\section{Understanding ``Out Of Thin Air'' using Temporal Logic}
\label{sec:logic}

A significant challenge for a software memory model is to relax order enough
to allow efficient implementation without admitting anomalous
behaviors---called \emph{out of thin air} (\oota) in the literature
\cite{vacuous,DBLP:conf/esop/BattyMNPS15,BoehmOOTA}.  The most famous example
is \ref{OOTA3} from \textsection\ref{sec:intro}.  Here we inline
initialization in order to fit the format of our proof rules:
\begin{align}
  \label{OOTA3} \tag{\textsc{oota1}}
  \PW{y}{0}\SEMI
  \PW{y}{x}
  \!\PAR\!
  \PW{x}{0}\SEMI
  \PR{y}{r}\SEMI \PW{x}{r}
  &&
  %\nonumber
  \smash{\hbox{\begin{tikzinline}[node distance=1.2em]
  \event{rx}{\DR{x}{1}}{}
  \event{wy}{\DW{y}{1}}{right=of rx}
  \po{rx}{wy}
  \event{y0}{\DW{y}{0}}{left=of rx}
  \event{x0}{\DW{x}{0}}{right=2em of wy}
  \event{ry}{\DR{y}{1}}{right=2em of x0}
  \event{wx}{\DW{x}{1}}{right=of ry}
  \po{ry}{wx}
  \rf[out=10,in=170]{wy}{ry}
  \rf[out=170,in=10]{wx}{rx}
  \wk[out=-15,in=-165]{y0}{wy}
  \wk[out=-15,in=-165]{x0}{wx}
    \end{tikzinline}}}
\end{align}
Although Java does not allow \oota{} behaviors of \ref{OOTA3},
\citet{DBLP:journals/toplas/Lochbihler13} showed that it does allow \oota\
behaviors of \ref{OOTA1}, also from \textsection\ref{sec:intro}.  In
\cite{DBLP:conf/lics/JeffreyR16}, we described a logic that rules out
\ref{OOTA3} but not \ref{OOTA1} or its variant \ref{OOTA4}.  In this section,
we provide a more accurate test of \oota{} behaviors by enhancing our
previous logic with temporal features.

On first read, we suggest that readers skip to the examples and the
discussion that follows, coming back to the definitions as necessary.
Example~\ref{ex:thin} discusses the canonical \oota{} example \ref{OOTA3};
the analysis is trivial and well-known \cite{DBLP:conf/lics/JeffreyR16,
  DBLP:conf/popl/KangHLVD17}.  Example~\ref{ex:lochb} is more interesting.
There, we discuss \ref{OOTA4}, which is a variant of
\citeauthor{DBLP:journals/toplas/Lochbihler13}'s \ref{OOTA1}.
% In this case, the violation is a subtler
% temporal property.  We develop a logic sufficient to prove that our semantics
% disallows \oota\ on \eqref{lochbihler}.

The logic given here is not meant to be definitive; in
\textsection\ref{sec:limits}, we discuss \oota{} examples that appear to
require non-trivial extensions
\cite{DBLP:conf/esop/SvendsenPDLV18,DBLP:journals/pacmpl/ChakrabortyV19}.

\noparagraph{Definitions}
We adapt past linear temporal logic (\pLTL)
\cite{Lichtenstein:1985:GP:648065.747612} to pomsets by dropping the previous
instant operator and adopting strict versions of the temporal operators.
The atoms of our logic are write and read events.
% \begin{displaymath}
%   \afo \QUAD::=\QUAD
%   \DR{\aLoc}{\aVal}
%   \mid
%   \DW\aLoc\aVal
%   \afo \wedge\bfo
%   \mid \lnot \afo
%   \once\afo
%   \mid \always\afo
% \end{displaymath}
%\begin{definition} %[Satisfaction]
Given a pomset $\aPS$ and event $\aEv$, define:\nofootnote{Let $\FALSE$, $\lor$,
  $\Rightarrow$ and $\once$ as usual;
  for example,
  $\once\afo = \lnot(\always\lnot\afo)$.}
\begin{displaymath}
  \renewcommand{\arraycolsep}{.2ex}
    \begin{array}{lrll}
      \aPS,\aEv &\models& \DW{\aLoc}{\aVal} &\text{ if } \labelingAct(\aEv) = \DW{\aLoc}{\aVal} \text{ and } \TRUE \text{ implies } \labelingForm(\aEv) \\
      \aPS,\aEv &\models& \DR{\aLoc}{\aVal} &\text{ if } \labelingAct(\aEv) = \DR{\aLoc}{\aVal} \text{ and } \TRUE \text{ implies } \labelingForm(\aEv) \\
      \aPS,\aEv &\models& \afo\land\bfo &\text{ if } \aPS,\aEv \models  \afo \text{ and } \aPS,\aEv \models  \bfo \\
      \aPS,\aEv &\models& \TRUE\\
      \aPS,\aEv &\models& \lnot\afo &\text{ if } \aPS,\aEv \not\models \afo \\
      \aPS,\aEv &\models& \always\afo &\text{ if } \forall \bEv \lt \aEv.\; \aPS,\bEv \models \afo\\
      \aPS,\aEv &\models& \once\afo &\text{ if } \exists \bEv \lt \aEv.\;  \aPS,\bEv \models \afo
    \end{array}
  \end{displaymath}

  Define $\FALSE$, $\lor$, and $\Rightarrow$ as usual.

  % \begin{definition}
  Let $\aPS \models \afo$ if
  $\aPS,\aEv \models\afo$, for all $\aEv \in \Event$.

  Let $\aPSS\models \afo$
  if $\aPS \models\afo$, for all $\aPS \in \aPSS$.

Let
  \begin{math}
    \afo, \aPSS \models \bfo  \text{ if } \{ \aPS \mid \aPS \models \afo \} \parallel \aPSS \models \bfo.
  \end{math}
%\end{definition}

  Let $\afo$ be \emph{downclosed} when
  $\{ \aPS \mid \aPS \models \afo \}$ is.

% Thus, $\aPS\models \afo \land \always\afo$ whenever $\aPS \models
  % \afo$. This fact relies on the use of universal quantification in the definition.

% We define other connectives as standard:
% $\once\afo = \lnot(\always\lnot\afo)$,
% %$\FALSE = \lnot(\TRUE)$
% $\afo\lor\bfo = \lnot(\lnot(\afo)\land\lnot(\bfo))$, and
% $\afo\Rightarrow\bfo = \lnot(\afo) \lor\ \bfo$.
% \begin{displaymath}
% \begin{array}{lrl}
% \once\afo &=& \lnot(\always\lnot\afo) \\
% \FALSE &=& \lnot(\TRUE) \\
% \afo\lor\bfo &=& \lnot(\lnot(\afo)\land\lnot(\bfo)) \\
% \afo\Rightarrow\bfo &=& \lnot(\afo) \lor\ \bfo
% \end{array}
% \end{displaymath}
%Let $$ be defined as $$.
%In addition, let $\FALSE$, $\lor$ and $$ be defined in the
%standard way.
% $\afo\lor\bfo$ for $\lnot(\lnot \afo \land \lnot \bfo)$,
% and $\afo \Rightarrow \bfo$ for $\lnot \afo \lor \bfo$.
  The past operators do not include the current instant, and so
  do \emph{not} satisfy
  $(\always\afo\Rightarrow\once\afo)$. The order-minimal elements always validate
    $\always\afo$ and invalidate
    $\once\afo$.
  However, we can prove the following:
% \begin{align*}
%   \frac{\aPS \models \afo \Rightarrow\once{\afo}}{\aPS \models \lnot \afo}\text{(Coinduction)}
%   &&
%   \frac{\aPS \models \always\afo \Rightarrow\afo}{\aPS \models \afo}\text{(Induction)}
% \end{align*}
% \begin{lemma}
% Given an pomset $\aPS$.
\begin{align*}
  \tag{Induction}
  \aPS \models& (\always\afo \Rightarrow\afo) \Rightarrow\afo
  \\[-1ex]
  \tag{Coinduction}
  \aPS \models& (\afo \Rightarrow\once{\afo}) \Rightarrow\lnot \afo
  \\[-1ex]
  \tag{Weakening}
  \aPS \models& (\afo \Rightarrow\once{\bfo}) \Rightarrow (\once\afo \Rightarrow\once{\bfo})
\end{align*}
% \end{lemma}
% \begin{proof}
% We prove that any node in a pomset satisfies these formulas.
%The proof for both rules proceeds by induction on the length of the maximal path from a root to a node.
%\end{proof}

% \begin{description}
% \item[Coinduction.]
%   \begin{math}
%     (\afo \Rightarrow\once{\afo}) \Rightarrow\lnot \afo
%   \end{math}
% \item[Induction.]
%   \begin{math}
%     (\always\afo \Rightarrow\afo) \Rightarrow\afo
%   \end{math}
% \end{description}

%We now present two proof rules for programs.

%\paragraph*{Proof rules for programs}
We present two additional proof rules.
The first provides a logical view of \emph{$\aLoc$-closure} (Def.~\ref{def:rf}):
%The soundness proof is straightforward.
% \begin{math}
%   \closed(\aLoc) = (\DR{\aLoc}{\aVal} \Rightarrow \once \DW{\aLoc}{\aVal}).
% \end{math}
% Although this definition does not mention intervening writes, it is
% sufficient for our example.
\begin{displaymath}
  %\tag{Closing $\aLoc$}
  \frac{
    \afo \text{ is independent of } \aLoc
    \qquad
    %\aPS \models \closed(\aLoc) \Rightarrow \afo
    \aPS \models (\DR{\aLoc}{\aVal} \Rightarrow \once \DW{\aLoc}{\aVal}) \Rightarrow \afo
  }{
    \nu \aLoc \DOT \aPS \models \afo
  }
\end{displaymath}
%It is straightforward to establish that this rule is sound.
% Although it does
% not mention intervening writes, the rule is sufficient for our examples.

