\chapter{Proving}
\graphicspath{ {./images/} }

In this and next chapter I will discuss how proving is done on a computer machine. Similarity of mathematical type structures and a programming language type system is to be understood thus explaining the theoretical correctness of afore mentioned equivalence.

\section{Hilbert-style deduction systems }
This is a kind of logic system \cite{hilbert_system}. The idea of a formal deduction says that there are mathematical formulaes or functions (for Input-Output generalization) which are either the base cases often called Axioms or are derived from some axioms by applying some hypotheses. Let $\Gamma$ be a set of pressumed contions and base cases (Axioms) and $\phi$ be deduction made using $\Gamma$ then we can write this as $\Gamma\vdash\phi$ meaning $\phi$ can be duduced and hence can be proved from $\Gamma$.

\begin{figure}[!htb]
\centering
  \includegraphics[scale=0.4]{hilbert}
  \caption{A Basic Deduction System (source : Wikipedia)}
\end{figure}

The Deduction system is well characterized by use of numerous Logical Axioms called an \textbf{Axiom Scheme}. It gives us a iterative and inductive nature of axiom deduction so that it can be extended as many step as one wish. The terms called \textit{Combinators} (like $\rightarrow$) that interweave the results of a set of a given Axiom Scheme and \textit{Quantifiers} (like $\forall$ ) generalize the results of axiom schemes using some quanitfiable data like the initial value of a mathematical function.

Using Combinators and Quantifiers one may easily reduce the deductions into less number of steps hence forming metatheorems. A metatheorem inmathematics is the one that can be achieved using some other very basic mathematical theorems. Thus the this gives us idea of correctness of untyped $\lambda$ -calculus. We can thus extend this to other objects also. Below I have tried to explain formation of a Hilbert-style deduction system for Abstract Binding Tree.\\

Professor \textbf{Robert Harper} in his book \textit{Practical Foundations of Programming Languages}\cite{pfpl} defines the term \textit{Judgement} 'J' defined on a set of rules 'R' defined for a type that satisfies a property 'P' (hence forming an Abstract Binding Tree ABT) and it follows an inductive definition

\[ \dfrac{J_1 J_2 J_3\cdots J_k}{J}\]

where each J$_i$ is some sort of pre-defined abstract judgements or base cases. The set R is a collection of all such J$_i$s. R is also referred to as an \textit{Axiom} if k=0 i.e it is just first judgement to be made. for example :

\[\dfrac{}{zero\quad nat} \quad \quad and \quad \dfrac{a\quad nat}{succ(a)\quad nat}  \]

He explains \textit{Derivabilty} Judjement J$_1$...J$_k$$\vdash$$_R$ K for a given set of rules 'R', with J$_i$ and K as basic judgements to show that we may derive K from the expansion of R$\cup$\{J$_1$...J$_k$\} of the rules with axioms

\[ \dfrac{}{J_1} \quad \dfrac{}{J_2} \quad  \dfrac{}{J_3} \quad \cdots \quad \dfrac{}{J_k}   \]

$\Gamma\vdash$$_R$K means that a Judgement K is derivable from rules R$\cup\Gamma$.

He defines \textit{Admissibility} Judgement written as $\Gamma\models_R$J, that if there exists any judgement like $\vdash$$_R$$\Gamma$ then it implies $\vdash$$_R$ J . It means that if all the assumptions (base cases) are derivable from R then J is derivable from R.

The mathemetical formalization of static part and dynamic part of a typed programming language is expressed in the form of the judgements.

The static feature of a language imposes constraints on the formation of the phases that are sensitive to the context in which thay occur. It follows an induction definiton like this

\[\chi | \Gamma\vdash e:\tau\]

where $\chi$ is a finite set of variables and $\Gamma$ is a typing context consisting of hypothesis of the form x:$\tau$, one for each $x\in\chi$. The Dynamics feature basically means the transition of states expressed in form of \textit{Transition} Judgement having a transition $s\longmapsto^n s'$ (for n$^{th}$ order transition) as

\[\dfrac{}{s\longmapsto^n s'} \quad \quad and \quad \dfrac{{s\longmapsto s'} \quad {s'\longmapsto^{*} s"}}{s\longmapsto^{*} s"}  \]

It is important to note that all this operations are performed on pressumed abstract mathematical objects, Abstract Binding Trees (ABTs) which are also the most important fundamental part of any type system. This theoretical equivalence thus allows us to construct the static and dynamic rules and some derived Judgements or abstract functions (with type correctness) for a programming language. A very good hand on experience can be found in the books Software Foundations \cite{Softwarefoundations} and Certified Proframming with Dependent Types \cite{cpdt}.

\section{Curry-Howard Correspondence }
In programming language theory the \textbf{Curry–Howard correspondence}\cite{curry_howard} (also known as the Curry–Howard isomorphism ) says that mathematical proofs and computer programs are equivalent. This equivalence depends on \textit{Axiom Schemes} with a Type as a combinator. It also follows the \textit{Combinatory Logic System} that allows removing a mentioned variable using some 'ways'. These ways also called functions and they use some combinators to define a result from given arguments. Then it assumes the correctness of Typed-$\lambda$ Calculus.

Let's assume a function $F$ that has a Type defined by set of rules $R$ and some set of initial conditions J$_i$ (i=1$\cdots n$) then we can write :

\[F \quad \equiv \quad J_{1 \cdots n}\vdash_R \lambda \quad (\lambda \mbox{ is the result of function that also has a Type defined by R.}) \]

A computer program is a set of such functions and a computer aided proof is a computer program. Thus it can be derived that "\textit{A computer Proof is a program with the thesis being proved is type for that program}" . Thus this forms the basis of proof assistants and Functional Programming.

\section{Hoare Logic}
It \cite{hoare_logic} is a logic system of formal rules to rigorously reason for the corectness of computer programs. The central feature of Hoare logic is the \textit{Hoare triple}. A triple describes how the execution of a piece of code changes the state of the computation. A Hoare triple is of the form

   \[\mbox{  \{ P \} C \{ Q \} }\]

where P and Q are some 'Quantifiable' assertions and C is a command. P is named the \textit{Precondition} and Q is called as the \textit{Postcondition}. It follows then that, when the precondition is met, executing the command should establish the postcondition. It's basic structure is developed on basis of Axiomatic and Inference rules that are able to reason for concurrency, Procedures, Jumps and Pointers.

\section{Separation Logic}
This logic system \cite{separation_logic} is an extension of Hoare system and describes states (as an analogue to basic Axioms in hoare system) as the store or heap, roughly corresponding to the local variables and stack allocated objects. The states are valid if there exists actual physical address (valid register is present) for that state. The vaious functions basically maps the different states onto one another. The correctness of this transformation is extensively under this logic system. All the data structures are treated in the formal system using separation logic system.


\section{Magnus expansion for $A$, $B$ constant and deterministic}
\subsection{Values of Moments}
	\input{C:/Users/kevin/Documents/MATLAB/PhD/Magnus/Final/Correction/AB_const_moment/Pdf/temp/moment_Delta0.0001_M1000.tex}


\newpage
\section{Thermal Analysis MATLAB Code} \label{sec:appJ}
\subsection{Convection MATLAB Code}

\lstinputlisting[language=Matlab]{appendix/code/thermal/convecTUBULAR_2.m}
%\inputminted{matlab}{appendix/code/convecTUBULAR_1.m}

The resulting $h-ratio$ is then applied to the value of K in the main script written below:

\subsection{Main Thermal MATLAB Code}

\lstinputlisting[language=Matlab]{appendix/code/thermal/TUBULAR_v_1_5.m}
%\inputminted{matlab}{appendix/code/TUBULAR_v_1_4.m}

%The code will be uppdated but nice you have a way of get it into the SED looks good ^^
%Shall make it look pretty during the weekend only ;)


\input{PreambleCommon}
\input{../WeekTitles}

\begin{document}
\setfont
\pagestyle{fancy}
\renewcommand{\Week}{7 }
\renewcommand{\WeekTitle}{\WeekTitleSeven }

\fancyhead[LE,RO]{Week \Week}  % default, usually only for first page
\fancyfoot{}
\sectionbox{Week \#\Week: \WeekTitle}

\vspace{5mm}
\noindent

\goals
\begin{itemize}
\item Determine how to calculate the area described by a function. WITH AN EDIT
\item Define the {\bf definite integral}.
\item Explore the relationship between the definite integral and area.
\item Explore ways to estimate the definite integral.
\end{itemize}

\newpage

\topic{Integration}
\subsection*{Integration}
If we had to summarize the first half of
the course, we would have to say that the focus was on {\bf
  differentiation}.

All differentiation problems ask the same basic question: {\bf At what
  rate does a process change}, and how does that rate of change relate
to other characteristics of the process?

The key observation was that {\bf at small scales, rates of change look linear}.

\newpage

In the remainder of the course we will study {\bf integration}.
Again, the analysis will be made possible by the observation that on a very
small scale all processes look linear.  This time, though, we will use
this fact to see how regarding a process as an {\bf accumulation} of
infinitely many small linear steps allows us to calculate the
accumulated total even when the rate of accumulation is far from
linear.  {\bf Integration is always in some way about finding the
  total at the end of a process of accumulation.}

\newpage

 \topic{Distance and Velocity}
 \subsection*{Distance and Velocity}

 Recall that if we measure distance $x$ as a function of time $t$, the
 velocity is determined by differentiating $x(t)$:
 \begin{center}
{\bf Velocity} is the {\bf slope} on the {\bf position graph}.
 \end{center}

 But now suppose we begin with a {\bf graph of the velocity} with
 respect to time.  How can we determine what {\bf distance} will be
 traveled?  Does distance also ``appear'' in the velocity graph
 somehow?

\newpage

\problem
 Consider the graph for the velocity of a particle shown below.
\begin{center}
\includegraphics[width=0.25\linewidth]{graphics/w07_const_velocity}
\end{center}
How far did the particle travel between $t=0$ and $t=5$ seconds?
\begin{enumerate}[(a)]
\item 5 m\\[1ex]
\item 10 m\\[1ex]
\item 15 m\\[1ex]
\item 20 m
\end{enumerate}

\newpage
\problem
~
\begin{center}
\includegraphics[width=0.25\linewidth]{graphics/w07_const_velocity}
\end{center}

Where does the distance travelled between $t=0$ and $t=5$ ``appear''
on this velocity graph?
\begin{enumerate}[(a)]
\item The distance travelled is the {\bf slope} between $t=0$ and $t=5$  \\[1ex]
\item The distance travelled is the {\bf average height} of the graph between $t=0$ and $t=5$  \\[1ex]
\item The distance travelled is the {\bf area} under the graph between $t=0$
  and $t=5$.
\end{enumerate}

\newpage

When the velocity is {\bf constant}, we have the equivalency:
\vspace{0.2in}
\begin{center}
dist = vel $\times$ time ~~~~ $\Longleftrightarrow$ dist = area under the velocity graph
\end{center}
\vspace{0.2in}

\problem
What about when the velocity is {\bf not} constant though?

\begin{center}
\includegraphics[width=0.35\linewidth]{graphics/w07_variable_velocity}
\end{center}

Do the units of the ``area'' under this graph still make sense as a
distance value?

\vfill
\newpage
 \topic{Calculating Areas}
\subsection*{Calculating Areas}

It appears that the distance traveled is the area under the graph of
velocity, even when the velocity is changing. We'll see exactly why
this is true very soon.

If we are simply interested in the area under a graph, without any
physical interpretation, we can already do so if the graph creates a
shape that we recognize.
\newpage

\problem Calculate the area between the $x$-axis and the graph of $y = x+1$ from $x=-1$ and $x=1$.

\hfill \includegraphics[width=0.25\linewidth]{graphics/w07_linear_area}
\newpage

\problem Calculate the area between the $x$-axis
and the graph of $y = \sqrt{1 - x^{2}}$ from $x = -1$ to $x = 1$.

\hfill \includegraphics[width=0.3\linewidth]{graphics/w07_semi_circle_area}

\vfill

\problem What shapes do you know, right now, for which you can
calculate the exact area?

\vfill

\newpage

\topic{Estimating Areas}
\subsection*{Estimating Areas}

Unfortunately, many or most arbitrary areas are essentially impossible
to find the area of when the shape isn't a simple composition of
triangles, rectangles, or circles.

In these cases, we must use less direct methods.  We will start by
making an {\em estimate} of the area under the graph using shapes
whose area is easier to calculate.

\newpage

\problem Suppose we are trying to find the area underneath the graph of the
function $f(x)$ given below between $x = 1$ and $x=4$.  Shade in that
region, and call that area $A$.

\begin{center}
\includegraphics[width=4in]{graphics/w07_graph06}
\end{center}

\newpage
We can make a rough estimation of the area by drawing a rectangle that
completely contains the area, or a rectangle that is completely
contained by the area.

\problem
{Calculate this overestimate and underestimate for the
  area $A$.}

\hfill \includegraphics[width=4in]{graphics/w07_graph06}

\newpage The next step is to use smaller rectangles to improve our
estimate the area.  We can divide the interval from $x = 1$ to $x = 4$
into 3 intervals of width 1, and use different size rectangles on each
interval.

\problem Estimate the area $A$ by using 3 rectangles of width 1.
  Use the function value at the {\em left} edge of the interval as the
  height of each rectangle.

\hfill \includegraphics[width=0.43\linewidth]{graphics/w07_graph06}

\newpage

We can repeat this process for any number of rectangles, and we expect
that our estimation of the area will get better the more rectangles we
use.  The method we used above, choosing for the height of the
rectangles the function at the left edge, is called the {\bf left hand
  sum}, and is denoted {\em LEFT(n)} if we use $n$ rectangles.

