer than the list of separators - we refer to the last subtree
as the \textit{last} or \textit{dangling} subtree.
In the original definition by Bayer \parencite{DBLP:journals/acta/BayerM72},
a B-tree with above structure must fulfill the three properties
\textit{balancedness}, \textit{order} and \textit{sortedness}.

\paragraph{Balancedness} \textit{Balancedness} requires
that each path from the root to any leaf has the same length $h$.
In other words, the height of all trees in one level of the tree must be equal,
where the height is the maximum path length to any leaf.
It is only possible to maintain this property
due to the flexible amount of subtrees in each node.

\paragraph{Sortedness} Further the indices must be \textit{sorted} within the tree which means that all indices stored
in the subtree to the left of a separator are smaller than the value of the separator
and all indices in the subtree to the right are greater.
Further all indices within a node should maintain a sorted order,
that is the list of separators in a node must be sorted.

\paragraph{Order} In general terms, the property of \textit{order} ensures a certain minimum and maximum
number of subtrees for each node.
However, as pointed out by Folk and Zoellick \parencite{DBLP:books/daglib/0095349_mod},
the property is defined differently in the literature.
For the purpose of this work, the original definition by Bayer
was chosen as most suitable.
A B-tree is of order $k$, if each internal node has at least $k+1$
subtrees and at most $2k+1$.
The root is allowed to have a minimum of 2 subtreess and a maximum of $2k+1$.

An alternative definition proposed by Knuth \parencite{DBLP:books/lib/Knuth98a},
is to allow between $\lceil \frac{k}{2} \rceil$ and $k$ children.
However this involves cumbersome \textit{real} arithmetic that unnecessarily complicates
mechanized proofs.
Sticking to the original definition is further supported by the fact that nodes are supposed
to fill memory pages which are usually of even size (usually some power of 2).
An even number of separators and trees plus one dangling last tree maximizes
the usage of such a page.

The same ambiguity exists for the term \textit{Leaf} which we will define consistently with Knuth's definition \parencite{DBLP:books/lib/Knuth98a}
to be an empty node, carrying no information,
rather than a node that contains data but no children.
This is close to the usual approach in functional programming,
and will yield more elegant recursive equations for our B-tree operations.
The lowest level of nodes hence contains a list of separators and
list of pointers to leaves as can be seen in \Cref{fig:btree-basic-nopair}.

Note that the B-tree definition is only meaningful for positive $k$.
For the case that $k$ is equal to 0,
all elements of the tree would have exactly one subtree
and no internal elements.
For the root node this even leads to a contradictory state:
It is required to contain at least 1 element or 2 subtrees.
However as it should not have more than $2k+1 = 1$ elements,
this constraint can not be satisfied.
Requiring positive $k$ is consistent with the definitions
in the consulted literature \parencite{DBLP:journals/acta/BayerM72,DBLP:journals/csur/Comer79,DBLP:books/daglib/0023376}.

% insert image of valid B-tree

\subsection{B-Tree operations}

The B-tree is a dynamic data-structure and provides
operations to query and update stored data.
Generally, the operations are defined recursively on the nodes.
The correct subtree may be found by inspecting the separators stored
in the currently visited node.
If the value that is being searched for is in the range of two
adjacent separators and equal to neither of them,
we recurse into the tree in between.
The obvious corner cases are if the value is less than the
minimal element or greater than the maximum element stored.
In that case we recurse in either the first or the last subtree.
The exact manner of inspection should in practice of course
be efficient and will hence be kept abstract until \Cref{chapter:imp-set}.

\paragraph{Retrieval}\label{par:intro-isin}
Since the whole tree is sorted,
checking whether certain elements are contained in the tree
is simply conducted by recursing into the correct node
in each level.
Either the element is found directly or found at a lower level.
If we reach a leaf node we know that the element is not contained in the tree.
There is little variation on this algorithm so there is no need for comparison.