The second rule describes concurrent composition, in the style of~\citet{Abadi:1993:CS:151646.151649}.  To simplify the presentation, we
consider the special case with a single invariant.
% We view the
% composition result as capturing key aspects of no-ThinAirRead, as will become
% clearer in the examples below.
% In order to state the theorem, we generalize the satisfaction relation to
% include environment assumptions.

\begin{proposition}%[Composition]
  Let $\afo$ be downclosed.  Let $\aPSS_1, \aPSS_2$ be
  augmentation\hyp{}closed. %\footnote{$\aPS'$ is an augmentation of $\aPS$ if
 %   $\Event'=\Event$, $\aEv\le\bEv$ implies $\aEv\le'\bEv$, $\aEv\gtN\bEv$
 %   implies $\aEv\gtN'\bEv$, and
 %   % $\labeling'(\aEv)=\labeling(\aEv)$
 %   if $\labeling(\aEv) = (\bForm \mid \bAct)$ then
 %   $\labeling'(\aEv) = (\bForm' \mid \bAct)$ where $\bForm'$ implies
 %   $\bForm$.}
  Then:
  \begin{displaymath}
    %\tag{Composition}
    \frac{
      \afo, \aPSS_1 \models\afo
      \qquad
      \afo, \aPSS_2 \models\afo
    }{\aPSS_1 \parallel \aPSS_2 \models \afo}
  \end{displaymath}
\end{proposition}
\begin{proof}[Proof sketch]
  We will show that all downsets in the downset closures of
  $\aPSS_1 \parallel \aPSS_2$ satisfy the required property.  Proof proceeds
  by induction on downsets of $\aPS \in \aPSS_1 \parallel \aPSS_2$.
  %
  The case for empty downset  follows from assumption that  $\afo$ is downset closed.
  %
  For the inductive case, consider %$\aPS$ in the downset closure of $\aPSS_1 \parallel \aPSS_2$, i.e.
  $\aPS \in \aPS_1 \parallel \aPS_2$ where
  $\aPS_i \in \aPSS_i$.  Since $\aPSS_1$ and $\aPSS_2$ are augmentation
  closed, we can assume that the restriction of $\aPS$ to the events of
  $\aPS_i$ coincides with $\aPS_i$, for $i=1,2$.
  %
  Consider a downset $\aPS'$ derived by removing a maximal element $\aEv$ from
  $\aPS$.  Suppose $\aEv$ comes from $\aPS_1$ (the other case is
  symmetric). Since $\aPS_2$ is a downset of $\aPS'$ and $\aPS' \models \afo$
  by induction hypothesis, we deduce that $\aPS_2 \models \afo$.
  % Thus, $\aPS_2 \in \mods{(\afo)}$.
  Since $\aPS_1 \in \aPSS_1$, by assumption $\afo, \aPSS_1 \models\afo$ we
  deduce that $\aPS \models \afo$.
\end{proof}

% The logic is defined with respect to downclosed sets, but $\sem{\aCmd}$
% includes only completed pomsets.  For reasoning in the logic, we downclose
% the semantics, considering pomsets that may not be completed.  Let
% $\semdown{\aCmd}=\{\aPS'\mid\aPS'$ is a downset of some
% $\aPS \in \sem{\aCmd}\}$.

\begin{example}
\label{ex:thin}
\noparagraph{Basic Examples}
With all variables initialized to $0$, we show that \ref{OOTA3}
satisfies
\begin{math}
  \lnot\DW{x}{1}.
\end{math}

We start with the invariant:
\begin{displaymath}
  [\DW{x}{1}\Rightarrow\once\DR{y}{1}]
  \land
  [\DW{y}{1}\Rightarrow\once\DR{x}{1}]
\end{displaymath}
This invariant holds for each thread; thus, it holds for the
aggregate program by composition.  Closing $y$ yields
\begin{math}
  \DR{y}{1} \Rightarrow \once\DW{y}{1}.
\end{math}
Weakening the right conjunct: % yields
\begin{math}
  \once\DW{y}{1}\Rightarrow\once\DR{x}{1}.
\end{math}
Chaining these together: %yields
\begin{math}
  \DR{y}{1} \Rightarrow \once\DR{x}{1}.
\end{math}
Weakening:  %yields
\begin{math}
  \once\DR{y}{1} \allowbreak\Rightarrow \once\DR{x}{1}.
\end{math}
Chaining into the left conjunct:  %yields
\begin{math}
  \DW{x}{1} \Rightarrow \once\DR{x}{1}.
\end{math}
Closing $x$,
% \begin{math}
%   \DR{x}{1} \Rightarrow \once\DW{x}{1}.
% \end{math}
weakening,
% \begin{math}
%   \once\DR{x}{1} \Rightarrow \once\DW{x}{1}.
% \end{math}
then chaining: %, yields
\begin{math}
  \DW{x}{1} \Rightarrow \once\DW{x}{1}.
\end{math}
By coinduction,
\begin{math}
  \lnot\DW{x}{1}.
\end{math}
%as required.
\end{example}

% The same reasoning can be applied to the control flow variant of \ref{OOTA3}
% \cite[CYC]{DBLP:conf/popl/VafeiadisBCMN15}:
% \begin{math}
%   %\tag{\textsc{cyc}}\label{CYC}
%   \IF{x}\THEN \PW{y}{1} \FI \!\PAR\! \IF{y}\THEN \PW{x}{1} \FI.
%   % &&
%   % %\nonumber
%   % \hbox{\begin{tikzinline}[node distance=1.5em]
%   % \event{rx}{\DR{x}{1}}{}
%   % \event{wy}{\DW{y}{1}}{right=of rx}
%   % \po{rx}{wy}
%   % \event{ry}{\DR{y}{1}}{right=2em of wy}
%   % \event{wx}{\DW{x}{1}}{right=of ry}
%   % \po{ry}{wx}
%   % \rf{wy}{ry}
%   % \rf[out=170,in=10]{wx}{rx}
%   %   \end{tikzinline}}
% \end{math}
% The program is data-race-free. Thus, allowing an execution that writes $1$
% would violate \drfsc{}.

\begin{example}
  \label{ex:lochb}
  \noparagraph{Lochbihler's Example} %The essential temporal property of
  % \ref{OOTA1} is: \emph{A write of $1$ to $y$ must be preceded by a read of
  %   $1$ from $x$, and if $1$ is written to $z$ then a write of $1$ to $x$
  %   must be preceded by a read of $1$ from $y$.}
  % \emph{allocation at type $\classC$ is preceded by reading $0$ for
  % $b$}.
  Because our language lacks object creation, we cannot consider
  \citeauthor{DBLP:journals/toplas/Lochbihler13}'s example (\ref{OOTA1}) directly.  Instead we study \ref{OOTA4}, which has the same
  temporal structure.
  The essential temporal property of
  \ref{OOTA4} is: \emph{A write of $1$ to $y$ must be preceded by a read of
    $1$ from $x$, and if $1$ is written to $z$ then a write of $1$ to $x$
    must be preceded by a read of $1$ from $y$.}
  % : \emph{writing $1$ for $x$ is preceded by reading $0$ for
  % $b$}.
  We show an attempted execution that violates this invariant, eliding
  initialization:
% A more general principle, in the spirit of~\citet{Abadi:1993:CS:151646.151649} can be proved.  We chose the simple case of temporal invariants to illustrate the idea in a simple form.  Even this simple version has interesting consequences.
\begin{gather}
  %\tag{\textsc{oota4}}
  \label{OOTA4}\tag{\textsc{oota4}}
  %   Z=1;
  % ||
  %   a=X; // 1
  %   Y=a;
  % ||
  %   b=Z; // 0
  %   if(b){
  %     X=1
  %   } else {
  %     c=Y; // 1
  %     X=c;
  %     W=c;
  %   }
  %     \VAR  \PW{x}{0}\SEMI \VAR  \PW{y}{0}\SEMI \VAR  \PW{z}{0}\SEMI
  \begin{gathered}
    %\PW{y}{0}\SEMI
    \PW{y}{x}
  \PAR
  % \PW{x}{0}\SEMI
  % \PW{z}{0}\SEMI
  \PR{y}{r} \SEMI \IF{b}\THEN  \PW{x}{r} \SEMI \PW{z}{r} \ELSE \PW{x}{1} \FI
  \PAR
  %\PW{b}{0}\SEMI
    \PW{b}{1}
  \\[-1ex]
% \hbox{\begin{tikzinline}[node distance=1.25em]
%   \event{wy0}{\DW{y}{0}}{}
%   \event{rx}{\DR{x}{1}}{right=.5em of wy0}
%   \event{wy}{\DW{y}{1}}{right=of rx}
%   \po{rx}{wy}
%   \event{wx0}{\DW{x}{0}}{right=2em of wy}
%   \event{wz0}{\DW{z}{0}}{right=.5em of wx0}
%   \event{ry}{\DR{y}{1}}{right=of wz0}
%   \event{wx}{\DW{x}{1}}{right=of ry}
%   \event{wz}{\DW{z}{1}}{right=of wx}
%   \po{ry}{wx}
%   \event{rb}{\DR{b}{1}}{right=of wz}
%   \event{wb0}{\DW{b}{0}}{right=2em of rb}
%   \event{wb1}{\DW{b}{1}}{right=.8em of wb0}
%   \wk{wb0}{wb1}
%   \rf[out=15,in=165]{wy}{ry}
%   \rf[out=-170,in=-10]{wx}{rx}
%   \po[out=25,in=25]{ry}{wz}
%   \wk[out=25,in=155]{wy0}{wy}
%   \wk[out=19,in=161]{wx0}{wx}
%   \wk[out=19,in=161]{wz0}{wz}
%   \rf[out=-170,in=-17]{wb1}{rb}
%   \po{rb}{wz}
% \end{tikzinline}}
\hbox{\begin{tikzinline}[node distance=1.5em]
      \event{rx}{\DR{x}{1}}{}
      \event{wy}{\DW{y}{1}}{right=of rx}
      \po{rx}{wy}
      \event{ry}{\DR{y}{1}}{right=3em of wy}
      \event{wx}{\DW{x}{1}}{right=of ry}
      \event{wz}{\DW{z}{1}}{right=of wx}
      \event{rb}{\DR{b}{1}}{right=of wz}
      \event{wb1}{\DW{b}{1}}{right=3em of rb}
      \po{ry}{wx}
      \rf{wb1}{rb}
      \rf{wy}{ry}
      \rf[out=-170,in=-10]{wx}{rx}
      \po{rb}{wz}
      \po[out=15,in=165]{ry}{wz}
\end{tikzinline}}
  \end{gathered}
\end{gather}
As we discussed in \textsection\ref{sec:pop} there is a dependency from
$(\DR{y}{1})$ to $(\DW{x}{1})$; thus, the outcome is disallowed.  This
outcome is also disallowed by our event structures model
\citep[\textsection9]{DBLP:journals/lmcs/JeffreyR19}, although the logic
given in that paper is insufficient to establish this fact.  The outcome is
\emph{allowed} by \citet{Manson:2005:JMM:1047659.1040336}, \citet{DBLP:conf/esop/JagadeesanPR10},
\citet{DBLP:conf/popl/KangHLVD17}, and
\citet{DBLP:journals/pacmpl/ChakrabortyV19}.
% , demonstrating a lack of
% compositionality in these models.
% \begin{tikzdisplay}[node distance=1.5em]
%   \event{wy0}{\DW{y}{0}}{}
%   \event{rx}{\DR{x}{1}}{right=4.5em of wy0}
%   \event{wy}{\DW{y}{1}}{right=of rx}
%   \po{rx}{wy}
%   \wk[bend left]{wy0}{wy}
%   \event{wx0}{\DW{x}{0}}{below=of wy0}
%   \event{rz}{\DR{z}{0}}{right=of wx0}
%   \event{ry}{\DR{y}{1}}{right=of rz}
%   \event{wx}{\DW{x}{1}}{right=of ry}
%   \event{ry1}{\DR{y}{1}}{right=of wx}
%   \event{wa}{\DW{a}{1}}{right=of ry1}
%   \rf{wy}{ry1}
%   \po{ry}{wx}
%   \wk[bend right]{wx0}{wx}
%   \rf{wy}{ry}
%   \rf{wx}{rx}
%   \event{wz0}{\DW{z}{0}}{below=of wx0}
%   \event{wz1}{\DW{z}{1}}{right=of wz0}
%   \rf{wz0}{rz}
%   \wk{wz0}{wz1}
%   \po{ry1}{wa}
%   \po[bend right]{rz}{wa}
% \end{tikzdisplay}

