% Template source: University of Florida Department of Physics, https://www.phys.ufl.edu/courses/phy4803L/sample-paper.zip

\documentclass[aps,twocolumn,secnumarabic,nobalancelastpage,amsmath,amssymb,nofootinbib,letterpaper]{revtex4}

% Documentclass Options
    % aps, prl, rmp stand for American Physical Society, Physical Review Letters, and Reviews of Modern Physics, respectively
    % twocolumn permits two columns, of course
    % nobalancelastpage doesn't attempt to equalize the lengths of the two columns on the last page
        % as might be desired in a journal where articles follow one another closely
    % amsmath and amssymb are necessary for the subequations environment among others
    % secnumarabic identifies sections by number to aid electronic review and commentary.
    % nofootinbib forces footnotes to occur on the page where they are first referenced
        % and not in the bibliography
    % REVTeX 4 is a set of macro packages designed to be used with LaTeX 2e.
        % REVTeX is well-suited for preparing manuscripts for submission to APS journals.

\usepackage{chapterbib}    % allows a bibliography for each chapter (each labguide has it's own)
\usepackage{color}         % produces boxes or entire pages with colored backgrounds
\usepackage{graphics}      % standard graphics specifications
\usepackage[pdftex]{graphicx}      % alternative graphics specifications
\usepackage{longtable}     % helps with long table options
\usepackage{epsf}          % old package handles encapsulated post script issues
\usepackage{bm}            % special 'bold-math' package
\usepackage{verbatim}			% for comment environment
\usepackage[colorlinks=true]{hyperref}  % this package should be added after all others
                                        % use as follows: \url{https://urldefense.proofpoint.com/v2/url?u=http-3A__web.mit.edu_8.13&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=D88uS55Tats-jlFQAC1XryFUYq8B7Lk3StFbXzgsiB4&m=Vjrc9Wj5n5rkIDMPJ5VsRj2GyXC3yXmN_zDHey6dVio&s=_byqsJfgO464rVIugNWFPmbBeIYfNiJcGS1fgIwc0m4&e= }
\usepackage{siunitx}
\usepackage{textcomp}
\usepackage{gensymb}

\usepackage[english]{babel}
\usepackage[autostyle, english=american]{csquotes}
\MakeOuterQuote{"}

%\addtolength\topmargin{-.5\topmargin} %cuts the top margin in half.

%
% And now, begin the document...
% Students should not have to alter anything above this line
%

\begin{document}
\title{Lab 1: Calculating the \(Q\) Value of a Pendulum}
\author{Tyler Tian}
\noaffiliation
\date{\today}

\begin{abstract}
In this experiment, a simple pendulum is constructed out of readily available materials, and its motion is tracked using
a computer vision algorithm in order to measure its \(Q\) factor. \(Q\) is measured using two methods: using a
least-squares fit of the theoretical model to the data, and counting the number of oscillations until it decays to some
factor of the initial amplitude. The two methods produced \(Q\) values that were different, but could still be in
agreement due to uncertainties.

Some interesting observations were made: 1. the measured \(Q\) value through oscillation counting depends on the
fraction of \(Q\) being measured, 2. the model does not fit the data very well, especially for large time values, and 3.
the period of the pendulum appears to decrease slightly with time.
\end{abstract}

\maketitle

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Introduction}

For this experiment, a simple pendulum is constructed and its \(Q\) factor is measured using two methods:
fitting data collected from it to a mathematical model, and through counting oscillations.

The mathematical model used for this lab is
\begin{equation}
    \theta(t) = \theta_0 e^{-\frac{t}{\tau}}\cos\left(2\pi\frac{t}{T} + \phi_0\right)
    \label{eqn:model}
\end{equation}
where $\theta(t)$ is the angle of the pendulum in radians at time $t$, $\theta_0$ is the initial amplitude at release,
$\tau$ is the time constant of decay, $T$ is the period and $\phi_0$ is the phase shift.

The \(Q\) factor is then defined as
\begin{equation}
    Q = \pi\frac{\tau}{T}
    \label{eqn:q}
\end{equation}

Measuring \(Q\) using oscillation counting relies on the mathematical property that after \(\frac{Q}{n}\) oscillations
(i.e. \(t = T\frac{Q}{n}\)), the amplitude becomes
\begin{equation}
    \theta_0 e^{-\frac{t}{\tau}} = \theta_0 e^{-\frac{T\frac{Q}{n}}{\tau}} = \theta_0 e^{-\frac{T\frac{\pi\frac{\tau}{T}}{n}}{\tau}} = \theta_0 e^{-\frac{\pi}{n}}
\end{equation}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Method}

\subsection{Pendulum Construction}

\begin{figure}[htb]
    \includegraphics[width=0.6\linewidth]{pendulum.png}
    \caption{The pendulum constructed for this experiment.}
\end{figure}

The main support structure of the pendulum consists of two pieces of wood, attached together with screws and an
L-bracket. This was chosen because the material was readily available, and could be substituted for any material of
similar size and suitable strength.

The string of the pendulum is a thin, braided string, specifically chosen for visibility and to minimize twisting in
order to keep the motion of the pendulum in the same plane. The string is wound around a screw at the top, with a piece
of green reflective tape on it for tracking.

The string is attached to a bob consisting of a small, red plastic cup with coins inside for weight. The colour of the
cup is deliberately chosen to allow for computer-vision (CV) based tracking. Coins are used for added weight because
they have known masses and are readily available.

The string length and bob mass are adjustable, but for this experiment, the distance from the pivot to the centre of the
mass is fixed at \(65\si{cm} \pm 1\si{cm}\), and the mass is fixed at 6 Canadian \$2 coins (about \(41.52\si{g}\)
assuming cup mass is negligible).

\subsection{Data Collection}
\label{section:method:data_collection}

\begin{figure}[htb]
    \includegraphics[width=\linewidth]{cv_track.png}
    \caption{CV-based tracking of the pendulum.}
\end{figure}

Videos of the pendulum are shot on a phone camera in FHD 60fps and then passed to a program to determine the angles.
The pendulum is released at a fixed starting amplitude each time, always starting on the right and swinging in the plane
of the camera.

The pendulum's angle is tracked using a Python program written with OpenCV (see Appendix \ref{appendix:code}).
The locations of the bob and pivot are determined by thresholding the image and then taking the average of the pixels to
find the centres. After the pixel coordinates have been determined, the ratio of the difference between the \(x\) and
\(y\) coordinates are used to compute the angle for each frame.

One data point is collected per 3 frames for 20 data points per second. Data collection starts as soon as the bob is
released, which is defined to be \(t = 0\).

\subsection{Data Analysis}

In total, 7 trials were conducted.
For each trial, the \(Q\) factor is determined using two independent methods as outlined below:

\subsubsection{Curve Fitting}

In the first method, \(Q\) is computed using Equation \ref{eqn:q} with values of \(\tau\) and \(T\) computed by fitting
Equation \ref{eqn:model} to the experimental data.

The data is passed to a Python program (see Appendix \ref{appendix:code}) that fits the model using a nonlinear
least-squares method, which determines the optimal values for \(\tau\) and \(T\) among others, and the standard
deviations of both, which is used as the uncertainty.

\subsubsection{Oscillation Counting}
\label{section:method:oscillation}

In the second method, the number of oscillations until the amplitude decays to \(e^{-\pi/3}\) of the original is
counted, which corresponds to \(\frac{Q}{3}\). The counting is again done with a Python program (see Appendix
\ref{appendix:code}).

Note that here an "oscillation" is defined as one complete period of the pendulum's swing. "Half-oscillations" are
counted if the amplitude first reaches the target value without completing a full period. For example, if the pendulum
starts at all the way to the right, and first reaches the target amplitude when it is swinging all the way to the left,
then a half-oscillation will be counted for the last cycle.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Observations}

\subsection{Curve Fitting}

\begin{figure*}[htb]
    \includegraphics[width=0.725\linewidth]{fit1.png}
    \caption{Result of fitting Equation \ref{eqn:model} to the data. For this particular fit, \(A = 0.653\),
    \(\tau = 77.9\), \(T = 1.65\), \(\phi = -0.439\). Uncertainty bars are omitted to improve readability.}
    \label{fig:fit}
    \includegraphics[width=0.725\linewidth]{fit2.png}
    \caption{Zoomed in view of the first 15 seconds.}
    \label{fig:fitzoom}
\end{figure*}

\(Q\) values computed using this method are shown in Table \ref{table:fit}:
\begin{table}[h]
    \begin{tabular}{c|c|c|c}
        Trial & \(Q\) & Uncertainty & \% Uncertainty \\
        \hline
        1   & 153.23    & \(\pm 3.65\) & 2.38 \\
        2   & 147.89    & \(\pm 3.95\) & 2.67 \\
        3	& 140.96	& \(\pm 3.53\) & 2.51 \\
        4	& 151.12	& \(\pm 3.81\) & 2.52 \\
        5	& 130.24	& \(\pm 3.86\) & 2.96 \\
        6	& 131.31	& \(\pm 3.76\) & 2.86 \\
        7	& 138.04	& \(\pm 3.70\) & 2.68 \\
        \hline
        \multicolumn{3}{l}{Mean} & 141.83 \\
        \multicolumn{3}{l}{Standard Deviation} & 9.24 \\
        \multicolumn{3}{l}{Uncertainty of the Mean} & 3.49
    \end{tabular}
    \caption{Raw data from curve fitting; values are \textbf{unrounded}. For final uncertainties see Section
        \ref{section:uncertainty}.}
    \label{table:fit}
\end{table}

A graph of the data and curve fit for one trial is shown in Figure \ref{fig:fit} and Figure \ref{fig:fitzoom}.

\subsection{Oscillation Counting}

\(Q\) values computed using this method are shown in Table \ref{table:oscillation}:
\begin{table}[h]
    \begin{tabular}{c|c|c|c}
        Trial & \(Q\) & Uncertainty & \% Uncertainty \\
        \hline
        1   & 148.5 & \(\pm 1.5\) & 1.01 \\
        2   & 151.5 & \(\pm 1.5\) & 0.99 \\
        3	& 148.5 & \(\pm 1.5\) & 1.01 \\
        4	& 154.5 & \(\pm 1.5\) & 0.97 \\
        5	& 139.5 & \(\pm 1.5\) & 1.08 \\
        6	& 142.5 & \(\pm 1.5\) & 1.05 \\
        7	& 148.5 & \(\pm 1.5\) & 1.01 \\
        \hline
        \multicolumn{3}{l}{Mean} & 147.6 \\
        \multicolumn{3}{l}{Standard Deviation} & 5.11 \\
        \multicolumn{3}{l}{Uncertainty of the Mean} & 1.93
    \end{tabular}
    \caption{Raw data from oscillation counting; values are \textbf{unrounded}. For final uncertainties see Section
        \ref{section:uncertainty}.}
    \label{table:oscillation}
\end{table}

It was chosen to measure for \(\frac{Q}{3} \rightarrow e^{-\pi/3} \approx 0.3509\) because of the very high \(Q\)
factor of the pendulum. The data collected only covers a time range enough for \(\frac{Q}{3}\).