% TODO move abstract discussion to introduction
%-------------------------------------------------
\paragraph{Insertion}\label{par:intro-ins}
There is also general consensus in the literature on
how to conduct insertion into a B-tree \parencite{DBLP:journals/csur/Comer79}.
%TODO citations
%TODO relationship to other implementations (are there more?)
Generally, an element is inserted into the nodes on the lowest level.
In a first step, the element is simply placed at the correct
position in the list of separators.
If the node had enough space left prior to this operation,
we are done.
If however the node has more than $2k$ elements after this insertion,
we need to split it and, passing the median to the parent node,
recurse back upwards.
We will see in \Cref{sec:abs-ins} how this can be
elegantly expressed in a functional specification.
More detailed descriptions and examples of insertion and deletion may be found
in \parencite{DBLP:books/daglib/0023376}.
%-------------------------------------------------

% TODO delete
% TODO move abstract discussion to introduction
%-------------------------------------------------
\paragraph{Deletion}\label{par:intro-del}
On deletion, elements are removed from the leaves only.
If the element to be deleted resides in an inner node,
it is replaced by the maximal lesser or minimal greater
element in the tree, which always resides in a leaf
to the left or right of the element to be removed.

After deletion, the nodes may need rebalancing in order
to ensure the order property.
A node having less than $k$ elements is said to have \textit{underflow}.
The exact procedure to handle underflow varies strongly in the literature.
Since only one element is removed from the node,
the most intuitive solution to underflow is to \textit{steal} or \textit{borrow} it
from the sibling to the left or right \parencite{DBLP:books/daglib/0023376}.
If either sibling has more than $k$ elements,
one of the neighboring elements may be moved into the current node.
Only in the case that both siblings have only $k$ elements,
a kind of reversal of the insertion split is conducted:

One of the siblings and the node itself, together with the separating
element of the parent node are merged and the result split again to form
a new, bigger node of valid order.

Following the description of Bayer \parencite{DBLP:journals/acta/BayerM72},
as done by Fielding \parencite{Fielding80},
the two cases can be treated identically.
If a node has less than $k$ elements,
merge it with one of its siblings.
If the resulting node has an overflow again,
it will be split in half, just as with insertion related overflows.
According to Comer \parencite{DBLP:journals/csur/Comer79} this may even be
more efficient than stealing single single keys from siblings.
Firstly, the resulting node is less likely to underflow again.
If it had stolen only one element, another deletion from this node
will certainly cause another overflow.
This is not the case when several elements are copied over.
Further, the node to merge with been completely read from memory at the point
of stealing an element.
Merging does therefore not incur additional memory accesses and
the cost of inter-memory copy of up to $k$ elements is negligible.

%-------------------------------------------------

\subsection{Properties}

B-trees are assumed to be stored on external memory,
such that each node roughly matches a page in main memory.
In real situations, this implies that the number of elements
that can be stored in each node, and hence also $k$, is huge, usually $\gg 1000$.
The overall number of memory accesses for all tree operations
is bounded by the depth of the tree,
which again is logarithmic in the number of indices -
where the base of the logarithm is closely proportional to the order $k$ of the tree.
This is due to the large branching factor and the guaranteed balancing.
Together, the data structure yields a very small number of required memory accesses
for retrieving and inserting data stay,
even if the tree stores large amounts of data.

Furthermore, by design, the storage usage of B-trees is at a minimum close to $50\%$
of the reserved memory,
where the average usage is usually higher \parencite{DBLP:journals/acta/BayerM72}.
This is achieved by ensuring that every node reserves the storage of $2k$ keys and separators.
By definition, the nodes (except for the root) always contain
at least $k$ elements, yielding a storage usage of close to $50\%$.

