\chapter{The Local Planning Semantics}\label{chap:5}
\minitoc
\label{sec3}

In Chapter~\ref{chap:2}, we presented a timed automata model for representing timed systems
with multiparty interactions. The semantics of such model is based on the notion of \emph{global
states}, that is, interactions executions are based not only on the state of participating
components but on the states of all components of the system.
Conversely, a distributed system can be seen as a collection of loosely coupled
components that communicate with a scheduling layer which, based on
a partial view of the system, is responsible of taking decisions for interactions executions
and their effective execution dates.
Additionally, high-level coordination primitives, such as multiparty synchronizations
(interactions) are rarely built-in primitives of distributed platforms.
Hence, their implementation on a distributed platform requires
protocols responsible for realizing these synchronizations using simpler primitives such as
point-to-point messages passing.
This is classically implemented using one or more additional
coordination component(s) observing the system state and deciding on interactions executions,
which adds on a communication overhead not reflected by the standard semantics presented in
Chapter~\ref{chap:2}.

This motivates the introduction of the \emph{\lpsb}. This semantics differs from
the standard semantics of timed automata in two main aspect: \emph{(i)} interactions executions
are based only on partial state of the system, that is, based only on the state of components
participating in the considered interaction. Thus, it allows to decide locally without
monitoring the entire system. \emph{(ii)} it distinguishes between the
execution decision of an interaction (its \emph{planning}), and the execution itself.
This distinction allows us to impose a delay between the planning of an interaction and
its execution. The latter is constrained by the (maximal) communication latency induced
by execution platforms, which is a parameter of the semantics.
Trivially, this semantics is correct in the sense that it refines (it is included in) the standard semantics.
However, being based on local states, planning decisions are too permissive and may
introduce deadlocks when they are not compatible with the global state of the system.

\section{Local Planning of Interactions}
\subsection{Definition of the LPS}
\label{subsec:wp}
Let $S=\gamma(B_1,\cdots,B_n)$ be a composition of components $B_1$, \ldots, $B_n$ with
disjoint set of locations, actions and clocks.
We define the predicate $\plnIntxt{\alpha}{\delta}$ characterizing states $(\loc, \val)$
from which an interaction $\alpha = \{ a_i \}_{i \in I} \in \gamma$ is enabled in
$\delta \in \realpoz$ units of time (if time progresses by $\delta$ units of time),
that is, such that $\enabled{\alpha}$ evaluates to true on state $(\loc, \val + \delta)$.
It is characterized by:
\begin{equation}\label{eq:enf1}
\plnIntxt{\alpha}{\delta} = \bigvee_{\substack{\loc\in\Loc\\\loc=(\loc_1,\cdots,\loc_n)}}
  \al{\loc}\wedge\bigwedge_{\substack{i\in I\\a_i\in\alpha}}\big(\Phi(a_i,\loc_i) + \delta\big)
\end{equation}
Notice that for an interaction $\alpha$ the predicate $\plnIntxt{\alpha}{\delta}$ depends only
on states of components of $\p{\alpha}$, which motivates the following property.

\begin{property}\label{pt:plnIn1}
Let $(\loc,\val)$ be a state of the composition $S$. For any interactions $\alpha,\beta\in\gamma$
such that, $(\loc,\val)\transit{\beta}_{\gamma}(\loc',\val')$ and $\p{\alpha}\cap\p{\beta}=
\emptyset$, if $\plnIntxt{\alpha}{\delta}$ holds at state $(\loc,\val)$ then it still
holds at state $(\loc',\val')$.
\end{property}
This property derives directly from the fact that executing an interaction $\beta$ does
not change the states of components participating in an interaction $\alpha$,
provided that $\alpha$ and $\beta$ have disjoint sets of participating components,
and thus, $\plnIntxt{\alpha}{\delta}$ is not affected by the execution of $\beta$ in this case.
In the following, we consider a slightly different definition of conflicts than the one
presented in Chapter~\ref{chap:3} and Chapter~\ref{chap:4}.
We say that two interactions $\alpha$ and $\beta$ \emph{conflicts} when
they have common participating components, that is, when $\p{\alpha}\cap\p{\beta}\neq\emptyset$,
and we write $\alpha\#\beta$.
We denote by $conf(\alpha)$ the set of interactions conflicting with $\alpha$, that is,
$conf(\alpha) = \{ \beta \in \gamma \ | \ \alpha\#\beta \}$.

\begin{property}\label{pt:plnIn2}
Let $(\loc,\val)$ and $(\loc,\val+\delta')$, with $\delta'\in\realpos$ be two states of
the composition $S$. For an interaction $\alpha\in\gamma$, if $\plnIntxt{\alpha}{\delta}$
holds at state $(\loc,\val)$ then $\plnIntxt{\alpha}{\delta-\delta'}$
also holds at any state $(\loc,\val+\delta')$ such that $\delta'\le\delta$.
\end{property}
This property can be found directly by writing expression~\ref{eq:enf1} on state
$(\loc,\val+\delta')$.

As previously explained, due to communication latencies induced by execution platforms,
we assume that interactions cannot be planned in $\delta$ units of time if $\delta < \hmin$,
where $\hmin \in \integerpoz$ is a parameter representing the \emph{minimal planning horizon},
which should represent the upper bound communication latencies.
Notice that for the sake of simplicity, we consider a global parameter $\hmin$ but
we could also assume different parameters for each interaction.
Additionally, we also consider upper bound planning horizons
$\hmax : \gamma \to \integerpoz\cup\{ +\infty \}$
for each interaction such that for any $\alpha\in\gamma$ we have $\hmax(\alpha) \geq \hmin$.
We denote by $\hmaxt$ the upper planning horizon assigning infinity to every $\hmax(\alpha)$.
A direct consequence of introducing the planning horizons is that every interaction $\alpha$
can be planned only using a horizon $\delta$ satisfying $\hmin \leq \delta \leq \hmax(\alpha)$,
meaning that every component $B\in\p{\alpha}$ will be blocked for a duration between
$[\hmin,\hmax(\alpha)]$. Observe that while $\hmin$ represents the worst case estimation of the
communication delays for a given platform, the parameters $\hmax(\alpha)$ will be used later
to find a strategy that avoids deadlocks by restricting the amount of time components
can be blocked for.

For an interaction $\alpha$, we define the predicate $\plntxt{\alpha}$
characterizing states from which $\alpha$ can be planned in a delay respecting
the planning horizons $\hmin$ and $\hmax(\alpha)$, that is:
\begin{displaymath}
\plntxt{\alpha}\Leftrightarrow\exists\delta\in\realpoz\ .\ \hmin\leq\delta\leq\hmax(\alpha)\
  \wedge\ \plnIntxt{\alpha}{\delta},
\end{displaymath}
It can be written formally as follows:
\begin{align}\label{eq:pln}
 \plntxt{\alpha}&=\bigvee_{\substack{\loc\in\Loc\\\loc=(\loc_1,\cdots,\loc_n)}}\al{\loc}\ \wedge\
  \backwardp{\hmin}{\hmx} \Big(\bigwedge_{\substack{i\in I\\a_i\in\alpha}}\Phi(a_i,\loc_i)\Big)\\
                &=\enabledbackwardb{\alpha}{\hmin}{\hmx}
\end{align}

\begin{definition}[Plan]\label{def:plan}
A plan $\pi$ is a function $\pi:\gamma \to\realpoz \cup \{ +\infty \}$ defining relative times
for executing interactions, with the convention that an interaction $\alpha$ is planned to
execute in $\pi(\alpha)$ time units only if $\pi(\alpha) < +\infty$.
Plans satisfy that for any two interactions $\alpha \neq \beta$, such that $\pi(\alpha) < +\infty$
and $\pi(\beta) < +\infty$, the interactions $\alpha$ and $\beta$ are not conflicting
(i.e. $\neg(\alpha\#\beta)$).
\end{definition}
We denote by $\pi_0$ the plan assigning $+\infty$ to every interaction of $\gamma$, that is,
$\forall\alpha\in\gamma,\pi_0(\alpha)=+\infty$. For a plan $\pi$, we consider its minimum value
$\pmin=\min\ \{\pi(\alpha)|\alpha\in\gamma\}$.
We also denote by $\confl(\pi)$ the set of interactions conflicting with the plan $\pi$, i.e.,
$\confl(\pi) = \{ \alpha \ | \ \exists \beta \# \alpha.$ $ \pi (\beta) < +\infty \}$,
and $\p{\pi}$ the set of components participating in interactions planned by
$\pi$, i.e., $\p{\pi}=\{B_i\ |\ \exists\alpha\ . \ \pi(\alpha)<+\infty\wedge B_i\in\p{\alpha} \}$.
Notice that since $\pi$ stores relative times, whenever time progresses by $\delta$, the value
$\pi(\alpha)$ assigned by $\pi$ to an interaction $\alpha$ should be decreased by $\delta$
until it reaches $0$, meaning that $\alpha$ has to execute.
We write $\pi-\delta$ to describe the progress of time
over the plan, that is, $(\pi-\delta)(\alpha) = \pi(\alpha) - \delta$ for interactions $\alpha$
such that $\pi(\alpha) < +\infty$.
Similarly, $\pi [ \alpha \mapsto \delta ]$ assigns relative time $\delta$ to $\alpha$,
$\alpha \notin conf(\pi)$, into existing plan $\pi$, i.e. $(\pi [ \alpha \mapsto \delta ])
(\beta) = \delta$ for $\beta = \alpha$, $(\pi [ \alpha \mapsto \delta ])(\beta) = \pi(\beta)$
otherwise.

\begin{definition}[Local Planning Semantics]\label{def:pln_sem}
Given a set of components $\{B_1,\cdots,B_n\}$ and an interaction set $\gamma$,
we define the \lps (LPS) of the composition $\gamma(B_1,\cdots,B_n)$,
as the TTS $(\Q_p,q_{p_0},\gamma\cup\realpos\cup(\gamma\times\realpoz),\tranbp{}{3})$ where:
\begin{itemize}
  \item $\Q_p=\Loc\times\mathcal{V}(\X)\times\Pi$, where $\Loc$ is the set of global locations,
    $\mathcal{V}(\X)$ is the set of global clock valuation, and $\Pi$ is the set of plans.
  \item $(\gamma\times\realpoz)$ defines the action of planning interactions of $\gamma$ and
    their relative times.
  \item $\tranbp{}{3}$ is the set of transitions defined by the rules:
    \begin{itemize}%[leftmargin=0em]
      \item $(\loc,\val,\pi)\tranbp{(\alpha,\delta)}{4}(\loc,\val,\pi [ \alpha\mapsto\delta ])$
        for $\alpha \in \gamma$, $\hmin\le\delta\le\hmax$ and $\delta\neq+\infty$
        if $\alpha \notin\confl(\pi)$ and
        $\plnIntxt{\alpha}{\delta}$ holds on $(\loc,\val,\pi)$.