However, an interesting phenomenon can be observed by varying the fraction of \(Q\) to measure for.
For example, by measuring for \(\frac{Q}{4}\) instead, the data in Table \ref{table:oscillation4} is obtained.
\begin{table}[h]
    \begin{tabular}{c|c|c|c}
        Trial & \(Q\) & Uncertainty & \% Uncertainty \\
        \hline
        1   & 126.0 & \(\pm 2\) & 1.59 \\
        2   & 138.0 & \(\pm 2\) & 1.45 \\
        3	& 134.0 & \(\pm 2\) & 1.49 \\
        4	& 144.0 & \(\pm 2\) & 1.39 \\
        5	& 128.0 & \(\pm 2\) & 1.56 \\
        6	& 126.0 & \(\pm 2\) & 1.59 \\
        7	& 134.0 & \(\pm 2\) & 1.49 \\
        \hline
        \multicolumn{3}{l}{Mean} & 132.9 \\
        \multicolumn{3}{l}{Standard Deviation} & 6.72 \\
        \multicolumn{3}{l}{Uncertainty of the Mean} & 2.54
    \end{tabular}
    \caption{Data obtained from measuring \(\frac{Q}{4}\)} instead.
    \label{table:oscillation4}
\end{table}

After more trials, it can be observed that the value of \(Q\) observed through counting oscillations is dependent on the
fraction of \(Q\) that was measured for. Moreover, as the denominator increases, the observed \(Q\) value seems to
decrease, while according to the mathematical model the value of \(Q\) should be independent of the fraction measured.
This is likely because the model is not an accurate approximation of the actual system. (More details in Section
\ref{section:analysis}.)

\subsection{Uncertainty Analysis}
\label{section:uncertainty}

\subsubsection{Measurement Uncertainty}

There are two sources of measurement uncertainty during the data collection process that can be easily quantified:
\begin{enumerate}
    \item \textbf{Time measurement uncertainty from the camera's frame rate and shutter speed.} Because the camera only
          captures a set number of frames per second, this creates a small uncertainty about the exact time that data
          points occurred. An upper bound for this uncertainty can be obtained by taking the time between two frames and
          dividing by 2. For a 60fps camera, this results in an uncertainty of \(\pm 0.008\si{s}\).
    \item \textbf{Angle measurement uncertainty from motion blur and imperfect tracking.} Motion blur caused by a
          fast-moving bob can make the angle hard to measure, and imperfect computer vision tracking of the bob and
          pivot may also result in an incorrect angle. To estimate an upper bound of this uncertainty, a frame is taken
          from when the pendulum has its maximum velocity to maximize motion blur. Two lines are drawn representing the
          worst possible cases for tracking, and the angle between them is taken. The result is a range of about
          \(5\degree\), or an uncertainty of \(\pm 3\degree\)/\(\pm 0.05\si{rad}\).
\end{enumerate}
\begin{figure}[h]
    \includegraphics[width=0.3\linewidth]{uncert1.png}
    \caption{Worst-case scenarios for angle uncertainty. Blue lines are drawn to indicate the greatest and least
        possible angle.}
\end{figure}

These uncertainties are shown in the graphs in Figures \ref{fig:fit} and \ref{fig:fitzoom}. They are very small when
compared to the uncertainties later in the experiment, and so they will be ignored as only the largest uncertainty is
considered for this lab. Furthermore, their random nature means that these uncertainties would already be included in
the uncertainty of the mean.

There are also other sources of measurement uncertainty that are much harder to quantify:
\begin{enumerate}
    \item Perspective distortion
    \item Tilted camera
    \item Pendulum not swinging perfectly in the plane of the camera
\end{enumerate}
These uncertainties are assumed to be smaller and random, and thus incorporated in the uncertainty of the mean and other
sources described below.

\subsubsection{Uncertainties From Curve Fitting}

For each trial, the standard deviation obtained from the least squares fit is used as uncertainty values for \(\tau\)
and \(T\) and used to calculate uncertainty for \(Q\). From Table \ref{table:fit}, the greatest percentage uncertainty
is trial 5 with an uncertainty of 2.96\%. When multiplied by the mean, this corresponds to an uncertainty of
\(\pm 4.20\), which is greater than the uncertainty of the mean.

\textbf{The final value as determined by this method is \(Q = 142 \pm 4\).}

\subsubsection{Uncertainties From Oscillation Counting}

Since the amplitude can only be determined at the top of a peak or bottom of a trough, this method yields a maximum
resolution of 0.5 oscillations (half oscillations are allowed as described in Section \ref{section:method:oscillation}).

Because oscillations are counted until the amplitude first decays to less than the target instead of finding the cycle
with amplitude closest to the target, this yields an uncertainty of \(\pm 0.5\) oscillations, which corresponds to
\(\pm 1.5\) for the final \(Q\) value.

From Table \ref{table:oscillation}, the greatest percentage uncertainty is trial 5 with an uncertainty of 1.08\%, which
corresponds to an uncertainty of \(\pm 1.59\) in \(Q\), less than the uncertainty of the mean.

\textbf{The final value as determined by this method is \(Q = 148 \pm 2\).}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Analysis and Conclusion}
\label{section:analysis}

\subsection{\texorpdfstring{\(Q\)}{Q} Factor}

The \(Q\) value obtained by oscillation counting is within 1.5 times the uncertainty of the \(Q\) value obtained by
curve fitting. If values follow a normal distribution, there is a 13.4\% chance for values to be more than 1.5 times the
uncertainty away. From this we conclude that \textbf{while there is a discrepancy between the two \(Q\) values, there is
a chance that they are in agreement.} From the \(Q\) values and uncertainties alone, it can be concluded that the actual
\(Q\) value is between 142 and 148 and closer to the latter (since it has a lower uncertainty).

However, as shown in Table \ref{table:oscillation4}, by measuring for \(\frac{Q}{4}\) a \(Q\) value of \(133 \pm 3\) is
obtained instead. This value is 2.25 times the uncertainty away from the \(Q\) value obtained by curve fitting, and 5
times the uncertainty away from the \(Q\) value obtained by counting for \(\frac{Q}{3}\). The probability for a value to
lie outside 2.25 times the uncertainty is about 2.44\%, so this value is not in agreement with either \(Q\) value found
above.

Furthermore, as the fraction of \(Q\) measured for gets smaller, the measured \(Q\) value gets even further from the
values obtained previously. It can be concluded that, at least for this particular pendulum, \textbf{oscillation
counting is not a reliable way for obtaining \(Q\)}.

\subsection{Model Accuracy}

An inspection of the residuals in Figure \ref{fig:fit} shows a clear pattern, which would not be present if the fit
represented the data well. At many points, the residuals reach a value of 0.2, which is over 25\% of the actual
amplitude of the data, 0.8. The amplitude of the fit also deviates significantly from the actual amplitude of the data
(0.6 versus 0.8), but adjusting the conditions of the fit does not improve it.

The two possible reasons for this happening are either that the fit was not done well, or the model does not reflect the
real data well. The data is inconclusive for determining which is the dominant effect, but there is likely \textbf{a mix
of both}.

The amplitudes obtained from fit seems to be systematically smaller than the actual peak amplitudes in the
data, which suggests an incorrect fit. However, it is also likely that the model itself is inaccurate: Due to the
experimental setup (see Section \ref{section:method:data_collection}), the theoretical value of \(\phi_0\) should
always be 0. However, all the trials have produced a nonzero value for \(\phi_0\).

Figure \ref{fig:fit_nophi} is the result of modifying the code to fix \(\phi\) at 0 (see Appendix \ref{appendix:code}).
\begin{figure}[htb]
    \includegraphics[width=0.9\linewidth]{fit3.png}
    \caption{Result of fitting Equation \ref{eqn:model} with \(\phi = 0\). For this particular fit, \(A = 0.686\),
    \(\tau = 63.16\), \(T = 1.66\). Uncertainty bars are omitted to improve readability.}
    \label{fig:fit_nophi}
\end{figure}

Compared to Figure \ref{fig:fit}, this time the fit is much worse, with the fit curve visibly deviating from the data in
both magnitude and phase near the end. The residuals seem to keep on increasing at the end, which allows us to conclude
that \textbf{Equation \ref{eqn:model} is likely not a very accurate model of this pendulum for large values of \(t\)}.

This might be because Equation \ref{eqn:model} is derived with the simplifying assumption of \(\sin x \approx x\) for
small angles and a damping force proportional to the velocity, while in reality drag is closer to quadratic.
This would cause the damping force to be stronger for smaller velocities, resulting in a rate of decay that is too fast
as shown in Figure \ref{fig:fit_nophi}.

For the fit in Figure \ref{fig:fit_nophi}, the largest percentage uncertainty was for the value of \(\tau\), which is
3.00\%. Assuming the 3.00\% carries over to the final value of \(\theta(t)\), this represents an uncertainty in the
worst case of \(\pm 0.0240\si{rad}\) (for a \(\theta\) value of 0.8). Comparing this to the residual graphs in Figures
\ref{fig:fit} and \ref{fig:fit_nophi}, the residuals easily exceed it by many times, even in regions where the
residuals are small.

Another reason for the large residuals could be that \textbf{the period of this pendulum appears to be non-constant}.
Observing the data more closely shows that the period of the pendulum appears to decrease slightly as time progresses.
In particular, for the trial in Figure \ref{fig:fit}, the initial period shortly after release is about
\(1.67\si{s} \pm 0.01\si{s}\), while the final period near the end of the video is about \(1.64\si{s} \pm 0.01\si{s}\).
Although the difference is small, it is consistently present throughout multiple trials and is too large to be explained
by uncertainties. This represents a slight deviation from the model, since Equation \ref{eqn:model} has a constant
period.

\subsection{Implications for Future Data Collection}

The findings have the following implications for data collection in future labs:
\begin{enumerate}
    \item The \(Q\) value was measured to be greater than 140, which means for every oscillation the amplitude decays to
          greater than \(e^{-\frac{\pi}{Q}} \approx 0.978 = 97.8\%\) of the previous oscillation. The high \(Q\) factor
          combined with a reasonably high period of about \(1.6\si{s}\) makes it very easy to measure multiple periods
          to get more accurate data, so in subsequent experiments more periods should be measured to improve accuracy.
    \item The slight change in period, although small (less than 2\%), means that results may differ depending on the
          when measurements are taken (specifically for measuring the period later in Lab 2). Therefore, special care
          should be taken to ensure that all period measurements are taken right at the beginning of the experiment so
          they could be compared.
\end{enumerate}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\appendix
\section{Source Code}

A comprehensive list of all source code, as well as the \LaTeX{} source for this report, can be found on GitHub at
\url{https://github.com/tylertian123/phy180_lab}, in particular:
\label{appendix:code}
\begin{enumerate}
    \item For tracking the pendulum and generating time-angle data: \url{https://github.com/tylertian123/phy180_lab/tree/lab1/cvtrack.py}
    \item For fitting the model to experimental data: \url{https://github.com/tylertian123/phy180_lab/tree/lab1/fit.py}
    \item For measuring \(Q\) by counting oscillations: \url{https://github.com/tylertian123/phy180_lab/tree/lab1/find_q.py}
    \item For fitting the model with \(\phi\) fixed at 0: \url{https://github.com/tylertian123/phy180_lab/tree/lab1/fit_nophi.py}
\end{enumerate}

\end{document}


\section{Program Logic}
\label{sec:program-logic}

This section describes how to build a program logic for an arbitrary language (\cf \Sref{sec:language}) on top of the base logic.
So in the following, we assume that some language $\Lang$ was fixed.
Furthermore, we work in the logic with higher-order ghost state as described in \Sref{sec:composeable-resources}.

\subsection{World Satisfaction, Invariants, Fancy Updates}
\label{sec:invariants}

To introduce invariants into our logic, we will define weakest precondition to explicitly thread through the proof that all the invariants are maintained throughout program execution.
However, in order to be able to access invariants, we will also have to provide a way to \emph{temporarily disable} (or ``open'') them.
To this end, we use tokens that manage which invariants are currently enabled.

We assume to have the following four cameras available:
\begin{align*}
  \InvName \eqdef{}& \nat \\
  \textmon{Inv} \eqdef{}& \authm(\InvName \fpfn \agm(\latert \iPreProp)) \\
  \textmon{En} \eqdef{}& \pset{\InvName} \\
  \textmon{Dis} \eqdef{}& \finpset{\InvName}
\end{align*}
The last two are the tokens used for managing invariants, $\textmon{Inv}$ is the monoid used to manage the invariants themselves.