The above mentioned properties are key to the widespread popularity of B-trees.
Usually the closely related structure of B$^+$-trees is used in applications,
being especially popular for the implementation of databases.
B-trees build the foundation to most modern relational database implementations \parencite{DBLP:journals/csur/Comer79}.
We therefore made sure to represent the important aspects for the applicability
of B-trees, little memory accesses and high storage usage, in our implementation.
% TODO more

\section{Related Work}

All the related work we have found considered B$^+$-trees
rather than B-trees.
However, some parallels can be observed.
There exist two pen and paper proofs via the rigorous approach
by Fielding \parencite{Fielding80} and Sexton \parencite{DBLP:journals/entcs/SextonT08}.
Even though not machine checked, they shed light on techniques applied in this work.

Fielding approaches the verification by refinement.
First, B$^+$-trees are viewed as nested sets of subtrees
or as leafs that are sets of key-value pairs.
Obtaining the correct subtree for recursion is in the abstract setting
only defined by appropriate pre and post-condition
and an actually executable function is provided in the second refinement step.
On this level, only arguments on the invariants are made.
In a second step B-trees are considered more concretely to contain
sorted lists of children and keys.
Here the argument for invariant preservation is informally
that the refined implementation
has the same structure as the abstract implementation.
Final imperative PASCAL code is given, derived by hand
imitating the functional style implementations and extended by assertions.

This approach is similar to what will be done in this work,
however mostly concerning the methodology rather than the actual
steps of refinement.
In this work, we will start at the definition using lists in \Cref{chapter:abs-set}
and refine to an imperative implementation with pointers and arrays in \Cref{chapter:imp-set}.
The code we obtain will be exported automatically to a functional language of choice.

We reason about the validity of this refinement via separation logic,
the same tool that Sexton employed \parencite{DBLP:journals/entcs/SextonT08}.
Their work shows that this tool allows to reason based on some kind of locality,
in particular that operations on subtrees are really only affecting subtrees.
We will make implicit use of this property in \Cref{chapter:imp-set}
for proofs on our imperative implementation.

The specification by Sexton is given as abstract machine rules,
somewhat more abstract than pure code but operating on a stack
much like we expect imperative programs to operate with pointers on a heap.
We therefore categorize this as a direct verification of an imperative implementation.

Among imperative implementations, two machine checked proofs exist as well.
In the work of Ernst \parencite{DBLP:journals/sosym/ErnstSR15},
an imperative implementation is directly verified
by combining interactive theorem proving
with shape analysis.
The main recursive procedures are interactively verified in KIV.
Data structure properties such as circle-freeness are then proven by shape-analysis.
Another direct proof on an imperative implementation
was conducted by Malecha \parencite{DBLP:conf/popl/MalechaMSW10}, with the YNOT
extension to the interactive theorem prover Coq.
Both works use recursively defined "shape predicates"
that describe formally how the nodes and pointers
represent an abstract tree of finite height.
In the work of Malecha, these predicates are even specified functionally.
However, we know of no verification that explicitly covers
a complete specification of functional B-trees and operations on it.

In addition to providing one, this work aims to show the benefits
of taking an indirection via a complete functional specification
to derive proofs for an imperative implementation.
Among others, these benefits are that the analysis of invariants of an abstract shape may be spared
or at least significantly simplified when
restricting the concrete pointer structures to be refinements
of an abstract algebraic type.

\section{Contributions}

In this work, we derive our own definition of B-trees
by combining the original definition
with approaches that have resulted in verified implementations previously.
Based on the definition, we specify the B-tree data structure in the
functional modeling language HOL.
The specification is complemented by a proof of its correctness
with respect to refining a set of linearly ordered elements.
All proofs are machine-checked in the Isabelle/HOL framework,
an interactive automated theorem prover \parencite{DBLP:books/sp/NipkowK14}.
Within the framework,
the functional specification already yields automatic extraction of executable,
but inefficient code.

Using manual refinement, we derive an imperative implementation of the functional specification
in Imperative/HOL.
For this purpose, we introduce static arrays with variable size
and efficient copy and move operations on arrays.
The implementation is defined with respect to some abstract imperative
operation for node-internal navigation.
We provide one such operation that employs linear search,
and one that conducts binary search.
All imperative programs are shown to refine the functional specifications
using the separation logic utilities from the Isabelle Refinement Framework by
Lammich \parencite{DBLP:journals/jar/Lammich19}.