      \item $(\loc,\val,\pi)\tranbp{\alpha}{3}(\loc',\val', \pi [ \alpha\mapsto+\infty ])$
        for $\alpha \in \gamma$ if $\pi(\alpha) = 0$ and $(\loc,\val)\transit{\alpha}_{\gamma}
        (\loc',\val')$.

      \item $(\loc,\val,\pi)\tranbp{\delta}{3}(\loc,\val+\delta,\pi-\delta)$ for
        $\delta \le \pmin$, $\loc = (\loc_1, \ldots, \loc_n)$, if
        $(\val + \delta)\models\I(\loc_i)$ for components $B_i \in \p{\pi}$ and
        $(\val + \delta + \hmin)\models\I(\loc_i)$ for components $B_i \notin \p{\pi}$.
  \end{itemize}
\end{itemize}
\end{definition}

Remark that in the above definition as well as in what follows, predicates defined on states
$(\loc,\val) \in \Q_g=\Loc\times\mathcal{V}(\X)$ of the standard semantics are
straightforwardly interpreted on states $(\loc,\val,\pi) \in \Q_p$ considering the
projection $(\loc,\val)$ of $(\loc,\val,\pi)$ on $\Q_g$.

States of the \lpsabrb do not include only locations and clock valuations,
but also the relative execution times of the planned interactions stored by $\pi$.
Initially, no interaction is planned, that is, initial states $(\loc_0,\val_0,\pi_0)$
satisfy $\pi_0 = +\infty$.
Planning an interaction $\alpha$ to be executed at a relative time $\hmin\le\delta\le\hmax
(\alpha)$ corresponds to the operation $\pi [ \alpha\mapsto\delta ]$ on the plan,
which can only be done if $\alpha$ is not conflicting with the latter, and becomes enabled if
time progresses by $\delta$ (i.e. if $\plnIntxt{\alpha}{\delta}$).
On the other hand, time progress not only updates clock values but also the plan by
decreasing the relative execution times of the planned interactions.
To force the execution of planned interactions when their relative execution times reach $0$,
time cannot progress more than the relative execution times of the interactions
(more than $\delta \le \pmin$).
As for the standard semantics, time progress is limited by the location invariants conditions
of the components, but with the following significant difference:
Components $B_i \in \p{\pi}$ participating in planned interactions behave as in the standard
semantics, that is, time can progress until their invariants become urgent.
For components $B_i \notin \p{\pi}$, i.e., that are not participating in planned interactions,
we take into account the minimal delay $\hmin$ needed for planning and then executing an
interaction: in components $B_i \notin \p{\pi}$ time can progress only up to $\hmin$ time
units before the urgency of their location invariants.
By doing so, we ensure that there always remains enough time to plan interactions involving
$B_i \notin \p{\pi}$ , if they exist, and execute them before their invariants
expire.

\begin{example}
  \label{exp:dl}
  Let us consider the following execution sequence for example of Figure~\ref{fig:tm} under
  the LPS with $\hmin = 2$ and $\hmax=\hmaxt$.
\begin{displaymath}
    \begin{split}
      &((\loc_0^1,\loc_0^2,\loc_0^3,\loc_0^4),(0,0,0),+\infty)\tranbp{(\alpha_1,26)}{6}
      ((\loc_0^1,\loc_0^2,\loc_0^3,\loc_0^4),(0,0,0),\{\alpha_1\mapsto26\})\tranbp{26}{3}\\
      &((\loc_0^1,\loc_0^2,\loc_0^3,\loc_0^4),(26,26,26),\{\alpha_1\mapsto0\})
      \tranbp{\alpha_1}{3}((\loc_1^1,\loc_1^2,\loc_0^3,\loc_0^4),(26,26,26),+\infty)\\
      &\tranbp{(\alpha_3,2)}{6}((\loc_1^1,\loc_1^2,\loc_0^3,\loc_0^4),(26,26,26),
      \{\alpha_3\mapsto2\})\tranbp{2}{3}((\loc_1^1,\loc_1^2,\loc_0^3,\loc_0^4),(28,28,28),\\
      &\{\alpha_3\mapsto0\})\tranbp{\alpha_3}{3}((\loc_0^1,\loc_2^2,\loc_0^3,\loc_0^4),
      (0,28,0),+\infty)\tranbp{(\alpha_2,26)}{6}((\loc_0^1,\loc_2^2,\loc_0^3,\loc_0^4),\\
      &(0,28,0),\{\alpha_2\mapsto26\})\tranbp{26}{3}((\loc_0^1,\loc_2^2,\loc_0^3,\loc_0^4),
      (26,54,26),\{\alpha_2\mapsto0\})\tranbp{\alpha_2}{3}\\
      &((\loc_1^1,\loc_2^2,\loc_1^3,\loc_0^4),(26,54,26),+\infty)\tranbp{(\alpha_4,2)}{6}
      ((\loc_1^1,\loc_2^2,\loc_1^3,\loc_0^4),(26,54,26),\{\alpha_4\mapsto2\})\\
      &\tranbp{2}{3}((\loc_1^1,\loc_2^2,\loc_1^3,\loc_0^4),(28,56,28),\{\alpha_4\mapsto0\})
      \tranbp{\alpha_4}{3}((\loc_0^1,\loc_2^2,\loc_2^3,\loc_0^4),(28,0,0),+\infty)\\
      &\tranbp{(\alpha_6,30)}{6}((\loc_0^1,\loc_2^2,\loc_2^3,\loc_0^4),(28,0,0),
      \{\alpha_6\mapsto30\})
    \end{split}
  \end{displaymath}
This execution sequence represents a path that alternates plan actions, time progress and
execution of some interactions, and leads to the action-time-lock state
$((\loc_0^1,\loc_2^2,\loc_2^3,\loc_0^4),(0,0,28),\{\alpha_6\mapsto30\})$.
In fact, the location invariant $x\leq30$ in component $T_1$, imposes the
planning of interaction $\alpha_7$ at the latest $h_{min}$ units of time before it becomes
urgent. However, since interaction $\alpha_6$ was planned in 28 units of time, $\alpha_7$
cannot be planned since it is conflicting with $\alpha_6$.
This execution sequence shows that a given system action-time-locks under the \lps, even if
it is deadlock-free in the standard semantics.
\end{example}

\subsection{Properties of the LPS}\label{subsec:planprop}
We use weak simulation to compare models of
the standard semantics and the local planning semantics
by considering the planning transitions unobservable.
As shown in Example~\ref{exp:dl}, the \lpsabrb does not preserve the deadlock freedom
property of our system.
Nevertheless, the following proves weak simulation relations between the two semantics.

\begin{lemma}\label{lem:pi_pln}
  Given a reachable state $(\loc,\val,\pi)$ of the \lpsabr. If for $\alpha\in\gamma$,
  $\pi(\alpha) < +\infty \Rightarrow \plnIntxt{\alpha}{\pi(\alpha)}$.
\end{lemma}

\begin{proposition}\label{prop:r1}
An interaction can execute from a state $(\loc,\val,\pi)$ in the \lpsabrb semantics only if
it can execute from $(\loc,\val)$ in the standard semantics, that is:
\begin{displaymath}
      \forall\alpha\in\gamma.(\loc,\val,\pi)\tranbp{\alpha}{3}(\loc',\val',\pi')
      \Rightarrow (\loc,\val)\transit{\alpha}_{\gamma}(\loc',\val').
\end{displaymath}
\end{proposition}

Proposition~\ref{prop:r1} is a consequence of Lemma~\ref{lem:pi_pln}: an interaction $\alpha$
can execute in the \lps only if $\pi(\alpha) = 0$ (see Definition~\ref{def:plan}).
That is, a state $(\loc,\val,\pi)$ of the \lpsabrb from which $\alpha$ can execute satisfies
$\plnIntxt{\alpha}{0}$ or equivalently $\enabled(\alpha)$, which demonstrates that $\alpha$
can execute from $(\loc,\val)$ in the standard semantics.

\begin{proposition}\label{prop:r2}
Time can progress by $\delta$ at a state $(\loc,\val,\pi)$ in the \lps only if time can
progress by $\delta$ at $(\loc,\val)$ in the standard semantics, that is:
\begin{displaymath}
      \forall\delta\in\realpos.(\loc,\val,\pi)\tranbp{\delta}{3}(\loc',\val',\pi')
      \Rightarrow (\loc,\val)\transit{\delta}_{\gamma}(\loc',\val').
\end{displaymath}
\end{proposition}

Proposition~\ref{prop:r2} is a direct consequence of the definition of time progress in
the \lps which is a restriction of the one in the standard semantics.

\begin{corollary}\label{cr:reach}
If a state $(\loc,\val,\pi)$ is reachable in the \lpsb, then the state $(\loc,\val)$ is
  reachable in the standard semantics.
\end{corollary}

Corollary~\ref{cr:reach} is obtained from Propositions~\ref{prop:r1} and~\ref{prop:r2} and the
fact that planning transitions (labeled by $(\alpha,\delta)$) affect only the plan $\pi$ in
states $(\loc,\val,\pi)$ of the \lpsabr.

The definition of weak simulation (Definition~\ref{def:wsim})
is based on the unobservability of $\beta-$transitions.
In our case, $\beta-$transitions corresponds to planning transitions.
Let $\tts_g$ and $\tts_p$ be respectively the underlying timed transition system of the standard
semantics and the \lps respectively.
\begin{corollary}\label{cr:sim}
  $\tts_p\simuw{R} \tts_g$ with $R=\{((\q,\pi);\q)\in\Q_p\times\Q_g\}$.
\end{corollary}

Corollary~\ref{cr:sim} corresponds to a notion of correctness of the \lpsb: any execution in
the \lpsabrb corresponds to an execution in the standard semantics.
In addition, if interactions are allowed to be planned with relative execution times of $0$
(i.e. $\hmin = 0$) then timeless planning of interactions becomes possible. Thus, the planning
semantics simulates the standards semantics in that case.
\begin{corollary}
  $\tts_g\simuw{R'} \tts_p$ with $R'=\{(\q;(\q,\pi))\in\Q_g\times\Q_p\ | \ \hmin=0\}$.
\end{corollary}

However, this is no longer true in general if  $\hmin > 0$ which means that not all execution
sequences of the standard semantics are preserved by the \lpsb.