We assume that at the beginning of the verification, instances named $\gname_{\textmon{State}}$, $\gname_{\textmon{Inv}}$, $\gname_{\textmon{En}}$ and $\gname_{\textmon{Dis}}$ of these cameras have been created, such that these names are globally known.

\paragraph{World Satisfaction.}
We can now define the proposition $W$ (\emph{world satisfaction}) which ensures that the enabled invariants are actually maintained:
\begin{align*}
  W \eqdef{}& \Exists I : \InvName \fpfn \Prop.
  \begin{array}[t]{@{} l}
    \ownGhost{\gname_{\textmon{Inv}}}{\authfull
      \mapComp {\iname}
        {\aginj(\latertinj(\wIso(I(\iname))))}
        {\iname \in \dom(I)}} * \\
    \Sep_{\iname \in \dom(I)} \left( \later I(\iname) * \ownGhost{\gname_{\textmon{Dis}}}{\set{\iname}} \lor \ownGhost{\gname_{\textmon{En}}}{\set{\iname}} \right)
  \end{array}
\end{align*}

\paragraph{Invariants.}
The following proposition states that an invariant with name $\iname$ exists and maintains proposition $\prop$:
\[ \knowInv\iname\prop \eqdef \ownGhost{\gname_{\textmon{Inv}}}
  {\authfrag \mapsingleton \iname {\aginj(\latertinj(\wIso(\prop)))}} \]

\paragraph{Fancy Updates and View Shifts.}
Next, we define \emph{fancy updates}, which are essentially the same as the basic updates of the base logic ($\Sref{sec:base-logic}$), except that they also have access to world satisfaction and can enable and disable invariants:
\[ \pvs[\mask_1][\mask_2] \prop \eqdef W * \ownGhost{\gname_{\textmon{En}}}{\mask_1} \wand \upd\diamond (W * \ownGhost{\gname_{\textmon{En}}}{\mask_2} * \prop) \]
Here, $\mask_1$ and $\mask_2$ are the \emph{masks} of the view update, defining which invariants have to be (at least!) available before and after the update.
We use $\top$ as symbol for the largest possible mask, $\nat$, and $\bot$ for the smallest possible mask $\emptyset$.
We will write $\pvs[\mask] \prop$ for $\pvs[\mask][\mask]\prop$.
%
Fancy updates satisfy the following basic proof rules:
\begin{mathparpagebreakable}
\infer[fup-mono]
{\prop \proves \propB}
{\pvs[\mask_1][\mask_2] \prop \proves \pvs[\mask_1][\mask_2] \propB}

\infer[fup-intro-mask]
{\mask_2 \subseteq \mask_1}
{\prop \proves \pvs[\mask_1][\mask_2]\pvs[\mask_2][\mask_1] \prop}

\infer[fup-trans]
{}
{\pvs[\mask_1][\mask_2] \pvs[\mask_2][\mask_3] \prop \proves \pvs[\mask_1][\mask_3] \prop}

\infer[fup-upd]
{}{\upd\prop \proves \pvs[\mask] \prop}

\infer[fup-frame]
{}{\propB * \pvs[\mask_1][\mask_2]\prop \proves \pvs[\mask_1 \uplus \mask_\f][\mask_2 \uplus \mask_\f] \propB * \prop}

\inferH{fup-update}
{\melt \mupd \meltsB}
{\ownM\melt \proves \pvs[\mask] \Exists\meltB\in\meltsB. \ownM\meltB}

\infer[fup-timeless]
{\timeless\prop}
{\later\prop \proves \pvs[\mask] \prop}
%
% \inferH{fup-allocI}
% {\text{$\mask$ is infinite}}
% {\later\prop \proves \pvs[\mask] \Exists \iname \in \mask. \knowInv\iname\prop}
%gov
% \inferH{fup-openI}
% {}{\knowInv\iname\prop \proves \pvs[\set\iname][\emptyset] \later\prop}
%
% \inferH{fup-closeI}
% {}{\knowInv\iname\prop \land \later\prop \proves \pvs[\emptyset][\set\iname] \TRUE}
\end{mathparpagebreakable}
(There are no rules related to invariants here. Those rules will be discussed later, in \Sref{sec:namespaces}.)

We can further define the notions of \emph{view shifts} and \emph{linear view shifts}:
\begin{align*}
  \prop \vsW[\mask_1][\mask_2] \propB \eqdef{}& \prop \wand \pvs[\mask_1][\mask_2] \propB \\
  \prop \vs[\mask_1][\mask_2] \propB \eqdef{}& \always(\prop \wand \pvs[\mask_1][\mask_2] \propB) \\
  \prop \vs[\mask] \propB \eqdef{}& \prop \vs[\mask][\mask] \propB
\end{align*}
These two are useful when writing down specifications and for comparing with previous versions of Iris, but for reasoning, it is typically easier to just work directly with fancy updates.
Still, just to give an idea of what view shifts ``are'', here are some proof rules for them:
\begin{mathparpagebreakable}
\inferH{vs-update}
  {\melt \mupd \meltsB}
  {\ownGhost\gname{\melt} \vs[\emptyset] \exists \meltB \in \meltsB.\; \ownGhost\gname{\meltB}}
\and
\inferH{vs-trans}
  {\prop \vs[\mask_1][\mask_2] \propB \and \propB \vs[\mask_2][\mask_3] \propC}
  {\prop \vs[\mask_1][\mask_3] \propC}
\and
\inferH{vs-imp}
  {\always{(\prop \Ra \propB)}}
  {\prop \vs[\emptyset] \propB}
\and
\inferH{vs-mask-frame}
  {\prop \vs[\mask_1][\mask_2] \propB}
  {\prop \vs[\mask_1 \uplus \mask'][\mask_2 \uplus \mask'] \propB}
\and
\inferH{vs-frame}
  {\prop \vs[\mask_1][\mask_2] \propB}
  {\prop * \propC \vs[\mask_1][\mask_2] \propB * \propC}
\and
\inferH{vs-timeless}
  {\timeless{\prop}}
  {\later \prop \vs[\emptyset] \prop}

% \inferH{vs-allocI}
%   {\infinite(\mask)}
%   {\later{\prop} \vs[\mask] \exists \iname\in\mask.\; \knowInv{\iname}{\prop}}
% \and
% \axiomH{vs-openI}
%   {\knowInv{\iname}{\prop} \proves \TRUE \vs[\{ \iname \} ][\emptyset] \later \prop}
% \and
% \axiomH{vs-closeI}
%   {\knowInv{\iname}{\prop} \proves \later \prop \vs[\emptyset][\{ \iname \} ] \TRUE }
%
\inferHB{vs-disj}
  {\prop \vs[\mask_1][\mask_2] \propC \and \propB \vs[\mask_1][\mask_2] \propC}
  {\prop \lor \propB \vs[\mask_1][\mask_2] \propC}
\and
\inferHB{vs-exist}
  {\All \var. (\prop \vs[\mask_1][\mask_2] \propB)}
  {(\Exists \var. \prop) \vs[\mask_1][\mask_2] \propB}
\and
\inferHB{vs-always}
  {\always\propB \proves \prop \vs[\mask_1][\mask_2] \propC}
  {\prop \land \always{\propB} \vs[\mask_1][\mask_2] \propC}
 \and
\inferH{vs-false}
  {}
  {\FALSE \vs[\mask_1][\mask_2] \prop }
\end{mathparpagebreakable}

\subsection{Weakest Precondition}

Finally, we can define the core piece of the program logic, the proposition that reasons about program behavior: Weakest precondition, from which Hoare triples will be derived.

\paragraph{Defining weakest precondition.}
We assume that everything making up the definition of the language, \ie values, expressions, states, the conversion functions, reduction relation and all their properties, are suitably reflected into the logic (\ie they are part of the signature $\Sig$).
We further assume (as a parameter) a predicate $\stateinterp : \State \to \iProp$ that interprets the physical state as an Iris proposition.
This can be instantiated, for example, with ownership of an authoritative RA to tie the physical state to fragments that are used for user-level proofs.
Finally, weakest precondition takes a parameter $\stuckness \in \set{\NotStuck, \MaybeStuck}$ indicating whether program execution is allowed to get stuck.

\begin{align*}
  \textdom{wp}(\stateinterp, \stuckness) \eqdef{}& \MU \textdom{wp\any rec}. \Lam \mask, \expr, \pred. \\
        & (\Exists\val. \toval(\expr) = \val \land \pvs[\mask] \pred(\val)) \lor {}\\
        & \Bigl(\toval(\expr) = \bot \land \All \state. \stateinterp(\state) \vsW[\mask][\emptyset] {}\\
        &\qquad (s = \NotStuck \Ra \red(\expr, \state)) * \later\All \expr', \state', \vec\expr. (\expr, \state \step \expr', \state', \vec\expr) \vsW[\emptyset][\mask] {}\\
        &\qquad\qquad \stateinterp(\state') * \textdom{wp\any rec}(\mask, \expr', \pred) * \Sep_{\expr'' \in \vec\expr} \textdom{wp\any rec}(\top, \expr'', \Lam \any. \TRUE)\Bigr) \\
%  (* value case *)
  \wpre[\stateinterp]\expr[\stuckness;\mask]{\Ret\val. \prop} \eqdef{}& \textdom{wp}(\stateinterp,\stuckness)(\mask, \expr, \Lam\val.\prop)
\end{align*}
The $\stateinterp$ will always be set by the context; typically, when instantiating Iris with a language, we also pick the corresponding state interpretation $\stateinterp$.
All proof rules leave $\stateinterp$ unchanged.
If we leave away the mask $\mask$, we assume it to default to $\top$.
If we leave away the stuckness $\stuckness$, it defaults to $\NotStuck$.

\paragraph{Laws of weakest precondition.}
The following rules can all be derived:
\begin{mathpar}
\infer[wp-value]
{}{\prop[\val/\var] \proves \wpre{\val}[\stuckness;\mask]{\Ret\var.\prop}}

\infer[wp-mono]
{\mask_1 \subseteq \mask_2 \and \vctx,\var:\textlog{val}\mid\prop \proves \propB \and (\stuckness_2 = \MaybeStuck \lor \stuckness_1 = \stuckness_2)}
{\vctx\mid\wpre\expr[\stuckness_1;\mask_1]{\Ret\var.\prop} \proves \wpre\expr[\stuckness_2;\mask_2]{\Ret\var.\propB}}

\infer[fup-wp]
{}{\pvs[\mask] \wpre\expr[\stuckness;\mask]{\Ret\var.\prop} \proves \wpre\expr[\stuckness;\mask]{\Ret\var.\prop}}

\infer[wp-fup]
{}{\wpre\expr[\stuckness;\mask]{\Ret\var.\pvs[\stuckness;\mask] \prop} \proves \wpre\expr[\stuckness;\mask]{\Ret\var.\prop}}

\infer[wp-atomic]
{\stuckness = \NotStuck \Ra \atomic(\expr) \and
 \stuckness = \MaybeStuck \Ra \stronglyAtomic(\expr)}
{\pvs[\mask_1][\mask_2] \wpre\expr[\stuckness;\mask_2]{\Ret\var. \pvs[\mask_2][\mask_1]\prop}
 \proves \wpre\expr[\stuckness;\mask_1]{\Ret\var.\prop}}

\infer[wp-frame]
{}{\propB * \wpre\expr[\stuckness;\mask]{\Ret\var.\prop} \proves \wpre\expr[\stuckness;\mask]{\Ret\var.\propB*\prop}}