This process results in a proof of the functional correctness
of an imperative implementation of the B-tree data structure.
The implementation supports set membership and insertion queries
and uses efficient binary search for intra-node navigation.
As with every specification in Imperative/HOL,
automatic executable code extraction to
several functional programming languages is supported.
In addition, we provide a proof of the logarithmic relationship between height and number of nodes,
reproducing results of Bayer \parencite{DBLP:journals/acta/BayerM72}.
This verifies claims on the efficiency of
operations on the tree.

All proofs, specifications and programs can be found in the appendix \parencite{MuendlerAppendix21}.


%\nomenclature[]{MLE}{Maximum Likelihood Estimate}
%\note{Make sure it's clear whether using random variables or not}
%\note{Might need to make clear Markov assumptions }
As discussed, HMMs and DBNs are useful tools for modelling complex random dynamic processes. Typically, models are used to provide some kind of inference about a process, to gain insight into its inner workings. By inference, we mean calculating the probability distributions over variables of interest. Some algorithms will be outlined here that will demonstrate how to calculate both exact and approximate inferences, using general structures for HMMs and DBNs. \par

First, inference algorithms commonly used with HMMs are discussed, as their representation is more rigid, meaning that it is easier to exploit their structure generally to perform inference. As previously stated, HMMs and DBNs are routinely used to model systems that have state variables that cannot be directly observed. In most cases, we are interested in inferring what the state of the system might be, given the observed evidence variables received. This is the first and arguably the most useful inference challenge that we inspect.

The actual quantity that we want to compute is
\[P(X_t | e_1, e_2, ..., e_t) = P(X_t | e_{1:t})\]
that is, the probability distribution of the hidden state variable, given all previously observed evidence variables. The notation $e_{1:t}$ denotes the joint distribution of $e_1, e_2, ..., e_t$. We are interested in computing this value, rather than the unconditional state distribution, $P(X_t)$, because we cannot observe the state directly, but we can observe the evidence variables. The conditional distribution $P(X_t | e_{1:t})$ is frequently referred to as the \textit{belief state} and the process of calculation of this distribution is frequently referred to as \textit{state estimation} or \textit{filtering} \cite{AIAMA}, \cite{Thrun:2005:ProbabilisticRobotics}, \cite{KollerPGM}. The \textit{forward algorithm} can be used to calculate the value of $P(X_t | e_{1:t})$ \cite[p.~572]{AIAMA}. It is a recursive algorithm, and takes advantage of the fact that the underlying process is Markovian. The forward algorithm for HMMs is shown in Algorithm \ref{alg:forwardAlgorithmHMMs} and is based on the algorithm outlined in \cite[p.~27]{Thrun:2005:ProbabilisticRobotics}. The derivation is useful to follow as an exercise, so we present it in the subsequent sub-section.
\subsubsection{HMM Filtering Algorithm Derivation}
\label{section:HMMFiltering}
\note{Might be better to put this in an appendix.}
Two well-known probability identities are used in the derivation:
\note{Fix the formatting here}
\begin{center}
%- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
\end{center}
%quad adds space
\[(a) \quad p(A | B, C) = \frac{p(B | A, C) p(A | C)}{p(B | C)} \quad \text{and} \quad (b) \quad p(A | B) = \int\limits_{C}P(A | B, C) P(C | B)dC\]

\begin{center}
%- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
\end{center}
The derivation is as follows:
\begin{enumerate}
\item {$ p(X_t | e_{1:t}) = p(X_t | e_{1:t-1}, e_t) $ }

\item{$ \text{applying (a) and letting} \quad \eta = \frac{1}{p(e_t | e_{1:t-1})} \quad = \quad \eta p(e_t | e_{1:t-1}, X_t)p(X_t|e_{1:t-1}) $ }

\item{$ \text{by the Markov property} \quad = \quad \eta p(e_t | X_t)p(X_t|e_{1:t-1})$}