\begin{corollary}\label{cr:zeno}
  If $\tts_g$ is zeno runs free then $\tts_p$ is too.
\end{corollary}
Corollary~\ref{cr:zeno} states that the $\lpsabr$ does not introduce any zenoness behavior if
the standard semantics is free from the latter. It is a direct consequence of
Corollary~\ref{cr:sim} and the fact that it is not possible to have infinite sequences of
planning transitions without interaction execution ($\gamma$ is finite and planning times are
bounded).
\begin{proposition}\label{prop:deadlock-timelock}
If every reachable state of $\tts_g$ is not a deadlock, then a reachable state of $\tts_p$ is not
  deadlock if and only if it is not an action-time-lock.
\end{proposition}
\begin{proof}[Proof of Propostion~\ref{prop:deadlock-timelock}]
  We prove Proposition~\ref{prop:deadlock-timelock} by contradiction.
  Let us assume that the system under the standard (resp. local planning) semantics is
  deadlock free (resp. action-time-lock-free).
  Let $(\loc,\val,\pi)$ be a reachable deadlock state of the \lpsabr. We have:
  \begin{displaymath}
    \nexists\sigma\in\gamma\cup(\gamma\times\realpoz),\exists\delta.\ (\loc,\val,\pi)
    \tranbp{\sigma}{3}(\loc',\val',\pi')
    \vee(\loc,\val,\pi)\tranbp{\delta}{3}(\loc,\val+\delta,\pi-\delta)\tranbp{\sigma}{3}
    (\loc',\val',\pi')
  \end{displaymath}

  We denote by $wait(\loc,\val,\pi)$ the set of allowed waiting times at state $(\loc,\val,\pi)$,
  that is:
\begin{displaymath}
  wait(\loc,\val,\pi)=\{0\}\cup\{\delta\in\realpos|(\loc,\val,\pi)\tranbp{\delta}{3}
  (\loc,\val+\delta,\pi-\delta)\}
\end{displaymath}
We also put $\max(wait(\loc,\val,\pi))$ to denote the maximal waiting time at state
$(\loc,\val,\pi)$. Notice that $\max(wait(\loc,\val,\pi))$ may not be defined in some cases.
In fact, we are not interested in its actual existence but rather in the fact that it is
bounded ($<+\infty$) or not.
\begin{lemma}\label{lemma:wait}
  Let $(\loc,\val,\pi)$ be a reachable state of the \lpsb. For $k\in\realpoz$, such
  that $k=\max(wait(\loc,\val,\pi))$, we have the following properties:
  \begin{description}
    \item[\namedlabel{p1}{P1}] If $k<+\infty$ then $(\loc,\val,\pi)\tranbp{k}{3}
      (\loc,\val+k,\pi-k)\wedge wait(\loc,\val+k,\pi-k)=\{0\}$
    \item[\namedlabel{p2}{P2}] If $\pi\neq\pi_0$ then $k\le\pmin$
  \end{description}

\end{lemma}

We distinguish 2 cases:
\paragraph*{Case 1: no interaction is planned (i.e. $\pi =\pi_0$)}
By definition of the \lpsabr, it is clear that for $\pi=\pi_0$, there is no interaction to
execute from $(\loc,\val,\pi)$ or any of its successor $(\loc,\val+\delta,\pi-\delta)$.
\begin{enumerate}
  \item $wait(\loc,\val,\pi)=\{0\}$:\\
    This means that time progress is not allowed at state $(\loc,\val,\pi)$. We also have
    $\nexists\sigma\in(\gamma\times\realpoz).(\loc,\val,\pi)\tranbp{\sigma}{3}(\loc',\val',\pi')$
    (deadlock assumption). We can conclude that $(\loc,\val,\pi)$ is a reachable action-time-lock
    state, which contradicts the assumption that the system under the \lps is
    action-time-lock-free.
  \item $wait(\loc,\val,\pi)\neq\{0\}$:
    \begin{enumerate}
      \item $\max(wait(\loc,\val,\pi))=+\infty$:\\
        \begin{lemma}\label{lemma:deadlock}
        Let $(\loc,\val,\pi)$ be a reachable state of the \lps.
        If $ \ \forall\delta\in\realpos. \ (\loc,\val,\pi)\tranbp{\delta}{3}
          (\loc,\val+\delta,\pi-\delta)\wedge\neg\plntxt{\alpha}$ at $(\loc,\val,\pi)$,
        then we have $\neg\enabled(\alpha)$ at $(\loc,\val+\delta,\pi-\delta)$ with
          $\delta\ge h_{\min}$.
      \end{lemma}
      By~\ref{p1} of Lemma~\ref{lemma:wait} we can deduce that $\exists\delta\ge h_{\min}$
      such that $(\loc,\val,\pi)\tranbp{\delta}{3}(\loc,\val+\delta,\pi-\delta)$.
      We also have from the deadlock assumption and Lemma~\ref{lemma:deadlock}:
      $\bigwedge_{\alpha\in\gamma}\neg\enabled(\alpha)$. Finally, since the state
      $(\loc,\val+\delta,\pi-\delta)$ is reachable in the standard semantics, and by evaluating
      the deadlock characterization~\ref{eq:dl} on state $(\loc,\val+\delta,
      \pi-\delta)$, we can conclude that the system under the standard semantics deadlocks,
      which contradicts the assumption of deadlock freedom of the system under the standard
      semantics.
      \item $\max(wait(\loc,\val,\pi))<+\infty$:\\
      Considering that $k=\max(wait(\loc,\val,\pi))$, then we have by~\ref{p1} of
      Lemma~\ref{lemma:wait}: $(\loc,\val,\pi)\tranbp{k}{3}(\loc,\val+k,\pi-k)\wedge
      wait(\loc,\val+k,\pi-k)=\{0\}$. Using the deadlock assumption we have:
      $\bigwedge_{\alpha\in\gamma}\neg\plntxt{\alpha}$ at state $(\loc,\val+k,\pi-k)$.
      Since the system cannot progress beyond this state ($wait(\loc,\val+k,\pi-k)=\{0\}$),
      we can conclude that $(\loc,\val+k,\pi-k)$ is a reachable action-time-lock state,
      which contradicts the assumption that the system under the \lps is action-time-lock-free.

    \end{enumerate}
\end{enumerate}

\paragraph*{Case 2: at least an interaction is planned (i.e. $\pi \neq \pi_0$)}
Considering that $k=\max(wait(\loc,\val,\pi))$, since $\pi\neq+\infty$, we have by~\ref{p2} of
Lemma~\ref{lemma:wait}: $k<+\infty\wedge k\le\min\pi$. Using the deadlock assumption we can
infer that $k<\min\pi$, since
no execution is possible from $(\loc,\val,\pi)$ or any of its successors.
This means that $(\loc,\val+k,\pi-k)$ is a reachable action-time-lock state,
which contradicts the assumption that the system under the \lpsabrb is action-time-lock-free.
\end{proof}

\section{Enforcing Deadlock-Free Planning}
\label{sec4}
As explained in previous section, the \lps is based on local conditions for planning interactions
and may exhibit deadlocks even when the system is deadlock-free with the standard semantics.
Such deadlocks are partly due to the fact that planning an interaction may block, in addition to
the participating components, extra components whose timing constraints are not considered by
these local conditions. In this section, we investigate simple execution strategies that only
restrict the horizon used for planning interactions with upper bounds.
By reducing the period of time during which components are blocked, they tend to remove deadlocks
from the reachable states.
In what follows, we consider a composition of components $S = \gamma(B_1,\cdots,B_n)$
such that it is deadlock-free in the standard semantics.

\begin{corollary}[Sufficient Condition for Deadlock-freedom]
  \label{cr:suff}
  If a reachable state of the planning semantics is not an action-time-lock then it is not
deadlock.
\end{corollary}
Corollary~\ref{cr:suff} is a direct consequence of Proposition~\ref{prop:deadlock-timelock}.
It affirms that for systems that are initially deadlock-free under the standard semantics,
it is sufficient to prove action-time-lock-freedom of the \lpsabrb
to prove its deadlock-freedom.

\begin{proposition}\label{prop:timelocks}
A reachable state $(\loc,\val,\pi)$ of the \lps is an action-time-lock if and only if:
\begin{displaymath}
  \pi>0 \ \wedge \bigwedge_{\alpha \notin conf(\pi)} \hspace*{-2ex} \neg\plntxt{\alpha} \ \wedge
  \hspace*{-1ex} \bigvee_{\substack{\loc_i \in \Loc_i \\ B_i \notin \p{\pi}}} \hspace*{-2ex}
  \al{\loc_i} \ \wedge (\urg(\loc_i) + \hmin).
\end{displaymath}
\end{proposition}
The above proposition derives directly from the definition of action-time-locks on a state
of the \lpsb.
As shown in Example~\ref{exp:dl}, the \lps may introduce deadlocks.
The source of deadlocks is twofold: \emph{(i)} due to communication delays,
consecutive execution in a component are separated by at least $\hmin$ units of time which may
be incompatible with its timings constraints, and \emph{(ii)} conditions for planning
interactions are too permissive as they only take into account timing constraints of
participating components whereas they may block additional components, namely the ones
participating in conflicting interactions.
In the rest of the paper, we study how to generate planning strategies for preserving
deadlock-freedom by restricting the planning transitions of the \lpsabrb so that deadlock
states become unreachable.
Such a strategy may not exist when timing constraints cannot accommodate with the
communication delays $\hmin$.

From Corollary~\ref{cr:suff}, action-time-lock-freedom is a sufficient
condition for deadlock-freedom of the \lpsabr.
By Proposition~\ref{prop:timelocks}, a state $(\loc,\val,\pi)$ is an action-time-lock in the
\lps if and only if no time progress is allowed nor planning or execution of interactions from
$(\loc,\val,\pi)$, that is:
\begin{displaymath}
  \pi>0 \ \wedge \ \bigwedge_{\alpha \in \gamma \setminus conf(\pi)} \hspace*{-2ex} \neg
  \plntxt{\alpha} \ \wedge
  \hspace*{-1ex} \bigvee_{\substack{\loc_i \in \Loc_i \\ B_i \notin \p{\pi}}} \hspace*{-2ex}
  \al{\loc_i} \ \wedge(\urg(\loc_i) + \hmin).
\end{displaymath}
The above predicate characterizes the fact that no interaction can be executed or planned,
nor time can progress in component $B_i \notin \p{\pi}$.
Consequently, we deduce that a necessary condition of action-time-lock is the existence of a
component $B_i \notin \p{\pi}$ such that time cannot progress in $B_i$ and $B_i$ cannot be
planned in an interaction, that is:
\begin{displaymath}
  \bigwedge_{\substack{\alpha \in \gamma(B_i) \setminus conf(\pi)}} \hspace*{-4ex}
  \Big(\neg\plntxt{\alpha} \ \wedge \ \bigvee_{\loc_i \in \Loc_i} \hspace*{-1ex} \al{\loc_i} \
  \wedge(\urg(\loc_i) + \hmin)\Big).
\end{displaymath}
where $\gamma(B_i)$ denotes the subset of interactions in which $B_i$ participates, that is,
$\gamma(B_i) = \{ \beta \in \gamma \ | \ B_i \in \p{\beta} \}$.
Notice that the above expression strongly depends on the plan $\pi$, which is difficult to
characterize in practice.
The following theorem proposes sufficient plan-independent condition characterizing
action-time-lock states of the \lpsabrb.
\begin{theorem}\label{thm:dla}
  Let $\phi$ be the following predicate:
\begin{displaymath}
  \bigvee_{1\le i\le n}\Big[\bigvee_{\loc_i \in \Loc_i}\al{\loc_i}\ \wedge(\urg(\loc_i)+\hmin) \
  \wedge\bigwedge_{\alpha \in \gamma(B_i)}\hspace*{-1ex}\Big(  \neg\plntxt{\alpha} \
  \vee\hspace*{-2ex}\bigvee_{\substack{\beta\in\confl(\alpha)\\B_i\notin\p{\beta}}}\hspace*{-1ex}
  \overline{\plntxt{\beta}} \Big)\Big].
\end{displaymath}
We prove that a reachable action-time-lock state $(\loc,\val,\pi)$ satisfies $\phi$.
\end{theorem}
\begin{proof}[Proof of Theorem~\ref{thm:dla}]
A reachable action-time-lock state of the \lpsabrb satisfies:
\begin{displaymath}
  \pi>0 \ \wedge \ \bigwedge_{\substack{\alpha \in \gamma(B_i) \setminus conf(\pi)}}
  \hspace*{-4ex} \Big(\neg\plntxt{\alpha} \ \wedge \ \bigvee_{\substack{\loc_i \in \Loc_i \\
  B_i \notin \p{\pi}}} \hspace*{-1ex} \al{\loc_i} \ \wedge(\urg(\loc_i) + \hmin)\Big).
\end{displaymath}