\infer[wp-frame-step]
{\toval(\expr) = \bot \and \mask_2 \subseteq \mask_1}
{\wpre\expr[\stuckness;\mask_2]{\Ret\var.\prop} * \pvs[\mask_1][\mask_2]\later\pvs[\mask_2][\mask_1]\propB \proves \wpre\expr[\stuckness;\mask_1]{\Ret\var.\propB*\prop}}

\infer[wp-bind]
{\text{$\lctx$ is a context}}
{\wpre\expr[\stuckness;\mask]{\Ret\var. \wpre{\lctx(\ofval(\var))}[\stuckness;\mask]{\Ret\varB.\prop}} \proves \wpre{\lctx(\expr)}[\stuckness;\mask]{\Ret\varB.\prop}}
\end{mathpar}

We will also want a rule that connect weakest preconditions to the operational semantics of the language.
\begin{mathpar}
  \infer[wp-lift-step]
  {\toval(\expr_1) = \bot}
  { {\begin{inbox} % for some crazy reason, LaTeX is actually sensitive to the space between the "{ {" here and the "} }" below...
        ~~\All \state_1. \stateinterp(\state_1) \vsW[\mask][\emptyset] (\stuckness = \NotStuck \Ra \red(\expr_1,\state_1)) * {}\\\qquad~~ \later\All \expr_2, \state_2, \vec\expr.  (\expr_1, \state_1 \step \expr_2, \state_2, \vec\expr)  \vsW[\emptyset][\mask] \Bigl(\stateinterp(\state_2) * \wpre[\stateinterp]{\expr_2}[\stuckness;\mask]{\Ret\var.\prop} * \Sep_{\expr_\f \in \vec\expr} \wpre[\stateinterp]{\expr_\f}[\stuckness;\top]{\Ret\any.\TRUE}\Bigr)  {}\\\proves \wpre[\stateinterp]{\expr_1}[\stuckness;\mask]{\Ret\var.\prop}
      \end{inbox}} }
\end{mathpar}

% We can further derive some slightly simpler rules for special cases.
% \begin{mathparpagebreakable}
%   \infer[wp-lift-pure-step]
%   {\All \state_1. \red(\expr_1, \state_1) \and
%    \All \state_1, \expr_2, \state_2, \vec\expr. \expr_1,\state_1 \step \expr_2,\state_2,\vec\expr \Ra \state_1 = \state_2 }
%   {\later\All \state, \expr_2, \vec\expr. (\expr_1,\state \step \expr_2, \state,\vec\expr)  \Ra \wpre{\expr_2}[\mask]{\Ret\var.\prop} * \Sep_{\expr_\f \in \vec\expr} \wpre{\expr_\f}[\top]{\Ret\any.\TRUE} \proves \wpre{\expr_1}[\mask]{\Ret\var.\prop}}

%   \infer[wp-lift-atomic-step]
%   {\atomic(\expr_1) \and
%    \red(\expr_1, \state_1)}
%   { {\begin{inbox}~~\later\ownPhys{\state_1} * \later\All \val_2, \state_2, \vec\expr. (\expr_1,\state_1 \step \ofval(\val),\state_2,\vec\expr)  * \ownPhys{\state_2} \wand \prop[\val_2/\var] * \Sep_{\expr_\f \in \vec\expr} \wpre{\expr_\f}[\top]{\Ret\any.\TRUE} {}\\ \proves  \wpre{\expr_1}[\mask_1]{\Ret\var.\prop}
%   \end{inbox}} }

%   \infer[wp-lift-atomic-det-step]
%   {\atomic(\expr_1) \and
%    \red(\expr_1, \state_1) \and
%    \All \expr'_2, \state'_2, \vec\expr'. \expr_1,\state_1 \step \expr'_2,\state'_2,\vec\expr' \Ra \state_2 = \state_2' \land \toval(\expr_2') = \val_2 \land \vec\expr = \vec\expr'}
%   {\later\ownPhys{\state_1} * \later \Bigl(\ownPhys{\state_2} \wand \prop[\val_2/\var] * \Sep_{\expr_\f \in \vec\expr} \wpre{\expr_\f}[\top]{\Ret\any.\TRUE} \Bigr) \proves \wpre{\expr_1}[\mask_1]{\Ret\var.\prop}}

%   \infer[wp-lift-pure-det-step]
%   {\All \state_1. \red(\expr_1, \state_1) \\
%    \All \state_1, \expr_2', \state'_2, \vec\expr'. \expr_1,\state_1 \step \expr'_2,\state'_2,\vec\expr' \Ra \state_1 = \state'_2 \land \expr_2 = \expr_2' \land \vec\expr = \vec\expr'}
%   {\later \Bigl( \wpre{\expr_2}[\mask_1]{\Ret\var.\prop} * \Sep_{\expr_\f \in \vec\expr} \wpre{\expr_\f}[\top]{\Ret\any.\TRUE} \Bigr) \proves \wpre{\expr_1}[\mask_1]{\Ret\var.\prop}}
% \end{mathparpagebreakable}

\paragraph{Adequacy of weakest precondition.}

The purpose of the adequacy statement is to show that our notion of weakest preconditions is \emph{realistic} in the sense that it actually has anything to do with the actual behavior of the program.
There are two properties we are looking for: First of all, the postcondition should reflect actual properties of the values the program can terminate with.
Second, a proof of a weakest precondition with any postcondition should imply that the program is \emph{safe}, \ie that it does not get stuck.

\begin{defn}[Adequacy]
  A program $\expr$ in some initial state $\state$ is \emph{adequate} for stuckness  $\stuckness$ and a set $V \subseteq \Val$ of legal return values ($\expr, \state \vDash_\stuckness V$) if for all $\tpool', \state'$ such that $([\expr], \state) \tpstep^\ast (\tpool', \state')$ we have
\begin{enumerate}
\item Safety: If $\stuckness = \NotStuck$, then for any $\expr' \in \tpool'$ we have that either $\expr'$ is a
  value, or \(\red(\expr'_i,\state')\):
  \[ \stuckness = \NotStuck \Ra \All\expr'\in\tpool'. \toval(\expr') \neq \bot \lor \red(\expr', \state') \]
  Notice that this is stronger than saying that the thread pool can reduce; we actually assert that \emph{every} non-finished thread can take a step.
\item Legal return value: If $\tpool'_1$ (the main thread) is a value $\val'$, then $\val' \in V$:
  \[ \All \val',\tpool''. \tpool' = [\val'] \dplus \tpool'' \Ra \val' \in V \]
\end{enumerate}
\end{defn}

To express the adequacy statement for functional correctness, we assume that the signature $\Sig$ adds a predicate $\pred$ to the logic:
\[ \pred : \Val \to \Prop \in \SigFn \]
Furthermore, we assume that the \emph{interpretation} $\Sem\pred$ of $\pred$ reflects some set $V$ of legal return values into the logic (also see \Sref{sec:model}):
\[\begin{array}{rMcMl}
  \Sem\pred &:& \Sem{\Val\,} \nfn \Sem\Prop \\
  \Sem\pred &\eqdef& \Lam \val. \Lam \any. \setComp{n}{v \in V}
\end{array}\]
The signature can of course state arbitrary additional properties of $\pred$, as long as they are proven sound.
The adequacy statement now reads as follows:
\begin{align*}
 &\All \mask, \expr, \val, \state.
 \\&( \TRUE \proves \pvs[\mask] \Exists \stateinterp. \stateinterp(\state) * \wpre[\stateinterp]{\expr}[\stuckness;\mask]{x.\; \pred(x)}) \Ra
 \\&\expr, \state \vDash_\stuckness V
\end{align*}
Notice that the state invariant $S$ used by the weakest precondition is chosen \emph{after} doing a fancy update, which allows it to depend on the names of ghost variables that are picked in that initial fancy update.

\paragraph{Hoare triples.}
It turns out that weakest precondition is actually quite convenient to work with, in particular when performing these proofs in Coq.
Still, for a more traditional presentation, we can easily derive the notion of a Hoare triple:
\[
\hoare{\prop}{\expr}{\Ret\val.\propB}[\mask] \eqdef \always{(\prop \wand \wpre{\expr}[\mask]{\Ret\val.\propB})}
\]
We assume the state interpretation $\stateinterp$ to be fixed by the context.

We only give some of the proof rules for Hoare triples here, since we usually do all our reasoning directly with weakest preconditions and use Hoare triples only to write specifications.
\begin{mathparpagebreakable}
\inferH{Ht-ret}
  {}
  {\hoare{\TRUE}{\valB}{\Ret\val. \val = \valB}[\mask]}
\and
\inferH{Ht-bind}
  {\text{$\lctx$ is a context} \and \hoare{\prop}{\expr}{\Ret\val. \propB}[\mask] \\
   \All \val. \hoare{\propB}{\lctx(\val)}{\Ret\valB.\propC}[\mask]}
  {\hoare{\prop}{\lctx(\expr)}{\Ret\valB.\propC}[\mask]}
\and
\inferH{Ht-csq}
  {\prop \vs \prop' \\
    \hoare{\prop'}{\expr}{\Ret\val.\propB'}[\mask] \\
   \All \val. \propB' \vs \propB}
  {\hoare{\prop}{\expr}{\Ret\val.\propB}[\mask]}
\and
% \inferH{Ht-mask-weaken}
%   {\hoare{\prop}{\expr}{\Ret\val. \propB}[\mask]}
%   {\hoare{\prop}{\expr}{\Ret\val. \propB}[\mask \uplus \mask']}
% \\\\
\inferH{Ht-frame}
  {\hoare{\prop}{\expr}{\Ret\val. \propB}[\mask]}
  {\hoare{\prop * \propC}{\expr}{\Ret\val. \propB * \propC}[\mask]}
\and
% \inferH{Ht-frame-step}
%   {\hoare{\prop}{\expr}{\Ret\val. \propB}[\mask] \and \toval(\expr) = \bot \and \mask_2 \subseteq \mask_2 \\\\ \propC_1 \vs[\mask_1][\mask_2] \later\propC_2 \and \propC_2 \vs[\mask_2][\mask_1] \propC_3}
%   {\hoare{\prop * \propC_1}{\expr}{\Ret\val. \propB * \propC_3}[\mask \uplus \mask_1]}
% \and
\inferH{Ht-atomic}
  {\prop \vs[\mask \uplus \mask'][\mask] \prop' \\
    \hoare{\prop'}{\expr}{\Ret\val.\propB'}[\mask] \\
   \All\val. \propB' \vs[\mask][\mask \uplus \mask'] \propB \\
   \atomic(\expr)
  }
  {\hoare{\prop}{\expr}{\Ret\val.\propB}[\mask \uplus \mask']}
\and
\inferH{Ht-false}
  {}
  {\hoare{\FALSE}{\expr}{\Ret \val. \prop}[\mask]}
\and
\inferHB{Ht-disj}
  {\hoare{\prop}{\expr}{\Ret\val.\propC}[\mask] \and \hoare{\propB}{\expr}{\Ret\val.\propC}[\mask]}
  {\hoare{\prop \lor \propB}{\expr}{\Ret\val.\propC}[\mask]}
\and
\inferHB{Ht-exist}
  {\All \var. \hoare{\prop}{\expr}{\Ret\val.\propB}[\mask]}
  {\hoare{\Exists \var. \prop}{\expr}{\Ret\val.\propB}[\mask]}
\and
\inferHB{Ht-box}
  {\always\propB \proves \hoare{\prop}{\expr}{\Ret\val.\propC}[\mask]}
  {\hoare{\prop \land \always{\propB}}{\expr}{\Ret\val.\propC}[\mask]}
% \and
% \inferH{Ht-inv}
%   {\hoare{\later\propC*\prop}{\expr}{\Ret\val.\later\propC*\propB}[\mask] \and
%    \physatomic{\expr}
%   }
%   {\knowInv\iname\propC \proves \hoare{\prop}{\expr}{\Ret\val.\propB}[\mask \uplus \set\iname]}
% \and
% \inferH{Ht-inv-timeless}
%   {\hoare{\propC*\prop}{\expr}{\Ret\val.\propC*\propB}[\mask] \and
%    \physatomic{\expr} \and \timeless\propC
%   }
%   {\knowInv\iname\propC \proves \hoare{\prop}{\expr}{\Ret\val.\propB}[\mask \uplus \set\iname]}
\end{mathparpagebreakable}

\subsection{Invariant Namespaces}
\label{sec:namespaces}

In \Sref{sec:invariants}, we defined a proposition $\knowInv\iname\prop$ expressing knowledge (\ie the proposition is persistent) that $\prop$ is maintained as invariant with name $\iname$.
The concrete name $\iname$ is picked when the invariant is allocated, so it cannot possibly be statically known -- it will always be a variable that's threaded through everything.
However, we hardly care about the actual, concrete name.
All we need to know is that this name is \emph{different} from the names of other invariants that we want to open at the same time.
Keeping track of the $n^2$ mutual inequalities that arise with $n$ invariants quickly gets in the way of the actual proof.