\item{$\text{applying (b)} \quad =  \quad \eta p(e_t | X_t)\int_{X_{t-1}}p(X_t|e_{1:t-1}, X_{t-1}) p(X_{t-1}|e_{1:t-1})dX_{t-1}$}

\item{$ \text{by the Markov property} \quad = \quad \eta p(e_t | x_t)\int_{X_{t-1}}p(X_t|X_{t-1}) p(X_{t-1}|e_{1:t-1})dX_{t-1} $}

\end{enumerate}
Note that $\eta$ is a normalizing constant that ensures that the probability distribution integrates to 1, and that the probabilities that need to be calculated can be done so from the parameters specified in the HMM; namely $p(e_t | X_t)$, specified by the sensor model, and $p(X_t | x_{t-1})$, specified by the transition model.

\begin{algorithm}{}
\caption{Forward Algorithm for HMMs}
\label{alg:forwardAlgorithmHMMs}

\begin{algorithmic}[1]
\renewcommand{\algorithmicrequire}{\textbf{Input:}}
\renewcommand{\algorithmicensure}{\textbf{Output:}}
%Input
\REQUIRE $\newline P(x_{t-1} | e_{1:t-1})=bel(x_{t-1}): \quad \text{The belief distribution as far as the previous time-step}
\newline e_t: \quad \text{The most recent observation}
\newline hmm: \quad \text{A Hidden Markov Model specifying the transition and observation probabilities,} \newline p(X_t | x_{t-1}) \text{ and } p(E_t | x_t)$
%Output
\ENSURE  $\newline P(X_{t} | e_{1:t}) = bel(X_{t})$

\hfill\pagebreak

\FOR{all $x_t$}
\STATE $\overline{bel}(x_t) = \int p(x_t | x_{t-1}) p(x_{t-1} | e_{1:t-1}) d x_{t-1}$
\STATE $bel(x_t) = p(e_t | x_t) \overline{bel}(x_t)$
\ENDFOR
\STATE $ \eta = 1 / \int_{x_t}{bel(x_t)}dx_t$
 \FOR{all $x_t$ do:}
\STATE $bel(x_t) = \eta{bel}(x_t)$
\ENDFOR

%\ENDWHILE
\RETURN $bel(X_t)$
\end{algorithmic}
\end{algorithm}

\note{Don't forget to mention: Sufficient statistics, forward algorithm}

Algorithm \ref{alg:forwardAlgorithmHMMs} uses integrals to account for the fact that the distribution of the hidden state, $X_t$, may be continuous. The work done in this thesis only uses discrete distributions, and so summations are used instead of integrals for the subsequent discussion. A consequence of using discrete distributions is that it is possible to formulate the forward algorithm using vector and matrix notation. As outlined in Section \ref{subsec:BGHMM}, the transition model $T=p(X_t | X_{t-1})$ for a HMM can be written down in matrix form, as can the observation model $O_t=p(E_t | X_T)$. This allows for a highly compact notation: denoting $p(x_t | e_{1:t})$ as $f_{1:t}$, we can write $f_{1:t} = \eta O_{t} T^{T} f_{1:t-1}$, where $f_{1:t}$ contains the vector of values of $p(x_t | e_{1:t})$ for every possible $x_t$ \cite[p.~579]{AIAMA}. Note that the observation model, $O_t$ is time dependent, as opposed to the transition model, which is assumed to be stationary. \par

Some insight can be gained from studying Algorithm \ref{alg:forwardAlgorithmHMMs}. There are three main steps to this algorithm, and the intuition behind them is explained based on explanations in \cite{AIAMA}, \cite{Thrun:2005:ProbabilisticRobotics} and \cite{Murphy1994DynamicLearning}:
\note{These are highly verbose, edit to make less wordy}
\begin{enumerate}