\newpage

\topic{Generalizing Area Calculation with Summation Notation}
\subsection*{Generalizing the Area Calculation}

Suppose we are trying to estimate the area under the function $f(x)$
from $x = a$ to $x = b$ via the left hand sum with $n$ rectangles.
\begin{itemize}
\item the {\bf width} of each rectangle will be $\Delta x =
\displaystyle\frac{b-a}{n}$.
\item If we label the endpoints of the
intervals to be $a = x_{0} < x_{1} < \cdots < x_{n-1} < x_{n} = b$,
then the {\bf heights} of the rectangles will be $f(x_{i})$'s, and
\item the formula for the left hand sum/area will be
\end{itemize}

\begin{align*}
  LEFT(n) = & f(x_{0}) \Delta x+
 f(x_{1}) \Delta x + \ldots +
 f(x_{n-1}) \Delta x
\\  = & \displaystyle\sum_{i=1}^{n} f(x_{i-1})\Delta x.
\end{align*}

\newpage

\subsection*{Aside: Summation Notation}

The capital greek letter sigma, $\sum$, is used as a shortform notation for long sums.
E.g.
$$\ds \sum_{i=1}^n x_i$$

\newpage
\problem
Translate the following into more traditional sums:

$\ds \sum_{i=1}^{100} i= $ \vfill

$\ds \sum_{n=1}^{10} n^2 + n= $  \vfill

$\ds \sum_{i=1}^{n}  f(x_{i-1}) ~\Delta x= $
\vfill

\newpage
\topic{Back to Areas!}
\subsection*{Back to Areas!}

Thinking back to our LEFT sum to estimate areas, we have a similar
definition for the {\bf right hand sum}, or {\em RIGHT(n)}. This is
calculated by taking the height of each rectangle to be the height of
the function at the {\bf right hand endpoint} of the interval.

\begin{align*}
RIGHT(n) = & f(x_{1}) \Delta x+
f(x_{2}) \Delta x + \ldots +
 f(x_{n}) \Delta x \\
= &  \displaystyle\sum_{i=1}^{n} f(x_{i})\Delta x.
\end{align*}

\bigskip

\newpage

{Calculate LEFT(6) and RIGHT(6) for the function shown,
  between $x=1$ and $x=4$.  You will need to estimate some rectangle
  heights from the graph.}

\includegraphics[width=0.4\linewidth]{graphics/w07_graph06}
\hfill \includegraphics[width=0.4\linewidth]{graphics/w07_graph06}
\newpage

%{In general, when will LEFT(n) be greater than RIGHT(n)? }
%\vfill
%
%{ When will LEFT(n) be an overestimate for the
%  area?}  \vfill
%
%{ When will LEFT(n) be an underestimate?}
%
%\vfill
%
%\newpage

\topic{Riemann Sums}
\subsection*{Riemann Sums}

Area estimations like $LEFT(n)$ and $RIGHT(n)$ are often called {\bf
  Riemann sums}, after the mathematician Bernahrd Riemann (1826-1866)
who formalized many of the techniques of calculus.  The general form
for a Riemann Sum is

\begin{align*}
 f(x_{1}^{*}) \Delta x+ f(x_{2}^{*}) \Delta x + \ldots + f(x_{n}^{*}) \Delta x
 \\ = \displaystyle\sum_{i=1}^{n} f(x_{i}^{*})\Delta x
\end{align*}

where each $x_{i}^{*}$ is some point in the interval $[x_{i-1},
x_{i}]$.  For $LEFT(n)$, we choose the left hand endpoint of the
interval, so $x_{i}^* = x_{i-1}$; for $RIGHT(n)$, we choose the right
hand endpoint, so $x_{i}^* = x_{i}$.  \newpage

The common property of all these
approximations is that they involve
\begin{itemize}
\item a sum of rectangular areas, with \\[1ex]
\item widths ($\Delta x$), and \\[1ex]
\item heights ($f(x_i^*)$)
\end{itemize}

There are other Riemann Sums that give slightly better estimates of
the area underneath a graph, but they often require extra computation.
We will examine some of these other calculations a little later.

\newpage

\topic{The Definite Integral}
\subsection*{The Definite Integral}

We observed that as we increase the number of rectangles used to
approximate the area under a curve, our estimate of the area under the
graph becomes more accurate.  This implies that to obtain the {\bf
  exact area}, we should use a {\bf limit} on our Riemann sums.

\medskip
\begin{center}
The area underneath the graph of $f(x)$ between $x=a$ and $x=b$ is equal to $\displaystyle\lim_{n \to \infty} LEFT(n) =
\displaystyle\lim_{n \to \infty} \displaystyle\sum_{i=1}^{n} f(x_{i-1})\Delta x$, ~~~where $\Delta x = \displaystyle\frac{b-a}{n}$.
\end{center}

This limit is called the {\em definite integral} of $f(x)$ from $a$ to $b$, and is equal to the area under curve whenever $f(x)$ is a non-negative continuous function.  The definite integral is written with some special notation.

\newpage

  {\bf{Notation for the Definite Integral}}

  The definite integral of $f(x)$ between $x=a$ and
  $x=b$ is denoted by the symbol $$\int_{a}^{b} f(x) \,dx$$
  We call $a$ and $b$ the {\bf{limits of integration}} and $f(x)$ the
  {\bf{integrand}}.  The $dx$ denotes which variable we are using; this will become important for using some techniques for calculating definite integrals.
Note that this notation shares the same common structure with Riemann sums:
\begin{itemize}
\item a sum ($\ds \int $ sign) \\[1ex]
\item widths ($dx$), and \\[1ex]
\item heights ($f(x)$)
\end{itemize}

\newpage

\problem Write the definite integral representing the area underneath
  the graph of $f(x) = x + \cos x$ between $x=2$ and $x=4$.

\vfill

\newpage

\problem
  Use a right hand sum with $n=4$ to estimate $\displaystyle
  \int_{0}^{2}x^2\,dx$.

\newpage

\vfill Sketch how the $n=$ right hand sum calculation would be
represented graphically, and how it differs from the exact value of
$\ds \int_0^2 x^2~dx$.

\includegraphics[width=0.3\linewidth]{graphics/w07_parabola_for_areas}
\hfill
\includegraphics[width=0.3\linewidth]{graphics/w07_parabola_for_areas}

\newpage

% You can get MuPAD to draw the diagram associated with the midpoint
% rule for this integral by first creating the plot object for the graph:

% [\, {\bf GRPH := plot::Function2d(x$\wedge$2, x=0..2)}

% and then use this graph to produce the plot object for the midpoint rule with 4 intervals:

% [\, {\bf RECTS := plot::Integral(GRPH, IntMethod=RiemannMiddle, Nodes=[4])}

% You can then show them together by typing

% [\, {\bf plot(GRPH, RECTS)}

% The values of the Riemann sum and the integral are automatically printed on the diagram.

%\newpage

\topic{Negative Integral Values}
\subsection*{Negative Integral Values}

So far we have only dealt with the areas under/intergrals of {\bf
  positive} functions.  Will the definite integral still be equal to
the area underneath the graph if $f(x)$ is always negative?  What
happens if $f(x)$ crosses the $x$-axis several times?

\problem Suppose that $f(x)$ has the graph shown below, and that A, B,
  C, D, and E are the areas of the regions shown.

\begin{center}
\includegraphics[width=0.6\linewidth]{graphics/w07_negative_area_example}
\end{center}

\newpage
\begin{center}
\includegraphics[width=0.4\linewidth]{graphics/w07_negative_area_example}
\end{center}

If we were to partition $[a,b]$ into small subintervals and construct a corresponding Riemann sum, then the first few terms in the Riemann sum would correspond to the region with area A, the next few to B, etc.

\problem
Which of these sets of terms have positive values?

\vfill

Which of these sets have negative values?
\vfill

\newpage

\begin{center}
\includegraphics[width=0.3\linewidth]{graphics/w07_negative_area_example}
\end{center}
\problem
{Express the integral $\displaystyle \int_a^b f(x) dx$ in
  terms of the (positive) areas A, B, C, D, and E.  }

\vfill
\vfill

{If $f$ were to represent velocity over time, what would the ``negative
  areas'' represent?}

\vfill
\newpage

%\newpage
% \problem
% The answer we found in the preceding question is
% \begin{enumerate}[A.]
% \item An underestimate because the first rectangle is very small.
% \item An overestimate because this is an increasing function.
% \item An underestimate because the graph of $f$ is concave upward.
% \item An overestimate because we used the midpoints.
% \end{enumerate}
%

\newpage
\begin{boxnote}
{\bf The Role of Riemann sums}
\begin{enumerate}
\item They are needed to say what we mean by an integral. \\[2ex]
\item They enable us to decide which integral is appropriate in a word
problem. \\[2ex]
\item They can also be used to give an approximate value of the
integral.
\end{enumerate}
\end{boxnote}

\vspace{0.5in}

We will explore how to avoid needing Riemann sums for calculations next week, through the Fundamental Theorem of Calculus!

\end{document}


w\subsection{Logical theories}\label{subsec:logical_theories}

\begin{definition}\label{def:first_order_theory}\mcite[def. 17.1]{OpenLogicFull}
  The \term{closure} of the set \( \Gamma \) of formulas in the \hyperref[def:first_order_syntax]{first-order language} \( \mscrL \) is the set
  \begin{equation*}
    \cl(\Gamma) \coloneqq \set{ \varphi \in \boldop{Form} \given \Gamma \vDash \varphi }.
  \end{equation*}

  Due to \fullref{rem:propositional_logic_as_first_order_logic}, this definition also holds for formulas in propositional logic.

  The set \( \Gamma \) is called \term{closed} if it equals its own closure. A closed set of closed formulas is also sometimes called a \term{theory} in e.g. \cite[def. 33.1]{OpenLogicFull}, but we will not put this restriction because it is not clear what are the axioms of an arbitrary closed set of formulas. Instead, we will use the term \enquote{theory} to mean the set of axioms itself.

  As discussed in \fullref{rem:deduction_with_free_variables}, we are only interested in closed formulas. If a formula is not closed, we instead consider its \hyperref[thm:implicit_universal_quantification]{universal closure}.

  If it is necessary to distinguish between derivability and entailment, we can use the syntactic closure \( \cl^\vdash \) and semantic closure \( \cl^\vDash \).

  \begin{thmenum}
    \thmitem{def:first_order_theory/axiomatized}\mcite[def. 17.1]{OpenLogicFull} We say that the set \( \Gamma \) is \term{axiomatized} by \( \Delta \) if \( \Gamma = \cl(\Delta) \).

    \medskip

    \thmitem{def:first_order_theory/complete}\mcite[def. 33.7]{OpenLogicFull} The set \( \Gamma \) of formulas is said to be \term{complete} if every for every formula in \( \varphi \), either \( \Gamma \vDash \varphi \) or \( \Gamma \vDash \neg \varphi \).

    This is not to be confused with \fullref{def:derivability_and_satisfiability/completeness}, which defines completeness of a deductive system via how it relates to semantics.
  \end{thmenum}
\end{definition}

\begin{definition}\label{def:first_order_theory_consistency}\mcite[def. 22.6]{OpenLogicFull}
  Given a deductive system, the set \( \Gamma \) of formulas is said to be \term[bg=противоречива,ru=противоречивая]{inconsistent} if \( \Gamma \vdash \bot \) and \term{consistent} otherwise.
\end{definition}

\begin{proposition}\label{thm:formulas_unsatisfiable_iff_inconsistent}
   Assuming \hyperref[def:classical_logic]{classical logic}, a theory \( \Gamma \) is \hyperref[def:propositional_semantics/satisfiability]{unsatisfiable} if and only if it is semantically \hyperref[def:first_order_theory_consistency]{inconsistent}.
\end{proposition}
\begin{proof}
  \SufficiencySubProof Assume first that \( \Gamma \) is unsatisfiable. Then for all zero models of \( \Gamma \) any formula is satisfied vacuously, in particular that any model of \( \Gamma \) satisfies \( \bot \). Thus, \( \Gamma \vDash \bot \) and, by \fullref{thm:classical_first_order_logic_is_sound_and_complete}, \( \Gamma \vdash \bot \). Therefore, \( \Gamma \) is inconsistent.

  \NecessitySubProof Let \( \Gamma \) be inconsistent and suppose that \( \mscrX = (X, I) \) is a model of \( \Gamma \). Fix any valuation \( v \) in \( \mscrX \). Since \( \Gamma \vdash \bot \), \fullref{thm:classical_first_order_logic_is_sound_and_complete} implies that \( \bot\Bracks{v} = T \).

  By the \hyperref[def:first_order_valuation/formula_valuation]{definition of formula valuation}, however, we have \( \bot\Bracks{v} = F \). The obtained contradiction shows that \( \mscrX \) cannot be a model of \( \Gamma \) and since this structure was chosen arbitrarily, we conclude that \( \Gamma \) is unsatisfiable.
\end{proof}

\begin{theorem}[First-order compactness theorem]\label{thm:first_order_compactness_theorem}\mcite[thm. 23.21]{OpenLogicFull}
  Assuming \hyperref[def:classical_logic]{classical logic}, for a theory \( \Gamma \) we have \( \Gamma \vDash \varphi \) for the closed formula \( \varphi \) if and only if there exists a finite subset of \( \Delta \subseteq \Gamma \) such that \( \Delta \vDash \varphi \).
\end{theorem}
\begin{proof}
  \SufficiencySubProof Suppose that \( \Gamma \vDash \varphi \). By \fullref{thm:classical_first_order_logic_is_sound_and_complete}, \( \Gamma \vdash \varphi \). Every \hyperref[def:proof_tree]{proof tree} is finite, and thus \( \varphi \) can be derived from only the finitely many premises \( \Delta \) of the proof. Then \( \Delta \vdash \varphi \) and, by the other direction of \fullref{thm:classical_first_order_logic_is_sound_and_complete}, we have \( \Delta \vDash \varphi \).

  \NecessitySubProof If \( \Delta \vDash \varphi \) for some finite \( \Delta \subseteq \Gamma \), then necessarily \( \Gamma \vDash \varphi \).
\end{proof}

\begin{corollary}\label{thm:first_order_compactness_theorem_satisfiability}\mcite[thm. 23.21]{OpenLogicFull}
  If every finite subset of \( \Gamma \) is satisfiable, then \( \Gamma \) itself is satisfiable.

  This is also called \enquote{the compactness theorem}.
\end{corollary}
\begin{proof}
  We can restate the theorem using its contraposition: If \( \Gamma \) is unsatisfiable, then there exists a finite subset \( \Delta \subseteq \Gamma \) that is also unsatisfiable. Due to \fullref{thm:formulas_unsatisfiable_iff_inconsistent}, this can be also restated as: If \( \Gamma \) is inconsistent, then there exists a finite subset \( \Delta \subseteq \Gamma \) that is also inconsistent.