To establish that this outcome is disallowed here, we prove
\begin{math}
  \lnot\DW{z}{1},
\end{math}
starting with invariant:
% which holds for each of the three threads, and thus, by composition, for the
% aggregate program:
\begin{align*}
  [\once\DW{y}{1} \Rightarrow \once\DR{x}{1}]
  \land
  [\notonce\DW{z}{1} \Rightarrow (\once\DR{y}{1} \land \always(\DW{x}{1} \Rightarrow \once\DR{y}{1}))]
\end{align*}
Closing $y$ and chaining into the left conjunct:
% \begin{math}
%   \once\DR{y}{1} \Rightarrow \once\DW{y}{1}. % \Rightarrow \once\DR{x}{1}
% \end{math}
% Chaining this implication on the left:
\begin{math}
  \once\DR{y}{1} \Rightarrow \once\DR{x}{1}.
\end{math}
% We can weaken this to:
% \begin{math}
%   \once\DR{y}{1} \Rightarrow \once\DR{x}{1}. % \Rightarrow \once\DR{x}{1}
% \end{math}
Chaining into the right conjunct:
\begin{displaymath}
  \notonce\DW{z}{1} \Rightarrow (\once\DR{x}{1} \land \always(\DW{x}{1} \Rightarrow \once\DR{x}{1}))
\end{displaymath}
Closing $x$:
% \begin{math}
%   \once\DR{x}{1} \Rightarrow \once\DW{x}{1}.
% \end{math}
%  Weakening and chaining again:
%we can replace $\once\DR{x}{1}$ with $\once\DW{x}{1}$:
\begin{math}
  \notonce\DW{z}{1} \Rightarrow (\once\DW{x}{1} \land \always(\DW{x}{1} \Rightarrow \once\DW{x}{1}).
\end{math}
Applying coinduction to the right conjunct:
\begin{displaymath}
  \notonce\DW{z}{1} \Rightarrow (\once\DW{x}{1} \land \always(\lnot \DW{x}{1}))
\end{displaymath}
Simplifying:
\begin{math}
  \notonce\DW{z}{1} \Rightarrow \FALSE,
\end{math}
as required.
\end{example}

\begin{comment}
  \color{red} Need to sort this out.
  Alan proposes:
\begin{verbatim}
     (W y 2) => <>(R x 1)
     (W y 1) => <>(R x 0)
     (W x 1) => <>(R y 1)
   <>(W x 1) => not(<>(W x 2))  --- which should be???  <>(W x 0) => not(<>(W x 1))
\end{verbatim}

2020/09/30: This seems to go bad because of initialization...
The formula
\begin{verbatim}
<>Wx0 => not(<>Wx1)
\end{verbatim}
does not hold for
\begin{verbatim}
x=0; x=y
\end{verbatim}

2020/09/10:  I am worried about the compositionality of this predicate:
\begin{verbatim}
I think
   <>(W x 0 => not(<>(W x 1)))
holds for
   x=0; r=y
and
   x=1
but not
   x=0; r=y || x=1
as shown by the execution
   Wx1 < Wx0 < Ry0
\end{verbatim}

It is impossible to fulfill $(\DR{y}{1})$ in the following
\cite[RNG]{DBLP:conf/esop/SvendsenPDLV18}:
\begin{align*}
  \taglabel{OOTA5}
    ( \PW{y}{x{+}1}
    \PAR
    \PW{x}{y} ) && \hbox{\begin{tikzinline}[node distance=1.5em]
        \event{rx}{\DR{x}{1}}{}
        \event{wy}{\DW{y}{2}}{right=of rx}
        \po{rx}{wy}
        \event{ry}{\DR{y}{1}}{right=3em of wy}
        \event{wx}{\DW{x}{1}}{right=of ry}
        \po{ry}{wx}
        \rf[out=170,in=10]{wx}{rx}
      \end{tikzinline}}
\end{align*}
The proof proceeds as before, starting with the following invariant:
\begin{gather*}
  [\DW{y}{2} \Rightarrow \once\DR{x}{1}] \land
  [\once\DW{x}{1} \Rightarrow \once\DR{y}{1}] \land
  [\once\DW{y}{1} \Rightarrow \once\DR{x}{0}] \land
  [\once\DW{x}{0} \Rightarrow \lnot(\once\DW{x}{1})]
\end{gather*}
\begin{verbatim}
  Wy2 => <>Rx1  /\  <>Wx1 => <>Ry1  /\  <>Wy1 => <>Rx0
close x and y
  Wy2 => <>Wx1  /\  <>Wx1 => <>Wy1  /\  <>Wy1 => <>Wx0
chain
  Wy1 => <>Wx0
chain with <>Wx0 => not(<>Wx1)
\end{verbatim}
\end{comment}

% Many examples are superficially similar, but in fact have fewer dependencies.
% A referee for a previous version of this paper expected that the following example is
% ``the same'':
% \begin{gather*}
%   \tag{OOTA?}\label{OOTA?}
%     \PW{y}{x}
%   \PAR
%     \IF{y}\THEN \PR{y}{r}\SEMI \PW{x}{r}\SEMI a\GETS r \ELSE \PW{x}{1} \FI
%   \\
%   \hbox{\begin{tikzinline}[node distance=1.5em]
%   \event{rx}{\DR{x}{1}}{}
%   \event{wy}{\DW{y}{1}}{right=of rx}
%   \po{rx}{wy}
%   \event{ry}{\DR{y}{1}}{right=2em of wy}
%   \event{wx}{\DW{x}{1}}{right=of ry}
%   \event{wa}{\DW{a}{1}}{right=of wx}
%   \rf[out=-15,in=-165]{wy}{ry}
%   \rf[out=170,in=10]{wx}{rx}
%   \po[out=-15,in=-165]{ry}{wa}
%     \end{tikzinline}}
% \end{gather*}
% In this execution, $\DW{x}{1}$ is independent of $\DR{y}{1}$, thus there is no
% \oota{} behavior.

Many examples are superficially similar, but in fact have fewer dependencies,
such as \eqref{OOTA?} from \textsection\ref{sec:intro}.

\noparagraph{RFUB: Register assignment From an Unexecuted Branch}
\citeauthor{BoehmOOTA}'s [\citeyear{BoehmOOTA}] \ref{RFUB} example presents
another potential form of \oota{} behavior.
% , in the context of compiler
% optimization.
Our analysis shows that there is no \oota{} behavior in
\ref{RFUB}, only a false dependency:
%\citet{BoehmOOTA} \labeltext{considers}{page:rfub} the following programs:
\begin{gather*}
  \tag{\textsc{rfub}}\label{RFUB}
  \sem{\PR{y}{r}\SEMI \PW{x}{r}}
  \not\supseteq
  \sem{\PR{y}{r}\SEMI \IF{r \NOTEQ 1} \THEN \PW{z}{1}\SEMI \LET{r}{1}\FI \SEMI \PW{x}{r}}
\end{gather*}
The left command is half of \ref{OOTA3}. %, from \textsection\ref{sec:logic}.
The right command is dubbed \rfub{}, for \emph{Register assignment From an
  Unexecuted Branch}.  \citeauthor{BoehmOOTA} observes that in the context
$\PW{x}{y} \PAR \hole{}$, these programs have different behaviors.  Yet the
\oota{} example on the left never writes $1$.  Why should the unexecuted
branch change that?  Because of the conditional, the write to $x$ in
\ref{RFUB} is independent of the read from $y$.  It useful to considering the
Hoare logic formulas satisfied by the two threads above: we have
$\hoare{\TRUE}{\ref{RFUB}}{x=1}$ for the right thread of \ref{RFUB}, but not
$\hoare{\TRUE}{\ref{OOTA3}}{x=1}$ for the right thread of \ref{OOTA3}.  The
change in the thread from \ref{OOTA3} to \ref{RFUB} is not a valid refinement
under Hoare logic; thus, it is expected that \ref{RFUB} may have additional
behaviors.