    \item The first step is often referred to as the prediction step:
    \begin{center}
    $\overline{bel}(x_t) = \sum_{x_{t-1}} p(x_t | x_{t-1}) p(x_{t-1} | e_{1:t-1}) d x_{t-1}$
    \end{center}

    This step carries out the first part of the calculation of the belief value for a given state $x_t$, by marginalizing over all possible hidden states ($x_{t-1}$) that could have preceded the current one ($x_t$). This reflects intuition: the probability of being in state $x_t$ should depend on the probability of transitioning from all possible previous states to $x_t$.
    %\note{this sentence doesn't seem necessary}
    Think "\textit{the probability that I am in location x is the sum of probabilities of starting at all other possible locations and subsequently ending up in location x, weighted against my belief that I began in each other possible location}".

    %product of our most recent belief of being in state $x_{t-1}$, given by $p(x_{t-1} | e_{1:t-1})$ and the probability of transitioning from that state to state $x_{t}$, for all previous possible states that we could have been in.
    $\overline{bel}(x_t)$ effectively projects our current belief to the next time step by using the transition probabilities specified in the HMM.

    \item The second step is often referred to as the correction step, or the measurement update step:
    \begin{center}
    $bel(x_t) = p(e_t | x_t) \overline{bel}(x_t)$
    \end{center}
    This step takes the projected belief in step 1 and multiplies it by the probability of observing the data that we did in the given hidden state, $x_t$. This can be thought of as a correction because the use of the measurement data narrows the probabilities of the possible states that the system could have transitioned to.
    \note{Need to re-word this to make more concise}
    %For example, if the value of a transition probability from state x to state y is low, and there is a low probability that the system was previously in state x, a high probability of observing the observed sensor reading given state y can still result in a relatively high posterior probability of the system being in state y given the new evidence.

    \item The final step is to ensure that the distribution sums to 1. This is done by multiplying by a normalizing constant, $\eta$.

\end{enumerate}
A key strength of this algorithm is the fact it allows updates to be performed online. The reason for this is that the information-state vector, $p(x_t | e_{1:t})$ is a sufficient statistic for the past history of observations. For a full proof of this property, the reader is referred to Appendix A of \cite{Smallwood1973TheHorizon}, which also provides insight into the update rule itself. In relation to the update rule, note that an initial distribution of the estimated state must be provided to this algorithm before the first update can be performed. The complexity of the forward algorithm is $\theta (nm^2)$, where m is the size of the joint distribution of the hidden variables, x, and n is the number of time-steps that have occurred. This is clear to see when viewing the update as the matrix-vector multiplication $f_{1:t} = \eta O_{t} T^{T} f_{1:t-1}$, as the size of T is $m^2$.

\subsubsection{Evidence Likelihood Algorithm Using a HMM}\label{subsubsec:EvLikelihood}
\note{Will talk about this briefly for SPRT}
The second useful quantity that we would like to calculate is the probability of observing the evidence that we did, often referred to the likelihood function of the data, as identified in Section \ref{subsec:BGHMM}. In simpler terms, this is the calculation of the probability of observing the data, given a fixed parameterised model of the data (the HMM). This value is useful as it can reveal insights into whether one model is more likely than another model, with applications including \textbf{M}aximum \textbf{a} \textbf{P}osteriori (MAP) parameter estimates and hypothesis testing. It is used in this thesis in Section \ref{subsubsec:SeachTerminationMethodology}. We would like to compute the value of
\[P(e_1, e_2, ..., e_t) = P(e_{1:t})\]
given the fixed set of parameters provided by the HMM. A brief outline of the derivation is shown:\note{might be best to put the derivation in an appendix}

\subsubsection{HMM Evidence Likelihood Algorithm Derivation}\label{subsubsec:BGEvidenceLikelihood}

Analogous to the filtering algorithm derivation, two well-known probability identities are used in the derivation:
\begin{center}
%- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
\end{center}
%quad adds space
\[(a) \quad p(A, B, C) = p(A | B, C) p(B, C) \quad \text{and} \quad (b) \quad p(A, B) = \sum_{C}{p(A | B, C)p(B, C)}\]

\begin{center}
%- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
\end{center}