  But the last formulation is a special case of \fullref{thm:first_order_compactness_theorem} with \( \varphi = \bot \).
\end{proof}

\begin{theorem}[Downward L\"owenheim-Skolem theorem]\label{thm:downward_lowenheim_skolem_theorem}\mcite{nLab:lowenheim_skolem_theorem}
  Let \( \Gamma \) be a \hyperref[def:first_order_theory]{first-order theory} over some arbitrary language. Suppose that \( \Gamma \) has a \hyperref[def:first_order_semantics/satisfiability]{model} of \hyperref[def:set_finiteness]{infinite} \hyperref[thm:cardinality_existence]{cardinality}.

  Then \( \Gamma \) also has a \hyperref[def:set_countability]{countable} model.
\end{theorem}

\begin{example}[Skolem's paradox]\label{ex:skolems_paradox}\mcite[ex. 23.32]{OpenLogicFull}
  From \fullref{thm:downward_lowenheim_skolem_theorem} it follows that \hyperref[def:zfc]{\logic{ZFC}}, if it is consistent, has a model at is at most countably infinite. The \hyperref[def:zfc/infinity]{axiom of infinity} states that no model of \logic{ZFC} is finite. Therefore, there exists a model of \logic{ZFC} that is countably infinite. But we can construct uncountable sets in \logic{ZFC}.

  Therefore, either:
  \begin{itemize}
    \item Uncountable sets within the metatheory are fundamentally different from those within the object theory.
    \item Uncountable sets are paradoxical and \logic{ZFC} must disallow them in order to be consistent.
    \item \logic{ZFC} is inconsistent even when restricted to countable sets.
  \end{itemize}
\end{example}

\begin{theorem}[Upward L\"owenheim-Skolem theorem]\label{thm:upward_lowenheim_skolem_theorem}\mcite{nLab:lowenheim_skolem_theorem}
  Let \( \Gamma \) be a \hyperref[def:first_order_theory]{first-order theory} over some arbitrary language. Suppose that \( \Gamma \) has a \hyperref[def:first_order_semantics/satisfiability]{model} of \hyperref[def:set_finiteness]{infinite} \hyperref[thm:cardinality_existence]{cardinality} \( \kappa \).

  Then for every \hyperref[def:set_finiteness]{infinite} \hyperref[def:cardinal]{cardinal} \( \mu \geq \card(\Gamma) \), the theory \( \Gamma \) also has a model of cardinality \( \mu \).
\end{theorem}

\begin{definition}\label{def:category_of_small_first_order_models}
  Let \( \mscrL \) be a first-order language and let \( \Gamma \) be a nonempty set of formulas. We describe the \term{categories of small models} for \( \Gamma \) as the \hyperref[def:concrete_category]{concrete category}. See \fullref{rem:positive_formulas_in_category_of_models} for why it is a reasonable restriction for \( \Gamma \) to be a set of \hyperref[def:positive_formula]{positive formulas}.

  Suppose that we are given a \hyperref[def:grothendieck_universe]{Grothendieck universe} \( \mscrU \), which is safe to assume to be the smallest suitable one as explained in \fullref{def:large_and_small_sets}.

  \begin{itemize}
    \item The \hyperref[def:category/objects]{set of objects} is the set of all \( \mscrU \)-small models of \( \Gamma \).

    \item The \hyperref[def:category/morphisms]{set of morphisms} between two models is the set of all \hyperref[def:first_order_homomorphism]{structure homomorphisms} between them.

    \item \hyperref[def:category/composition]{Composition of morphisms} is the usual \hyperref[def:multi_valued_function/composition]{function composition}.

    \item The \hyperref[def:category/identity]{identity morphism} on a model is the \hyperref[def:multi_valued_function/identity]{identity function} on its universe.
  \end{itemize}
\end{definition}

\begin{remark}\label{rem:positive_formulas_in_category_of_models}
  We usually want \( \Gamma \) to be a set of \hyperref[def:positive_formula]{positive formulas} because, in general, homomorphisms are not injective and the homomorphic image of a model may fail to be a model. \Fullref{thm:positive_formulas_preserved_under_homomorphism} shows that if all formulas in \( \Gamma \) are positive, the image of any homomorphism is again a model and thus an object in the category.
\end{remark}

\begin{example}\label{ex:def:category_of_small_first_order_models}
  This is an incomplete list of categories corresponding to \hyperref[def:first_order_theory]{first-order theories} that can be found in this document:
  \begin{itemize}
    \item The categories \hyperref[def:pointed_set/category]{\( \cat{Set_*} \)}, \hyperref[def:set_with_involution/category]{\( \cat{Inv} \)}, \hyperref[def:magma/category]{\( \cat{Mag} \)}, \hyperref[def:unital_magma/category]{\( \cat{Mag}_* \)}, \hyperref[def:unital_magma/monoid]{\( \cat{Mon} \)}, \hyperref[def:group/category]{\( \cat{Grp} \)} and \hyperref[def:abelian_group]{\( \cat{Ab} \)}, whose relations are crucial for the definition and properties of groups.

    \item The categories \hyperref[def:semiring/ring]{\( \cat{Ring} \)} of rings, \hyperref[def:semiring/ring]{\( \cat{Mod}_\mscrR \)} of modules and \hyperref[def:vector_space]{\( \cat{Vect}_\BbbK \)} of vector spaces, which are both based on abelian groups.

    \item The categories \hyperref[def:category_of_topological_groups]{\( \cat{TopGrp} \)} and \hyperref[def:category_of_topological_groups]{\( \cat{TopVect}_\BbbK \)} of topological groups and vector spaces, respectively.

    \item The categories \hyperref[def:partially_ordered_set/category]{\( \cat{Pos} \)} in order theory and the related \hyperref[def:semilattice/category]{\( \cat{Lat} \)}, \hyperref[def:heyting_algebra/category]{\( \cat{Heyt} \)} and \hyperref[def:boolean_algebra/category]{\( \cat{Bool} \)} in lattice theory.
  \end{itemize}

  In contrast:
  \begin{itemize}
    \item We define the category \hyperref[def:category_of_small_topological_spaces]{\( \cat{Top} \)}  of topological spaces and all of its related categories within set theory without a corresponding first-order theory.

    \item The category \hyperref[def:category_of_small_sets]{\( \cat{Set} \)} of sets with respect to either \logic{ZFC}, \logic{ZFC+U} or na\"ive set theory is not the same as the category of \( \mscrU \)-small models of set theory. Instead, it is a category within a fixed set theory. Within the metatheory of this document, we work within a fixed model of \logic{ZFC+U} with respect to \hyperref[def:classical_logic]{classical logic}.

    \item Similarly, we do not care about models of \hyperref[def:peano_arithmetic]{Peano arithmetic} enough to study its category of \( \mscrU \)-small models. Instead, we only use a single model and denote it by \( \BbbN \).
  \end{itemize}
\end{example}

\begin{definition}\label{def:lindenbaum_tarski_algebra}\mcite{nLab:lindenbaum_tarski_algebra}
  Assume some fixed \hyperref[def:deductive_system]{deductive system} in propositional or first-order logic. Let \( \Gamma \) be a \hyperref[def:first_order_theory]{closed set} of \hyperref[def:first_order_syntax/ground_formula]{closed formulas} within the corresponding logic.

  Then \( (\Gamma, \vdash) \) is a \hyperref[def:preordered_set]{preordered set}. The \term{Lindenbaum-Tarski algebra} of the theory \( \Gamma \) is the partially ordered set obtained from \( (\Gamma, \vdash) \) using \fullref{thm:preorder_to_partial_order}.

  More concretely, the Lindenbaum-Tarski algebra of \( \Gamma \) is a quotient set of \( \Gamma \) by the relation \hyperref[def:proof_derivability]{interderivability} and endowed with the partial order
  \begin{equation}\label{eq:def:lindenbaum_tarski_algebra/order}
    [\varphi] \leq [\psi] \T{if and only if} \varphi \vdash \psi.
  \end{equation}

  Of course, we can define the algebra using entailment rather than derivability, but in the cases we consider, the two are equivalent and derivability is simpler to work with.
\end{definition}
\begin{proof}
  The correctness of \eqref{eq:def:lindenbaum_tarski_algebra/order}, i.e. the fact that the relation \( \leq \) does not depend on the choice of representatives from the quotient sets, follows from \fullref{thm:preorder_to_partial_order}.

  We must only demonstrate that \( (\Gamma, \vdash) \) is indeed a preordered set. Reflexivity of \( \vdash \) follows from \fullref{def:axiomatic_deductive_system} and transitivity follows from \fullref{thm:deductive_system_transitivity}.
\end{proof}

\begin{proposition}\label{thm:intuitionistic_lindenbaum_tarski_algebra}
  Assume that we are working in the \hyperref[def:intuitionistic_propositional_deductive_systems]{intuitionistic propositional natural deduction system}. The \hyperref[def:lindenbaum_tarski_algebra]{Lindenbaum-Tarski algebra} of a closed set of closed formulas \( \Gamma \) then is a \hyperref[def:heyting_algebra]{Heyting algebra}.

  In the \hyperref[def:classical_propositional_deductive_systems]{classical derivation system}, the algebra is instead a \hyperref[def:boolean_algebra]{Boolean algebra}.

  In the \hyperref[def:minimal_propositional_axiomatic_deductive_system]{minimal derivation system}, we have an unbounded lattice with only a top element, but no bottom. Consequently, conditionals and pseudocomplements may fail to exist.

  Explicitly:
  \begin{thmenum}
    \thmitem{thm:intuitionistic_lindenbaum_tarski_algebra/join} The \hyperref[def:semilattice/join]{join} of the equivalence classes \( [\psi_1] \) and \( [\psi_2] \) is the class \( [\psi_1 \vee \psi_2] \) of their \hyperref[def:propositional_language/connectives/disjunction]{disjunction}.

    \thmitem{thm:intuitionistic_lindenbaum_tarski_algebra/top} The class of \hyperref[def:propositional_semantics/tautology]{tautologies} \( [\top] \) is the \hyperref[def:partially_ordered_set_extremal_points/top_and_bottom]{top element}.

    \thmitem{thm:intuitionistic_lindenbaum_tarski_algebra/meet} Similarly to joins, the \hyperref[def:semilattice/meet]{meet} of \( [\psi_1] \) and \( [\psi_2] \) is the equivalence class \( [\psi_1 \wedge \psi_2] \) of their \hyperref[def:propositional_language/connectives/conjunction]{conjunction}.

    \thmitem{thm:intuitionistic_lindenbaum_tarski_algebra/bottom} The class of \hyperref[def:propositional_semantics/contradiction]{contradictions} \( [\bot] \) is the \hyperref[def:partially_ordered_set_extremal_points/top_and_bottom]{bottom element}.

    \thmitem{thm:intuitionistic_lindenbaum_tarski_algebra/conditional} The \hyperref[eq:def:heyting_algebra/conditional]{conditional} of \( [\psi_1] \) and \( [\psi_2] \) is the equivalence class \( [\psi_1 \rightarrow \psi_2] \).

    \thmitem{thm:intuitionistic_lindenbaum_tarski_algebra/complement} The \hyperref[eq:def:heyting_algebra/pseudocomplement]{pseudocomplement} \( \widetilde{[\psi]} \) of \( [\psi] \) equals \( [\neg \psi] \).

    In the classical derivation system this pseudocomplement is a complement, i.e. it satisfies \eqref{def:bounded_lattice_complement/join} and \eqref{def:bounded_lattice_complement/meet}.
  \end{thmenum}
\end{proposition}
\begin{proof}
  \SubProofOf{thm:intuitionistic_lindenbaum_tarski_algebra/join} We will show that \( [\psi_1 \vee \psi_2] \) is the supremum of \( [\psi_1] \) and \( [\psi_2] \).

  The inference rule \eqref{eq:def:minimal_propositional_natural_deduction_system/or/intro_left} implies that \( \psi_1 \vdash \psi_1 \vee \psi_2 \) and \eqref{eq:def:minimal_propositional_natural_deduction_system/or/intro_right} implies that \( \psi_2 \vdash \psi_1 \vee \psi_2 \). Thus, \( \psi_1 \vee \psi_2 \) is an upper bound for both \( \psi_1 \) and \( \psi_2 \) under the ordering \( \vdash \).

  Let \( \varphi \) be any formula in \( \Gamma \) such that \( \psi_1 \vdash \varphi \), \( \psi_2 \vdash \varphi \) and \( \varphi \vdash (\psi_1 \vee \psi_2) \). Then the following instance of \eqref{eq:def:minimal_propositional_natural_deduction_system/or/elim}
  \begin{equation*}
    \begin{prooftree}
      \hypo{ [\psi_1 \vee \psi_2] }
      \hypo{ [\psi_1]^1 }
      \ellipsis {} { \varphi }
      \hypo{ [\psi_2]^1 }
      \ellipsis {} { \varphi }
      \infer[left label=\( 1 \)]3[\ref{eq:def:minimal_propositional_natural_deduction_system/or/elim}]{ \varphi }
    \end{prooftree}
  \end{equation*}
  demonstrates that \( \psi_1, \psi_2, (\psi_1 \vee \psi_2) \vdash \varphi \). Hence, from \fullref{thm:deductive_system_transitivity} it follows that \( (\psi_1 \vee \psi_2) \vdash \varphi \).

  Obviously interderivability is not affected by the choice of representatives from \( [\psi_1] \) and \( [\psi_2] \), hence \( [\varphi] = [\psi_1 \vee \psi_2] \) and this is indeed the supremum of \( [\psi_1] \) and \( [\psi_2] \).

  \SubProofOf{thm:intuitionistic_lindenbaum_tarski_algebra/top} The inference rule \eqref{eq:def:minimal_propositional_natural_deduction_system/top/intro} shows that \( [\varphi] \leq [\top] \) for any formula \( \varphi \) and \( [\top] \) is the top element.

  \SubProofOf{thm:intuitionistic_lindenbaum_tarski_algebra/meet} Let \( \psi_1 \) and \( \psi_2 \) be any formulas in \( \Gamma \). The inference rule \eqref{eq:def:minimal_propositional_natural_deduction_system/and/elim_left} implies that \( \psi_1 \wedge \psi_2 \vdash \psi_2 \) and \eqref{eq:def:minimal_propositional_natural_deduction_system/and/elim_right} implies that \( \psi_1 \wedge \psi_2 \vdash \psi_1 \). Thus, \( \psi_1 \wedge \psi_2 \) is a lower bound for both \( \psi_1 \) and \( \psi_2 \) under the ordering \( \vdash \).