To solve this issue, instead of remembering the exact name picked for an invariant, we will keep track of the \emph{namespace} the invariant was allocated in.
Namespaces are sets of invariants, following a tree-like structure:
Think of the name of an invariant as a sequence of identifiers, much like a fully qualified Java class name.
A \emph{namespace} $\namesp$ then is like a Java package: it is a sequence of identifiers that we think of as \emph{containing} all invariant names that begin with this sequence. For example, \texttt{org.mpi-sws.iris} is a namespace containing the invariant name \texttt{org.mpi-sws.iris.heap}.

The crux is that all namespaces contain infinitely many invariants, and hence we can \emph{freely pick} the namespace an invariant is allocated in -- no further, unpredictable choice has to be made.
Furthermore, we will often know that namespaces are \emph{disjoint} just by looking at them.
The namespaces $\namesp.\texttt{iris}$ and $\namesp.\texttt{gps}$ are disjoint no matter the choice of $\namesp$.
As a result, there is often no need to track disjointness of namespaces, we just have to pick the namespaces that we allocate our invariants in accordingly.

Formally speaking, let $\namesp \in \textlog{InvNamesp} \eqdef \List(\nat)$ be the type of \emph{invariant namespaces}.
We use the notation $\namesp.\iname$ for the namespace $[\iname] \dplus \namesp$.
(In other words, the list is ``backwards''. This is because cons-ing to the list, like the dot does above, is easier to deal with in Coq than appending at the end.)

The elements of a namespaces are \emph{structured invariant names} (think: Java fully qualified class name).
They, too, are lists of $\nat$, the same type as namespaces.
In order to connect this up to the definitions of \Sref{sec:invariants}, we need a way to map structued invariant names to $\InvName$, the type of ``plain'' invariant names.
Any injective mapping $\textlog{namesp\_inj}$ will do; and such a mapping has to exist because $\List(\nat)$ is countable and $\InvName$ is infinite.
Whenever needed, we (usually implicitly) coerce $\namesp$ to its encoded suffix-closure, \ie to the set of encoded structured invariant names contained in the namespace: \[\namecl\namesp \eqdef \setComp{\iname}{\Exists \namesp'. \iname = \textlog{namesp\_inj}(\namesp' \dplus \namesp)}\]

We will overload the notation for invariant propositions for using namespaces instead of names:
\[ \knowInv\namesp\prop \eqdef \Exists \iname \in \namecl\namesp. \knowInv\iname{\prop} \]
We can now derive the following rules (this involves unfolding the definition of fancy updates):
\begin{mathpar}
  \axiomH{inv-persist}{\knowInv\namesp\prop \proves \always\knowInv\namesp\prop}

  \axiomH{inv-alloc}{\later\prop \proves \pvs[\emptyset] \knowInv\namesp\prop}

  \inferH{inv-open}
  {\namesp \subseteq \mask}
  {\knowInv\namesp\prop \vs[\mask][\mask\setminus\namesp] \later\prop * (\later\prop \vsW[\mask\setminus\namesp][\mask] \TRUE)}

  \inferH{inv-open-timeless}
  {\namesp \subseteq \mask \and \timeless\prop}
  {\knowInv\namesp\prop \vs[\mask][\mask\setminus\namesp] \prop * (\prop \vsW[\mask\setminus\namesp][\mask] \TRUE)}
\end{mathpar}

\subsection{Accessors}

The two rules \ruleref{inv-open} and \ruleref{inv-open-timeless} above may look a little surprising, in the sense that it is not clear on first sight how they would be applied.
The rules are the first \emph{accessors} that show up in this document.
Accessors are propositions of the form
\[ \prop \vs[\mask_1][\mask_2] \Exists\var. \propB * (\All\varB. \propB' \vsW[\mask_2][\mask_1] \propC) \]

One way to think about such propositions is as follows:
Given some accessor, if during our verification we have the proposition $\prop$ and the mask $\mask_1$ available, we can use the accessor to \emph{access} $\propB$ and obtain the witness $\var$.
We call this \emph{opening} the accessor, and it changes the mask to $\mask_2$.
Additionally, opening the accessor provides us with $\All\varB. \propB' \vsW[\mask_2][\mask_1] \propC$, a \emph{linear view shift} (\ie a view shift that can only be used once).
This linear view shift tells us that in order to \emph{close} the accessor again and go back to mask $\mask_1$, we have to pick some $\varB$ and establish the corresponding $\propB'$.
After closing, we will obtain $\propC$.

Using \ruleref{vs-trans} and \ruleref{Ht-atomic} (or the corresponding proof rules for fancy updates and weakest preconditions), we can show that it is possible to open an accessor around any view shift and any \emph{atomic} expression:
\begin{mathpar}
  \inferH{Acc-vs}
  {\prop \vs[\mask_1][\mask_2] \Exists\var. \propB * (\All\varB. \propB' \vsW[\mask_2][\mask_1] \propC) \and
   \All\var. \propB * \prop_F \vs[\mask_2] \Exists\varB. \propB' * \prop_F}
  {\prop * \prop_F \vs[\mask_1] \propC * \prop_F}

  \inferH{Acc-Ht}
  {\prop \vs[\mask_1][\mask_2] \Exists\var. \propB * (\All\varB. \propB' \vsW[\mask_2][\mask_1] \propC) \and
   \All\var. \hoare{\propB * \prop_F}\expr{\Exists\varB. \propB' * \prop_F}[\mask_2] \and
   \atomic(\expr)}
  {\hoare{\prop * \prop_F}\expr{\propC * \prop_F}[\mask_1]}
\end{mathpar}

Furthermore, in the special case that $\mask_1 = \mask_2$, the accessor can be opened around \emph{any} expression.
For this reason, we also call such accessors \emph{non-atomic}.

The reasons accessors are useful is that they let us talk about ``opening X'' (\eg ``opening invariants'') without having to care what X is opened around.
Furthermore, as we construct more sophisticated and more interesting things that can be opened (\eg invariants that can be ``cancelled'', or STSs), accessors become a useful interface that allows us to mix and match different abstractions in arbitrary ways.

For the special case that $\prop = \propC$ and $\propB = \propB'$, we use the following notation that avoids repetition:
\[ \Acc[\mask_1][\mask_2]\prop{\Ret x. \propB} \eqdef \prop \vs[\mask_1][\mask_2] \Exists\var. \propB * (\propB \vsW[\mask_2][\mask_1] \prop)  \]
This accessor is ``idempotent'' in the sense that it does not actually change the state.  After applying it, we get our $\prop$ back so we end up where we started.

%%% Local Variables:
%%% mode: latex
%%% TeX-master: "iris"
%%% End:


\documentclass[10pt]{report}

\usepackage{verbatim}
\usepackage{subcaption} % for subfigures
%\usepackage{amsthm} % for QED
%\usepackage{algpseudocode} % for pseudo-code
\usepackage{mathtools} % for \xRightarrow

\usepackage{listings} % for code
\lstset
{
	language=Matlab,
	frame=single,
	basicstyle=\footnotesize,
	numbers=left,
	stepnumber=1,
	showstringspaces=false,
	tabsize=4,
	breaklines=true,
	breakatwhitespace=false,
}

\usepackage{siunitx} % for scientific notation
% for `e' in scientific notation
\sisetup{output-exponent-marker=\ensuremath{\mathrm{e}}}

\usepackage{float} % for figure [H]
\usepackage{booktabs} % for tabular
\usepackage{caption} % for \caption*
\usepackage[export]{adjustbox} % for valign=t
\usepackage{array} % for column type m
\usepackage{verbatim}
\usepackage{graphicx}
\graphicspath{ {imgs/} }
\usepackage{fancyhdr}
\usepackage{amssymb}
\usepackage{amsmath}

%%%%%% Pagination
\setlength{\topmargin}{-.3 in}
\setlength{\oddsidemargin}{0in}
\setlength{\evensidemargin}{0in}
\setlength{\textheight}{9.in}
\setlength{\textwidth}{6.5in}

%Title page
\newcommand{\hwTitle}{Homework \#5}
\newcommand{\hwCourse}{Introduction to Computational Mathematics}
\newcommand{\hmwkClassInstructor}{Professor Shuwang Li}

\title{
	\vspace{2in}
	\textmd{\textbf{\hwCourse\\\hwTitle}}\\
	\vspace{0.3in}\large{\textit{\hmwkClassInstructor}}
	\vspace{3in}
}

%\title{Homework 1}
\author{\textbf{Zhihao Ai}}
\date{}

%Header setting.
\pagestyle{fancy}
\fancyhead[L]{Zhihao Ai}
\fancyhead[C]{Math 350}
\fancyhead[R]{Homework 5}
%%%%%%

%Custom commands.
\newcommand{\ds}{\displaystyle}
\newcommand{\eva}[2] {\left. #1 \right|_{#2}}
\newcommand{\dintt}[4] {\int_{#1}^{#2} #3 d#4}

\newcolumntype{C}{ >{\centering\arraybackslash} m{3em} }
\newcolumntype{D}{ >{\centering\arraybackslash} m{4em} }
\newcolumntype{N}{ >$ c <$}

\newcommand{\abs}[1] {\left| #1 \right|}
\newcommand{\norm}[2][\infty] {\left\Vert \mathbf{#2} \right\Vert_#1}

\begin{document}

\maketitle

\section*{Part 1. Reading Assignment}
%Read chapter 5.

\section*{Part 2. Fundamental Concepts/Ideas}
\begin{enumerate}
	\item
	Given data
	\begin{table}[H]
		\centering
		\begin{tabular}{*{6}{N}} \toprule
			i & 1 & 2 & 3 & 4 & 5 \\ \midrule
			x_i & 1.0 & 1.4 & 1.8 & 2.2 & 2.6\\
			y_i & 0.931 & 0.473 & 0.297 & 0.224 & 0.618\\
			\bottomrule
		\end{tabular}
	\end{table}
	We can fit these data using a curve $y=p(x)=\frac{1}{a+bx}$ in the least square sense.
	\begin{enumerate}
		\item
		Find coefficients $a$ and $b$. Hint: you can let $Y(x)=1/p(x)=a+bx$.