Understanding \oota{} behavior is notoriously difficult, even for the
greatest minds in the field!  % We believe that \emph{logic} is the only tool
% that can cut the horrible knot that semanticists have tied themselves in.
% Preconditions provide a \emph{natural} solution to working out these
% dependencies.
This example shows the wisdom of using existing tools, such as preconditions
and Hoare logic, to model new problems, such as relaxed memory.
% We don't
% need to abandon established ideas; we only need to adapt them!
% On page \pageref{page:rfub}, we discuss \citeauthor{BoehmOOTA}'s
% [\citeyear{BoehmOOTA}] \ref{RFUB} example, which presents another potential
% form of \oota{} behavior, in the context of compiler optimization.  Our
% analysis shows that there is no \oota{} behavior in \ref{RFUB}, instead
% \citeauthor{BoehmOOTA}'s analysis has a false dependency.

% Understanding \oota{} behavior is notoriously difficult, even for the
% greatest minds in the field!  We believe that \emph{logic} is the only tool
% that can cut the horrible knot that semanticists have tied themselves in.
% Preconditions provide a \emph{natural} solution to working out these
% dependencies.

% \endinput

% \paragraph{Load buffering and thin air.}
% The program
% \begin{math}
%   %\PW{x}{0}\SEMI \PW{y}{0}\SEMI
%   (\PW{y}{x} \PAR \bReg\GETS y\SEMI \PW{x}{1})
% \end{math}
% has top level executions that result in the final outcome $x = y = 1$, such as:
% \begin{tikzdisplay}[node distance=1.5em]
%   % \event{wx0}{\DW{x}{0}}{}
%   % \event{wy0}{\DW{y}{0}}{below=wx0}
%   \event{rx}{\DR{x}{1}}{}
%   \event{wy}{\DW{y}{1}}{right=of rx}
%   \po{rx}{wy}
%   \event{ry}{\DR{y}{1}}{right=3em of wy}
%   \event{wx}{\DW{x}{1}}{right=of ry}
%   \rf{wy}{ry}
%   \rf[out=170,in=10]{wx}{rx}
%   %\po{rx}{wy}
% \end{tikzdisplay}
% In \textsection\ref{sec:logic} we provide machinery to prove that this
% outcome is impossible if there is order from read to write in both
% threads.  This order can be achieved by replacing the second thread
% \begin{math}
%   (\bReg\GETS y\SEMI \PW{x}{1})
% \end{math}
% with
% \begin{math}
%   (\bReg\GETS y^\mRA\SEMI \PW{x}{1})
% \end{math}
% or
% \begin{math}
%   (\IF{y}\THEN \PW{x}{1}\FI)
% \end{math}
% or
% \begin{math}
%   (\PW{x}{y}).
% \end{math}

% A more interesting example is the following variant of \eqref{types}:
% \begin{displaymath}
%   %\label{OOTA4}
%   % \PW{x}{0}\SEMI
%   %\PW{y}{0}\SEMI
%   (
%     \PW{y}{x}
%   \PAR
%     \IF{z}\THEN \PW{x}{1} \ELSE \PW{x}{y}\SEMI a\GETS y \FI
%   \PAR
%     \PW{z}{0}\SEMI \PW{z}{1}
%   )
% \end{displaymath}
% This program is allowed to write $1$ to $a$ under many speculative
% memory models
% \cite{Manson:2005:JMM:1047659.1040336,DBLP:conf/esop/JagadeesanPR10,DBLP:conf/popl/KangHLVD17},
% even though the read of $1$ from $y$ in the else branch of the second
% thread arises out of thin air.   \citet{DBLP:journals/toplas/Lochbihler13}
% argues that such executions compromise type safety unless object allocation
% partitions memory by type.
% In our model, the attempted execution is:
% \begin{tikzdisplay}[node distance=1.5em]
%   \event{rx}{\DR{x}{1}}{}
%   \event{wy}{\DW{y}{1}}{below=of rx}
%   \po{rx}{wy}
%   \event{ry}{\DR{y}{1}}{right=of rx}
%   \event{wx}{\DW{x}{1}}{below=of ry}
%   \po{ry}{wx}
%   \rf{wy}{ry}
%   \rf{wx}{rx}
%   \event{rz}{\DR{z}{0}}{right=of ry}
%   \event{wz0}{\DW{z}{0}}{right=of rz}
%   \rf{wz0}{rz}
%   \event{wz1}{\DW{z}{1}}{right=of wz0}
%   \wk{wz0}{wz1}
%   \event{ry1}{\DR{y}{1}}{below=of rz}
%   \rf[bend right]{wy}{ry1}
%   \event{wa}{\DW{a}{1}}{right=of ry1}
%   \po{ry1}{wa}
%   \po{rz}{wa}
% \end{tikzdisplay}
% This is forbidden by the evident cycle.

% \begin{verbatim}

% y=x+1; a=y || x=y
% prove a!=2

% Wyv_1 /\ Wyv_2 => v_1 == v_2 (and maybe v_1==0 \/ v_2==0)
% Wx1 => <>-1 Ry1
% Wy1 => <>-1 Rx1
% \end{verbatim}

% Local Variables:
% mode: latex
% TeX-master: "paper"
% End:


\chapter{Theory of Algebraic Diagrammatic Construction}

Essentially, ADC is a kind of many-body perturbation theory, whose basic idea is to divide Hamiltonian to unperturbed part and perturbed part, and the sum over different orders of contribution.
If the summation is over all the contributions from infinite orders, then the exact energy will be obtained.
Obviously, numerically it is impossible to do so, thus a simple idea is to truncate the summation to some particular order.
However, when the order increases, on one hand, the expression for a direct perturbation become very complicated, on the other hand, the size inconsistency problem appears again.
Although it is shown that in the first few order all ill-behaved terms that break size consistency are canceled finally, a reason and proof is needed for higher orders.

On the other hand, instead of designed for solving ground state like what all the methods we discussed previously does, ADC is designed for ionization potential, electron affinity or excited state.
Interestingly, all these different purposes are based on a same theoretical framework, which is propagator, Green function and Feynman diagram.
There similarity is that all these processes include gain and loss of electrons, which is obvious in the ionization potential and electron affinity case.
In the excited state case, it can be viewed as gain of an electron with higher energy and loss with lower energy.
Thus, number of electrons is never conserved in ADC, which is hard to deal with in the formal quantum mechanics framework, which means a new tool is needed.

In order to finish these purposes, a many-body field theory approach is required, which originates from quantum field theory which is developed for a theoretical elementary particle physics.
After quantum field theory is constructed, the idea of field theory is quickly transferred to many-body physics, which becomes the basis of many-body perturbation theory.

In many-body field theory, a language of second quantization is used.
We have used a little second quantization when discussing the Post-Hartree Fock part for convenience.
However, we didn't give a formal definition for the notations we give.

Thus, in this chapter, we will firstly formally introduce second quantization, Green function and Feynman diagram.
Then we will discuss how these concepts are applied to ADC and to calculate the three kinds of energies mentioned above.
Finally, we will discuss the concept intermediate state and its relation with size consistency and compactness, and prove that ADC is both a canonical and size consistent method.


\documentclass{article}

\usepackage{enumitem}
\usepackage[english]{babel}
\usepackage[utf8]{inputenc}
\usepackage{parskip}
\usepackage{graphicx}
\usepackage{mathtools}
\usepackage{mathrsfs}
\usepackage{amsmath,amsthm,hyperref}
\usepackage{amssymb}
\usepackage{amsmath}
\DeclareMathOperator{\Tr}{tr}
\usepackage{bbm}

% Margins
\usepackage[top=2.5cm, left=3cm, right=3cm, bottom=4.0cm]{geometry}
% Colour table cells
\usepackage[table]{xcolor}

% Get larger line spacing in table
\newcommand{\tablespace}{\\[1.25mm]}
\newcommand\Tstrut{\rule{0pt}{2.6ex}}         % = `top' strut
\newcommand\tstrut{\rule{0pt}{2.0ex}}         % = `top' strut
\newcommand\Bstrut{\rule[-0.9ex]{0pt}{0pt}}   % = `bottom' /

% my new commands
\newcommand\partialkj{\frac{\partial^2}{\partial\theta_k\partial\theta_j}}
\makeatletter
\newcommand*\bigcdot{\mathpalette\bigcdot@{.5}}
\newcommand*\bigcdot@[2]{\mathbin{\vcenter{\hbox{\scalebox{#2}{$\m@th#1\bullet$}}}}}
\makeatother
\newcommand{\minus}{\scalebox{0.5}[1.0]{$-$}}
\newcommand{\zero}{\scalebox{0.6}[0.75]{$^{(0)}$}}
\newcommand{\supi}[1]{\scalebox{0.6}[0.75]{$^{(#1)}$}}\newcommand{\supi}{\scalebox{0.6}[0.75]{$^{(i)}$}}
\newcommand{\bigDash}{\scalebox{3.0}[1.0]{$-$}}