  We must show that \( \psi_1 \wedge \psi_2 \) is interderivable with the greatest lower bound. Let \( \varphi \) be a formula in \( \Gamma \) such that \( \varphi \vdash \psi_1 \), \( \varphi \vdash \psi_2 \) and \( (\psi_1 \wedge \psi_2) \vdash \varphi \). We will show that \( \varphi \vdash (\psi_1 \wedge \psi_2) \).

  The rule \eqref{eq:def:minimal_propositional_natural_deduction_system/and/intro} implies that
  \begin{equation*}
    \psi_1, \psi_2 \vdash \psi_1 \wedge \psi_2.
  \end{equation*}

  But \( \varphi \) derives both \( \psi_1 \) and \( \psi_2 \), hence due to \fullref{thm:deductive_system_transitivity},
  \begin{equation*}
    \varphi \vdash (\psi_1 \wedge \psi_2).
  \end{equation*}

  Analogously to the proof of \fullref{thm:intuitionistic_lindenbaum_tarski_algebra/join}, we conclude that the choice of representatives of the equivalence classes is irrelevant and that \( [\varphi] = [\psi_1 \wedge \psi_2] \) is the infimum of \( [\psi_1] \) and \( [\psi_2] \).

  \SubProofOf{thm:intuitionistic_lindenbaum_tarski_algebra/bottom} That \( [\bot] \) is the bottom is a restatement of \eqref{eq:thm:minimal_propositional_negation_laws/efq}.

  \SubProofOf{thm:intuitionistic_lindenbaum_tarski_algebra/conditional} Restating \eqref{eq:def:heyting_algebra/conditional}, we must prove that \( [\psi_1 \rightarrow \psi_2] \) equals
  \begin{equation*}
    ([\psi_1] \rightarrow [\psi_2]) = \underbrace{\sup\set[\Big]{ [\varphi] \given* \varphi \in \Gamma \T{and} (\varphi \wedge \psi_1) \vdash \psi_2 }}_{\Phi}.
  \end{equation*}

  An equivalent condition for \( \varphi \) to be in \( \Phi \) is, due to \fullref{thm:conjunction_of_premises},
  \begin{equation*}
    \varphi, \psi_1 \vdash \psi_2.
  \end{equation*}

  Then by the deduction theorem,
  \begin{equation*}
    \varphi \vdash (\psi_1 \rightarrow \psi_2).
  \end{equation*}

  Thus, \( [\psi_1 \rightarrow \psi_2] \) is an upper bound of \( \Psi \).

  It remains to show that \( (\psi_1 \rightarrow \psi_2) \in \Psi \). Both \( \psi_1 \) and \( (\psi_1 \rightarrow \psi_2) \) follow from the formula \( \parens[\Big]{ (\psi_1 \rightarrow \psi_2) \wedge \psi_1 } \) and by applying \eqref{eq:def:def:axiomatic_deductive_system/mp}, we obtain
  \begin{equation*}
    \psi_1, (\psi_1 \rightarrow \psi_2) \vdash \psi_2.
  \end{equation*}

  From \fullref{thm:conjunction_of_premises},
  \begin{equation*}
    \parens[\Big]{ (\psi_1 \rightarrow \psi_2) \wedge \psi_1 } \vdash \psi_2.
  \end{equation*}

  Therefore, \( [\psi_1 \rightarrow \psi_2] \in \Phi \) and it is indeed the supremum of \( \Psi \).

  \SubProofOf{thm:intuitionistic_lindenbaum_tarski_algebra/complement} The pseudocomplement \( \widetilde{[\psi]} \) is, by definition,
  \begin{equation*}
    \widetilde{[\psi]}
    =
    [\psi] \rightarrow [\bot].
  \end{equation*}

  From what we have already proved, we can conclude that \( \widetilde{[\psi]} = [\psi \rightarrow \bot] \). From \fullref{def:minimal_propositional_axiomatic_deductive_system/negation} it follows that the formulas \( \psi \rightarrow \bot \) and \( \neg \psi \) are interderivable, thus \( \widetilde{[\psi]} = [\neg \psi] \).

  If we are working in classical logic where \eqref{eq:thm:minimal_propositional_negation_laws/lem} holds, then
  \begin{equation*}
    \sup\set{ [\psi], \widetilde{[\psi]} }
    \reloset {\ref{thm:intuitionistic_lindenbaum_tarski_algebra/join}} =
    [\psi \vee \neg \psi]
    \reloset {\eqref{eq:thm:minimal_propositional_negation_laws/lem}} =
    [\top],
  \end{equation*}
  which proves \eqref{def:bounded_lattice_complement/join}.

  The dual law \eqref{def:bounded_lattice_complement/meet}
  \begin{equation*}
    \inf\set{ [\psi], \widetilde{[\psi]} }
    \reloset {\ref{thm:intuitionistic_lindenbaum_tarski_algebra/meet}} =
    [\psi \wedge \neg \psi]
    \reloset {\eqref{eq:thm:minimal_propositional_negation_laws/lnc}} =
    [\neg \top]
    =
    \widetilde{[\top]}
    \reloset {\eqref{eq:def:heyting_algebra/pseudocomplement}} =
    [\bot].
  \end{equation*}
\end{proof}

\begin{remark}\label{rem:thm:intuitionistic_lindenbaum_tarski_algebra/syntactic_proof}
  Notice that the proof of \fullref{thm:intuitionistic_lindenbaum_tarski_algebra} relies entirely on the derivation system. On the other hand, we define \hyperref[def:propositional_heyting_algebra_semantics]{Heyting semantics} for intuitionistic formulas.

  Thus, we have shown that Heyting algebras arise naturally from the intuitionistic natural deduction system and that their role as a semantic framework is completely justified.
\end{remark}


%%#fixtex% for html/pdf   -*-latex-*-

\section{Fourier Transforms in {\ifeffit} } \label{App:Fourier}

This appendix describes and lists the conventions used for Fourier
transforms in {\ifeffit}.

\subsection{Fourier transform Conventions}\label{App:Fourier:overview}

Many of {\ifeffit}'s command use Fourier transforms (FT) to perform
their tasks.  In addition to {\cmnd{fftf}} and {\cmnd{fftr}}, which
are principly designed to do Fourier transforms, the commands
{\cmnd{chi\_noise}}, {\cmnd{feffit}}, and {\cmnd{spline}} all do (or
can do) Fourier transforms as part of their data processing.  The form
of the Fourier transform done by all these commands is the same, and
is really an XAFS-specific Fourier transform that converts {\chik}
into {\chir} in the forward direction and {\chir} into {\chiq} in the
reverse direction.  The XAFS-specific FT done by these commands will
be described in detail shortly.  For now, an important point to
emphasize is that all these commands share many arguments and grogram
variables describing the Fourier transforms.  These shared command
arguments and program variables are the topic of this section.

The forward XAFS Fourier transform, done with {\cmnd{fftf}}, transforms
{\chik} to {\chir}.  To do this, the {\chik} data is first multiplied by a
$k$-weighting factor of the form $k^w$ and a window function before the
actual Fast Fourier transform is performed.  The $k$-weighting factor $w$
is used to ``even out'' the decaying {\chik} function and to emphasize
different $k$-regions of the EXAFS in the resulting {\chir}.  Popular
choics for $w$ are 1, 2, and 3.

Formally, the XAFS Fourier transform can be written as
\begin{equation}
\tilde\chi(R) =  {{1}\over{\sqrt{2\pi}}} \int_{-\infty}^{\infty} {
         dk e^{i2kR} k^w \tilde\chi(k) \Omega(k) }
\end{equation}
\noindent
where $\Omega(k)$ is the window function, and $w$ is the $k$-weighting
factor.  The window function can take a variety of functional forms, all of
which rise from a small value (possible zero) at low-$k$, rise up to one,
and then fall back towards zero at high-$k$.  The window is intended to
smooth out any ringing in the resulting FT amplitude while maintaining as
much resolution as possible, and will be discussed in more detail in the
next section.

A discrete form of the above formula is actually used so that the Fast
Fourier Transform algorithm can be exploited.  The key point here is that
the data is sampled on a finite and {\emph{uniform}} grid in $k$ (or $R$
for the back-transform).  The $k$-space grid used throughout {\ifeffit} is
$\delta k=0.05 {\rm\,  \AA}^{-1}$.  The array sizes for {\chik} and {\chir}
are $N_{\rm fft} = 2048$, and the data is {\emph{zero-padded}} out to
high-$k$ (or high-$R$).  The zero-padding for {\chik} will smooth the data
points in $R$-space, and the zero-padding of {\chir} will smooth the data
in backtransformed-$k$-space.  The grid in $R$-space is $\delta R = \pi /
N_{\rm fft}\,\delta k$, which is then $\sim0.0307\,\rm\AA$.

For the discrete Fourier transforms, we write $k_n =n \delta k$ and $R_m = m
\,\delta R$, and have
\begin{equation}
\tilde\chi(R_m) = {{i \delta
    k}\over{\sqrt{\pi N_{\rm fft}}}}\, \sum_{n=1}^{N_{\rm fft}} \chi(k_n)
\, \Omega(k_n) \, k_n^w e^{2\pi i n m/N_{\rm fft}}
\end{equation}
\noindent
for the forward transform and
\begin{equation}
\tilde\chi(k_n) = {{2
    i \delta R}\over{\sqrt{\pi N_{\rm fft}}}}\, \sum_{m=1}^{N_{\rm fft}}
\tilde\chi(R_m) \, \Omega(R_m) \, e^{-2\pi i n m/N_{\rm fft}}
\end{equation}
\noindent
for the back transform.  These normalizations preserve the symmetry
properties of the Fourier Transforms with conjugate variables $k$ and $2R$.

There are few slight complication with these formulas.  The first arises
from the fact that because the classic EXAFS equation has a term of the
form ${e^{i2kR}}$ or $\sin(2kR)$, it customary to use $k$ and $2R$ as the
Fourier conjugate variables while still desiring the $R$ space function to
be a function of $R$.  This changes the normalization factors in front of
the integral to those above.

The other minor complication is that the ``measured'' {\chik} derived from
{\muE} and is a strictly real function while the Fourier transform
inherently treats {\chik} as complex functions, signified by the $\tilde{ }
$ above the $\chi$).  There is an ambiguity about how to construct the
complex $\tilde\chi(k)$.  In many formal treatments, the measured XAFS is
written as the imaginary part of some function, so that constructing
$\tilde\chi(k)$ as $(0, \chi_{\rm measured}(k))$ might seem a natural
choice.  For historical reasons, {\ifeffit} uses the opposite convention,
constructing $\tilde\chi(k)$ as $(\chi_{\rm measured}(k),0)$.  You can
easily override this default however and do transforms assuming {\chik} is
the imaginary part of $\tilde\chi(k)$.  Normally, one does a forward
transform with
\begin{verbatim}
  Iff> fftf(real = data.chi)
\end{verbatim}
\noindent
which sets $\tilde\chi(k)$ as $(\chi_{\rm data}(k),0)$. You can use
\begin{verbatim}
  Iff> fftf(imag = data.chi)
\end{verbatim}
\noindent
to  construct $\tilde\chi(k)$ as $(0,\chi_{\rm data}(k))$.

The Fourier transform requires that the $\chi(k)$ data begin at $k=0$.
More to the point, the {\cmnd{fftf}} command {\emph{assumes}} that the
supplied array for $chi$ starts at $k=0$ unless told otherwise.  It is
important to include the $k$-array with this keyword.  If not given, the
$\chi$ array will be assumed to have it's first point be $\chi(k=0)$, and
then to be input on an even $k$-grid with spacing $\rm0.05\,\AA$.

\subsection{Fourier transform window functions}\label{App:Fourier:windows}

There are seven optional forms for the Fourier transform window
$\Omega(k)$.  There is quite a bit of literature on the different windows,
and generally more opinion than justified reason for selecting one window
function over others.  I believe that all the window functions in
{\ifeffit} are appropriate and useful for EXAFS analysis.  My
recommendation is to pick one function and stick with it.  If you're unsure
about which one to pick, my favorites are the Hanning window (the default
in {\ifeffit}, largely for historical reasons) and the Kaiser-Bessel
window.  Again, I have not seen any objective rational for preferring any
other windows, and the choice is really a matter of taste.

The available window functions are described below, first in the table
giving a brief description, then with an equation for the window function,
and finally with a representative plot.  For simplicity, all are written as
functions of $k$.  The $R$-space windows are exactly analogous with
{\tt{k}} replaced by {\tt{r}}.

\begin{table}
  \begin{center}
    \caption[a]{Table of Fourier Transform Window Functions.  The first
      four windows list ramp up from 0 to 1 over a $k$-range defined by the
      {\tt{dk}} parameter, stay at 1 for some $k$-range, and then drop back
      down to zero.  The final three window functions apply a continuous
      function that may never go to zero over the entire $k$-range of the
      window.  For each window type, the Key in the second column gives the
      value to use for the {\tt{kwindow}} parameter of {\cmnd{fftf}}, or
      the {\tt{rwindow}} parameter of {\cmnd{fftr}}.  \smallskip }
    {\label{Table:FTwins}}
    \begin{tabular}{lll}
    \noalign{\smallskip}%
    {Window Name} & {Key} & Description  \\
    \noalign{\smallskip}    \hline    \noalign{\smallskip}
    Hanning            & {\tt{hanning}} &  ramps up and down as $\cos^2(k)$ \\
    Parzen             & {\tt{parzen}}  &  ramps up and down linear with $k$\\
    Welch              & {\tt{welch}}   &  ramps up and down linear with $k^2$\\
    \noalign{\smallskip}
    Sine               & {\tt{sine}}    &  a Sine function over the full $k$-range\\
    Gaussian           & {\tt{gaussian}}&  a Gaussian function over the full  $k$-range\\
    Kaiser-Bessel      & {\tt{kaiser}}  &  a modified Bessel function over the full $k$-range\\
    \noalign{\smallskip}    \hline
    \end{tabular}
  \end{center}
\end{table}

{\tt{altwindow}} names an alternative window {\bf{array}} is named with
   this keyword, overriding the `normal' window.  The array specified must be
   created before invoking {\tt{feffit}}.