In order to approximate the above formula, we distinguish two cases:
\paragraph*{Case 1: no interaction is planned (i.e. $\pi = \pi_0$)\\}
From $\pi = +\infty$ we deduce directly that there exists an urgent component $B_i$
such that no interaction $\alpha$
involving $B_i$ can be planned, that is:
\begin{equation}
\label{eq:case1}\tag{1}
\bigvee_{\substack{1\le i\le n}}\Big[\bigvee_{\loc_i \in \Loc_i}\al{\loc_i}\ \wedge(\urg(\loc_i)
  +\hmin) \ \wedge\bigwedge_{\substack{\alpha \in \gamma(B_i)}} \hspace*{-1ex}\neg\plntxt{\alpha}
  \Big].
\end{equation}

\paragraph*{Case 2: at least an interaction is planned (i.e. $\pi \neq\pi_0$)\\}
In this case, there exists an urgent component $B_i \notin \p{\pi}$ such that no interaction
$\alpha$ involving $B_i$ can be planned, either because it conflicts with a planned interaction
$\beta$ ($0<\pi(\beta)<+\infty$) or because $\plntxt{\alpha}$ is not satisfied, that is
$\exists\beta\in\pi,\exists B_i\notin\p{\beta}$ satisfying:
\begin{displaymath}
  (0<\pi(\beta)<+\infty) \ \wedge\bigwedge_{\substack{\alpha \in \gamma(B_i) \setminus
  conf(\beta)}} \hspace*{-4ex} \neg\plntxt{\alpha} \ \wedge \ \bigvee_{\substack{\loc_i \in
  \Loc_i \\ B_i \notin \p{\beta}}} \hspace*{-1ex} \al{\loc_i} \ \wedge(\urg(\loc_i) + \hmin).
\end{displaymath}
or equivalently $\exists\beta\in\pi,\exists B_i\notin\p{\beta}$ satisfying:
\begin{displaymath}
  \bigvee_{\substack{\loc_i \in \Loc_i \\ B_i \notin \p{\beta}}} \hspace*{-1ex} \al{\loc_i} \
  \wedge(\urg(\loc_i) + \hmin) \ \wedge\bigwedge_{\alpha \in \gamma(B_i) }
 \Big(\neg\plntxt{\alpha}\vee\big(\beta\in\confl(\alpha)\wedge (0<\pi(\beta)<+\infty)\big)\Big) .
\end{displaymath}
By noticing that we have the following implication between quantifiers
$\exists y,\forall x. Q(x,y)\implies\forall x,\exists y. Q(x,y)$, we can deduce that the
above condition implies:
\begin{displaymath}
  \bigvee_{1\le i\le n}\Big[\bigvee_{\loc_i \in \Loc_i}\al{\loc_i}\ \wedge(\urg(\loc_i)+\hmin) \
  \wedge\bigwedge_{\alpha \in \gamma(B_i)}\hspace*{-1ex}\Big(  \neg\plntxt{\alpha} \
  \vee\hspace*{-2ex}\bigvee_{\substack{\beta\in\confl(\alpha)\\B_i\notin\p{\beta}}}\hspace*{-1ex}
0<\pi(\beta)<+\infty \Big)\Big].
\end{displaymath}

As $\pi > 0$, and if we consider only reachable action-time-locks, we have $0 < \pi(\beta) \leq
\hmax(\beta)$, and by Lemma~\ref{lem:pi_pln} we have $\plnIntxt{\beta}{\pi(\beta)}$.
That is, $\beta$ satisfies  $\plntxt{\beta}$ in which the lower bound $\hmin$ is replaced by the
strict lower bound 0, i.e.:
\begin{displaymath}
\overline{\plntxt{\beta}} \Leftrightarrow \exists \delta > 0\ . \ \delta \leq \hmax(\beta) \
  \wedge \ \plnIntxt{\beta}{\delta}.
\end{displaymath}
Then, the above expression becomes:
\begin{equation}
  \label{eq:case2}\tag{2}
  \bigvee_{1\le i\le n}\Big[\bigvee_{\loc_i \in \Loc_i}\al{\loc_i}\ \wedge(\urg(\loc_i)+\hmin) \
  \wedge\bigwedge_{\alpha \in \gamma(B_i)}\hspace*{-1ex}\Big(  \neg\plntxt{\alpha} \
  \vee\hspace*{-2ex}\bigvee_{\substack{\beta\in\confl(\alpha)\\B_i\notin\p{\beta}}}\hspace*{-1ex}
  \overline{\plntxt{\beta}} \Big)\Big].
\end{equation}

By remarking that Expression~\ref{eq:case1} implies Expression~\ref{eq:case2},
we can conclude that an action-time-lock of the \lps satisfies:
\begin{displaymath}
  \bigvee_{1\le i\le n}\Big[\bigvee_{\loc_i \in \Loc_i}\al{\loc_i}\ \wedge(\urg(\loc_i)+\hmin) \
  \wedge\bigwedge_{\alpha \in \gamma(B_i)}\hspace*{-1ex}\Big(  \neg\plntxt{\alpha} \
  \vee\hspace*{-2ex}\bigvee_{\substack{\beta\in\confl(\alpha)\\B_i\notin\p{\beta}}}\hspace*{-1ex}
  \overline{\plntxt{\beta}} \Big)\Big].
\end{displaymath}
\end{proof}

Notice that due to the monotony of $\phi$ on upper bound horizons, we obtain the following lemma:

\begin{lemma}\label{lemma:mon}
  If $\tts_p$ is action-time-lock free for the upper bound horizons function $\hmax$,
  then it is action-time-lock free for any upper bound horizon function $\hmax'\le\hmax$.
\end{lemma}

In order to attest that planning interactions does not introduce deadlocks,
we use an SMT solver to check the satisfiability of $\phi$.
As explained earlier, a given system is deadlock-free under
the restricted \lpsabrb if $Reach(\tts_p)\wedge\phi$ is unsatisfiable. Since
$Reach(\tts_p)\subseteq Reach(\tts_g)$ (Corollary~\ref{cr:sim}), we can verify the above on
$Reach(\tts_g)$.
Effectively, we do not compute $Reach(\tts_g)$ to avoid the combinatorial explosion problem,
inherent to composition of timed automata. In fact, we rather build an over-approximation,
$\overline{Reach(\tts_g)}$, of the latter, and use it during our verification.
Finding a strategy granting action-time-lock-freedom is based on the idea of restricting
the upper bound horizon function $\hmax$. In fact, since $\hmin$ is a parameter that is
dependent of the communication latency of a given execution platform, it cannot be tuned.
Instead, initially for each interaction $\alpha\in\gamma$, $\hmax(\alpha)=+\infty$. Thereafter,
due to the monotony of $\phi$ (Lemma~\ref{lemma:mon}) on upper horizons, this parameter will be
refined, that is, its maximum will be decreased until finding a function $\hmax$ for which
$\reacha\wedge\phi$ is unsatisfiable or until reaching the upper horizon function
$\hmaxm$ for which $\hmax(\alpha)=\hmin$ for every $\alpha\in\gamma$ and such that
$\reacha\wedge\phi$ is satisfiable.

\section{Planning Semantics as Real-Time Controller Synthesis}
\label{sec5}

In Section~\ref{sec5}, we presented a method that provides execution strategies
by restricting the upper bounds planning horizon for each interaction. This strategy aims
to preserve the deadlock-freedom property of a given system under the local planning semantics
without imposing further scheduling constraints.
This approach relies on the verification of a given expression on over-approximations of the
reachable states of the initial semantics. Thus, it may give false-positive results due to
\emph{(i)} the nature of expression to check (sufficient condition) and \emph{(ii)} the
over-approximation of the reachable states of the $\lpsabrb$ using over-approximations of
the reachable states of the standard semantics (Corollary~\ref{cr:sim}).

In such cases, an alternative is to tackle the problem as a real-time controller synthesis
problem. Real-time controller synthesis is a common method used to extract an execution
strategy from formal specifications satisfying certain properties. Usually, these properties
express the reachability (resp. non-reachability) of a set of winning states (resp. bad states).
In case of planning interactions with bounded horizons, the idea is to restrict the
transition relation so that all the remaining
behaviors do not lead to states where a component is urgent and no possible execution
including this component may occur. This can be formalized as a reachability game for a timed
game automaton~\cite{tiga:alg}, where the main idea consists in trying to find an execution
strategy guaranteeing that a given set of namely \emph{bad states} of the system are never
reached.

In order to apply this approach, it is required to encode the planning of interactions
and their effects on the system, that is, \emph{(i)} encode interactions planning as
synchronizations between components, \emph{(ii)} reserve the components of the planned
interactions until their chosen execution date, i.e, keep track of the planned interactions
and their execution dates, and \emph{(iii)} characterize the set of bad states.
Thereafter, tools such as UPPAAL-Tiga~\cite{tiga} can be used to find an execution strategy of
the planning semantics avoiding the set of bad states, that is, deadlock states.
Expressing the planning problem as a real-time controller synthesis problem is not
an easy task. Hereinafter, we discuss the different issues met during the formalization
process and provide suggestions for solving them.
\subsection{Planning Zones}

From Equation~\ref{eq:pln}, we can see that the clocks values for planning an interaction
$\alpha$ are calculated at a global level, that is, by applying the
$\backwardp{\hmin}{\hmx}$ on the conjunction of its participating actions timing constraints.
Notice that for a timing constraint $g=g_1\wedge g_2$, we have:
\begin{equation}\label{eq:plz}
  \backwardp{\hmin}{\hmx} g=\backwardp{\hmin}{\hmx}(g_1\wedge g_2) \implies\backwardp{\hmin}{\hmx}
  g_1\wedge\backwardp{\hmin}{\hmx} g_2
\end{equation}

The above equation bears out the fact that planning states must be encoded on the composition
of the system model and not on individual components. Particularly, equation~\ref{eq:plz}
points out the fact that encoding the planning on transitions of individual components
will induce additional behavior ($\backwardp{\hmin}{\hmx}(g_1\wedge g_2) \implies
\backwardp{\hmin}{\hmx} g_1\wedge\backwardp{\hmin}{\hmx}g_2$). This represents the first
drawback of
this method since building the composition may be tedious especially for big scale systems.
Therefore, a simple solution to avoid computing the composition is to consider
models with interactions having timing constraints on up to one of their participating
actions, that is, given an interaction $\alpha=\{a_i\}_{i\in I}\in\gamma$, we have
$g_{\alpha}=\true$ or $g_{\alpha}=g_{a_i}$, with $g_{a_j}=\true$ for $j\in I, j\neq i$.
In fact, considering interactions including up to one action with timing constraints,
will allow to encode the planning on individual components that, additionally to the defined
synchronizations (interactions), will also synchronize their planning actions.