%%%%%%%%%%%%%%%%%
%     Title     %
%%%%%%%%%%%%%%%%%
\title{Problem Set #2: Kernels, SVMs, and Theory}
\author{Eitan Joseph \and Caroline Wang}
\date{\today}

\begin{document}
\maketitle

%%%%%%%%%%%%%%%%%
%   Problem 1   %
%%%%%%%%%%%%%%%%%
\section{Problem 1}
\textbf{Kernel ridge regression\\\\}
In contrast to ordinary least squares which has a cost function\begin{equation}
    J(\theta) = \frac{1}{2}\sum_{i=1}^{m}\left(\theta^T x^{(i)}-y^{(i)}\right )^2
\end{equation}we can also add a term that penalizes large weights in $\theta $. In \textit{ridge regression}, our least
squares cost is regularized by adding a term $\lambda ||\theta ||^2$
, where $\lambda>0$ is a fixed (known) constant
(regularization will be discussed at greater length in an upcoming course lecutre). The ridge regression cost function is then\begin{equation*}
     J(\theta) = \frac{1}{2}\sum_{i=1}^{m}\left(\theta^T x^{(i)}-y^{(i)}\right )^2 + \frac{\lambda}{2}||\theta ||^2
\end{equation*}
\begin{enumerate}[label=(\alph*)]
    \item Use the vector notation described in class to find a closed-form expreesion for the
value of $\theta$ which minimizes the ridge regression cost function.\\
\textit{answer}: \\

We know that the cost function without the penalty term can be written in closed form as
\begin{align*}
    \frac{1}{2}\left(X\theta-\Vec{y}\right)^T\left(X\theta-\Vec{y}\right)
\end{align*}
We can then rewrite the penalty term to be
\begin{align*}
    \frac{\lambda}{2}\theta^T\theta
\end{align*}
Therefore, together with the penalty term, the $J(\theta)$ will be as follows: \begin{align*}
    J(\theta) = \frac{1}{2}\left(X\theta-\Vec{y}\right)^T\left(X\theta-\Vec{y}\right) + \frac{\lambda}{2}\theta^T\theta
\end{align*}
So we can now evaluate the gradient respect to $J(\theta)$:
\begin{align*}
    \nabla_\theta J(\theta) = X^TX\theta -X^T\Vec{y} + \lambda\theta
\end{align*}
Using the knowledge from lecture 2 that
\begin{align*}
    \nabla_\theta \frac{1}{2}\left(X\theta-\Vec{y}\right)^T\left(X\theta-\Vec{y}\right) = X^TX\theta -X^T\Vec{y}
\end{align*}
To find the optimization point, we want to set the gradient vector to zero \begin{align*}
    \Vec{0} = &X^TX\theta -X^T\Vec{y} + \lambda\theta
\end{align*}
And then solve for $\theta$ to get
\begin{align*}
    \theta =& \left(X^TX+\lambda I\right)^{\minus1}X^T\Vec{y}
\end{align*}
\item Suppose that we want to use kernels to implicitly represent our feature vectors in a
high-dimensional (possibly infinite dimensional) space. Using a feature mapping $\phi$,
the ridge regression cost function becomes\begin{align*}
     J(\theta) = \frac{1}{2}\left(X\theta-\Vec{y}\right)^T\left(X\theta-\Vec{y}\right) + \frac{\lambda}{2}\theta^T\theta
\end{align*}Making a prediction on a new input $x_{new}$ would now be done by computing $\theta^T\phi (x_{new})$.
Show how we can use the “kernel trick” to obtain a closed form for the prediction on the new input without ever explicitly computing $\phi (x_{new})$. You may assume that the parameter vector $\theta$ can be expressed as a linear combination of the input feature
vectors; i.e.$ \sum_{i=1}^{m}\alpha_i \phi (x^{(i)})$ for some set of parameters $\alpha_i$.\\\\
\textit{Answer:}\\
From part a, we know that the optimized $\theta$ can be written as: \begin{align*}
     \theta =& \left(X^TX+\lambda I\right)^{\minus1}X^T\Vec{y}
\end{align*}
By using the identity $\left(\lambda I +BA\right)^{\minus1}B = B\left(\lambda I +AB\right)^{\minus1}$ we can rewrite $\theta$ as: \begin{align*}
    \theta =& X^T\left(XX^T+\lambda I\right)^{\minus1}\Vec{y}
\end{align*}
The kernel algorithm maps the feature matrix (training data set matrix) to a higher dimension before applying the linear classification algorithm. Therefore, we will denote the new feature matrix $\Phi$ with columns $\phi(x^{(i)})$. \\\\Then we can use our new feature matrix to redefine $\theta$ as follows: \begin{align*}
    \theta =&{}\: \Phi^T\left(\Phi\Phi^T+\lambda I\right)^{\minus1}\Vec{y}
\end{align*}
We know that the kernel matrix is the covariance matrix of $\Phi$ with itself: $K = \Phi\Phi^T$. Therefore: \begin{align*}
    \theta =&{}\: \Phi^T\left(K+\lambda I\right)^{\minus1}\Vec{y}
\end{align*}
Given that the prediction on $x_{new}$ denoted $y_{new}$ = $\theta^T \phi(x_{new})$, we can substitute for $\theta$ and solve \begin{align*}
    y_{new} = y^T\left(K+\lambda I\right)^{\minus1}\Phi \phi(x_{new})
\end{align*} To use the assumption that that the parameter vector $\theta$ can be expressed as a linear combination of the input feature vectors, we rewrite $\theta$ in the form $ \sum_{i=1}^{m}\alpha_i \phi (x^{(i)})$ by defining some feature set $\alpha$.\\\\
We can define the set of parameters $\alpha$ to be: $\left(K+\lambda I\right)^{\minus1}y$. Thus, \begin{align*}
     y_{new}=\sum_{i=1}^{m}\alpha_i \phi (x^{(i)})^T \phi(x_{new})
\end{align*}
Finally, we can use the fact that the kernel function is defined as $K(x^{(i)},x_{new}) = \phi (x^{(i)})^T \phi(x_{new})$ to rewrite the equation as
\begin{align*}
     y_{new}=\sum_{i=1}^{m}\alpha_i K(x^{(i)},x_{new})
\end{align*}
\end{enumerate}

%%%%%%%%%%%%%%%%%
%   Problem 2   %
%%%%%%%%%%%%%%%%%
\section{Problem 2}
\textbf{$l_2$ norm soft margin SV\\\\}
In class, we saw that if our data is not linearly separable, then we need to modify our
support vector machine algorithm by introducing an error margin that must be minimized.
Specifically, the formulation we have looked at is known as the $l_1$ norm soft margin SVM.
In this problem we will consider an alternative method, known as the $l_2$ norm soft margin
SVM. This new algorithm is given by the following optimization problem (notice that the
slack penalties are now squared:\begin{align*}
    \min_{w,b,\xi} \quad &\frac{1}{2}||w||^2+\frac{C}{2}\sum_{i=1}^{m}x_i^2\\
    \textrm{s.t.} \quad &y^{(i)}(w^Tx^{(i)}+b) \geq 1-\xi_i, i=1,\dots m
\end{align*}

\begin{enumerate}[label=(\alph*)]
    \item Notice that we have dropped the $\xi_i \geq 0$ constraint in the $l_2$ problem. Show that these non-negativity constraints can be removed. That is, show that the optimal value of the objective will be the same whether or not these constraints are present.\\\\
    \textit{answer:}\\
    For any $\xi_i < 0$ that satisfies the convex constraint, the value $\xi_i = 0$ also satisfies the constraint and minimizes the objective function.
    \item What is the Lagrangian of the $l_2$ soft margin SVM optimization problem?
    \begin{equation*}
        \mathcal{L}(w,b,\alpha, \xi) = \frac{1}{2}w^Tw + \frac{C}{2}\sum_{i=1}^{m}\xi_i^2-\sum_{i=1}^{m}\alpha_i[y^{(i)}(w^Tx^{(i)}+b)-1+\xi_i]
    \end{equation*}
    \item Minimize the Lagrangian with respect to $w$, $b$, and $\xi$ by taking the following gradients: $\nabla_w\mathcal{L}$, $\frac{\partial}{\partial b}\mathcal{L}$, and $\nabla_\xi\mathcal{L}$, and then setting them equal to 0.\\\\
    \textit{answer:}
    \begin{align*}
        \nabla_w \mathcal{L} =&{} w - \sum_{i=1}^m\alpha_iy^{\supi{i}}x^{\supi{i}} \overset{set}=\: 0
    \end{align*}
    By using the fact that we set the gradient to $0$ we can solve for $w$
    \begin{align*}
        w =&{}\sum_{i=1}^m\alpha_iy^{\supi{i}}x^{\supi{i}}
    \end{align*}
    And solve for $b$ by taking the partial derivative
    \begin{align*}
        \frac{\partial}{\partial b}\mathcal{L} =&{} \sum_{i=1}^m\alpha_iy^{\supi{i}} = 0\\
    \end{align*}
    And finally solve for $\xi$ by taking the gradient
    \begin{align*}
        \nabla_\xi \mathcal{L} =&{} C\sum_{i=1}^m\xi_i - \sum_{i=1}^m\alpha_i =\: 0\\
        C\sum_{i=1}^m\xi_i =&{}\sum_{i=1}^m\alpha_i
    \end{align*}
    \item What is the dual of the $l_2$ soft margin SVM optimization problem?\\\\
    \textit{answer:} To compute the dual problem, we need to reparameterize the Lagrangian as a function of $w$ on $\alpha$ \begin{align*}
        W(\alpha)=&\frac{1}{2}\sum_{i=1}^{m}\sum_{j=1}^{m}(\alpha_i y^{\supi{i}}x^{\supi{i}})^T (\alpha_j y^{\supi{j}}x^{\supi{j}})+\frac{1}{2}\sum_{i=1}^{m}\frac{\alpha_i}{\xi_i}\xi_i^2\\
        &\: -\sum_{i=1}^{m}\alpha_i\left[y^{\supi{i}}\left(\left(\sum_{j=1}^{m}(\alpha_j y^{\supi{j}}x^{\supi{j}})\right)^T x^{\supi{i}}+b\right)-1+\xi_i\right]\\
        =&\frac{1}{2}\sum_{i=1}^{m}\sum_{j=1}^{m}\alpha_i\alpha_jy^{\supi{i}}y^{\supi{j}}(x^{\supi{i}})^Tx^{\supi{j}}+\frac{1}{2}\sum_{i=1}^{m}\alpha_i\xi_i-\sum_{i=1}^{m}\sum_{j=1}^{m}\alpha_i\alpha_jy^{\supi{i}}y^{\supi{j}}(x^{\supi{i}})^Tx^{\supi{j}}\\&\:-b\sum_{i=1}^{m}a_iy^{\supi{i}} + \sum_{i=1}^{m}a_i-\sum_{i=1}^{m}\alpha_i\xi_i\\
        =&\sum_{i=1}^{m}a_i-\frac{1}{2}\sum_{i=1}^{m}\sum_{j=1}^{m}\alpha_i\alpha_jy^{\supi{i}}y^{\supi{j}}(x^{\supi{i}})^Tx^{\supi{j}}-\frac{1}{2}\sum_{i=1}^{m}\alpha_i\xi_i\\
        =&\sum_{i=1}^{m}a_i-\frac{1}{2}\sum_{i=1}^{m}\sum_{j=1}^{m}\alpha_i\alpha_jy^{\supi{i}}y^{\supi{j}}(x^{\supi{i}})^Tx^{\supi{j}}-\frac{1}{2}\sum_{i=1}^{m}\frac{\alpha_i^2}{C}
    \end{align*}
   Now to formulate the dual optimization problem, we simply add the constraints derived in part c to our objective function\begin{align*}
        \max_{\alpha }\quad &\sum_{i=1}^{m}a_i-\frac{1}{2}\sum_{i=1}^{m}\sum_{j=1}^{m}\alpha_i\alpha_jy^{\supi{i}}y^{\supi{j}}(x^{\supi{i}})^Tx^{\supi{j}}-\frac{1}{2}\sum_{i=1}^{m}\frac{\alpha_i^2}{C}\\
        s.t. \quad &\sum_{i=1}^{m}a_iy^{\supi{i}}=0
    \end{align*}
\end{enumerate}