%%#GraphicsFile%    win_hanning  WinHanning
% Anatomy of the Hanning Window.
\begin{figure}[tb] \begin{center}
  \includegraphics[width=2.75in,angle=-90]{figs/win_hanning.ps}
  \caption{ Anatomy of the Hanning Window.}\label{Fig:WinHanning}
\end{center} \end{figure}
%%#EndGraphics%

%%#GraphicsFile%    win_parzen  WinParzen
% Anatomy of the Parzen Window.
\begin{figure}[tb] \begin{center}
  \includegraphics[width=2.75in,angle=-90]{figs/win_parzen.ps}
  \caption{ Anatomy of the Parzen Window.}\label{Fig:WinParzen}
\end{center} \end{figure}
%%#EndGraphics%

%%#GraphicsFile%    win_welch  WinWelch
% Anatomy of the Welch Window.
\begin{figure}[tb] \begin{center}
  \includegraphics[width=2.75in,angle=-90]{figs/win_welch.ps}
  \caption{ Anatomy of the Welch Window.}\label{Fig:WinWelch}
\end{center} \end{figure}
%%#EndGraphics%

%%#GraphicsFile%    win_gauss  WinGauss
% Anatomy of the Gauss Window.
\begin{figure}[tb] \begin{center}
  \includegraphics[width=2.75in,angle=-90]{figs/win_gauss.ps}
  \caption{ Anatomy of the Gauss Window.}\label{Fig:WinGauss}
\end{center} \end{figure}
%%#EndGraphics%

%%#GraphicsFile%    win_kaiser  WinKaiser
% Anatomy of the Kaiser Window.
\begin{figure}[tb] \begin{center}
  \includegraphics[width=2.75in,angle=-90]{figs/win_kaiser.ps}
  \caption{ Anatomy of the Kaiser Window.}\label{Fig:WinKaiser}
\end{center} \end{figure}
%%#EndGraphics%

%%#GraphicsFile%    win_sine  WinSine
% Anatomy of the Sine Window.
\begin{figure}[tb] \begin{center}
  \includegraphics[width=2.75in,angle=-90]{figs/win_sine.ps}
  \caption{ Anatomy of the Sine Window.}\label{Fig:WinSine}
\end{center} \end{figure}
%%#EndGraphics%

%% {{\bigskip} \halign{\tolerance=8000 \hfuzz=5pt
%% \vtop{\parindent=0.25truein\hsize=1.00truein\tt\strut{\hfil#\hfil}\strut}&%
%% \vtop{\parindent=0.00truein\hsize=5.25truein\rm\strut{#}\strut}\cr
%% Ikwindo & Window Type and functional form  \cr
%% \noalign{\smallskip}
%% %%
%%   0  & Hanning Window Sills:  The Default Window Type.  \cr%%
%%      & {\vskip-30truept { $${
%%   { {\rm W}(k) =  \cases{
%% \displaystyle\sin^2\bigg({{\pi \, ({k - {\tt Kmin} + {\tt Dk1}/2})}\over
%%                          {2 \, \, {\tt Dk1}}} \bigg) ,
%%       & ${\tt Kmin} - {\tt Dk1}/2 \le k  <  {\tt Kmin} + {\tt Dk1}/2$\cr
%%  1.0, & ${\tt Kmin} + {\tt Dk1}/2 \le k \le {\tt Kmax} - {\tt Dk2}/2$\cr
%% \displaystyle\cos^2\bigg({{\pi \, ({k - {\tt Kmax} + {\tt Dk2}/2})}\over
%%                          {2 \, \, {\tt Dk2}}} \bigg) ,
%%    & ${\tt Kmax} - {\tt Dk2}/2  <  k \le {\tt Kmax} + {\tt Dk2}/2$\cr}
%% }  \hskip 3truept plus 5pt minus 2pt \hfill  }$$}\vskip-16truept}\cr
%% %%
%%   1  & Hanning Window Fraction:  {\tt Dk1} is the fraction of the
%%            window range that is not held at 1.00. In the formula
%%            below, $\gamma =  {\tt Dk1}({\tt Kmax}-{\tt Kmin})/2$ \cr
%%      & {\vskip-30truept { $${
%% {\rm W}(k) =  \cases{
%% \displaystyle\sin^2\bigg({{\pi \, ({k - {\tt Kmin} + {\tt Dk1}/2})}\over
%%                          {2 \, \, {\tt Dk1}}} \bigg) ,
%%   & ${\tt Kmin} \le k  <  {\tt Kmin} + \gamma $ \cr
%% {\vbox{\vskip4truept }}
%%  1.0
%%    & ${\tt Kmin} + \gamma  \le k \le {\tt Kmax} - \gamma $\cr
%% {\vbox{\vskip4truept }}
%% \displaystyle\cos^2\bigg({{\pi \, ({k - {\tt Kmax} + {\tt Dk1}/2})}\over
%%                          {2 \, \, {\tt Dk1}}} \bigg) ,
%%    & ${\tt Kmax} - \gamma <  k \le {\tt Kmax} $
%% \cr}  \hskip 45truept plus 10truept minus 20truept \hfill
%% }$$}\vskip-16truept}\cr
%% \noalign{\goodbreak}
%%  2  &  Gaussian Window:  Note that ${\rm W}(k)$ never goes to zero.
%%        {\tt Iwindo} = 7 gives an alternate form for the Gaussian window.\cr
%%      & {\vskip-30truept { $${
%% {\rm W}(k) =
%%      \exp\bigg( -{\tt Dk1}\, \bigl\{{ {2k - {\tt Kmax} - {\tt Kmin} }
%%                                      \over{ {\tt Kmax} + {\tt Kmin} }
%%                                       }\bigr\}^2\bigg)
%%  \hskip 163truept plus 10truept minus 20truept \hfill }$$}\vskip-16truept}\cr
%% %%\noalign{\smallskip}
%% \noalign{\medskip \goodbreak}
%%  3   & Lorentzian Window: Note that ${\rm W}(k)$ never goes to zero.\cr
%%      & {\vskip-30truept { $${
%% {\rm W}(k) =
%%   \bigg( 1.0 + {\tt Dk1}\, \bigl\{{ {2k - {\tt Kmax} - {\tt Kmin} }
%%                                    \over{ {\tt Kmax} + {\tt Kmin} }
%%                                       }\bigr\}^2\bigg)^{-1}
%%  \hskip 156truept plus 10truept minus 20truept \hfill }$$}\vskip-16truept}\cr
%%  %%\noalign{\smallskip}
%% \noalign{\goodbreak}
%%   4  & Parzen Window: This window has linear ``sills''.\cr
%%      & {\vskip-30truept { $${
%% {\rm W}(k) =  \cases{%
%% \displaystyle{ { k - {\tt Kmin} + {\tt Dk1}/2 }\over
%%                          {\tt Dk1}}  ,
%%    & ${\tt Kmin} - {\tt Dk1}/2 \le k  <  {\tt Kmin} + {\tt Dk1}/2$\cr
%% {\vbox{\vskip4truept }}
%% 1.0   & ${\tt Kmin} + {\tt Dk1}/2 \le k \le {\tt Kmax} - {\tt Dk2}/2$\cr
%% {\vbox{\vskip4truept  }}
%% \displaystyle{1.0 - {{ k - {\tt Kmax} + {\tt Dk2}/2 } \over
%%                          {\tt Dk2}} } ,
%%    & ${\tt Kmax} - {\tt Dk2}/2  <  k \le {\tt Kmax} + {\tt Dk2}/2 $
%% \cr}  \hskip 25truept plus 10truept minus 20truept \hfill
%% }$$}\vskip-16truept}\cr
%% \noalign{\goodbreak}
%%   5  & Welch Window: This window has quadratic ``sills''. \cr
%%      & {\vskip-30truept { $${
%% {\rm W}(k) =  \cases{%
%% \displaystyle{ \big\{{{ k - {\tt Kmin} + {\tt Dk1}/2} \over
%%                          {\tt Dk1}}\big\}^2 },
%%    & ${\tt Kmin} - {\tt Dk1}/2 \le k  <  {\tt Kmin} + {\tt Dk1}/2$\cr
%% {\vbox{\vskip4truept }}
%% 1.0   & ${\tt Kmin} + {\tt Dk1}/2 \le k \le {\tt Kmax} - {\tt Dk2}/2$\cr
%% {\vbox{\vskip4truept }}
%% \displaystyle{1.0 - \big\{{{k - {\tt Kmax} + {\tt Dk2}/2}\over
%%                          {\tt Dk2}}\big\}^2 } ,
%%   & ${\tt Kmax} - {\tt Dk2}/2  <  k \le {\tt Kmax} + {\tt Dk2}/2$\cr}
%%   \hskip 8truept plus 10truept minus 20truept \hfill
%% }$$}\vskip-16truept}\cr
%% \noalign{\goodbreak}
%%    6  &  Sine Window: This gives a half-period over the window range. \cr
%%       & {\vskip-30truept { $${{\rm W}(k) =
%%             \sin \bigg({ { \pi\,({\tt Kmax} + {\tt Dk2} - k)}\over
%%              { {\tt Kmax} + {\tt Dk2} - {\tt Kmin} + {\tt Dk1}}}\bigg)
%%             \hskip 180truept plus 10truept minus 20truept \hfill }$$}
%% \vskip-16truept}\cr
%%    7  &  Gaussian Window: An alternate version of the Gaussian window.\cr
%%       & {\vskip-30truept { $${ {\rm W}(k) =
%%              \exp\bigg( -{\tt Dk1}\, \bigl({k - {\tt Dk2} }\bigr)^2\bigg)
%%           \hskip 216truept plus 10truept minus 20truept \hfill }$$}
%% \vskip-16truept}\cr   }}   \goodbreak


\myframe{proving things about \tla\ specs: \hfill correctness}{

One may want to prove something like \\
\vspace{5pt}
\hfill the following about the Quicksort specification:
\vspace{15pt}
\begin{example}[correctness]
\[
\begin{array}{r c l}
Correctness & \triangleq & (U = \{\})\  \Rightarrow\  A \in PermsOf(A_0) \ \wedge \ IsSorted(A)\\
\\
\end{array}
\]

\end{example}

\vspace{75pt}

}

\input{tla-pic.tex}

\subsection{The Basics}

\myframe{proving things about \tla\ specs: \hfill \tlapm}{

{\color{Maroon} Idea:} \\
\vspace{15pt}
User writes something fairly close to\\
\hspace{50pt} a Hilbert-style mathematical proof \\
\hspace{45pt} (or a Fitch-style natural deduction proof); \\
\vspace{13pt}
\hfill backend provers take care of the annoying details.
\vspace{75pt}
}

\myframe{proving things about \tla\ specs: \hfill \tlapm}{

{\color{Maroon} Idea:} \\
\vspace{15pt}
User writes something {\color{Maroon}fairly close} to\\
\hspace{50pt} a Hilbert-style mathematical proof \\
\hspace{45pt} (or a Fitch-style natural deduction proof); \\
\vspace{15pt}
\hfill backend provers take care of the annoying details.
\vspace{25pt}

% reasonably light-weight
{\color{Maroon} some guidance using keywords like\\
\hfill \kw{assume-prove}, \kw{pick}, \kw{have}, \kw{witness}, \kw{case}, etc }

\vspace{26pt}
}

\myframe{proving things about \tla\ specs: \hfill \tlapm}{

{\color{Maroon} Idea:} \\
\vspace{15pt}
User writes something fairly close to\\
\hspace{50pt} a Hilbert-style mathematical proof \\
\hspace{45pt} (or a Fitch-style natural deduction proof); \\
\vspace{15pt}
\hfill backend provers {\color{Maroon}take care of the annoying details}.
\vspace{25pt}

\hfill {\color{Maroon} we wish... \smiley }
\vspace{38pt}
}

\myframe{proving things about \tla\ specs: \hfill \tlapm\ proofs}{
 \hspace{-18pt} {\color{Maroon} The simplest \tlapm\ proof  is a one-liner:}

\begin{example}[reflexivity of $PermsOf$]
\vspace{-10pt}
\[
\begin{array}{r c l }
\kw{lemma}\ PermsOf\_refl & \triangleq &
\kw{assume}\ \kw{new}\ S, \kw{new}\ T, \kw{new}\ X \in [S \rightarrow T] \\
& & \kw{prove}\ \    X \in PermsOf(X) \\ \\
&  \kw{by} &   \kw{def}\ \ PermsOf,\ Automorphisms,\ **
\end{array}
\]

\end{example}
\vspace{80pt}
}

\myframe{proving things about \tla\ specs: \hfill \tlapm\ proofs}{
 \hspace{-18pt} {\color{Maroon} The simplest \tlapm\ proof  is a one-liner:}

\begin{example}[reflexivity of $PermsOf$]
\vspace{-10pt}
\[
\begin{array}{r c l }
\kw{lemma}\ PermsOf\_refl & \triangleq &
{\color{Maroon}\textbf{\kw{assume}}}\ \kw{new}\ S, \kw{new}\ T, \kw{new}\ X \in [S \rightarrow T] \\
& &{\color{Maroon} \textbf{\kw{prove}}}\ \    X \in PermsOf(X) \\ \\
&  \kw{by} &  \kw{def}\ \ PermsOf,\ Automorphisms,\ **
\end{array}
\]

\end{example}

{\color{Maroon}
\underline{\kw{assume-prove}} \\ \vspace{10pt}
equivalent to: \hfill
$\forall S,\ \forall T,\ \forall X \in [S \rightarrow T] .\ X \in PermsOf(X) $\\ \vspace{10pt}
actually: \hfill $S \in [S \rightarrow T]\ \vdash\ X \in PermsOf(X)$
}
\vspace{20pt}
}

\myframe{proving things about \tla\ specs: \hfill \tlapm\ proofs}{
 \hspace{-18pt} {\color{Maroon} The simplest \tlapm\ proof  is a one-liner:}

\begin{example}[reflexivity of $PermsOf$]
\vspace{-10pt}
\[
\begin{array}{r c l }
\kw{lemma}\ PermsOf\_refl & \triangleq &
\kw{assume}\ \kw{new}\ S, \kw{new}\ T, \kw{new}\ X \in [S \rightarrow T] \\
& & \kw{prove}\ \    X \in PermsOf(X) \\ \\
&{\color{Maroon} \textbf{\kw{by}}} &{\color{Maroon} \textbf{\kw{def}\ \ PermsOf,\ Automorphisms,\ **}}
\end{array}
\]