The idea is to split each transition of the initial model into two transitions:
\emph{(1)} a planning transition, followed by \emph{(2)} an execution transition
after the plan transition being performed. For an interaction $\alpha\in\gamma$, the choice
of the planning horizon, that is, the duration for which components participating in $\alpha$
will be blocked for until their execution, will be encoded on the execution transition of
the component whose action $a_i\in\alpha$ and $g_{\alpha}=g_{a_i}$. Otherwise,
if $g_{\alpha}=\true$ this choice is made arbitrarily. Consequently, this component will be
equipped with a clock $x_p$ that will be used to track the planning dates.
Finally, location invariants must also be translated to enforce planning
at the latest $\hmin$ units of time before their expiry.
Figure~\ref{fig:enc} depicts an overview of such transformation for $\delta=\hmin$ horizon:
\input{./Figures/planEncode.tex}

\subsection{Infinite Planning Transitions}

Effectively, in order to encode the planning in timed automata, horizons values must
be integer. Moreover, due to the dense time nature of the planning intervals (relative
planning date for each interaction$\alpha$ are in $[\hmin,\hmax(\alpha)]$), we end up with
an infinity of plan transitions, especially when not restricted upper bound planning horizons,
i.e., $\hmax=\hmaxt$.
Consequently, the first thing to do is to restrict for each interaction $\alpha\in\gamma$ the
upper bound planning horizon $\hmax(\alpha)$.Thereafter, we propose to discretize the
planning horizons in order to obtain finite values in $\integerpos$ (Figure~\ref{fig:disc}).
In what follows, we denote by $Disc:\gamma\lto\mathcal{D}$ the discretized horizon function
defining for each interaction its respective discretized planning horizons
$\mathcal{D}\subset\integerpos$.

\input{./Figures/infinitPlan.tex}

\begin{definition}[Planning Timed Automaton]
  \label{def:plan_aut}
  Given n timed components $\tcal{B}_i=(\Loc_i,\loc_0^i,\A_i,\T_i,\X_i,\I_i)$ synchronizing
  through the interaction set  $\gamma$ such that, for each interaction $\alpha\in\gamma$,
  the guard of $\alpha$ is equal to the guard of one of its included actions.
  We define the corresponding planning model as the composition of the n timed automata
  $\tcal{B}_i^p=(\Loc_i^p,\loc_0,\A_i\cup\tcal{P}_i,\T_i^p,\X_i\cup\{x_i^p\},\I_i^p)$,
  w.r.t the interaction set $\gamma\cup\tcal{P}$, where:
  \begin{itemize}
    \item $\tcal{P}_i=\cup_{a\in\A_i} \ p_{a}$ is the set of \emph{Planning Actions}
    \item $\tcal{P}=\{p_{\alpha}=\{p_{a_i}\}_{i\in I}|\alpha\in\gamma\wedge\alpha=
      \{a_i\}_{i\in I}\}$ is the set of \emph{Planning Interactions}
    \item $x_i^p$ is a \emph{Tracking Clock} for interactions execution in each component
    \item $\Loc_i^{p}=(\Loc_i\cup\Loc_{i_p})$ is the set of control locations, where
      $\Loc_{i_p}$ is the set of locations following planning actions
    \item $\T_i^p$ is such that for each $(\loc_i,a_i,g_i,r_i,\loc'_i)\in\T_i$, $a_i\in\alpha$
      and for each
      $\delta\in Disc(\alpha)$:
      \begin{itemize}
        \item if $g_{\alpha}\neq\true$ we have:\\
          Planning transitions: $\begin{cases}
            \loc_i\transit{p_{a_i},\true,\emptyset}\loc_{a_i}, \text{ if } g=\true\\
            \loc_i\transit{p_{a_i},\backwardp{\delta}{\delta} g_i,r(x_i^p)}\loc^{\delta}_{a_i},
          \text{ otherwise}\end{cases}$\\
          Execution transitions: $\begin{cases}
            \loc_{a_i}\transit{a,\true,r_i}\loc'_i, \text{ if } g=\true\\
            \loc_{a_i}^{\delta}\transit{a,g_a\wedge x_i^p=\delta,r_i}\loc'_i, \text{ otherwise}
            \end{cases}$\\
            where $\loc_{a},\loc_{a_i}^{\delta}\in\Loc_{i_p}$.\\
        \item if $g_{\alpha}=\true$, we choose one action $b\in\alpha$:\\
           Planning transitions: $\begin{cases}
            \loc_i\transit{p_{a_i},\true,\emptyset}\loc_{a_i}, \text{ if } a\neq b\\
          \loc_i\transit{p_{a_i},\true,r(x_i^p)}\loc_{a_i}^{\delta}, \text{ otherwise}
           \end{cases}$\\
           Execution transitions: $\begin{cases}
            \loc_{a_i}\transit{a_i,\true,r_i}\loc'_i, \text{ if } a\neq b\\
            \loc_{a_i}^{\delta}\transit{a_i,g_i\wedge x_i^p=\delta,r_i}\loc'_i, \text{ otherwise}
            \end{cases}$\\
      \end{itemize}
    \item $\I_i^p$ is the set of \emph{Location Invariants} , such that
      $\forall\loc_i^p\in\Loc_i^p$, we have:\\
      $\I_i^p(\loc_i^p)= \begin{cases}
        \I(\loc_i)-\hmin, \text{ if }\loc_i^p=\loc_i\in\Loc_i\\
        x_{i}^{p}\le\delta\wedge\I(\loc_i), \text{ if } \loc_i^p=\loc_{a_i}^{\delta}\in
        \Loc_{i_p}$ such that $\loc_i\in\Loc_i\wedge\loc_i\transit{p_{a_i}}\loc_{a_i}^{\delta},
      \end{cases}$
  \end{itemize}

\end{definition}

For a composition $\gamma(B_1,\cdots,B_n)$, let $\tts_{p'}=(\Q_{p'},\gamma'\cup\realpos,
\lto_{\gamma'})$, where $\gamma'=\gamma\cup\tcal{P}$, be the corresponding timed transition
system of its planning model under the
standard semantics.
\begin{theorem}\label{correctness}
  $\tts_{p'}\simuw{R'}\tts_g$ where $R'$ is the relation defined as follows:
  For $q^p=(\loc^p,\val^p)\in\Q_{p'}$ and $q^g=(\loc^g,\val^g)\in\Q_g$, such that $(q^p,q^g)\in
  R'$, we have:

  \begin{itemize}
    \item $\loc^p=(\loc^p_1,\cdots,\loc^p_n),\ \loc_g=(\loc^g_1,\cdots,\loc^g_n)$:
      \[\forall i\in\{1,\cdots,n\},\ \loc^g_i=\begin{cases}
        \loc^p_i, \text{ if } \loc^p_i\in\Loc_i,\\
        \loc_i, \text{ if } \loc^p_i\in\Loc_{i_p}\text{ with }\loc_i\transit{a,g,r}\loc_i^p\in
        \T_i^p\wedge\loc_i\in\Loc_i,
    \end{cases}
      \]
      Notice that for the case where $\loc_i^p\in\Loc_{i_p}$, $\loc_i$ is unique by
      construction of the planning model.
    \item $\val^g=equ(\val^p)$, where $equ(\val^p)$ is the projection of $\val^p$ on clocks of
      $\val^g$
  \end{itemize}

  \end{theorem}
  \begin{proof}[Proof of Theorem~\ref{correctness}]
    To prove that $\tts_{p'}\simuw{R'} \tts_g$, we need to prove that:

  \begin{enumerate}
    \item $\forall(q^p,q^g)\in R',\sigma\in\gamma\cup\realpos\text{ such that }q^p\transit{
        \sigma}_{\gamma'}q'^{p}\Rightarrow\exists q'^g.(q'^{p},q'^g)\in R'\wedge
      q^g\transit{\sigma}_{\gamma}q'^g$
    \item $\forall(q^p,q^g)\in R',p_{\alpha}\in\tcal{P}\text{ such that }q^p\transit{
        p_{\alpha}}_{\gamma'}q'^{p}\Rightarrow(q'^{p},q^g)\in R'$
  \end{enumerate}

  \begin{enumerate}
    \item
  \begin{enumerate}
    \item Suppose that $(q^p,q^g)\in R',\sigma=\alpha\in\gamma$ and $q^p\transit{\alpha}_{
        \gamma'}q'^{p}$ with $q'^p=(({\loc'}_1^p,\cdots,{\loc'}_n^p),{\val'}^p)$. We have:
      $q^p\transit{\alpha}_{\gamma'}q'^{p}\Rightarrow g_{\alpha}$ is $\true$, and for
      $\alpha=\{a_i\}_{i\in\I}$, by construction of the planning automaton, we have:
      $\loc_i^g\transit{a_i,g_i,r_i}{\loc'}_i^g$ such that ${\loc'}_i^g={\loc'}_i^p$. Moreover,
     since the same clocks are reset by the execution of $\alpha$ in both models, we deduce
      that $\val'^g=equ(\val'^p)$.
      By remarking that the state of components not participating in $\alpha$ remains the same,
      we conclude that $\exists {q'}^g$ such that
      $q^g\transit{\alpha}_{\gamma}{q'}^g\wedge({q'}^p,{q'}^g)\in R'$.
    \item Suppose that $(q^p,q^g)\in R',\sigma\in\realpos$ and $q^p\transit{\sigma}_{\gamma'}
      q'^{p}$. For $q^p_i=(\loc_i^p,\val_i^p)$, we define $\I_g$ the set of indexes such that
       $\loc_i^p\in\Loc_i$, and $\I_p$ the set of indexes such that $\loc_i^p\in\Loc_{p_i}$.
       \begin{itemize}
         \item $\forall i\in\I_g$.$\loc_i^p=\loc_i^g\wedge\q_i^p\transit{\sigma}
           {q'}_i^p\Rightarrow q_i^g\transit{\sigma}{q'}_i^g$. This implication is a direct
           result of the planning model definition since: $\sigma\le\I(\loc_i^p)\le\I(
           \loc_i^g)-\hmin$.
         \item $\forall i\in\I_p.\loc_i^g=\loc_i$ such that $\loc^p_i\in\Loc_{i_p}\text{ with }
           \loc_i\transit{a,g,r}\loc_i^p\in\T_i^p\wedge\loc_i\in\Loc_i$.
           Thus $\q_i^p\transit{\sigma}{q'}_i^p\Rightarrow q_i^g\transit{\sigma}{q'}_i^g$,
           since $\I(\loc_i^p)\implies\I(\loc_i^g)$.