%%%%%%%%%%%%%%%%%
%   Problem 4   %
%%%%%%%%%%%%%%%%%
\section{Problem 3}
\textbf{SVM with Gaussian kernel}\\\\
Consider the task of training a support vector machine using the Gaussian kernel $K(x,z) = \exp(-||x-z||^2/\tau^2)$. We will show that as long as there are no two identical points in the
training set, we can always find a value for the bandwidth parameter $\tau$ such that the SVM
achieves zero training error.

\begin{enumerate}[label=(\alph*)]
\item Recall from class that the decision function learned by the support vector machine can be written as
\begin{align*}
    f(x) = \sum_{i=1}^{m}\alpha_iy\supi{i}K(x\supi{i},x)+b
\end{align*}
Assume that the training data $f\{(x\supi{1}, y\supi{1}),\dots , (x\supi{m}, y\supi{m})\}$ consists of points which
are separated by at least a distance of $\epsilon$; that is, $||x\supi{j}-x\supi{i}||\geq \epsilon$ for any $i\neq j$.
Find values for the set of parameters $\{\alpha_1, \dots, \alpha_m,b\}$ and Gaussian kernel width $\tau$ such that $x\supi{i}$ is correctly classified, for all $i=1, \dots, m$. [Hint: Let $\alpha_i=1$ for all i
and $b=0$. Now notice that for $y\in \{-1,1\}$ the prediction on $x\supi{i}$ will be correct if $|f(x\supi{i})-y\supi{i}|<1$ , so find a value of $\tau$ that satisfies this inequality for all $i$.\\\\
\textit{answer:}\\\\
We will first let $\alpha_i = 1 \forall i$ and we will let $b = 0$. We notice here that since $y \in \{-1,+1\}$, the prediction on $x\supi{i}$ will be correct if $\Big|f\left(x\supi{i}\right)-y\supi{i}\Big| < 1$.\\\\
Now we can substitute in our $f\left(x\supi{i} )\right)$ to get the equation
\begin{align*}
     \Big|f\left(x\supi{i}\right)-y\supi{i}\Big|= &\left|\left(\sum_{k=1}^{m}\alpha_ky\supi{k}K(x\supi{k},x\supi)+b\right)-y\supi{i}\right| <1\\
   \Longrightarrow &\left|\left(\sum_{k=1}^{m}y\supi{k}K(x\supi{k},x\supi)\right)-y^\supi{i}\right| <1
\end{align*}
Substituting the Gaussian Kernel for K gives
\begin{align*}
    \left|\left(\sum_{k=1}^{m}y\supi{k}\exp\left(-\frac{||x\supi{k}-x\supi{i}||^2}{\tau^2}\right)\right)-y^\supi{i}\right| <1
\end{align*}
By pulling out $y^\supi{i}$ from the sum we get
\begin{align*}
    &\left|y\supi{i} + \left(\sum_{\substack{k=1\\k\neq i}}^{m} y\supi{k}\exp\left(-\frac{||x\supi{k}-x\supi{i}||^2}{\tau^2}\right)\right)-y^\supi{i}\right| <1\\
    \Longrightarrow &\left|  \sum_{\substack{k=1\\k\neq i}}^{m} y\supi{k}\exp\left(-\frac{||x\supi{k}-x\supi{i}||^2}{\tau^2}\right)\right| <1
\end{align*}
Since each $y\supi{k}$ is either $-1$ or $+1$ in the worse case for the inequality all $y\supi{k}$s are the same.\\Essentially, $\sum_{k=1}^{m}y\supi{i}\leq |\sum_{k=1}^{m}y\supi{i} |$, and since $||x\supi{j}-x\supi{i}||\geq \epsilon$ for any $i\neq j$, we can write \begin{align*}
    &\left|  \sum_{\substack{k=1\\k\neq i}}^{m} y\supi{k}\right|\exp\left(-\frac{\epsilon^2}{\tau^2}\right) <1\\
    \Longrightarrow & (m-1)\exp\left(-\frac{\epsilon^2}{\tau^2}\right)<1
\end{align*}
Then we can solve for $\tau$:
\begin{align*}
    \tau <\frac{\epsilon}{\sqrt{\log (m-1)}}
\end{align*}
For simplification, we can choose: \begin{align*}
    \tau = \frac{\epsilon}{\log m}
\end{align*}
\item Suppose we run a SVM with slack variables using the parameter $\tau$ you found in part (a). Will the resulting classifier necessarily obtain zero training error? Why or why not? A short explanation (without proof) will suffice. \\\\
\textit{answer: }\\\\
The classifier will obtain zero training error. We can verify this by observing that the SVM algorithm WITHOUT any slack variable will achieve zero training error if it can satisfy the convex constraint. If we can find a solution that satisfies the convex constraint without a slack variable, then we have proved that the classifier will still obtain zero training error. This is because in order to minimize the objective function, the algorithm will necessarily choose the slack variables to be equal to zero if possible.\\\\To do this we first observe that our convex constraint is
\begin{align*}
    y\supi{i}\left(w^Tx\supi{i} + b\right) = y\supi{i}f(x\supi{i}) > 1
\end{align*}
By using our $\tau$ from part (a) we can ensure that $y\supi{i}f(x\sup{i}) > 0 \;\forall i$ (meaning that every classification of $x\supi{i}$ is correct), and therefore we can take each $\alpha_i$ to be large enough to satisfy the inequality. Since we can satisfy this constraint, it is clear that we can satisfy the same constraint with a slack variable.

\item Suppose we run the SMO algorithm to train an SVM with slack variables, under the conditions stated above, using the value of $\tau$ you picked in the previous part, and using some arbitrary value of $C$ (which you do not know beforehand). Will this necessarily result in a classifier that achieve zero training error? Why or why not? Again, a short explanation is sufficient.\\\\
\textit{answer}: \\\\
The classifier will not be able to obtain zero training error because there exists a constant $C$ in front of $(C\sum_{i=1}^{m}\xi_i)$ for which we have no information on. If the constant $C$ happened to be $\leq 0$, then the minimization of the objective function could be achieved with non-zero slack variables.
\end{enumerate}
\section{Problem 5}
\textbf{Uniform convergence}\\
In class we proved that for any finite set of hypotheses $\mathcal{H} = \{h_1,\dots, h_k\}$, if we pick the hypothesis $\hat{h}$ that minimizes the training error on a set of m examples, then with probability at least $1-\delta$,\begin{align*}
    \epsilon(\hat{h})\leq \left(\min_{i}\epsilon(h_i)\right)+2\sqrt{\frac{1}{2m}\log\frac{2k}{\delta}}
\end{align*}where $\epsilon(h_i)$ is the generalization error of hypothesis $h_i$. Now consider a special case (often called the \textit{realizable} case) where we know, a priori, that there is some hypothesis in our class $\mathcal{H}$ that achieves zero error on the distribution from which the data is drawn. Then we could obviously just use the above bound with $\min_i\epsilon(h_i)=0$; however, we can prove a better bound than this.