The derivation is as follows:
\begin{enumerate}

\item {$p(e_{1:t}) = \sum_{x_t}p(e_{1:t}, x_t) \quad = \quad \sum_{x_t}p({e_{1:t-1}, e_t, x_t}) $
}
\item {$\text{applying (a) } \quad= \quad
\sum_{x_t}{p(e_t | e_{1:t-1}, x_t)p(x_t, e_{1:t-1})}$
}
\item{$\text{by the Markov property}
\quad = \quad \sum_{x_t}p(e_t | x_t)p(x_t, e_{1:t-1})$
}

\item{$\text{applying (b)} \quad =  \quad
\sum_{x_t}p(e_t | x_t) \sum_{x_{t-1}}p(x_t|e_{1:t-1}, x_{t-1}) p(x_{t-1},e_{1:t-1})$
}

\item{$\text{by the Markov property} \quad = \quad
\sum_{x_t}{p(e_t | x_t)\sum_{x_{t-1}}p(x_t|x_{t-1}) p(x_{t-1},e_{1:t-1})}$
}

\end{enumerate}

The algorithm for calculating likelihoods uses the forward algorithm, $\alpha$, with the replacement of  $p(x_{t-1}|e_{1:t-1})$ with $p(x_{t-1}, e_{1:t-1})$ and one final summation. This means that it is possible to use the forward algorithm to calculate likelihoods: $p(e_{1:t}) = \sum_{i=1}^{n} \alpha(x_i, e_i)$, where $\alpha(x, e)$ is the result of applying the forward algorithm to the sequence of evidence variables $(e_1, ..., e_t)$.

%No point in writing up likelihood algorithm as it's very similar to forward algorithm.

%\subsubsection{HMM Parameter Learning Using Expectation Maximization}\label{subsubsec:EMAlgo}
%\note{Can talk about this briefly for battery model}
%Since a HMM is a parameterised model of a stochastic process, a natural question to ask is whether it is possible to determine a \textit{"best"} set of parameters to describe the process, by using observations of the process. This is a more complex version of the well-known process of finding the parameters that maximize the likelihood function of fully observable data, known as the \textbf{M}aximum \textbf{L}ikelihood \textbf{E}stimate (MLE). Finding the most likely set of parameters which provided the observed values can be described mathematically as the value of \note{fix argmax notation}$\argmax_{\lambda} P(E_{1:t} | \lambda)$. Note that this is a fundamentally different problem to that discussed in the preceding section; here we do not assume a fixed set of parameters for the HMM ($\lambda$).

%This is a well-studied problem for HMMs and the solution is given by the \textbf{E}xpectation \textbf{M}aximisation (EM) algorithm, proposed by \citeauthor{Dempster1977MaximumAlgorithm}. This algorithm is reasonably complex and highly detailed overviews can be found in many texts that deal with parameter estimation for statistical models. A quick outline of how the algorithm works is provided here.\par

%The reason why the standard methods for finding the MLE for a parameterised model do not work with HMMs is due to the fact that there is no way to directly express the quantity  $P(E_{1:t} | \lambda)$ directly. This can be seen in the derivation of the evidence likelihood in <reference whichever appendix it ends up in>. Instead, it is necessary to marginalize over states: $ P(e_{1:t} | \lambda) = \sum_{x_t}{p(x_t, e_{e:t} | \lambda)}$. The standard approach to finding the parameters that maximize a model is to take a log transform of the likelihood function, which preserves the solution but turns the problem into one of finding the parameters that maximize a sum rather than a product. Using standard methods of calculus, this can usually be done easily. The issue with HMMs is that when a logarithmic transformation is applied to the likelihood function, the summation sign remains within the log function, which means finding the maximum is still a difficult problem. The EM algorithm, taking the approach of many iterative techniques, relaxes the constraints on the problem in order to find a lower bound of the log-likelihood and then iteratively improves this lower bound with increasing likelihood values.