		Let $Y(x) = 1/p(x) = a + bx$, then $Y_i = 1/y_i$. To minimize $I(a, b) = \sum_i [(a+bx) - Y_i]^2$, let both $\partial{I}/\partial{a} = \partial{I}/\partial{b} = 0$ and we have
		\[
		\begin{cases}
		2\sum_i [(a + b x_i) - Y_i] \cdot 1 = 0\\
		2\sum_i [(a + b x_i) - Y_i] \cdot x_i = 0
		\end{cases}
		\Rightarrow
		\begin{cases}
		\sum_i a + (\sum_i x_i)b = \sum_i Y_i\\
		(\sum_i x_i)a + (\sum_i x_i^2)b = \sum_i x_i Y_i\\
		\end{cases}
		\]
		Below is the script that solves the equations:
		\lstinputlisting{hw5p1.m}
		The coefficients outputed is $a\approx 0.980376, b\approx 0.859535$.

		\item
		Compute the residual $E = \sum_{i=1}^{5} [p(x_i) - y_i]^2$.

		The script above produces $E\approx 0.269785$.

		\item
		Use Matlab to plot the curve $y=p(x)$ and $(x_i, y_i)$ on the same plot.

		\begin{figure}[H]
			\centering
			\includegraphics[width=0.5\linewidth]{hw5p1}
		\end{figure}
	\end{enumerate}
	\textit{Things learned:} Data fitting is about minimizing the error between the calculated curve and the data points. By setting the partial derivatives of each parameter to 0, we are able to minimize the error function. We can transform the curve function like $p(x) = \frac{1}{a+bx}$ into a form that is easy to take partial derivatives of. In the meantime, we also need to apply the same function to the original $y_i$'s to make the transformed question equivalent to the original one. In this question there is a outliner so the curve doesn't fit the first four well enough.

	\item
	Given data
	\begin{table}[H]
		\centering
		\begin{tabular}{*{8}{N}} \toprule
			i & 1 & 2 & 3 & 4 & 5 & 6 & 7 \\ \midrule
			x_i & 0.2 & 0.3 & 0.4 & 0.5 & 0.6 & 0.7 & 0.8\\
			y_i & 3.16 & 2.38 & 1.75 & 1.34 & 1.00 & 0.74 & 0.56\\
			\bottomrule
		\end{tabular}
	\end{table}
	We can fit these data using a curve $y=q(x)=\beta e^{-\alpha x}$ in the least square sense.
	\begin{enumerate}
		\item
		Find coefficients $\alpha$ and $\beta$. Hint: you can let $Y(x)=\ln y=\ln \beta - \alpha x$.

		Let $Y(x) = \ln{q(x)} = \ln{\beta} - \alpha x$, then $Y_i = \ln {y_i}$. To minimize $I(\alpha, \beta) = \sum_i [(\ln{\beta} - \alpha x_i) - Y_i]^2$, let both $\partial{I}/\partial{\alpha} = \partial{I}/\partial{\beta} = 0$ and we have
		\[
		\begin{cases}
		2\sum_i [(\ln{\beta} - \alpha x_i) - Y_i] \cdot x_i = 0\\
		2\sum_i [(\ln{\beta} - \alpha x_i) - Y_i] / \beta = 0
		\end{cases}
		\Rightarrow
		\begin{cases}
		(\sum_i x_i)\ln{\beta} - (\sum_i x_i^2)\alpha = \sum_i x_i Y_i\\
		\sum_i \ln{\beta} - (\sum_i x_i)\alpha = \sum_i Y_i
		\end{cases}
		\]
		Below is the script that solves the equations:
		\lstinputlisting{hw5p2.m}
		The coefficients outputed is $a\approx 2.888285, b\approx 5.631019$.

		\item
		Compute the residual $E = \sum_{i=1}^{7} [q(x_i) - y_i]^2$.

		The script above produces $E\approx 0.000897$.

		\item
		Use Matlab to plot the curve $y=q(x)$ and $(x_i, y_i)$ on the same plot.

		\begin{figure}[H]
			\centering
			\includegraphics[width=0.5\linewidth]{hw5p2}
		\end{figure}
	\end{enumerate}
	\textit{Things learned:} The procedure is similar to problem 1. We need to set the partial derivatives to 0 and solve the equations to get the parameters. Since there is no outliner in this problem, the curve fits the data points well so the residual is quite small.
\end{enumerate}

\newpage

\section*{Part 3. Computer Assignments}
(Problem 5.8 @ Page 22) Given 25 observations, $y_k$, taken at equally spaced values of $t$.
\begin{enumerate}
	\item [(a)]
	Fit the data with a straight line, $y(t) = \beta_1 + \beta_2 t$, and plot the residuals, $y(t_k)-y_k$. You should observe that one of the data points has a much larger residual than the others. This is probably an \textit{outlier}.

	\lstinputlisting{hw5ca1a.m}
	\begin{figure}[H]
		\begin{subfigure}[b]{0.5\linewidth}
			\centering
			\includegraphics[width=\linewidth]{hw5ca1a_fit}
			\caption*{$y(t) = 4.012692 + 0.532643t$}
		\end{subfigure}
		\begin{subfigure}[b]{0.5\linewidth}
			\centering
			\includegraphics[width=\linewidth]{hw5ca1a_residual}
			\caption*{$y(t_k)-y_k$}
		\end{subfigure}
	\end{figure}

	\item [(b)]
	Discard the outlier, and fit the data again by a straight line. Plot the residuals again. Do you see any pattern in the residuals?

	\begin{figure}[H]
		\begin{subfigure}[b]{0.5\linewidth}
			\centering
			\includegraphics[width=\linewidth]{hw5ca1b_fit}
			\caption*{$y(t) = 3.500757 + 0.556271t$}
		\end{subfigure}
		\begin{subfigure}[b]{0.5\linewidth}
			\centering
			\includegraphics[width=\linewidth]{hw5ca1b_residual}
			\caption*{$y(t_k)-y_k$}
		\end{subfigure}
	\end{figure}
	The residuals show a pattern of sin function.

	\item [(c)]
	Fit the data, with the outlier excluded, by a model of the form
	\[
	y(t) = \beta_1 + \beta_2 t + \beta_3 \sin t
	\]

	\lstinputlisting{hw5ca1c.m}
	According to the outputs, $y(t) = 3.289994 + 0.574871 t + 1.198019 \sin t$.

	\item [(d)]
	Evaluate the third fit on a finer grid over the interval $[0,26]$. Plot the fitted curve, using line style '-', together with the data, using line style 'o'. Include the outlier, using a different marker, '*'.

	\begin{figure}[H]
		\begin{subfigure}[b]{0.5\linewidth}
			\centering
			\includegraphics[width=\linewidth]{hw5ca1c_fit}
			\caption*{$y(t) = 3.289994 + 0.574871 t + 1.198019 \sin t$}
		\end{subfigure}
		\begin{subfigure}[b]{0.5\linewidth}
			\centering
			\includegraphics[width=\linewidth]{hw5ca1c_residual}
			\caption*{$y(t_k)-y_k$}
		\end{subfigure}
	\end{figure}
	Excluding the outliner, the residual $E = \sum_{i=1}^{24} [y(t_i) - y_i]^2 \approx 9.682834$.
\end{enumerate}
\end{document}


% !TeX root = ../main.tex
% Add the above to each chapter to make compiling the PDF easier in some editors.
\graphicspath{{./figures/ch2/}}

\chapter{Auction Theory}\label{chapter:theory}
In this chapter I will establish a basis of auction theory developed by academia. At first I will describe what an auction is and introduce basic auction formats like the First Price and Second Price Auction. Afterwards I will describe the exposure problem. To get an understanding of the auction formats used in the simulation (see \autoref{chapter:simulation}) I will introduce the Simultaneous Multi-Round Auction (SMRA) and Hierarchical Package Bidding (HPB). %TODO abbreviations

\section{What is an Auction?}
Auctions have become a well-established tool for answering a fundamental question in markets: "Who gets what to which price?". Having themselves proven as an effective tool to sell goods and implement public policies, auctions are now being used in a wide variety of settings, from effectively allocating radio spectrum to mobile network operators, trading electricity and pollution permits, governmental procurement and many more. Auction theory has been studied by academia for decades mostly by economists. With the rise of new auction types like combinatorial formats, where bidders can place bids on packages of items, auction theory became increasingly an interdisciplinary field of economics, operation research and computer science.

Auctions are concerned with an allocation problem, meaning which bidder gets a good at what price. They are micro-foundations of markets, that try to answer this question \cite{Cramton2006}. %TODO

\paragraph{The Independent Private Value (IPV) model.}
Auctions can be defined using different perspectives, e. g. a game theoretic, a contract and mechanism design theory or market microstructure approach. For the following formulations, I will use the game theoretic perspective. A basic auction environment comprises of the following characteristics (based on \cite[p. 1]{Levin2004}):

\begin{itemize}
	\item A number of bidders $ i = 1,...,n $
	\item the object to be auctioned, called \textit{item}
	\item the signal $ S_i $ observed by bidder $ i $ with a realization $ s_i \in [\bar{s}, \underbar{s}] $
	\item independence of bidder's signals $ S_1, ..., S_n $
	\item Bidder \textit{i} has a valuation function $ v_i(s_i) = s_i $
\end{itemize}
The IPV\footnote{The simulation in this thesis will be based on the IPV.} can be extended to fit the needs for combinatorial auctions, where not only one item, but $ m $ indivisible items are simultaneously being auctioned among the $ n $ bidders \cite[p. 267]{Nisan2007}. Also, the valuation function now maps from a subset $ S $ of the $ m $ items to their valuation  $ v(S) \to \mathbb{R} $, which the bidder $ i $ obtains upon winning this specific bundle of items and where the valuation function is monotone and "normalized", meaning $ v(\emptyset) = 0 $ \cite[p. 268]{Nisan2007}.
This formulation is necessary as the valuation of these subsets does not necessarily equal the sum of its containing items. Furthermore, two types of subsets can be defined, where subsets S and T with $ S \cap T = \emptyset $ are called \textit{complements} if $ v(S \cup T) > v(S) + v(T) $ (also called \textit{super-additive}) and \textit{substitutes} if $ v(S \cup T) < v(S) + v(T) $  \cite[p. 268]{Nisan2007}. Assuming the non-existence of \textit{externalities}, meaning the bidder's valuation is not dependent on the allocation of items to other bidders, the \textit{utility} or \textit{payoff} $ \pi_i $ of bidder $ i $ can be described as $ \pi_i = v_i(S) - p $, where $ p $ is the price for the current subset $ S$ \cite[p. 268]{Nisan2007}.

The mapping of items to bidders is called \textit{allocation} and is written $ S_1, ..., S_n $ with $ S_i \cap S_j = \emptyset $ for every $ i \neq j $. Summing all valuations over the allocation  $ \sum_i v_i(S_i) $ is called \textit{social welfare}. One goal of an auction can be to maximize this metric in its equilibrium. \cite[p. 268]{Nisan2007}.

\paragraph{Common Value Auctions.}
Item valuations do not have to be bound by its private valuation, but can also be influenced by the overall allocation of the items. In those cases, bidder $ i $ can learn about bidder $ j $'s information and might be forced to re-evaluate its valuation for the object \cite[p. 8]{Levin2004}. Therefore, the signals and information from bidder $ i $ and $ j $ are dependent. Examples for auctions incorporating this behaviour can be initial public offerings or spectrum auctions. In \textit{common value auctions}, the signals from other bidders influence a bidder's valuation by $ v_i(s_i, s_{-i}) $. Note, that the IPV is a special case of this formulation with $ v_i(s_i, s_{-i}) = s_i $, where the signals $ S_1,..., S_n $ are independent \cite[p. 8]{Levin2004}.