         \end{itemize}
       We conclude that $\exists q'^g$ such that $q^g\transit{\sigma}_{\gamma}{q'}^g\wedge({q'}^
         p,{q'}^g)\in R'$.
  \end{enumerate}

\item Suppose that $(q^p,q^g)\in R'$ and $q^p\transit{p_{\alpha}}_{\gamma'}q'^{p}$, with
  $p_{\alpha}\in\tcal{P}$ and $q'^p=(({\loc'}_1^p,\cdots,{\loc'}_n^p),{\val'}^p)$. We have:
      $q^p\transit{p_{\alpha}}_{\gamma'}q'^{p}\Rightarrow$ for $\alpha=\{a_i\}_{i\in\I}$
      $\loc_i^g=\loc_i^p\wedge\loc_i^g\transit{p_{a_i}}{\loc'}_i^p$. Moreover, since planning
      actions reset only the clocks $x_i^p$ for tracking execution time, we can deduce that
      $({q'}^p,q^g)\in R'$.
  \end{enumerate}

\end{proof}

\begin{figure}[ht]
  \begin{minipage}[b]{0.5\linewidth}
  \centering
  \includegraphics[width=1.15\linewidth]{Figures/c.eps}\\
    (a) Controller Component
  \vspace{4ex}
  \end{minipage}%%
  \begin{minipage}[b]{0.5\linewidth}
  \centering
  \includegraphics[width=.75\linewidth]{Figures/v.eps}\\
    (b) Variable Component
  \vspace{4ex}
  \end{minipage}
  \begin{minipage}[b]{\linewidth}
  \centering
  \includegraphics[width=0.75\linewidth]{Figures/t.eps}\\
    (c) Task Component
  \vspace{4ex}
  \end{minipage}%%
  \caption{Planning Automata for the Task Manager Example}
  \label{fig:uppaal}
\end{figure}

Once interactions planning encoded, one last thing to do is to add the set of bad states to each
planning automaton (if needed) and find a strategy to avoid those states.
Figure~\ref{fig:uppaal} depicts the corresponding planning automata for example of
Figure~\ref{fig:tm} with respect to Definition~\ref{def:plan_aut}.
Locations suffixed by \emph{p}, correspond to locations following
planning actions, whereas locations ending with \emph{err} define the bad states, that is,
states with urgent location invariant(s) and no possible execution removing the urgency.
In this example, for each interaction $\alpha\in\gamma$, we chose $\mathcal{D}(\alpha)=\{1,2\}$.
Notice that for this example, we consider that all actions are controllable actions since
it is a closed system in the sense that there is no interaction with the environment.

We performed the verification on the Task Manager examples with 20 tasks. The winning
condition being a safety condition: avoid all \emph{\say{err}} locations. This was translated
into the following property:
\begin{equation}\label{eq:avoid}
  \text{\textsf{control: A[ ] forall (i : int[0,N-1]) not (Task(i).l\_{2\_{err}} or
  Task(i).l\_{3\_{err}})}}
\end{equation}

The property of interest was successfully verified. Additionally, we were also able to
synthesize all wining actions of all states using the command line of UPPAAL-Tiga. A sample
of the resulting output is provided below Figures~\ref{fig:sample}.
Notice that the average execution time\footnote{The experiments have been conducted on a HP
machine with Ubuntu 16.04, an Intel\textsuperscript{\textregistered}
Core\textsuperscript{\texttrademark}i5-4300U processor of frequency 1.90GHz$\times$4, and
7.7GiB memory.} for verifying Property~\ref{eq:avoid} is $0.1141$ seconds
($0.6534$ seconds when requesting the generation of a strategy).
\begin{figure}[ht]
  \fbox{\begin{minipage}{40em}
    \texttt{State: ( Controller.l\_1\_p\_1 Task(0).l\_0 Task(1).l\_1\_p Task(2).l\_3\_p2
  Task(3).l\_0 Task(4).l\_0 Task(5).l\_0 Task(6).l\_0 Task(7).l\_0 Task(8).l\_0 Task(9).l\_0
  Task(10).l\_0 Task(11).l\_0 Task(12).l\_0 Task(13).l\_0 Task(14).l\_0 Task(15).l\_0
  Task(16).l\_0 Task(17).l\_0 Task(18).l\_0 Task(19).l\_0 Var.V\_pe ) vlist[0]=2 vlist[1]=0
  vlist[2]=0 vlist[3]=0 vlist[4]=0 vlist[5]=0 vlist[6]=0 vlist[7]=0 vlist[8]=0 vlist[9]=0
  vlist[10]=0 vlist[11]=0 vlist[12]=0 vlist[13]=0 vlist[14]=0 vlist[15]=0 vlist[16]=0
  vlist[17]=0 vlist[18]=0 vlist[19]=0 vlen=1 Controller.list[0]=1 Controller.list[1]=0
  Controller.list[2]=0 Controller.list[3]=0 Controller.list[4]=0 Controller.list[5]=0
  Controller.list[6]=0 Controller.list[7]=0 Controller.list[8]=0 Controller.list[9]=0
  Controller.list[10]=0 Controller.list[11]=0 Controller.list[12]=0 Controller.list[13]=0
  Controller.list[14]=0 Controller.list[15]=0 Controller.list[16]=0 Controller.list[17]=0
  Controller.list[18]=0 Controller.list[19]=0 Controller.len=1\\
  When you are in (Controller.zp==1 \&\& Task(2).yp<=2), take transition Controller.l\_1\_p\_1->
  Controller.l\_0 \{ zp == 1 \&\& 1 == front(), exec\_run[1]!, z := 0, dequeue() \}
  Task(1).l\_1\_p->Task(1).l\_2 \{ 1, exec\_run[id]?, y := 0, venqueue(id) \}
  When you are in (Task(2).yp==2 \&\& Controller.zp<=1), take transition Task(2).l\_3\_p2->
  Task(2).l\_0 \{ yp == 2, exec\_end[id]!, vdequeue() \}
  Var.V\_pe->Var.V\_ee \{ 2 == vfront(), exec\_end[2]?, 1 \}}
  \end{minipage}}
  \caption{Sample of the Output Strategy from UPPAAL-Tiga}
  \label{fig:sample}
\end{figure}

\subsection{Discussion}

In this section, we explained how the problem of planning interactions can be formalized into
a real-time controller synthesis approach. However, this approach has some drawbacks.
In order to encode planning of interactions in components as timed automata, this approach
restricts its scope to discretized horizon values which results in having less control
over the planning dates of interactions, and leads in case of a high number of discretized
values, to an explosion in the number of planning transitions. Unfortunately, we do not
have an immediate solution for this problem. In fact, it is user dependent since one user may
just want to have a ASAP execution for a given interaction, for instance because the components
involved in this interaction are often requested, and in that case the practice will be to
always plan with $\hmin$. In other cases, the user may want to plan an interaction with
flexible amount time.
Additionally, this approach considers only a class of systems where interactions have timing
constraints on up to one of their participating components action. Otherwise, the planning
should be encoded on the composition, which represents a tedious work because of the state
space explosion problem. Nevertheless, this approach differs form the usual scheduler
synthesis approach since it is not performed on the regular semantics of timed automata.
Particularly, here we are interested in avoiding bad states of the planning semantics
(states that verify the expression of Theorem~\ref{thm:dla}). Consequently, unless finding an
automatic general method for generating such complex expression in the query language accepted
by such tools, and without ignoring that finding a strategy avoiding those states
may be hard in term of computational complexity, our real-time controller synthesis approach
seems more straightforward and much simpler but it comes with some feasibility restriction.


\documentclass[modern]{aastex62}

\input{xostyle}
\input{xosymbols}

\begin{document}\raggedbottom\sloppy\sloppypar\frenchspacing

\title{%
\project{exoplanet}:
A toolkit for scalable inference for exoplanetary systems using transits,
radial velocities, \& astrometry
%An efficient and robust toolkit for gradient-based
%probabilistic characterization of exoplanets using transits and radial
%velocities
}

\author[0000-0002-9328-5652]{Daniel Foreman-Mackey}
\affil{Center for Computational Astrophysics, Flatiron Institute, New York, NY}

\begin{abstract}

As larger and more precise datasets continue to be collected for the discovery
and characterization of exoplanets, we must also develop computationally
efficient and rigorous methods for making inferences based on these data.
The efficiency and robustness of numerical methods for probabilistic inference
can be improved by using derivatives of the model with respect to the
parameters.
In this paper, I derive methods for exploiting these gradient-based methods
when fitting exoplanet data based on radial velocity, astrometry, and
transits.
Alongside the paper, I release an open source, well-tested, and
computationally efficient implementation of these methods.
These methods can substantially reduce the computational cost of fitting large
datasets and systems with more than one exoplanet.

\end{abstract}

\keywords{%
methods: data analysis ---
methods: statistical
}

\section{Outline}

\begin{enumerate}

{\item Introduction
\begin{itemize}
{\item the datasets available and forthcoming}
{\item existing tools for exoplanet fitting}
{\item motivation for gradients}
\end{itemize}}

\item Automatic differentiation and inference frameworks

\item Hamiltonian Monte Carlo and variants

\item Custom gradients required for exoplanet datasets
\begin{itemize}
\item Radial velocities and Kepler's equation
\item Astrometry
\item Transits
\end{itemize}

\item Implementation details and benchmarks

\item Examples

\item Discussion

\end{enumerate}

\section{Introduction}

Datasets are getting larger and more precise and this leads to an interest in
more ambitious questions about these systems.
The existing inference methods are no longer up to the task when the datasets
are large and when the number of parameters is large.
Many probabilistic inferences in astronomy have been limited by the existing
tools that can't scale e.g.\ emcee.
However, in other fields such as ML, methods have been developed that can
scale to datasets too large to fit into memory and millions of parameters.
The key ingredient in all of these methods is that it must be possible to
efficiently evaluate the derivative of the model with respect to the physical
parameters.
This can often be intractable for applications astrophysics because the models
generally include a physically motivated component that can't be trivially
differentiated.
However, we can take advantage of the substantial development that has been
invested in automating this process.

This paper presents an example of how these tools and methods can be
exploited in the specific astronomical application of fitting exoplanet
datasets.
We go through the derivation and implementation of the custom functions and
their gradients that are required for gradient-based characterization of
exoplanets.