\end{example}
\vspace{80pt}
}

\myframe{proving things about \tla\ specs: \hfill \tlapm\ proofs}{
 \hspace{-18pt} {\color{Maroon} The simplest \tlapm\ proof  is a one-liner:}

\begin{example}[reflexivity of $PermsOf$]
\vspace{-10pt}
\[
\begin{array}{r c l }
\kw{lemma}\ PermsOf\_refl & \triangleq &
\kw{assume}\ \kw{new}\ S, \kw{new}\ T, \kw{new}\ X \in [S \rightarrow T] \\
& & \kw{prove}\ \    X \in PermsOf(X) \\ \\
&{\color{Maroon} \textbf{\kw{by}}} &{\color{Maroon} Isa \ \ \textbf{\kw{def}\ \ PermsOf,\ Automorphisms,\ **}}
\end{array}
\]

\end{example}
{\color{Maroon}
\underline{Tactics} \\ \vspace{10pt}
\hfill \kw{SMT, (CVC, Z3, Yices), \ Isa, (Auto, Blast, Force), Zenon, TPL} \\ \vspace{10pt}
default: \hfill \kw{SMT, Zenon, Isa}
}

\vspace{22.5pt}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% PERMS OF TRANS
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\myframe{proving things about \tla\ specs: \hfill \tlapm\ proofs}{
 \hspace{-18pt} {\color{Maroon} Some \tla\ proofs are more complicated (`hierarchical'):}

\footnotesize
\begin{example}[transitivity of $PermsOf$]
\footnotesize
\vspace{-7pt}
\[
\begin{array}{r c l }
\kw{lemma}\ PermsOf\_trans & \triangleq &
\kw{assume}\ \kw{new}\ S, \kw{new}\ T, \kw{new}\ X \in [S \rightarrow T], \\
& & \kw{new}\ Y \in PermsOf(X), \kw{new}\ Z \in PermsOf(Y) \\
& & \kw{prove}\ \    Z \in PermsOf(X) \\ \\
\end{array}
\] \vspace{-15pt}
%\scriptsize
\[
\begin{array}{r c l}
& \langle1\rangle 1 & Y \in [S \rightarrow  T] \\
&  & \kw{by}\  PermsOf\_type \\
& \langle1\rangle 2 & \kw{pick}\ f \in Automorphisms(S) : Y = X **\, f \\
&  & \kw{by}\  \kw{def}\  PermsOf \\
& \langle1\rangle 3 & \kw{pick}\ g \in Automorphisms(S) : Z = Y **\, g \\
&  & \kw{by}\  \langle1\rangle 1\ \ \kw{def}\  PermsOf \\
& \langle1\rangle 4 & Z = X **\, (f **\, g) \\
&  & \kw{by}\   \langle1\rangle 2, \langle1\rangle 3\ \  \kw{def}\  Automorphisms, ** \\
& \langle1\rangle\ \  & \kw{qed} \\
&  & \kw{by}\   Automorphisms\_trans, \langle1\rangle 4\ \  \kw{def}\  PermsOf \\
\end{array}
\]

\end{example}
}

\myframe{proving things about \tla\ specs: \hfill \tlapm\ proofs}{
 \hspace{-18pt} {\color{Maroon} Some \tla\ proofs are more complicated (`hierarchical'):}

\footnotesize
\begin{example}[transitivity of $PermsOf$]
\footnotesize
\vspace{-7pt}
\[
\begin{array}{r c l }
\kw{lemma}\ PermsOf\_trans & \triangleq &
\kw{assume}\ \kw{new}\ S, \kw{new}\ T, \kw{new}\ X \in [S \rightarrow T], \\
& &  {\color{Maroon} \textbf{\kw{new}}\ Y \in PermsOf(X), \textbf{\kw{new}}\ Z \in PermsOf(Y)} \\
& & \color{Maroon} \textbf{\kw{prove}}\ \ Z \in PermsOf(X) \\ \\
\end{array}
\] \vspace{-15pt}
%\scriptsize
\[
\begin{array}{r c l}
& \langle1\rangle 1 & Y \in [S \rightarrow  T] \\
&  & \kw{by}\  PermsOf\_type \\
& \langle1\rangle 2 & \kw{pick}\ f \in Automorphisms(S) : Y = X **\, f \\
&  & \kw{by}\  \kw{def}\  PermsOf \\
& \langle1\rangle 3 & \kw{pick}\ g \in Automorphisms(S) : Z = Y **\, g \\
&  & \kw{by}\  \langle1\rangle 1\ \ \kw{def}\  PermsOf \\
& \langle1\rangle 4 & Z = X **\, (f **\, g) \\
&  & \kw{by}\   \langle1\rangle 2, \langle1\rangle 3\ \  \kw{def}\  Automorphisms, ** \\
& \langle1\rangle\ \  & \kw{qed} \\
&  & \kw{by}\   Automorphisms\_trans, \langle1\rangle 4\ \  \kw{def}\  PermsOf \\
\end{array}
\]

\end{example}
}

\myframe{proving things about \tla\ specs: \hfill \tlapm\ proofs}{
 \hspace{-18pt} {\color{Maroon} Some \tla\ proofs are more complicated (`hierarchical'):}

\footnotesize
\begin{example}[transitivity of $PermsOf$]
\footnotesize
\vspace{-7pt}
\[
\begin{array}{r c l }
\kw{lemma}\ PermsOf\_trans & \triangleq &
\kw{assume}\ \kw{new}\ S, \kw{new}\ T, \kw{new}\ X \in [S \rightarrow T], \\
& & \kw{new}\ Y \in PermsOf(X), \kw{new}\ Z \in PermsOf(Y) \\
& & \kw{prove}\ \    Z \in PermsOf(X) \\ \\
\end{array}
\] \vspace{-15pt}
%\scriptsize
\[
\begin{array}{r c l}
&\color{Maroon} \langle1\rangle 1 & Y \in [S \rightarrow  T] \\
&  & {\color{Maroon}\textbf{\kw{by}}}\  PermsOf\_type \\
&\color{Maroon} \langle1\rangle 2 & \kw{pick}\ f \in Automorphisms(S) : Y = X **\, f \\
&  & {\color{Maroon}\textbf{\kw{by}}}\  \kw{def}\  PermsOf \\
&\color{Maroon} \langle1\rangle 3 & \kw{pick}\ g \in Automorphisms(S) : Z = Y **\, g \\
&  & {\color{Maroon}\textbf{\kw{by}}}\  \langle1\rangle 1\ \ \kw{def}\  PermsOf \\
&\color{Maroon} \langle1\rangle 4 & Z = X **\, (f **\, g) \\
&  & {\color{Maroon}\textbf{\kw{by}}}\   \langle1\rangle 2, \langle1\rangle 3\ \  \kw{def}\  Automorphisms, ** \\
&\color{Maroon} \langle1\rangle\ \  & \color{Maroon} \textbf{\kw{qed}} \\
&  & {\color{Maroon}\textbf{\kw{by}}}\   Automorphisms\_trans, \langle1\rangle 4\ \  \kw{def}\  PermsOf \\
\end{array}
\]

\end{example}
}

\myframe{proving things about \tla\ specs: \hfill \tlapm\ proofs}{
 \hspace{-18pt} {\color{Maroon} Some \tla\ proofs are more complicated (`hierarchical'):}

\footnotesize
\begin{example}[transitivity of $PermsOf$]
\footnotesize
\vspace{-7pt}
\[
\begin{array}{r c l }
\kw{lemma}\ PermsOf\_trans & \triangleq &
\kw{assume}\ \kw{new}\ S, \kw{new}\ T, \kw{new}\ X \in [S \rightarrow T], \\
& & \kw{new}\ Y \in PermsOf(X), \kw{new}\ Z \in PermsOf(Y) \\
& & \kw{prove}\ \    Z \in PermsOf(X) \\ \\
\end{array}
\] \vspace{-15pt}
%\scriptsize
\[
\begin{array}{r c l}
& \langle1\rangle 1 & Y \in [S \rightarrow  T] \\
&  & \kw{by}\ \color{Maroon} PermsOf\_type \\
& \langle1\rangle 2 & \kw{pick}\ f \in Automorphisms(S) : Y = X **\, f \\
&  & \kw{by}\  \kw{def}\  PermsOf \\
& \langle1\rangle 3 & \kw{pick}\ g \in Automorphisms(S) : Z = Y **\, g \\
&  & \kw{by}\ {\color{Maroon} \langle1\rangle 1}\ \ \kw{def}\  PermsOf \\
& \langle1\rangle 4 & Z = X **\, (f **\, g) \\
&  & \kw{by}\ {\color{Maroon} \langle1\rangle 2, \langle1\rangle 3}\ \  \kw{def}\  Automorphisms, ** \\
& \langle1\rangle\ \  & \kw{qed} \\
&  & \kw{by}\ {\color{Maroon} Automorphisms\_trans, \langle1\rangle 4}\ \  \kw{def}\  PermsOf \\
\end{array}
\]

\end{example}
}

\myframe{proving things about \tla\ specs: \hfill \tlapm\ proofs}{
 \hspace{-18pt} {\color{Maroon} Some \tla\ proofs are more complicated (`hierarchical'):}

\footnotesize
\begin{example}[transitivity of $PermsOf$]
\footnotesize
\vspace{-7pt}
\[
\begin{array}{r c l }
\kw{lemma}\ PermsOf\_trans & \triangleq &
\kw{assume}\ \kw{new}\ S, \kw{new}\ T, \kw{new}\ X \in [S \rightarrow T], \\
& & \kw{new}\ Y \in PermsOf(X), \kw{new}\ Z \in PermsOf(Y) \\
& & \kw{prove}\ \    Z \in PermsOf(X) \\ \\
\end{array}
\] \vspace{-15pt}
%\scriptsize
\[
\begin{array}{r c l}
& \langle1\rangle 1 & \color{Maroon} \bf Y \in [S \rightarrow  T] \\
&  & \kw{by}\  PermsOf\_type \\
& \langle1\rangle 2 & \kw{pick}\ f \in Automorphisms(S) : Y = X **\, f \\
&  & \kw{by}\  \kw{def}\  PermsOf \\
& \langle1\rangle 3 & \kw{pick}\ g \in Automorphisms(S) : Z = Y **\, g \\
&  & \kw{by}\  \langle1\rangle 1\ \ \kw{def}\  PermsOf \\
& \langle1\rangle 4 & \color{Maroon} \bf Z = X **\, (f **\, g) \\
&  & \kw{by}\   \langle1\rangle 2, \langle1\rangle 3\ \  \kw{def}\  Automorphisms, ** \\
& \langle1\rangle\ \  & \kw{qed} \\
&  & \kw{by}\   Automorphisms\_trans, \langle1\rangle 4\ \  \kw{def}\  PermsOf \\
\end{array}
\]

\end{example}
}

\myframe{proving things about \tla\ specs: \hfill \tlapm\ proofs}{
 \hspace{-18pt} {\color{Maroon} Some \tla\ proofs are more complicated (`hierarchical'):}

\footnotesize
\begin{example}[transitivity of $PermsOf$]
\footnotesize
\vspace{-7pt}
\[
\begin{array}{r c l }
\kw{lemma}\ PermsOf\_trans & \triangleq &
\kw{assume}\ \kw{new}\ S, \kw{new}\ T, \kw{new}\ X \in [S \rightarrow T], \\
& & \kw{new}\ Y \in PermsOf(X), \kw{new}\ Z \in PermsOf(Y) \\
& & \kw{prove}\ \    Z \in PermsOf(X) \\ \\
\end{array}
\] \vspace{-15pt}
%\scriptsize
\[
\begin{array}{r c l}
& \langle1\rangle 1 & Y \in [S \rightarrow  T] \\
&  & \kw{by}\  PermsOf\_type \\
& \langle1\rangle 2 & {\color{Maroon} \text{\bf{\kw{pick}}}}\ f \in Automorphisms(S) : Y = X **\, f \\
&  & \kw{by}\  \kw{def}\  PermsOf \\
& \langle1\rangle 3 & {\color{Maroon} \text{\bf{\kw{pick}}}}\ g \in Automorphisms(S) : Z = Y **\, g \\
&  & \kw{by}\  \langle1\rangle 1\ \ \kw{def}\  PermsOf \\
& \langle1\rangle 4 & Z = X **\, (f **\, g) \\
&  & \kw{by}\   \langle1\rangle 2, \langle1\rangle 3\ \  \kw{def}\  Automorphisms, ** \\
& \langle1\rangle\ \  & \kw{qed} \\
&  & \kw{by}\   Automorphisms\_trans, \langle1\rangle 4\ \  \kw{def}\  PermsOf \\
\end{array}
\]

\end{example}
}

\myframe{proving things about \tla\ specs: \hfill \tlapm\ proofs}{

\begin{center}
\href{run:examples/videos/PermsOf.mp4}{\textbf{PermsOf lemmas demo}}
\end{center}

}

\subsection{Safety Properties: Proving Boxes}

\myframe{proving things about \tla\ specs: \hfill safety proofs}
{
For some safety property $P$,  the thing to prove is generally:
\vspace{25pt}
\begin{theorem}[Safety]
\begin{center}
$Spec\ \Rightarrow\  \Box\, P$
\end{center}
\end{theorem}

\vspace{75pt}
}

\myframe{proving things about \tla\ specs: \hfill safety proofs}
{
For some safety property $P$,  the thing to prove is generally:
\vspace{25pt}
\begin{theorem}[Safety]
\begin{center}
$Init \wedge \Box\, [Next]_V \  \Rightarrow \ \Box\, P$
\end{center}
\end{theorem}

\vspace{75pt}
}

\myframe{proving things about \tla\ specs: \hfill safety proofs}
{
For some safety property $P$,  the thing to prove is generally:
\vspace{25pt}
\begin{theorem}[Safety]
\begin{center}
$Init \wedge \Box\, [Next]_V \  \Rightarrow \ \Box\, P$
\end{center}
\end{theorem}
\vspace{20pt}
{\color{Maroon} Question:} \\
\hfill How does one prove a $\Box$ ?
\vspace{27pt}
}