\paragraph{Bayesian Nash Equilibrium.}
Often, auctions are described by the equilibria they create, meaning the "convergence" of strategies used by the bidders that is induced by the auction format. If a bidder would know every strategy its competitors were following, he could easily deduce a payoff-maximizing action, which is called \textit{best response}. Let $ s = (s_i, s_{-i}) $ be the \textit{strategy profile} of the game, where $ s_i $ is bidder's $ i $ strategy and $ s_{-i} $  the strategies of its competitors. Bidder's $ i $ best response $ s_i^* $ to the strategy profile of its competitors $ s_{-i} $ is a mixed strategy $ s_i^* \in S_i $ where $ \pi_i (s_i^*, s_{-i}) \geq \pi_i (s_i, s_{-i}) \quad \forall s_i \in S_i $ \cite[p. 62]{Leyton-Brown2008}. When considering all the bidder's strategies, the strategy profile $ s = (s_1, ..., s_n) $ is a \textit{Nash equilibrium} if for all agents $ i $, $ s_i $ is the best response to their competitors' strategies $ s_{-i} $ \cite[p. 62]{Leyton-Brown2008}. Therefore, the Nash equilibrium describes the \textit{stable} balance between the different bidder's strategies, where no bidder wants to change his strategy if he knew the strategies its competitors.
The \textit{Bayesian Nash equilibrium} takes into account the assumption a bidder makes about the strategies of its competitors. With $ I = \{1, 2, ..., n\} $ being the set of players, $ X_i $ the set of possible types of agent $ i \in I $ and $ F(\cdot) $ the probability distribution over the set $ X = X_1 \times X_2 \times ... \times X_n $ each player can choose a strategy $ s_i \in S_i $ where $ s_i: X_i \to S_i $ \cite[p. 6 f.]{Menezes2005}. The \textit{Bayesian Nash equilibrium} concerning the best responses $ s_1^*, ..., s_n^*$ and $ \forall i \in I, \forall x_i \in X $ and $ \forall s_i \in S_i $ can then be described as

$$ \int_{x_{-i} \in X_{_i}} \pi_i(s_i^*, s_{-i}^*, x_i, x_{-i}) d\hat{F_i}(x_{-i}|x_i) \geq \int_{x_{-i} \in X_{_i}} \pi_i(s_i, s_{-i}^*, x_i, x_{-i}) d\hat{F_i}(x_{-i}|x_i)  $$

where $ \hat{F_i}(x_{-i}|x_i) $ describes probability distribution over agent $ i $'s competitors' types, given that agent $ i $ knows his own type $ x_i $. The agent continuously updates his prior information on the distribution using Bayes rule, when he learned that his type is $ x_i $ \cite[p. 6 f.]{Menezes2005}.

\subsection{Sealed Bid Auction - First Price Auction}
The sealed bid or first price auction is easy to imagine. Each bidder places sealed bids $ b_1, ..., b_n $ and the bidder with the highest bid wins, \textit{paying the amount he bid}. Because of the nature of this rule, bidders have an incentive to not bid their true valuation of the object, because this would result in $ \pi_i = v(s_i) -b_i = 0 $ \cite[p. 3]{Levin2004}. To circumvent that, bidders might bid below their actual valuation to potentially increase their profit. Interestingly, it can be shown that the equilibrium for the sealed-bid first price auction with $ n $ bidders can be described as $$ b(v(s_i)) = \Big( \dfrac{n - 1}{n} \Big) v(s_i)   $$ e. g. in a sealed bid auction with two bidders, each bidder would bid half its valuation of the object \cite{Vickrey1961}.

\subsection{Vickrey Auction - Second Price Auction}
The Vickrey auction is a special case of the sealed bid auction, where bidders submit sealed bids $ b_1,...b_n $ and the bidder with the highest bids wins, but only \textit{pays the amount of the second highest bid}. It can be shown, that in equilibrium, each bidder will bid its valuation of the object $ b_i(s_i) = s_i $ \cite[p. 2]{Levin2004}.
The Nash equilibria of the Vickrey auction and the open English auction are the same. When auctioning items in an open and ascending (English) manner, the equilibrium will settle at the second highest valuation \cite[p. 2]{Levin2004}. With the item prices rising from zero upwards, bidders can drop out of the auction when they reached their valuation of the object. The winner will have to pay the amount of the second highest valuation as its bidder will have dropped out as the price reached its valuation, making it the last bidder in the auction.

\section{SAA - Simultaneous Ascending Auctions}
In contrast to the normal English auction, were one item is sold at the same time using an ascending price system, spectrum auctions sell many goods. When selling items sequentially, bidders' available information and responding possibilities are limited and thus bidders might risk missing the opportunity to buy items at low prices early or even being forced to buy them at a much higher prices later on. Also they might fail to bundle desired packages of items together, which would be more valuable to them. Bidders are forced to make good predictions about the outcome of the auction and bid accordingly. Most times this leads to less efficient auctions, meaning less frequently bidders achieve to acquire the items or item combinations they value the most \cite[p. 185]{Cramton2006}.

\paragraph{Characteristics.}
To reduce the amount of exposure bidders will be subjected to, simultaneous ascending auctions were introduced. In this format, many items are sold, were each item can be bid on simultaneously. Bidders can not submit bids on packages of items, but have to place bids on single objects. Like in an English auction, prices rise with each valid bid placed until the auction is finished, e.g. when each bidder stopped raising bids or when times runs out.
If certain item combination are complementarities, meaning their combination has super-additive valuation, bidders in SAA tend to suffer from bidder exposure \cite[p. 209]{Cramton2006}. To mitigate this effect, withdrawal of standing bids can be implemented, that enables bidders to back out of failed item aggregations.

\paragraph{Conclusion and discussion.}
SAA are a well established format used in high-stake auctions like spectrum, energy or pollution permit auctions. With mild complementarities, SAA yield in competitive equilibria, that also hold stand in practical usage \cite[p. 209]{Cramton2006}. While SAA manage to successfully combine auctioning of multiple items with simple mechanism design, SAA can incentivise bidders to expose themselves in order to achieve certain item combinations when complementarities exist. In those environments, package bids should be used to increase efficiency of the auction\cite[p. 185]{Cramton2006}. Also, revenue-reducing strategies and bidder collusion can occur in markets with weak competition, as well as bid-signalling to cooperatively split items between competing bidders \cite[p. 187., p. 209]{Cramton2006}.

\section{The Exposure Problem}\label{subsection:exposure-problem}
During an auction with many offered items, bidders often try to acquire certain item combinations, because those packages of items might have super-additive valuation, meaning their package valuation is higher than the sum of the valuation of each item. In the field of spectrum auctions these might be a specific number of blocks obtained in a certain frequency band that enables better technology, e.g. LTE instead of GSM, or the clustering of adjacent geographical regions that allows a bidder to provide service for a bigger market while reducing costs by optimally placing transmission towers in the regions.
When auction formats only allow bidders to place bids on single items, not packages of items, they run into the risk of failing to achieve the desired item combination. In order to acquire those bundles, bidders might have to bid above the valuation of a particular item but might not be able to acquire the remaining items in the bundle. This is called the exposure problem.

\paragraph{A simple example.} A bidder tries to acquire the synergistic combination of items $ A $ and $ B $. The bidder's valuation for each single item is $ v(A) = v(B) = 10 $, but when combining both, let's say because it enables the bidder to use more cost-effective technology, the valuation of both items together is $ v(AB) = 40 $, so twice the summed valuation of the single items.

Now, let's consider the following situation: The current prices are $ p(A) = 9 $ and $ p(B) = 14 $. Normally, the bidder would set its bid for item A with $ bid(A, B) = (10, 0) $, thus excluding item B from its bid, because the current price already exceeds the bidder's internal valuation of the item. However, because the sum of both prices are still less than the combined valuation of the items, hence, the bidder has an incentive to also bid on B. For the sake of the argument, our bidder now placed its bid with $ bid(A, B) = (10, 15) $, the auction finished, but a competitor achieved to acquire item A with a higher price. Now, our bidder bought item B with $ p(B) = 15 $ and let's remember that the single item internal valuation of item B was $ v(B) = 10 $. Instead of gaining a surplus through obtaining one of the auctioned items, our bidder now made a loss (example based on \cite{Levin2009}).

In auctions with many items and thus a high number of item combinations it is hard to keep track of the dependencies. Academia tackles the exposure problem by researching new auction formats or mechanisms that try to mitigate the exposure subjected to the bidders. One mechanism is the possibility to retract bids like they are offered in implementations of the SMRA %TODO abbr
(see \autoref{subsection:smra_theory}), where "failed bids", e.g. bids that failed to aggregate a desired item combination, can be withdrawn to free up budget, which the bidder can then focus on other valuation maximizing bids. This is a well establish mechanism, even though according to Cramton, this can lead to "undesirable gaming behavior" within the auction and has to be constrained to effectively control such behaviour \cite{Cramton2006}.
Other efforts strive to reduce exposure of bidders by enabling them to bid on (pre-)defined packages, like the HPB format (more on that in \autoref{subsection:hpb_theory}).

\section{What is the Advantage of Round Based Auctions?}
In standard auction models, like in sealed bid auctions, it is assumed that each bidder knows its valuation for each possible package a priori \cite{Cramton2006}. In fact, determining valuation is a costly process, because it can depend on information of other bidders and especially when a high number of items are involved, create a solution space of combinatorial magnitude.

Round based auctions try to mitigate this problem as each round, bidding information is released and bidders can identify target licenses more easily \cite{Levin2009}. The extent of the information range depends on the model and its implementation, but exemplary might contain price information like the highest winning bid and all bids placed by competitors. With the newly revealed information at hand, bidder's uncertainty is reduced so that they can set their future bids more aggressively and can focus on the valuation maximazing parts of the item space, which improves efficieny according to Cramton \cite{Cramton2006}. Over time, bidders increasingly get an understanding of what the overall allocation and prices at the end of the auction might look like and can bid according to this judgement.

Using this advantage, round based formats were used in national spectrum auctions in the U.S. (and later on in Europe) since 1994 when it was proposed to the U.S. Federal Communication Commission by Milgrom, Wilsen and McAfee.

\section{Auction Formats used in Spectrum Auctions}
Even though the success of simultaneous ascending auction formats in national spectrum auctions led to a widespread use of formats like the SMRA, %TODO abbr
a number of other formats were used in recent times or new formats were proposed by academia. In the following section I will describe the auction processes and rules for the Simultaneous Multi-Round Auction (SMRA). %TODO abbr
and the Hierarchical Package Bidding Auction (HBP). Both formats will be compared in the simulation (see \autoref{chapter:simulation}). %TODO abbr

\subsection{SMRA - Simultaneous Multi-Round Auction}\label{subsection:smra_theory}
The Simultaneous Multi-Round Auction (SMRA) is most commonly used auction format used for selling spectrum world wide. Since its development in the early 90's for the US Federal Communications Commission its usage has become wide spread, making it the de facto standard. Its success stems from the fact, that it often leads to good allocations \cite{BichlerLecture2016}, but it suffers from strategic challenges for bidder when used in an environment where complementarities exist.

\paragraph{Characteristics.}
The SMRA extends the SAA, by adding a round based system. Multiple items are auctioned at the same time - in contrast to the English auction - in a round based fashion, where each round has a time limit in which bidders can place bids.  When a round is finished, bidding data is published that contains the \textit{current} winner of each item, which corresponds with the highest bid placed on each item \cite{BichlerLecture2016}. The degree of transparency provided by the auctioneer depends on the implementation, e.g. the German auction in 2015 provided very high transparency by showing all bids placed by each participant \cite{Bundesnetzagentur2015}. Often, only highest bid submitted is published.
In each round, bidders have to exceed the provisional prices of the previous round by a pre-defined \textit{increment} if they wish to claim the item. In the German auction, bidders could submit bids using a \textit{clickbox} system, which offered pre-defined multiples of the current increment. The increment can change over time, depending on the current \textit{phase} of the auction. The auction ends, when no new bids are being submitted. Each bidders than acquire the items where he possesses the highest active bid and pays the prices accordingly.