\begin{enumerate}[label=(\alph*)]
    \item Consider a learning algorithm which, after looking at $m$ training examples, chooses some hypothesis $\hat{h}\in \mathcal{H}$ that makes zero mistakes on this training data. (By our assumption, there is at least one such hypothesis, possibly more.) Show that with probability $1-\delta$\begin{align*}
        \epsilon(\hat{h})\leq \frac{1}{m}\log\frac{k}{\delta}
    \end{align*}
    Notice that since we do not have a square root here, this bound is much tighter. [Hint: Consider the probability that a hypothesis with generalization error greater than $\gamma$ makes no mistakes on the training data. Instead of the Hoeffding bound, you might also find the following inequality useful: $(1-\gamma)m\leq e^{-\gamma m}$].\\\\
    \textit{answer:}\\\\
The problem states that the probability that $h$ incorrectly predicts some training example $(x\supi{i}, y\supi{i})$ from the distribution $D$ is $\gamma$. Therefore we have that \begin{align*}
    P(h\in \mathcal{H} \text{ that h predicts correctly})=1-\gamma
\end{align*}
For $h$ to predict correctly $m$ times, once for each training example, we have \begin{align*}
    P( h\in \mathcal{H} \text{ that h predicts correctly m times})=(1-\gamma)^m \leq e^{-\gamma m}
\end{align*}
Since there are total $k$ hypothesis in $\mathcal{H}$, \begin{align*}
    P(\forall h\in \mathcal{H} \text{ that h predicts correctly m times})=k(1-\gamma)^m \leq ke^{-\gamma m}
\end{align*}
After setting this probability to $\delta$ and solving for $\gamma$ we obtain the following:\begin{align*}
    &ke^{-\gamma m} = \delta\\
    \Longrightarrow &\gamma = \frac{1}{m}\log\frac{k}{\delta}
\end{align*}
From the lecture we know that $|\hat{\epsilon}(\hat{h})-\epsilon(\hat{h})|> \gamma$ with probability $1-\delta$, therefore since $\hat{\epsilon}{(\hat{h})}= 0$ we obtain the inequality \begin{align*}
    \epsilon(\hat{h})\leq \frac{1}{m}\log\frac{k}{\delta}
\end{align*}
    \item Rewrite the above bound as a sample complexity bound, i.e., in the form: for fixed $\delta$ and $\gamma$, for $\epsilon(\hat{h}) \leq \gamma$ to hold with probability at least $(1 - \delta)$, it suffices that $m \leq f(k,\gamma,\delta)$.
    \textit{answer:}\\\\
    From part (a) we have that $\gamma \leq \frac{1}{m}\log\frac{k}{\delta}$ We now simply need to rewrite this as an inequality on $m$ as follows
    \begin{align*}
        m \leq \frac{1}{\gamma}\log\frac{k}{\delta}
    \end{align*}
\end{enumerate}

\end{document}

Kernels, SVMs, and Theory/Problem Set 2 - Kernals, SVM and Theory.tex


\documentclass{article}
\usepackage[section]{placeins}
\usepackage{graphicx}

\author{Yaghoub Shahmari}
\title{Report - Problem Set no 1}
\date{\today}
\graphicspath{ {../Figs/} }

\begin{document}
    \maketitle
    \section*{Problem 1}
    \textbf{Basic description:}

    There we want to simulate the Koch curve using computational methods.
    In that case, we have to follow the algorithm which leads us to the solution.
    At first, we have a list of 2 points that create a single line.
    Then we have to create three more points between them and transmit them to the position they have to go.
    At first, we divide the line into third.
    Add the final point of the line in the middle of our list.
    Then we will do that again but we will divide the first line to two-thirds instead of third.
    Then we will rotate the final spot in 60 degrees and add the point before the last point in the list.
    And finally, we will do the previous operation without rotation.
    We have to repeat these operations for every point side by side in the initial list (the initial list in every step will be updated and will contain more points).

    I implemented the algorithm for the few shapes, apart from the line,
    I also applied the algorithm in some triangles
    (the rotation degrees for them were 60, -60, and 120).
    The results are as follows:

    \begin{figure}[!htb]
        \centering
        \includegraphics[scale = 0.15]{/Q1/KochCurve1O1}
        \label{fig:1.1.1}
        \includegraphics[scale = 0.15]{/Q1/KochCurve1O2}
        \label{fig:1.1.2}
        \includegraphics[scale = 0.15]{/Q1/KochCurve1O5}
        \label{fig:1.1.3}
        \caption{Koch curve for a single line. The figures belong to the first, second, and fifth stages, respectively.}
    \end{figure}
    \begin{figure}[!htb]
        \centering
        \includegraphics[scale = 0.15]{/Q1/KochCurve2O1}
        \label{fig:1.2.1}
        \includegraphics[scale = 0.15]{/Q1/KochCurve2O2}
        \label{fig:1.2.2}
        \includegraphics[scale = 0.15]{/Q1/KochCurve2O5}
        \label{fig:1.2.3}
        \includegraphics[scale = 0.15]{/Q1/KochCurve3O1}
        \label{fig:1.3.1}
        \includegraphics[scale = 0.15]{/Q1/KochCurve3O2}
        \label{fig:1.3.2}
        \includegraphics[scale = 0.15]{/Q1/KochCurve3O5}
        \label{fig:1.3.3}
        \includegraphics[scale = 0.15]{/Q1/KochCurve4O1}
        \label{fig:1.4.1}
        \includegraphics[scale = 0.15]{/Q1/KochCurve4O2}
        \label{fig:1.4.2}
        \includegraphics[scale = 0.15]{/Q1/KochCurve4O5}
        \label{fig:1.4.3}
        \caption{Koch curve for triangles (The rotation degrees are 60, -60, and 120 respectively, from up to down). The figures belong to the first, second, and fifth stages, respectively.}
    \end{figure}

    \section*{Problem 2}
    \textbf{Basic description:}

    There we want to simulate the Heiway dragon using computational methods.
    As before we have to transmit and rotate our points to create what we want.
    We must note that our rotation degree is 45 degrees.
    We have to rotate the whole structure one by one with 45 and -45 degrees.
    However, if we change both rotation degrees to -45 we will have the Lévy C curve.
    The results are as follows:
    \begin{figure}[!htb]
        \centering
        \includegraphics[scale = 0.13]{/Q2/Heighway-dragon-O1}
        \label{fig:2.1.1}
        \includegraphics[scale = 0.13]{/Q2/Heighway-dragon-O5}
        \label{fig:2.1.2}
        \includegraphics[scale = 0.13]{/Q2/Heighway-dragon-O10}
        \label{fig:2.1.3}
        \includegraphics[scale = 0.13]{/Q2/Heighway-dragon-O15}
        \label{fig:2.1.3}
        \caption{The Heighway dragon fractal. The figures belong to the 1st, 5th, 10th, and 15th stages, respectively.}
    \end{figure}
    \begin{figure}[!htb]
        \centering
        \includegraphics[scale = 0.13]{/Q2/Lévy-C-curve-O1}
        \label{fig:2.2.1}
        \includegraphics[scale = 0.13]{/Q2/Lévy-C-curve-O5}
        \label{fig:2.2.2}
        \includegraphics[scale = 0.13]{/Q2/Lévy-C-curve-O10}
        \label{fig:2.2.3}
        \includegraphics[scale = 0.13]{/Q2/Lévy-C-curve-O15}
        \label{fig:2.2.3}
        \caption{The Lévy C curve fractal. The figures belong to the 1st, 5th, 10th, and 15th stages, respectively.}
    \end{figure}
    \section*{Problem 3}
    \textbf{Basic description:}

    There we want to simulate the Sierpinski triangle using computational methods.
    In that case, we must define a list of triangles that initially have only one triangle.
    In each step of our algorithm, the list will be updated and will contain more triangles.
    So we have to apply an algorithm that takes a single triangle from the list,
    makes it in four smaller triangles, and returns three of them (the center one won't return).
    You have to define a triangle as a list of the points that
make up our triangle
    And the coordinates of the points have to be divided in half.
    That would be enough for the first triangle but the others still need a transmission.
    And after all of our operations, a single triangle changed to three.
    we have to repeat these operations for every single triangle we have at the beginning of each stage.
    The results are as follows:
    \begin{figure}[!htb]
        \centering
        \includegraphics[scale = 0.027]{/Q3/SPT-O1}
        \label{fig:3.1.1}
        \includegraphics[scale = 0.027]{/Q3/SPT-O3}
        \label{fig:3.1.2}
        \includegraphics[scale = 0.027]{/Q3/SPT-O5}
        \label{fig:3.1.3}
        \includegraphics[scale = 0.027]{/Q3/SPT-O7}
        \label{fig:3.1.3}
        \caption{The Sierpinski triangle fractal. The figures belong to the 1st, 3th, 5th, and 7th stages, respectively.}
    \end{figure}
    \section*{Problem 4}
    \textbf{Basic description:}

    There we want to simulate the Sierpinski triangle using random computational methods.
    In that case, we will choose some random points on the surface.
    Then we will transit the points with three transmission functions.
    For each point, we will do this operation P times.
    We must note that in each step,
    we will choose a random function for applying.
    Our functions are as follows:

    $f_{1} = [x, y] \div 2$

    $f_{2} = [x, y] \div 2 + [1, 0]$

    $f_{3} = [x, y] \div 2 + [0, 1]$

    \begin{figure}[!htb]
        \centering
        \includegraphics[scale = 0.1]{/Q4/RSPTp5num10000}
        \label{fig:4.1.1}
        \includegraphics[scale = 0.1]{/Q4/RSPTp500num10000}
        \label{fig:4.1.2}
        \caption{The of deployed points is 10000 and P is 5 and 500 respectively.}
    \end{figure}
    \begin{figure}[!htb]
        \centering
        \includegraphics[scale = 0.1]{/Q4/RSPTp5num100000}
        \label{fig:4.2.1}
        \includegraphics[scale = 0.1]{/Q4/RSPTp500num100000}
        \label{fig:4.2.2}
        \caption{The of deployed points is 100000 and P is 5 and 500 respectively.}
    \end{figure}
    \section*{Problem 5}
    \textbf{Basic description:}

    There we want to simulate the Sierpinski triangle using the Khayyam-Pascal's triangle.
    We know that if we separate the odd and even numbers of the Khayyam-Pascal's triangle we have the Sierpinski triangle.
    If we continue the Khayyam-Pascal's triangle up to $2^n$ ser stage our Sierpinski triangle will complete up to the nth stage.

    here is the results:

    \begin{figure}[!htb]
        \centering
        \includegraphics[scale = 0.05]{/Q5/SPTKP-O1}
        \label{fig:5.1.1}
        \includegraphics[scale = 0.05]{/Q5/SPTKP-O2}
        \label{fig:5.1.2}
        \includegraphics[scale = 0.05]{/Q5/SPTKP-O3}
        \label{fig:5.1.3}
        \caption{The Sierpinski triangle fractal. The $n$ equals 1, 2, and 3, respectively.}
    \end{figure}
    \section*{Problem 6}
    \textbf{Basic description:}

    There we want to simulate the Barnsley fern fractal using random computational methods.
    The method is the same as the random method for creating the Sierpinski triangle.
    Our functions are as follows:

    $f_{1}(x, y)=\left[\begin{array}{cc}0.00 & 0.00 \\ 0.00 & 0.16\end{array}\right]\left[\begin{array}{l}x \\ y\end{array}\right]$

    $f_{2}(x, y)=\left[\begin{array}{cc}0.85 & 0.04 \\ -0.04 & 0.85\end{array}\right]\left[\begin{array}{l}x \\ y\end{array}\right]+\left[\begin{array}{l}0.00 \\ 1.60\end{array}\right]$

    $f_{3}(x, y)=\left[\begin{array}{cc}0.20 & -0.26 \\ 0.23 & 0.22\end{array}\right]\left[\begin{array}{l}x \\ y\end{array}\right]+\left[\begin{array}{l}0.00 \\ 1.60\end{array}\right]$

    $f_{4}(x, y)=\left[\begin{array}{cc}-0.15 & 0.28 \\ 0.26 & 0.24\end{array}\right]\left[\begin{array}{l}x \\ y\end{array}\right]+\left[\begin{array}{l}0.00 \\ 0.44\end{array}\right]$

    \begin{figure}[!htb]
        \centering
        \includegraphics[scale = 0.1]{/Q6/RandomBarnsleyFern-p10num10000}
        \label{fig:6.1.1}
        \includegraphics[scale = 0.1]{/Q6/RandomBarnsleyFern-p100num10000}
        \label{fig:6.1.2}
        \caption{The of deployed points is 10000 and P is 10 and 100 respectively.}
    \end{figure}
    \begin{figure}[!htb]
        \centering
        \includegraphics[scale = 0.1]{/Q6/RandomBarnsleyFern-p10num1000000}
        \label{fig:6.2.1}
        \includegraphics[scale = 0.1]{/Q6/RandomBarnsleyFern-p100num1000000}
        \label{fig:6.2.2}
        \caption{The of deployed points is 1000000 and P is 10 and 100 respectively.}
    \end{figure}
\end{document}


\documentclass[12pt]{amsart}
\usepackage{geometry} % see geometry.pdf on how to lay out the page. There's lots.
\usepackage{bsymb}
\usepackage{unitb}
\usepackage{calculational}
\usepackage{ulem}
\usepackage{hyperref}
\normalem
\geometry{a4paper} % or letter or a5paper or ... etc
% \geometry{landscape} % rotated page geometry

% See the ``Article customise'' template for some common customisations

\title{}
\author{}
\date{} % delete this line to display the current date

%%% BEGIN DOCUMENT
\setcounter{tocdepth}{4}
\begin{document}

\maketitle
\tableofcontents

\newcommand{\G}{\text{G}}
\renewcommand{\H}{\text{H}}

\section{Initial model}
\begin{machine}{m0}

\with{functions}
\with{sets}
\with{intervals}
\newset{\G}

\begin{align*}
& \variable{p,q : \Int }
\\ & \variable{qe : \Int \pfun \G }
\\ & \variable{ emp : \Bool }
\\ & \variable{ res : \G }
\end{align*}

\begin{align*}
\invariant{m0:inv0}{ qe &\1\in \intervalR{p}{q} \tfun \G }
% \invariant{m0:inv0}{ \dom.qe = \intervalR{p}{q} }
\\ \invariant{m0:inv1}{ p &\1\le q }
\end{align*}

\begin{align*}
\initialization{m0:init0}{p = 0 \land q = 0 \land qe = \emptyfun }
\end{align*}

\newevent{m0:push:left}{push\_left}
\param{m0:push:left}{x : \G}

\begin{align*}
\evassignment{m0:push:left}{m0:act0}{ qe' &\2= qe \2| p\0-1 \fun x }
\\ \evassignment{m0:push:left}{m0:act1}{ p' &\1= p-1 }
\\ \evassignment{m0:push:left}{m0:act2}{ q' &\1= q }
\\ \evassignment{m0:push:left}{m0:act3}{ res' = res }
\\ \evassignment{m0:push:left}{m0:act4}{ emp' = emp }
\end{align*}

\newevent{m0:push:right}{push\_right}
\param{m0:push:right}{ x : \G }

\begin{align*}
\evassignment{m0:push:right}{m0:act0}{ qe' &\2= qe \2| q \fun x }
\\ \evassignment{m0:push:right}{m0:act1}{ p' & \1= p }
\\ \evassignment{m0:push:right}{m0:act2}{ q' & \1= q+1 }
\\ \evassignment{m0:push:right}{m0:act3}{ res' = res }
\\ \evassignment{m0:push:right}{m0:act4}{ emp' = emp }
\end{align*}

\newevent{m0:pop:left}{pop\_left}

\begin{align*}
\evassignment{m0:pop:left}{m0:act0}{ qe' &\1= \{ p \} \domsub qe }
\\ \evassignment{m0:pop:left}{m0:act1}{ p' &\1= p+1 }
\\ \evassignment{m0:pop:left}{m0:act2}{ q' &\1= q }
\\ \evguard{m0:pop:left}{m0:grd0}{ p < q }
\\ \evassignment{m0:pop:left}{m0:act3}{ (p = q \land res' = res) \lor (p < q \land res' = qe.p) }
\\ \evassignment{m0:pop:left}{m0:act4}{ emp' = (p = q) }
\end{align*}

\newevent{m0:pop:right}{pop\_right}

\begin{align*}
\evassignment{m0:pop:right}{m0:act0}{ qe' &\1= \{ q-1 \} \domsub qe }
\\ \evassignment{m0:pop:right}{m0:act1}{ p' &\1= p }
\\ \evassignment{m0:pop:right}{m0:act2}{ q' &\1= q-1 }
\\ \evguard{m0:pop:right}{m0:grd0}{ p &< q }
\\ \evassignment{m0:pop:right}{m0:act3}{ (p = q \land res' = res) \lor (p < q \land res' = qe.(q\1-1)) }
\\ \evassignment{m0:pop:right}{m0:act4}{ emp' = (p = q) }
\end{align*}

% \begin{align*}
\input{m0_m0-push-left}
% \end{align*}

\end{machine}

\newcommand{\REQ}{\text{REQ}}

\begin{machine}{m1}
\refines{m0} \\
\newset{\REQ}

\[ \variable{pshL,pshR : \REQ \pfun \G} \]

\hide{ \dummy{r : \REQ}; \dummy{x : \G} }
\begin{align*}
\progress{m1:prog0}
	{ r \in \dom.pshL \1\land pshL.r = x }
	{ p < q \land qe.p = x \1\land \neg r \in \dom.pshL }
\\ \progress{m1:prog1}
	{ r \in \dom.pshR \1\land pshR.r = x }
	{ p < q \1\land qe.(q-1) = x \1\land \neg r \in \dom.pshR }
\end{align*}

\indices{m0:push:left}{ r : \REQ }
\indices{m0:push:right}{ r : \REQ }
\begin{align*}
\refine{m1:prog0}{ensure}{m0:push:left}{ \index{r}{r'=r} }
\end{align*}
\begin{align*}
\\ \evassignment{m0:push:left}{m1:a0}{ pshL' = \{ r \} \domsub pshL }
\\ \evassignment{m0:push:left}{m1:a1}{ pshR' = pshR }
\\ \evassignment{m0:push:right}{m1:a0}{ pshR' = \{ r \} \domsub pshR }
\\ \evassignment{m0:push:right}{m1:a1}{ pshL' = pshL }
\\ \evguard{m0:push:left}{m1:grd0}{ x = pshL.r }
\\ \evguard{m0:push:left}{m1:grd1}{ r \in \dom.pshL }
\\ \cschedule{m0:push:left}{m1:sch0}{ r \in \dom.pshL }
\end{align*}
\begin{align*}
% \removecoarse{m0:push:left}{default} % \weakento{m0:push:left}{default}{m1:sch0}
\\ \evassignment{m0:pop:right}{m1:a0}{ pshL' = pshL }
\\ \evassignment{m0:pop:right}{m1:a1}{ pshR' = pshR }
\\ \evassignment{m0:pop:left}{m1:a0}{ pshL' = pshL }
\\ \evassignment{m0:pop:left}{m1:a1}{ pshR' = pshR }
\end{align*}

\begin{align*}
\refine{m1:prog1}{ensure}{m0:push:right}{ \index{r}{r'=r} }
\end{align*}

\begin{align*}
% \removecoarse{m0:push:left}{default} % \weakento{m0:push:left}{default}{m1:sch0}
\\ \cschedule{m0:push:right}{m1:sch0}{ r \in \dom.pshR }
\\ \evguard{m0:push:right}{m1:grd0}{ r \in \dom.pshR }
\\ \evguard{m0:push:right}{m1:grd1}{ pshR.r = x }
\end{align*}

\begin{align*}
\variable{ popR, popL : \set [\REQ]}
\end{align*}

\begin{align*}
\progress{m1:prog2}{ r \in popR }{ \neg r \in popR \land emp = (p = q) \land (emp \lor res = qe.(q\0-1))  }
\\ \progress{m1:prog3}{ r \in popL }{ \neg r \in popL \land emp = (p = q) \land (emp \lor res = qe.p)  }
\end{align*}
\begin{align*}
\refine{m1:prog2}{ensure}{m0:pop:right}{ \index{r}{r'=r} }
\end{align*}
% \refine{m1:prog3}{ensure}{m0:pop:left}{}
\indices{m0:pop:right}{ r : \REQ }
\begin{align*}
\cschedule{m0:pop:right}{m1:sch0}{ r \in popR }
% \\ \removecoarse{m0:pop:right}{default} % \weakento{m0:pop:right}{default}{m1:sch0}
\\ \evguard{m0:pop:right}{m1:sch0}{ r \in popR }
\\ \evassignment{m0:pop:right}{m1:a2}{ popR' = popR \setminus \{ r \} }
\\ \evassignment{m0:pop:right}{m1:a3}{ (emp' = (p = q)) \land (p < q \implies res' = qe.(q\0-1)) }
\end{align*}

\end{machine}

\input{m1_m0-push-right}

\end{document}