These methods and their implementation are not an all-in-one package designed
to do the fitting.
Instead, it provided the framework needed to use these tools within pipelines.

\begin{figure}[htbp]
\begin{centering}
\includegraphics[width=0.8\linewidth]{figures/simple_rv.pdf}
\oscaption{simple_rv}{\label{fig:simple_rv}
This is a figure.}
\end{centering}
\end{figure}

\section{Automatic differentiation}

The main limitation of gradient-based inference methods is that, in order to
use them, you must \emph{compute the gradients}!
The fundamental quantity of interest is the first derivative (gradient) of the
log-likelihood function (or some other goodness-of-fit function) with respect
to the parameters of the model.
In all but the simplest cases, symbolically deriving this gradient function is
tedious and error-prone.
Instead, it is generally preferable to use a method (called automatic
differentiation) that can automatically compute the exact gradients of the
model \emph{to machine precision} at compile time.
We would like to emphasize the fact that we are not talking \emph{numerical}
derivatives like finite difference methods, and there is no approximation
being made.

The basic idea behind automatic differentiation is that code is always written
as the composition of basic functions and, if we know how to differentiate the
subcomponents, then we can apply the chain rule to differentiate the larger
function.
This realization was one of the key discoveries that launched the field of
machine learning called ``deep learning'', where automatic differentiation was
given the name ``backpropagation'' (CITE).
Since then, there has been a substantial research base that has made these
methods general and computationally efficient, and from this, many open source
libraries have been released that ease the use of these methods (e.g.\
TensorFlow, PyTorch, Stan, ceres, Eigen, etc.\ CITATIONS).
Despite the existence of these projects, automatic differentiation has not
been widely adopted in the astronomical literature because there is some
learning curve associated with porting existing code bases to a new language
or framework.
Furthermore, many projects in astronomy involve fitting realistic, physically
motivated models that involve numerical solutions to differential equations
or special functions that are not natively supported by the popular automatic
differentiation frameworks.

In this paper, we demonstrate how to incorporate exoplanet-specific functions
into these frameworks and derive the functions needed to characterize
exoplanets using gradient-based methods applied to radial velocity,
astrometry, and transit datasets.
Similar derivations would certainly be tractable for microlensing, direct
imaging, and other exoplanet characterization methods, but these are left to a
future paper.

At present, there are many model-building libraries available in every
programming language, and it is not clear which should be preferred.
For this paper, we focus on implementations within TensorFlow
\citep{Abadi:2016} because it is accessible using Python, the most widely used
programming language in astronomy (CITE?) and because the code is
well-supported and stable.
This being said, the basic ideas behind each library are similar and the core
implementation in C++ can be minimally modified to support other frameworks.

\section{The custom operations provided by exoplanet}

\subsection{A solver for Kepler's equation}

A key assumption that is often made when fitting exoplanets is that the
planets are orbiting the central star on independent bound Keplerian orbits
(CITE).
To compute the coordinates of a planet on its orbit, we must solve Kepler's
equation
\begin{eqnarray}
M &=& E - e\,\sin E
\end{eqnarray}
for the eccentric anomaly $E$ at fixed eccentricity $e$ and mean anomaly $M$.
This equation must be solved numerically and there is a rich literature
discussing methods for this implementation.
We have found the method from CITE to provide the right balance of numerical
stability (with a relative accuracy of about $10^{-20}$ for all values of $M$
and $e$) and computational efficiency.

As well as solving Kepler's equation, we must also efficiently evaluate the
gradients (or, more precisely, \emph{back-propagate} the gradients) of $E$
with respect to $e$ and $M$.
After solving for $E$, this can be computed efficiently and robustly using
implicit differentiation.
For numerical methods like this, it is often possible to compute the gradients
without applying automatic differentiation to the implementation directly and
that is generally preferred for the purposes of numerical stability.
In this case, the relevant gradients are
\begin{eqnarray}
\frac{\dd E}{\dd e} &=& \frac{\sin E}{1 - e\,\cos E} \\
\frac{\dd E}{\dd M} &=& \frac{1}{1 - e\,\cos E} \quad.
\end{eqnarray}

\paragraph{Implementation details}

We find that directly evaluating the true anomaly $f$
%\begin{eqnarray}
%f &=& 2\,\tan^{-1}\,left(\frac{\sqrt{1+e}}{\sqrt{1-e}}\,\tan \frac{E}{2}\right)
%\end{eqnarray}
when solving Kepler's equation is more efficient than evaluating it separately
within Theano.
This means that we must also provide a method for evaluating the derivative of
$f$ with respect to $e$ and $M$.

\subsection{Limb-darkened light curves}

\subsection{Scalable Gaussian Processes for time series}

\appendix

\section{Solving Kepler's equation}

A crucial component for all of the models in this paper is an accurate and
high-performance solver for Kepler's equation
\begin{eqnarray}\eqlabel{kepler-equation}
M &=& E - e\,\sin E \quad.
\end{eqnarray}
We use the method presented by \citet{Nijenhuis:1991}.
Unlike most of the methods used in astrophysics, this algorithm \emph{is not
iterative}.
This can lead to much better compiler optimization.
Furthermore, this algorithm doesn't require the evaluation of trigonometric
functions directly.
As well as improving performance, this also increases the accuracy of the
results because it avoids catastrophic cancellations when evaluating $E - \sin
E$ and $1 - \cos E$ by evaluating these differences directly using a series
expansion.

The procedure is as follows:
\begin{enumerate}

\item Initial estimates are selected for the parameters by partitioning the
parameter space into 4 regions and applying a set of heuristics specific to
each part of parameter space.

\item This estimate is refined using either a single iteration of Halley's
second order root finding algorithm (with the sine function with its series
expansion) or a variant of the cubic approximation from \citet{Mikkola:1987}.

\item Finally, the result is updated by a single step of a high-order
generalized Newton method where the order of the method controls the target
accuracy of the method. In the \exoplanet\ implementation, we use a 4th order
update.

\end{enumerate}

The details of the implementation are exactly ported from the implementation
in \citet{Nijenhuis:1991} so we won't reproduce that here, but we did an
experiment to compare the performance and accuracy of this method to some
implementations of Kepler solvers commonly used for exoplanet fitting.
Specifically we compare to the implementations from the \batman\ transit
fitting framework \citep{Kreidberg:2015} and the \radvel\ radial velocity
fitting library \citep{Fulton:2017, Fulton:2018}.
In both cases, the solver is implemented in \project{C} and exposed to
\python\ using the \python\ \project{C}-API directly or \cython\
\citep{Behnel:2011} respectively.
Similarly, the implementation in \exoplanet\ is written in \cpp\ with \python\
bindings exposed by \theano\ \citep{Theano-Development-Team:2016}.

To test the implementation, we generated 5000 true eccentric anomalies
$E_\mathrm{true}$ uniformly distributed between $0$ and $2\,\pi$.
Then, for a range of eccentricities $e$, we computed the mean anomaly $M$ using
\eq{kepler-equation} and used each library to solve \eq{kepler-equation} for
$E_\mathrm{calc}$.
The top panel of \Figure{kepler_solver} shows the average computational cost per
solve of \eq{kepler-equation} for each library as a function of eccentricity.
The implementation of the \citet{Nijenhuis:1991} algorithm in \exoplanet\ is
more than an order of magnitude more efficient than the other methods and this
cost does not depend sensitively on the eccentricity of the orbit.
It is worth noting that both \batman\ and \exoplanet\ feature ``fused''
solvers that return both the eccentric anomaly and the true anomaly whereas
\radvel\ only computes the eccentric anomaly so there is a small amount of
computational overhead introduced into both \exoplanet\ and \batman\ when
compared to \radvel.

The bottom panel of \Figure{kepler_solver} shows the 90th percentile of the
distribution of absolute errors when comparing $E_\mathrm{true}$ and
$E_\mathrm{calc}$ for each method as a function of eccentricity.
Across all values of eccentricity, \exoplanet\ computes the eccentric anomaly
with an accuracy of better than 15 decimal places.
In some cases, the \radvel\ solver is slightly better, but at some
eccentricities, the error is more than an order of magnitude worse for
\radvel\ than for \exoplanet.
In all cases, the accuracy of the implementation from \batman\ is several
orders of magnitude worse than the other implementations.
This accuracy could be improved by decreasing the convergence tolerance in the
iterative solver at the cost of longer run times, but the current value of
$10^{-7}$ is currently hard coded\footnote{\url{%
https://github.com/lkreidberg/batman/blob/70f2c0c609124bdf4f17041bf09d5426f3c93334/c\_src/\_rsky.c\#L45}}.

\begin{figure}[htbp]
\begin{centering}
\includegraphics[width=0.8\linewidth]{figures/kepler_solver.pdf}
\oscaption{kepler_solver}{\figurelabel{kepler_solver}
The performance of the Kepler solver used by \exoplanet\ compared to
the solvers from the \radvel\ \citep{Fulton:2017, Fulton:2018} and \batman\
\citep{Kreidberg:2015} libraries.
\emph{top}: The average wall time required to solve Kepler's equation once for
the eccentric anomaly $E$ conditioned on eccentricity $e$ and mean anomaly $M$.
Smaller numbers correspond to faster solutions.
\emph{bottom}: The 90-th percentile of the absolute error of the computed
eccentric anomaly for 5000 true values of $E$ in the range $0 \le E < 2\,\pi$.
Smaller numbers correspond to more accurate solutions.}
\end{centering}
\end{figure}

\section{Contact points}

In the plane of the orbit, $S_0$, the coordinates of the orbit satisfy the
equation
\begin{eqnarray}\eqlabel{constraint0}
{({x_0} - a\,e)}^2 + \frac{{y_0}^2}{1-e^2} &=& a^2 \quad.
\end{eqnarray}
To rotate into the observing plane, we perform the following transformation
\begin{eqnarray}\eqlabel{rotation}
\bvec{x}_2 &=& R_i\,R_\omega\,\bvec{x}_0 \\
\left(\begin{array}{c}x_2\\y_2\\z_2\end{array}\right) &=&
\left(\begin{array}{ccc}
1 & 0 & 0\\
0 & \cos i & \sin i \\
0 & -\sin i & \cos i \\
\end{array}\right) \,
\left(\begin{array}{ccc}
\cos\omega & \sin\omega & 0\\
-\sin\omega & \cos\omega & 0 \\
0 & 0 & 1 \\
\end{array}\right) \,
\left(\begin{array}{c}x_0\\y_0\\0\end{array}\right) \quad.
\end{eqnarray}
In this space, the planet will transit whenever
\begin{eqnarray}
z_2 < 0 &\mathrm{and}& {x_2}^2 + {y_2}^2 < L^2
\end{eqnarray}
where $L = R_\star + R_P$.
The contact point therefore occurs when
\begin{eqnarray} \eqlabel{quad1}
\hat{x_2}^2 + \hat{y_2}^2 = L^2
\end{eqnarray}
where the hat indicates that