To incentivise bidding right from the start, SMRA makes use of \textit{activity rules}. This is often realised by \textit{eligibility points (EP)} that corresponds to a bidder's bidding extent. Each bidder starts with a pre-defined number of EP - often comprising of the maximum number of licenses allowed to bid on - and each item can be matched to a certain number of EP necessary to bid on them. If the EP from the items won in the previous round and the bids submitted in the new round are less than the current \textit{activity level}, a bidder's EP gets deducted by the amount it "under-bid". An example for an activity level can be 65\% of the starting EP, as used in the German auction in the first bidding phase. From then on, the activity level subsequently rose to 80\% and 100\% \cite[p. 15]{Bundesnetzagentur2015}.
Additionally, auctioneers using SMRA can use a wide range of tools to influence the outcome of the auction. These can include:
\begin{itemize}
	\item \textit{minimum prices} for the items
	\item \textit{bid increments} and how their value changes over the course of the auction
	\item \textit{bid withdrawals} and \textit{waivers}, which allow the bidder to either withdraw a bid submitted in a previous round or to suspend himself from bidding for a round (without consequences)
	\item \textit{bidding floors} and \textit{caps} which regulate how many items a bidders is allowed to obtain in a specific frequency band to prevent monopolies or businesses to drop out of the market due to insufficient supply.
\end{itemize}

\paragraph{Conclusion and discussion.}
The SMRA is an easy to implement auction format which clear and simple rules which often realises efficient allocations. In environments where complementarities exist (such as synergetic values between items), the SMRA fails to resolve at a Walrasian equilibrium \cite{BichlerLecture2016}. Due to its lack of package bidding, bidders might be incentivised to expose themselves in order to acquire certain item combinations, making the exposure problem a central challenge in SMRA strategies. The activity rules have shown to be fairly similar world wide, but the degree of transparency differs widely, as well as the rules in procurement, which have impact on the performance of the auction. Nevertheless, the SMRA is a well established and frequently used format for spectrum auctions and other common value auctions.

\subsection{HPB - Hierarchical Package Bidding}\label{subsection:hpb_theory}
While the Hierarchical Package Bidding Auction (HPB) has never been used in a national spectrum auction before, this thesis will run simulations using this format to explore indicators of its eligibility as basis for further research. The implementation used in this thesis is based on the propositions of \citeauthor{Goeree2010} from 2007.

The paper hypothesised that HPB might help mitigating the exposure problem (see \autoref{subsection:exposure-problem}) by pre-packaging bidding items into bundles inside a tree like hierarchy structure. This allows bidders to bid on packages, signalling a desired allocation. By that, the bidder can bid on a certain package until its valuation, without the need to possibly strategically bid over the valuation of single items in that package. In the end, the bidder either manages to acquire every item in the package and combining them to realise super-additive valuation or does not win any of the items. Of course, bidders are still able to bid on single items.

Combinatorial auctions try to solve the problem by allowing bidders to bid on any desired item combinations. Determining the provisional allocation after each round shows to be an intricate and computationally expensive problem in the magnitude of \textit{NP-hard} \cite{Goeree2010}, meaning non-deterministic polynomial-time hard, because the number of possible arrangements growth exponentially with the number of objects. Thus, it is not guaranteed to find the optimal solution within a reasonable amount of time and mostly the best current solution yielded within a pre-defined time frame will be chosen. This approach is problematic as price calculations seem non-transparent and even experts claim the ability to rig auctions based on this computational downside  \cite{Goeree2010}.

\paragraph{The HPB idea.} \citeauthor{Rothkopf1998} proposed a hierarchical pre-packaging of items to avoid the issues of computational expensiveness of combinational auctions in 1998 \cite{Rothkopf1998}. The work of \citeauthor{Goeree2010} was based on this proposition and extended it by developing a recursive pricing formula for combinatorial auctions using the pre-defined hierarchies. The basic idea of the pricing formula is that prices for single items would be increased by \textit{"lump-sum taxes"} handed down from packages in the higher hierarchy levels. In the case a package bid is winning, the excess prices will be proportionally propagated down towards the single item level of the hierarchy. The goal is to create a transparent and computationally inexpensive way to calculate the prices.

\begin{figure}[h]
	\centering
	\input{./figures/ch2/hpb_hierarchy_example.tikz}
	\caption{Example of an HPB Hierarchy for spectrum auctions}
	\label{fig:hpb-hierarchy-example}
\end{figure}

\paragraph{The mathematical formulation.}
An example for a HPB hierarchy can be seen in \autoref{fig:hpb-hierarchy-example}, which subsequently unites items to regional and finally a nation wide package. Formulated in \cite{Goeree2010}, a hierarchy has $ H \geq 1 $ hierarchy levels which are subsequently labeled $ h = 1, ..., H $ and each level $h$ contains $ I_h $ packages. The single items can be found as leaves in the tree in $ h = 1 $, from there the package grow bottom up. Packages in level $ h $ are written as $ P_{i_h}^h \text{ for } i_h = 1,..., I_h $. Each of the packages consists of $ \alpha_{i_h}^h $ bidding items and the number of packages in a level falls while propagating upward in the hierarchy. As an important note, all packages in a hierarchy are non-overlapping, meaning $ \forall \text{ level-h packages } P_{i_h}^h \neq P_{i_h}^h \implies P_{i_h}^h \cap P_{i_h}^h = \emptyset $. Therefore, each package is contained in only one package in the following upper level $ h' > h $ and there is only one unique level-$h'$ package $ P_{j_{h'}}^{h'} $ with $ P_{j_{h'}^{h'}} \supset P_{i_h}^h  $. This results in the number of items being contained in a package is the sum of items it covers in level-1.
\begin{align}
	\sum_{P_{i_1}^1 \subset P_{i_h}^h} \alpha_{i_1}^1 = \alpha_{i_h}^h
\end{align}
Every hierarchy level contains all items from level-1: $ \sum_{i_h = 1}^{I_h} \alpha_{i_h}^h = \alpha \text{ } \forall \text{ h in h } = 1,...,H $ with $ \alpha $ being the
 total number of \textit{(level-1)} items in the auction.
After defining the hierarchy and its properties, \citeauthor{Goeree2010} devised two recursive algorithms for calculating the \textit{revenues} $ R(P_{i_h}^h) $ and \textit{prices} $ p(P_{i_1}^1) $.

\textbf{Revenues and the assignment problem:} To assign items to bidders, first the highest bid $ b^{max}(P_{i_h}^h)$ on the packages have to be found. Finding the optimal assignment and revenue can be describes as follows:
\begin{enumerate}
	\item Set $ h = 1 $, for this level set revenues to $ R(P_{i_1}^1) = b^{max}(P_{i_1}^1)$ for $ i_1 = 1, ..., I_1 $, those bids are marked as \textit{"provisionally winning"}
	\item if $ h < H \implies h = h+1$ and continue with step \textit{3}, otherwise \textit{stop}
	\item if $ b^{max}(P_{i_h}^h) > \sum_{P_{i_{h-1}}^{h-1} \subset P_{i_h}^h} R(P_{i_{h-1}}^{h-1}) \implies R(P_{i_h}^h) = b^{max}(P_{i_h}^h)$ and label $ b^{max}(P_{i_h}^h) $ as \textit{provisionally winning}, bids from all lower levels on packages that overlap with $ P_{i_h}^h $ are unmarked. Otherwise, $ R(P_{i_h}^h) = \sum_{P_{i_{h-1}}^{h-1} \subset P_{i_h}^h}  R(P_{i_{h-1}}^{h-1})$ and \textit{return to step 2}.
\end{enumerate}

\textbf{Prices:} Now, with the assignment set, the prices have to be updated. They are assigned to the level-1 items in the hierarchy by adding \textit{"lump sum tax"} to the items if the revenue of package is less than the one the next level upwards. With $ p(P_{i_1}^1) $ being the price of level-1 package $ P_{i_1}^1 $:
\begin{enumerate}
	\item Set $ h = 1 $ and define prices for all packages in this level as $ p(P_{i_1 }^1) = b^{max}(P_{i_1}^1) $  $\forall i_1 = 1, ..., I_1 $
	\item if $ h < H  \implies h = h + 1 $ and continue with \textit{step 3}, otherwise \textit{stop}
	\item For each package $ P_{i_h}^h $ in level-$h$ calculate $$ \tau^h(P_{i_1}^1) = \dfrac{\alpha_{i_1}^1}{\alpha_{i_h}^h} \Big( R(P_{i_h}^h) \quad - \sum_{P_{i_{h-1}}^{h-1} \subset P_{i_h}^h} R(P_{i_{h-1}}^{h-1}) \Big) \geq 0 $$ and add $ \tau^h(P_{i_1}^1) $ to the price $ p(P_{i_1}^1) $ of each level-1 package $ P_{i_1}^1 $ contained in $ P_{i_h}^h $. Return to \textit{step 2}
\end{enumerate}

In comparison to the calculations needed in other combinatorial auction formats, the computations done in the two formulations above are computationally inexpensive. This is one of the advantages of HPB. \citeauthor{Goeree2010} derived a calculation of the level-1 prices as follows:
\begin{align}
	p(P_{i_1}^1) = b^{max}(P_{i_1}^1) + \sum_{P_{i_h}^h \supset P_{i_1}^1} \dfrac{\alpha_{i_1}^1}{\alpha_{i_h}^h} \Big( R(P_{i_h}^h) \quad - \sum_{P_{i_{h-1}}^{h-1} \subset P_{i_h}^h} R(P_{i_{h-1}^{h-1}}) \Big)
\end{align}

%TODO include simple example?

\paragraph{Summary and discussion.}
HPB shows to be less computationally expensive as other combinatorial auction formats but maintains the possibility for bidders to bid on \textit{pre-defined} packages within a hierarchy that is built bottom up from the single items upwards. The assignment problem as well as the price calculations can be done using a recursive function, where the number of comparisons needed is only linear in relation to the pre-defined packages \cite{Goeree2010}.

\citeauthor{Goeree2010} also mention in their paper that the pre-packaging will disadvantage small bidders who also contribute to finding optimal allocations. The impact of this needs to be researched in further studies. Also, \citeauthor{Goeree2010} argue that non-overlapping package structures may not always be able to reflect the interests of the participating bidders. It still needs to be verified to what extent the hierarchy influences auction outcomes. Also, for each auction there might be an array of alternative hierarchies. To choose the appropriate hierarchy seems to be key in using HPB efficiently.

\subsection{Other Auction Formats}
In spectrum auctions world wide a variety of different auctions formats are used. The reason for that are different performance properties of efficiently allocating items to bidders as well as maximizing revenue or social welfare.
For example, Canada used a the combinatorial clock auction (CCA) format to sell the 2500 MHz spectrum in the 2014 . It used an OR-bidding language, where bidders were able to express that they want to acquire a license for a certain price \textit{and / or} a different license for a different price \cite{FCCCanada}. The auction involved a price discovery stage that was similar to the SMRA auction format, but the CCA allowed bidders to submit bids on packages rather than only on single items. This was necessary due to the regional nature of the licenses being auctioned and the complementarities that existed between them \cite{FCCCanada}.

Despite the fact that combinatorial auction allows bidding on packages, it still inherits a lot of issues like non-linear price progressions that makes it hard for bidders to compare prices, as well as computational issues \cite[p. 290]{Nisan2007}, which results in combinatorial auction not being frequently used in spectrum auctions.

In 2015, the French 700 MHz spectrum auction was even conducted in a sealed bid manner \cite{FranceSealed2015}, raising EUR 2.8bn in the process. The sealed bid part in the auction was used to decide where in the spectrum band auctioned blocks should be placed.