\myframe{proving things about \tla\ specs: \hfill proving $\Box$}
{
\hspace{-18pt} {\color{Maroon}There are two rules that `make' a $\Box$:}
\vspace{15pt}
\begin{rl}[$\Box$-Induction -- standard LTL]
\begin{prooftree}
         \AxiomC{$Init \seq P$}
         \AxiomC{$P\ ,\ [Next]_V \seq  P'$}
         \RightLabel{\rlable{\Box-Ind}}
         \BinaryInfC{$Init\ ,\ \Box\, [Next]_V  \seq \Box\, P$}
\end{prooftree}
\end{rl}

\vspace{30pt}

\begin{rl}[Necessitation]
\begin{prooftree}
        \AxiomC{$\seq P$}
         \RightLabel{\rlable{Nec}}
        \UnaryInfC{$\hspace{8pt} \seq \Box\, P$}
\end{prooftree}
\end{rl}
\vspace{45pt}

}

\myframe{proving things about \tla\ specs: \hfill proving $\Box$}
{
\hspace{-18pt} {\color{Maroon}There are two rules that `make' a $\Box$:}
\vspace{15pt}
\begin{rl}[$\Box$-Induction -- standard LTL]
\begin{prooftree}
         \AxiomC{$Init \seq P$}
         \AxiomC{$P\ ,\ [Next]_V \seq  P'$}
         \RightLabel{\rlable{\Box-Ind}}
         \BinaryInfC{$Init\ ,\ \Box\, [Next]_V  \seq \Box\, P$}
\end{prooftree}
\end{rl}

\vspace{30pt}

\begin{rl}[Necessitation]
\begin{prooftree}
        \AxiomC{$\Box\, F_1, \ldots, \Box\, F_n \seq P$}
         \RightLabel{\rlable{Nec}}
        \UnaryInfC{$\hspace{8pt} \Box\, F_1, \ldots, \Box\, F_n \seq \Box\, P$}
\end{prooftree}
\end{rl}
\vspace{45pt}

}

\myframe{proving things about \tla\ specs: \hfill proving $\Box$}
{
\hspace{-18pt} {\color{Maroon}There are two rules that `make' a $\Box$:}
\vspace{15pt}
\begin{rl}[$\Box$-Induction -- standard LTL]
\begin{prooftree}
         \AxiomC{$Init \seq P$}
         \AxiomC{$P\ ,\ [Next]_V \seq  P'$}
         \RightLabel{\rlable{\Box-Ind}}
         \BinaryInfC{$Init\ ,\ \Box\, [Next]_V  \seq \Box\, P$}
\end{prooftree}
\end{rl}

\vspace{30pt}

\begin{rl}[Necessitation -- careful about weakening !]
\begin{prooftree}
        \AxiomC{$\Box\, F_1, \ldots, \Box\, F_n \hspace{10pt} \seq P$}
        \RightLabel{\rlable{WK}}
         \UnaryInfC{$\hspace{1pt} \Box\, F_1, \ldots, \Box\, F_n, G \seq  P$}
        \RightLabel{\color{Maroon} \Large $\times$}
        \UnaryInfC{$\hspace{9pt} \Box\, F_1, \ldots, \Box\, F_n , G \seq \Box\, P$}
\end{prooftree}
\end{rl}
\vspace{45pt}

}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% CORRECTNESS FOR QUICKSORT
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\myframe{proving things about \tla\ specs: \hfill correctness of Quicksort}{
\hspace{-18pt} {\color{Maroon}Correctness of Quicksort is a safety property:}
\vspace{10pt}
\begin{example}[correctness of quicksort]
\vspace{-12pt}
\[
\begin{array}{r c l}
Correctness & \triangleq & (U = \{\})\  \Rightarrow\  A \in PermsOf(A_0) \ \wedge \ IsSorted(A)\\ \\
\kw{theorem} & & Spec \Rightarrow \Box \, Correctness
\\
\end{array}
\]

\end{example}

\vspace{15pt}

Using $\Box$-Induction to prove this directly is not a good idea, \\
\hfil because $Correctness$ is vacuously true as long as $U \neq \{\}$.

\vspace{15pt}
\hfill {\color{Maroon} We need an inductive invariant... }
\vspace{18.5pt}
}

\myframe{proving things about \tla\ specs: \hfill correctness of Quicksort}{
\hspace{-18pt} {\color{Maroon}Correctness of Quicksort is a safety property:}
\vspace{10pt}
\begin{example}[correctness of quicksort]
\[
\begin{array}{r c l}
Correctness & \triangleq & (U = \{\})\  \Rightarrow\  A \in PermsOf(A_0) \ \wedge \ IsSorted(A)
\\ \\
% \kw{theorem} & & Spec \Rightarrow \Box \, Correctness
% \\ \\
UnsortedIsCovered & \triangleq &  \forall\ i, j \in 1\,..\,N .\  i < j \ \wedge \ A[j] < A[i] \\
& & \Rightarrow \exists\ u \in U. \  \{i,j\} \subseteq u[1]\,..\, u[2]\\
\\
NoOverlap & \triangleq & \forall\ u,v \in U .\ (u[1]\, ..\, u[2]) \cap (v[1]\, ..\, v[2]) \neq \{\} \\
& &  \Rightarrow u = v
\\ \\
Inv & \triangleq & UnsortedIsCovered \wedge NoOverlap
\\
\end{array}
\]

\end{example}
}

\myframe{proving things about \tla\ specs: \hfill correctness of Quicksort}{
\hspace{-18pt} {\color{Maroon}The proof will look like this:}
\vspace{10pt}
\begin{example}[correctness of quicksort]
\[
\begin{array}{r c l r}
\kw{theorem} & & Spec \Rightarrow \Box \, Correctness
\\ \\
& \langle 1 \rangle 1 & Spec \Rightarrow \Box \, TypeOK & \mathsf{\Box-Ind}
\\
& \langle 1 \rangle 2 & Spec \Rightarrow \Box \, Inv & \mathsf{\Box-Ind}
\\
& \langle 1 \rangle 3 & TypeOK \wedge Inv \Rightarrow Correctness
\\
& \langle 1 \rangle q & \kw{qed} \\
& & \kw{by}\ \langle1\rangle1, \langle1\rangle2, \langle1\rangle3, \kw{PTL} & \mathsf{Nec}
\\
\end{array}
\]

\end{example}

\vspace{36.5pt}
}

\myframe{proving things about \tla\ specs: \hfill correctness of Quicksort}{
\hspace{-18pt} {\color{Maroon}The problem with weakening manifests itself here:}
\vspace{10pt}
\begin{example}[correctness of quicksort]
\[
\begin{array}{r c l r}
\kw{theorem} & & Spec \Rightarrow \Box \, Correctness
\\ \\
& \langle 1 \rangle 1 & Spec \Rightarrow \Box \, TypeOK & \mathsf{\Box-Ind}
\\
& \langle 1 \rangle 2 & Spec \Rightarrow \Box \, Inv & \mathsf{\Box-Ind}
\\
& \langle 1 \rangle 3 & TypeOK \wedge Inv {\color{Maroon} \wedge\  Init} \Rightarrow Correctness
\\
& \langle 1 \rangle q & \kw{qed} \\
& & \kw{by}\ \langle1\rangle1, \langle1\rangle2, \langle1\rangle3, \kw{PTL} & \color{Maroon} \Large{ \mathbf{\times}}
\\
\end{array}
\]

\end{example}

\vspace{36.5pt}
}

\myframe{proving things about \tla\ specs: \hfill correctness of Quicksort}{

\begin{center}
\href{run:examples/videos/QuicksortCor.mp4}{\textbf{Quicksort correctness demo}}
\end{center}
% 1. dummy proof at bottom
% 2. add init show failure
% 3. show proof with lemmata, show both lemmata

}

\myframe{proving things about \tla\ specs: \hfill so far so good ...}{
\footnotesize
\hspace{-18pt} {\color{Maroon} There are several nice aspects of writing proofs in \tla:}

\begin{itemize}
        \item little overhead over the pen-and-paper version ;
        \item proofs are quite robust wrt to changes in definitions, etc
\href{run:examples/videos/NoOverlaps.mp4}{{\color{Maroon}(\textbf{demo})}} ;
        \item interface facilitates asynchronous working style ; % {\color{Maroon} ...}
        \item module system ;
        \item show me another ITP that supports modal reasoning.
\end{itemize}

\vspace{20pt}

\hspace{-18pt} {\color{Maroon} There are also several not-so-nice aspects of writing proofs in \tla:}

\begin{itemize}
        \item controlling the exact obligations is subtle ;
% this is partly due to design decisions taken to minimize the explicit modal reasoning...
        \item modal reasoning is subtle, can look strange, and is limited {\color{Maroon} (at present)} ;
        \item no certificates {\color{Maroon} (at present)}.
\end{itemize}
\vspace{10pt}

}


For the most part, the abstract semantics applies existing semantic operators of boxed Intervals \cite{COU98}.

First of all, $\mathbb{I}$ defines the semantics of arithmetic expressions on a single hypercube by applying the well-known arithmetic operators on intervals.

This semantics is used to define the abstract semantics $\mathbb{B}$ of Boolean comparisons. Given a hypercube and a Boolean comparison $E_1 <bop> E_2$ where $<bop> \in \{\geq, >, \leq, <, \neq \}$, this semantics returns an \emph{abstract value of the boolean domain} (namely, $\mathit{true}$, $\mathit{false}$, or $\top$) comparing the intervals obtained from $E_1$ and $E_2$ through $\mathbb{I}$. Therefore, given a Boolean condition and a set of hypercubes, we partition this set into the hypercubes for which (i) the condition surely holds, (ii) the conditions surely does not hold, and (iii) the condition may or may not hold. In this way, we can discard all the hypercubes for which a given Boolean condition surely holds or does not hold.

Note that in this way we lose some precision. For instance, imagine that in a given hypercube we know that $\statement{x} \in [0..5]$ (because the fixed width of intervals associated to \statement{x} is 5), and we check if $\statement{x} \leq 3$. The answer of $\mathbb{B}$ will be $\top$ and, if the condition was inside an \statement{if} statement, this hypercube will be used to compute the semantics of both the branches. Indeed, we would know that $\statement{x} \in [0..3]$ in the \statement{then} branch, and $\statement{x} \in [4..5]$ in the else branch. Nevertheless, we cannot and do not want to track this information in our hypercube, since the width of the interval associated to \statement{x} is 5, and fixed widths are a key feature in order to obtain an efficient analysis. We will present (Section \ref{sec:widths}) how we can recursively modify the widths of the analysis to improve precision in these cases.

The semantics of the logical operators $not$, $and$, $or$ is defined in the standard way.

$\mathbb{I}$ is used to define the semantics $\mathbb{S}$ of variable assignment as well. The standard semantics of \statement{x=exp} is to (i) obtain the interval representing the right part ($\mathbb{I}\llbracket\statement{x=exp}, \sigma\rrbracket=[m..M]$), and (ii) assign it in the current state. This approach does not necessarily produce a single hypercube, since we could assign an interval which width is greater than the fixed width of the assigned variable, or that covers several other intervals belonging to different partitions. In this case, we build up several hypercubes that cover the interval $[m..M]$. This can be formalized by $assign(h, V_i, [a..b])=\{h[i\mapsto m] : [m\times w_i .. (m+1)\times w_i]\cap [a..b] \neq \emptyset\}$, where $h$ is a hypercube, $V_i$ is the assigned variable, and $[a..b]$ is the interval we are assigning (which depends on the hypercube $h$, since we use its variables values to compute the result of the expression). We repeat this process for each hypercube $h$ in the abstract state by using it as input for the computation of $assign$.
In this way, we are able to over-approximate the assignment keeping the fixed widths of the intervals, which is a key feature of our domain in order to obtain an efficient analysis.