%The Baum-Welch algorithm is a special case of the EM algorithm and is frequently used to solve the problem of estimating the parameters of a HMM. The algorithm is described fully in appendix <reference appendix>.

\subsubsection{Filtering Algorithm for DBNs}\label{subsubsec:filteringDBN}
\note{Extend HMM to add control variable}
\begin{wrapfigure}{r}{0.68\textwidth}
    \centering
    \includegraphics[width = 0.68\textwidth]{Chapters/BackgroundKnowledgeAndRelatedWork/MultiAgentTargetDetectionBackground/Figs/HMMs/HMMWithControl.png}
    \caption{A DBN with Hidden State variables (grey), Observation variables (orange) and Control variables (green).}
    \label{fig:HMMWithControlVariablesExample}
\end{wrapfigure}
The forward algorithm for state estimation was presented in Section \ref{section:HMMFiltering}. A slightly modified version of this algorithm is now described, which is very commonly used in stochastic systems that can be influenced by actions that an agent may take. Such systems have \textit{control variables} as well as hidden state variables and observation variables. These control variables (variables which represent the actions that an agent may perform) have an influence on the transition probabilities between states. The graphical model in Figure \ref{fig:HMMWithControlVariablesExample} describes the basic case. The arrows describe the conditional independence assumptions: at time t, the hidden state ($x_t$) depends on the previous state ($x_{t-1}$), and the previous control action taken ($u_t$). As with the HMM, the observation $e_t$ is conditionally dependent on the state $x_t$. This causes a slight change in the filtering algorithm: on line 2 of algorithm \ref{alg:forwardAlgorithmHMMs}: $\overline{bel}(x_t) = \sum_{x_{t-1}} p(x_t | x_{t-1}) p(x_{t-1} | e_{1:t-1}) $ is replaced with $\overline{bel}(x_t) = \sum_{x_{t-1}} p(x_t | u_t, x_{t-1}) p(x_{t-1} | e_{1:t-1}, u_{1:t-1})$, reflecting that transition probabilities now depend on the most recent control action taken, as well as the previous state.

%DBNs have already been shown to be a powerful tool while modelling stochastic systems, since the hidden variables can be described by conditional independences, rather than

%This algorithm can be further generalized - if multiple control variables, hidden state variables and observation variables are needed to describe the system fully, it is possible to make minor modifications which reflect the conditional independences stated by the underlying DBN by .

It is worth noting that there are many filtering algorithms that deal with data that come from certain distributions and satisfy constraints related to their transition and observation models, for example the Kalman Filter \cite[p.~43]{Thrun:2005:ProbabilisticRobotics}.

%\subsubsection{Discrete Bayes Filter}
%\note{This is what is used in the work that I did, so it is outlined}

\subsubsection{Approximate State Estimation}
\note{Thought about using Particle filter to avoid the dimensionality problem when attempting to maintain estimated state}
The state estimation algorithms mentioned so far maintain the exact values of the distribution $p(x_t | e_{1:t}, u_{1:t})$, but we will quickly mention an approximate method that is also frequently used. The computational complexity of the filtering algorithms is determined by how well the joint distribution of hidden state variables, observation variables and control action variables can be factored, but in the worst case the complexity is given by the case where the joint distribution of the hidden state variables cannot be factored at all. The forward algorithm, described in Algorithm \ref{alg:forwardAlgorithmHMMs} for a HMM performs the update from each time state in O($n^2$), where $n$ is the dimension of the hidden state variable \cite{Smyth1997ProbabilisticModels}.
%$O(n^2ut)$, where n are the number of hidden states, u is the number of available control actions and t is the number of time steps.
In some cases, this can become intractable if the state space is large enough. % and the transition model cannot be factored.
In this case, approximate techniques are used. An example is the \textit{particle filter}. Details of the particle filter can be found in \cite[p.~96]{Thrun:2005:ProbabilisticRobotics} and \cite[p.~665]{KollerPGM}.