%\todogiulia{Tino: come dicevo questa sezione si dovrebbe ridurre all'osso: riferimenti a Intervalli, Disjuctinve domains trough Powerset, Prodotto Cartesiano, Conditional Partitioning}
%
%In this Section, we define the abstract semantics of Hypercubes. In particular, the semantics we will define are the following ones:
%\begin{itemize}
%\item $\mathbb{I}$, the abstract semantics of arithmetic expressions, which receives an expression and a single hypercube in input and returns an \emph{interval of real values} resulting from the execution of that expression when the variable values belong to that hypercube.
%\item $\mathbb{B}$, the abstract semantics of boolean conditions, which receives a single hypercube and two expressions in input and returns an \emph{abstract value of the boolean domain} (namely, $true$, $false$, or $\top$) obtained by comparing the two expressions (through $\geq, >, \leq, <$ or $\neq$) when the variable values belong to that hypercube. Boolean conditions can be combined through logical operators (and, or, not) in the usual way (i.e., exploiting the abstract semantics of the boolean abstract domain).
%\item $\mathbb{S}$, the abstract semantics of statements, which receives in input a set of hypercubes (the current abstract state) and returns a new set of hypercubes (the new abstract state after the execution of the statement).
%\end{itemize}
%
%\subsection{The abstract semantics of arithmetic expressions, $\mathbb{I}$}
%
%\subsubsection{Constants}
%\label{sec:constants}
%We define a constant as a variable which gets assigned only once with a constant value, or a numerical value which appears in some statements (without being assigned to a specific variable). To simplify the treatment of constants, we execute a preprocessing on the program with constant propagation, to remove constant variables and replace their uses with their numerical value.
%
%
%The abstract semantics of an expression made up by a constant numeric value is, simply, an interval of zero width: the extremes of the interval are the same and they are equal to the value of the constant.
%Then, the abstract semantics of a constant is:
%
%$$\mathbb{I}\llbracket c \rrbracket \; h = [c,c]$$
%
%Note that the value of the hypercube in input ($h$) is ignored because it is not needed to compute the result.
%
%\subsubsection{Intervals}
%The abstract semantic of an expression made up by an interval of real values is immediate: it is exactly that interval, without modifications. We ignore the hypercube passed in input.
%
%$$\mathbb{I}\llbracket (m,M) \rrbracket \; h = [m,M]$$
%
%\subsubsection{Variables}
%When the expression is made up by a variable, we must consider the abstract value of that variable in the hypercube passed in input. Let $h_i$ be the integer index associated to the $i$-th dimension of the hypercube, $V_i$ the $i$-th variable defined in the program and $w_i$ the width associated in the analysis to such variable. Then, the abstract semantics of a variable  is $\mathbb{I}\llbracket V_i\rrbracket \; h = [h_i*w_i,(h_i+1)*w_i]$.
%
%
%\subsubsection{Arithmetic operations}
%We considered only the most used arithmetic operators. In particular, we considered sum ($+$), subtraction ($-$), product ($\times$) and division ($\div$). These operators should suffice for most physics simulations (for example, our case study requires only sum and product - the change of sign being a multiplication for $-1$). Anyway, our framework can be easily extended to support other operations (for example modulus), by simply defining their abstract semantics when working on intervals of values.
%
%The semantics of these operators over intervals has been already deeply studied, and we refer to \cite{COU98} for their definitions.
%
%
%\subsection{The abstract semantics of Boolean conditions, $\mathbb{B}$}
%\label{sec:boolcondition}
%We now define the semantics of integer comparison using the operators $>$, $<$, $\leq$, $\geq$, and $\neq$.
%
%The abstract semantics separately computes the semantics on the left and right arithmetical expressions of the statement, obtaining two intervals. Let us call them $i_1 = [a,b]$ and $i_2 = [c,d]$. The abstract comparison between them depends on the specific comparison operator present in the statement:
%\begin{itemize}
%\item $i_1 \neq i_2$ returns true if $b < c \vee a > d$, false if $b=c=a=d$, and $\top$ otherwise.
%\item $i_1 < i_2$ returns true if $b < c$, false if $a > d$, top otherwise.
%\item $i_1 > i_2$ returns true if $a > d$, false if $b < c$, top otherwise.
%\item $i_1 \leq i_2$ returns true if $b \leq c$, false if $a \geq d$, top otherwise.
%\item $i_1 \geq i_2$ returns true if $a \geq d$, false if $b \leq c$, top otherwise.
%\end{itemize}
%
%$\mathbb{B}$ will be used by the statement semantics $\mathbb{S}$ when computing the semantics of \statement{if} and \statement{while} statements to discard the hypercubes that surely do not satisfy the condition. Note that in this way we lose some precision. For instance, imagine that in a given hypercube we know that $\statement{x} \in [0..5]$ (because the fixed width of intervals associated to \statement{x} is 5), and we check if $\statement{x} \leq 3$ when computing the semantics of an \statement{if} statements. The answer of $\mathbb{B}$ will be $\top$, and so this hypercube will be used to compute the semantics of both the branches. Indeed, we would know that $\statement{x} \in [0..3]$ in the \statement{then} branch, and $\statement{x} \in [4..5]$ in the else branch. Nevertheless, we cannot track this information in our hypercube, since the width of the interval associated to \statement{x} is 5. Anyway, we will present (Section \ref{sec:widths}) how we can recursively modify the widths of the analysis to improve precision in these cases.
%
%
%\subsection{The abstract semantics of statements, $\mathbb{S}$}
%
%\subsubsection{Assignment}
%Usually, with non-disjunctive domains, the abstract semantics of an assignment is straightforward: you have to compute the abstract semantics of the expression and update the abstract value of the variable with the result. In our domain, though, we track a different kind of information: we represent possible values of all variables together (through hypercubes) and we consider disjunctive information (a set of valid hypercubes instead of a single hypercube). Therefore, we must devise a specific abstract semantics to deal with the assignment statement.
%
%Let the assignment be $V_i = e$, where $e$ is an arithmetic expression. Our approach can then be sketched as follows:
%\begin{itemize}
%\item we consider, separately, each hypercube $h$ of the current state;
%\item we compute the abstract semantics of the arithmetic expression $e$ passing to it the hypercube $h$.
%\item we create a new hypercube (or \emph{some} new hypercubes, depending on the width of the resulting interval), where the abstract value of $V_i$ is the abstraction of the interval resulting from $e$.
%\end{itemize}
%
%If the interval obtained from $e$ overlaps over several partitions established for variable $V_i$, we have to build up several hypercubes as result of the assignments semantics over a single hypercube.
%
%
%On the other hand, if many hypercubes of the initial state map to the same hypercube in the resulting state, it could also happen that the cardinality of \adomain\ decreases (or remains unmodified) after the execution of an assignment.
%
%Formally:
%
%$$\mathbb{S}\llbracket \statement{V_i = e}\rrbracket \; H = \bigcup_{h \in H} {assign(h, V_i, \mathbb{I}\llbracket e\rrbracket \; h)}$$
%
%where $assign(h, V_i, [a,b])=\{h[i\mapsto m] : [m\times w_i .. (m+1)\times w_i]\cap [a..b] \neq \emptyset\}$. The output of this function is the set of hypercubes covering all the intervals that overlaps with the interval assigned to the given variable.
%
%
%\subsubsection{If-then-else semantics}
%
%To precisely deal with branches of \statement{if} statements, we partition the abstract state \adomain\ with respect to the evaluation of the branching condition. In particular, we compute the abstract semantics $\mathbb{B}$ of the boolean condition on each hypercube of \adomain\ and we assign each hypercube to a specific partition, based on the result of the condition semantics. Therefore, we obtain three partitions: the hypercubes for which the condition evaluates to true ($p_t$), the ones for which the condition evaluates to false ($p_f$), and the ones for which we do not have a definitive answer ($p_\top$).
%
%Once obtained these three partitions, we can compute selectively the abstract semantics of the two branches, and in particular the \statement{then} branch with $p_t \cup p_\top$, and the \statement{else} branch with $p_f \cup p_\top$.
%
%Formally, the semantics of the \statement{if} statements follows:
%
%$$\mathbb{S}\llbracket \statement{if}(B)\ \statement{then}\ P_1\ \statement{else}\ P_2\rrbracket \; H = ( \mathbb{S}\llbracket P_1\rrbracket \; (p_t \cup p_\top) ) \cup ( \mathbb{S}\llbracket P_2\rrbracket \; (p_f \cup p_\top) )$$
%
%where $p_t = \{ h \in H : \mathbb{B}\llbracket \ael{if}\rrbracket \; h = true \}$, $p_f = \{ h \in H : \mathbb{B}\llbracket \ael{if}\rrbracket \; h = false \}$, and $p_\top = \{ h \in H : \mathbb{B}\llbracket \ael{if}\rrbracket \; h = \top \}$.
%
%\subsubsection{Concatenation of statements}
%The abstract semantics of the concatenation of two statements is straightforward: it executes the abstract semantics of the first statement, it takes the result and it passes it as input to the abstract semantics of the second statement. Formally:
%
%$$\mathbb{S}\llbracket P_1;P_2\rrbracket \; H = \mathbb{S}\llbracket P_2\rrbracket \; (\mathbb{S}\llbracket P_1\rrbracket \; H)$$
%
%\todogiulia{Non sono per niente convinto che sia questa big-step semantics quello di cui abbiamo bisogno. Ad esempio, la semantics di \statement{while(true) P_1; P_2} ritorna $\emptyset$ stando a questa definizione. A occhio abbiamo bisogno di qualcos'altro, e.g., uno stato astratto per ogni punto di programma di un cfg? In questo caso, non dobbiamo lavorare a questo livello con \statement{if} e \statement{while} ma piu' a basso livello.}
%
%\subsection{While loop}
%To do.

12. Hypercubes Domain/HC/Sections/versione SAS2013/3b_abstract_semantics.tex

12. Hypercubes Domain/Sections/versione SAS2013/3b_abstract_semantics.tex


%File: algorithm.tex
%Date: Sun Nov 17 23:43:49 2013 +0800
%Author: Yuxin Wu <ppwwyyxxc@gmail.com>

\section{Algorithm and Implementation}

We presented a prototype system based on MFCC as acoustic features, and
GMM as our recognition model.

\subsection{MFCC}
MFCC (Mel-frequency Cepstral Coefficient) is a representation of the short-term power spectrum of a sound,
based on a linear cosine transform of a log
power spectrum on a nonlinear mel-scale of frequency \cite{mfcc} .
MFCC is the mostly widely used features in Automatic Speech Recognition(ASR), and it can also be
applied to Speaker Recognition task.

The process to extract MFCC feature is as followed:
\begin{figure}[H]
  \centering
  \includegraphics[width=\textwidth]{res/MFCC.png}
\end{figure}

First, the input speech should be divided into successive short-time frames of length $L$,
neighboring frames shall have overlap $R$. In our implementation, We choose $L = 20ms  $ ans $ R = 10 ms$.
Those frames are then windowed by Hamming Window, as shown in \figref{frames}
\begin{figure}[H]
  \centering
  \includegraphics[width=0.7\textwidth]{res/frames.png}
  \caption{Framing and Windowing \label{fig:framming}}
\end{figure}

Then, We perform Discrete Fourier Transform (DFT) on windowed signals to compute their spectrums.
For each of $N$ discrete frequency bands we get a complex number $X[k]$ representing
magnitude and phase of that frequency component in the original signal.

Considering the fact that human hearing is not equally sensitive to all frequency bands, and especially, it has lower resolution at higher frequencies.
Scaling methods like Mel-scale and Bark-scale are aimed at scaling the frequency domain to fit human auditory perception better.
They are approximately linear below 1 kHz and logarithmic above 1 kHz.
\begin{figure}[H]
  \centering
  \includegraphics[width=0.6\textwidth]{res/mel-scale.png}
\end{figure}

In MFCC, Mel-scale is applied on the spectrums of the signals. The expression of Mel-scale warpping is as followed:
\[ M(f) = 2595 \log_{10}(1 + \dfrac{f}{700}) \]

\begin{figure}[H]
  \centering
  \includegraphics[width=0.5\textwidth]{res/bank.png}
  \caption{Filter Banks (6 filters) \label{fig:bank}}
\end{figure}
Then,  we appply the bank of filters according to Mel-scale on the spectrum,
calculate the logarithm of energy under each bank by $E_i[m] = \log (\sum_{k=0}^{N-1}{X_i[k]^2 H_m[k]}) $ and apply Discrete
Cosine Transform (DCT) on $E_i[m](m = 1, 2, \cdots M) $ to get an array $c_i $:
\[ c_i[n] = \sum_{m=0}^{M-1}{E_i[m]\cos(\dfrac{\pi n}{M}(m - \dfrac{1}{2}))} \]

Usually, the first 13 terms in $c_i $ is used as features for future training.

\subsection{GMM}

We use Gaussian Mixture Model (GMM) to model all features from one person.
For implementation, we use the GMM model training and predicting routine from the famous python
machine learning package scikit-learn \cite{sklearn}.
Since the last step of MFCC is DCT, different dimensions of the features are strongly independent, so we
use GMM with diagonal covariance matrix. The number of components in GMM is chosen as 32 in our implementation.

After building models for each person, it can be used to calculate the probability that the input signal is generated by this model.
The model with maximum probability is picked out as the result, and the corresponding person is recognized.

\pysrcpart{res/test.py}{45}{50}


\section{Dam break on wet areas}

The dam break problem on wet areas was solved analytically by
Stoker~\cite{Stoker1948, Stoker1957}.
The analytical solution exhibits a rarefaction and involves a shock. Generally this problem is easier to solve numerically than the dry dam break (the dam break on a dry area).

The initial condition is
\begin{equation} \label{eq:dbp_init_wet}
u(x,0)=0, ~~v(x,y)=0, ~~\textrm{and}~~
h(x,0) = \left\{ \begin{array}{ll}
h_1 & \textrm{if $x < 0$}\\
h_0 & \textrm{if $x > 0$}\\
\end{array} \right.
\end{equation}
where $h_1>h_0>0$. The topography is a horizontal flat bed.

The analytical solution~\cite{Stoker1948, Stoker1957}
to the wet dam break problem is
\begin{equation}
h(x) = \left\{ \begin{array}{ll}
h_1 & \textrm{if $x \leq -t \sqrt{gh_1}$}\\
h_3=\frac{4}{9g}(\sqrt{gh_1}-\frac{x}{2t})^2 & \textrm{if $-t \sqrt{gh_1} <x \leq t(u_2-\sqrt{gh_2}$})\\
h_2=\frac{h_0}{2}\bigg(\sqrt{1+\frac{8\dot{\xi}^2}{gh_0}}-1\bigg) & \textrm{if $ t(u_2-\sqrt{gh_2}) <x < t\dot{\xi}$}\\
h_0 & \textrm{if $x \geq t\dot{\xi}$}\\
\end{array} \right.
\end{equation}
and
\begin{equation}
u(x) = \left\{ \begin{array}{ll}
0 & \textrm{if $x \leq -t \sqrt{gh_1}$}\\
u_3=\frac{2}{3}(\sqrt{gh_1}+\frac{x}{t}) & \textrm{if $-t \sqrt{gh_1} <x \leq t(u_2-\sqrt{gh_2}$})\\
u_2=\dot{\xi}-\frac{gh_0}{4\dot{\xi}}\bigg(1+\sqrt{1+\frac{8\dot{\xi}^2}{gh_0}} \bigg) & \textrm{if $ t(u_2-\sqrt{gh_2}) <x < t\dot{\xi}$}\\
0 & \textrm{if $x \geq t\dot{\xi}$}\\
\end{array} \right.
\end{equation}
at any time $t>0$, where $\dot{\xi}$ is the shock speed constant given by
\begin{equation} \label{eq:shock}
\dot{\xi}=2\sqrt{gh_1}+\frac{gh_0}{4\dot{\xi}}\bigg( 1+\sqrt{1+\frac{8\dot{\xi}^2}{gh_0}}\bigg)-\bigg( 2gh_0 \sqrt{1+\frac{8\dot{\xi}^2}{gh_0}}-2gh_0\bigg)^\frac{1}{2}.
\end{equation}

\subsection{Results}

For our test, we consider $h_1=10$ and $h_0=1$ in (\ref{eq:dbp_init_wet}).
The following figures show the stage, $x$-momentum, and $x$-velocity at several instants of time.
We should see excellent agreement between the analytical and numerical solutions.

\begin{figure}
\begin{center}
\includegraphics[width=0.9\textwidth]{stage_plot.png}
\end{center}
\caption{Stage results}
\end{figure}

\begin{figure}
\begin{center}
\includegraphics[width=0.9\textwidth]{xmom_plot.png}
\end{center}
\caption{Xmomentum results}
\end{figure}

\begin{figure}
\begin{center}
\includegraphics[width=0.9\textwidth]{xvel_plot.png}
\end{center}
\caption{Xvelocity results}
\end{figure}

\endinput