Using the inverse of \eq{rotation} to re-write \eq{constraint0} in terms of
$x_2$ and $y_2$, we find the following quadratic equation
\begin{eqnarray} \eqlabel{quad2}
A\,{x_2}^2 + B\,{x_2\,y_2} + C\,{y_2}^2 + D\,x_2 + E\,y_2 + F &=& 0
\end{eqnarray}
with
\begin{eqnarray}
A &=& \left(e^{2}\,\cos^{2}{\omega} - 1\right)\,\cos^{2}{i} \\
B &=& 2\,e^{2}\,\cos{i}\,\sin{\omega}\,\cos{\omega}\\
C &=& e^{2}\,\sin^{2}{\omega} - 1\\
D &=& 2\,a\,e\,\left(1-e^{2}\right)\,\cos^{2}{i}\,\cos{\omega}\\
E &=& 2\,a\,e\,\left(1-e^{2}\right)\,\sin{\omega} \cos{i}\\
F &=& a^{2}\,\left(e^{2} - 1\right)^{2}\,\cos^{2}{i}
\end{eqnarray}

The pair of quadratic equations defined by \eq{quad1} and \eq{quad2} can be
combined to give a quartic equation for $x_2$
\begin{eqnarray}
a_0 + a_1\,{x_2} + a_2\,{x_2}^2 + a_3\,{x_2}^3 + a_4\,{x_2}^4 = 0
\end{eqnarray}
where
\begin{eqnarray}
a_0 &=& \left(C L^{2} - E L + F\right) \left(C L^{2} + E L + F\right) \\
a_1 &=& - 2 \left(B E L^{2} - C D L^{2} - D F\right)\\
a_2 &=& 2 A C L^{2} + 2 A F - B^{2} L^{2} - 2 C^{2} L^{2} - 2 C F + D^{2} + E^{2}\\
a_3 &=& 2 \left(A D + B E - C D\right)\\
a_4 &=& A^{2} - 2 A C + B^{2} + C^{2}
\end{eqnarray}
which can be solved symbolically (CITE Kipping) or numerically.

\paragraph{Edge-on orbits}
For an edge-on orbit, $\cos{i} = 0$ and the contact points occur at
\begin{eqnarray}\eqlabel{edgeon1}
x_2 &=& \pm L \\
y_2 &=& 0 \quad,
\end{eqnarray}
but care must be taken when evaluating $z_2$.
To do this, we substitute \eq{edgeon1} into \eq{constraint0} to get the
following quadratic equation for $z_2$
\begin{eqnarray}
b_0 + b_1\,{z_2} + b_2\,{z_2}^2 &=& 0
\end{eqnarray}
where
\begin{eqnarray}
b_{0,\pm} &=& L^2\,(e^2\,\cos^2\omega - 1) \mp 2\,a\,e\,L\,\cos\omega\,(e^2-1) +
a^2\,{(e^2 -1)}^2 \\
b_{1,\pm} &=& -2\,a\,e\,\sin\omega\,(e^2-1) \pm 2\,e^2\,L\,\sin\omega\,\cos\omega\\
b_{2,\pm} &=& e^{2} \sin^{2}{\left (\omega \right )} - 1 \quad.
\end{eqnarray}
There are 4 solutions to this system of which we are only interested in the
ones where $z_2 < 0$ (the others are the contact points for the occultation).

\begin{figure}[htbp]
\begin{centering}
\includegraphics[width=0.8\linewidth]{figures/contact_points.pdf}
\oscaption{contact_points}{\label{fig:contact_points}
This is a figure.}
\end{centering}
\end{figure}

\newpage
\bibliography{exoplanet}

\end{document}


\chapter{Conclusion}
\label{chap:conclusion}

Three main approaches for the particle identification at Belle~\RN{2} are studied.

First, the current and future particle identification variables are described. Hereby, the goodness of the global PID variables is discussed. Altogether, the likelihood ratios are properly defined, however, a flaw in the definition of the global PID of the proton is revealed. The unexpected kink can be traced back to the CDC detector and is especially dominant for particles with a low to medium transverse momentum.

On the basis of the particle likelihoods, further extensions of the particle identification utilizing Bayes theorem are discussed. The likelihood of different particles are weighted by species and are assigned a priori probabilities. At first, these a priori probabilities only depend on the abundance of a species and show similar results to the global PID approach. The new approach increases the overall identification efficiencies by increasing the weights of particles with a high abundance. The introduction of further dependencies of the a priori probabilities increases the performance only marginally.

Finally, an alternative approach in identifying particles using a neural network is analysed. Using a simple network provides acceptable performance with overall accuracies in the range of the previously discussed global PID. Nevertheless, it is heavily biased by particles of high abundance and upsampling the data shows only limited improvements.

In conclusion, the particle identification can be improved by using a Bayesian approach. However, particle identification rates for specific species highly depend on the identification algorithm and may be chosen depending on the decay of interest. Currently, the neural network does not provide a sufficiently good classification to be used right away, but is an especially promising candidate for further research.


\section{Cells as functions}
\label{introduction:hierarchy}

Abstracting cell biological systems into mathematical or computational
models can be a powerful way to learn about those systems, though the
value of any given model can vary tremendously. If a model is as
complicated as the system it represents,
we have learned nothing; if the model is too simple, we have not captured
the biology we are trying to understand. In any case, the process of modeling
itself brings a rigor to and an awareness of the studied system that might not have
otherwise been possible \cite{Janes2013,Zhang2013,Pe'er2011}.

This section is primarily intended for classically trained
biologists, like myself, who are not often exposed to this way of thinking.
Those in fields that are historically more modeling-oriented,
such as computer science and systems biology, will likely find the following
to be familiar.

\subsubsection{Setting up an abstraction}

A useful abstraction when developing models of
cell signaling is to think of cells
as functions $f$ that convert sensory inputs $S$
into behavioral responses $R$, such that $f(S)=R$. For example,
$S$ may be the concentration of an extracellular ligand, while
$R$ may be the nuclear concentration of a downstream
transcription factor, so that $f(S)$ models the
behavior of a receptor that converts one to the other.
The function, then, is typically the biological process that we wish
to understand.

I borrow the term ``encoding'' from computer science
to refer to this relationship, because it carries with it the
idea that it is \b{information} that is being converted from one form to another.
Using this language,
$f$ encodes $S$ into $R$. Take human speech as an example.
In speech our brains generate
words that are encoded into complex temporal patterns of
vocal chord tension, lung contraction, tongue movement, and so
on. Those patterns in turn encode temporal changes in air
pressure that propagate away from the speaker. Cells
in the ear of the listener encode those pressure changes into
mechanical movements, which then encode those movements into
neuronal activity that the listener finally decodes into the
original spoken words.

For experiments in this framework, $S$ is whatever
experimental perturbation is being applied, $R$ is the
experimental readout, and $f$ is the biological encoding process that
we are trying to understand. The assumption in our experiments,
then, is that knowledge of $S$ and $R$ are sufficient to infer
$f$. When we first dive into the complete unknowns of a
phenomenon, a precise inference is essentially impossible.
As a consequence, we find ourselves using vague
words to describe $f$, such as ``recruits,'' ``activates,''
or ``mediates''; the function remains a mystery.

For values of $S$ and $R$ that are
closely connected by some process, experiments allow us
to associate more precise
mechanisms with $f$, so that we can describe the function with words like ``binds''
or ``phosphorylates.'' However, for values of $S$ and $R$
that are distantly connected, perhaps through other nodes such as in the
case of speech described above,
clear definitions of $f$ become more difficult. This
is a constant struggle in the study of developmental signaling pathways,
as studied in this dissertation, because many of their
interesting biological effects are far removed in time from the
signaling event. Activation of these pathways may therefore
induce many complex layers of signal processing before finally affecting $R$
\arp{fig:introduction:function}: the function is a composition of functions.

To precisely model mechanism in such cases, collapsing the
relationship between $S$ and $R$ into an understandable function is impossible.
Instead we would need to break the original function into many, where
the output of each function becomes the input for the next
(\ar{fig:introduction:function}), and study them individually.
By breaking up a general, indirect model (e.g. ``Wnt blocks
stem cell differentiation'') into a set of more specific models with direct
relationships (e.g. ``Wnt binds Frizzled, resulting in
increased \bcat, which in turn binds to the Myc promoter and
increases its expression''), we obtain insight about mechanistic details
at the cost of simplicity.

  \begin{figure}[!bt]
  \centering
  \includegraphics[width=2.5in]{FIGS/introduction/function.pdf}
  {\singlespacing
  \caption[Abstracting signaling as a hierarchy of functions.]
          { Cells can be abstracted as functions that take sensory
			inputs $S$ and yield output responses $R$. However, interpretation of this
			abstraction suffers from unknowns between the initial
			input $S$ and the final output of interest $R$ (\b{a}). By adding
			more (\b{b}) and more (\b{c}) components the model becomes
			complex but each link gains functional insight.}
  \label{fig:introduction:function}}
  \end{figure}

As an additional point, for a given biological function $f$ there can be
multiple inputs and outputs, many (or most) of which are unknown.
And so the inputs and outputs are better thought of
as lists or vectors, as in equations
\ref{eq:introduction:inputs}-\ref{eq:introduction:function}
(bold face, non-italics indicate a vector).
In this model, the true
values of $\vec{S}$ are the known and experimental parameters
as well as any unmeasured parameters
(e.g. $S_1$ to $S_3$ may represent treatment duration,
treatment concentration, and ambient temperature). The values
of $\vec{R}$ are the measured responses as well as any unmeasured
cellular parameters that change in response to $\vec{S}$.
To complicate
matters, each parameter may have completely different units
(e.g. concentration versus temperature).
We must inevitably approximate the true
biological parameter vectors $\vec{S}$ and $\vec{R}$
by choosing a small known subset of their values, and
thus can only ever obtain estimates of the true function $f$.
%
    \begin{gather}
    \vec{S}  = [S_1\cdots S_n] \label{eq:introduction:inputs} \\
    \vec{R}  = [R_1\cdots R_m] \label{eq:introduction:outputs} \\
    f(\vec{S})  =\vec{R} \label{eq:introduction:function}
    \end{gather}

Aside from the obvious issue that our approximate
models can only include things that we know about, cellular functions are often highly
non-linear. That is, it need not be true that $f(S_{1a}+S_{1b})=f(S_{1a})+f(S_{1b})$,
where $S_{1a}$ and $S_{1b}$ are different values for the same parameter,
nor that $f(aS)=af(S)$, where $a$ is a constant. A typical dose-response
curve makes a good example, since doubling the dose
(by setting $a=2$) does not necessarily double the output (i.e. $f(2S)\neq 2f(S)$).
Temporal feedback makes the models even more complex, since this
allows a function to eventually modify its own input.

\subsubsection{Making use of the abstraction}

To summarize, we can think of cells as
hierarchies of functions, where the true signals $\vec{S}$ and responses $\vec{R}$
make up the nodes
of a signaling network, and the functions are the mechanistic activities that
connect them in time. The functions we study may take into account
many parameters of which we are completely unaware, and so we only obtain
estimates of $f$. Our goal in studying cell signaling is to estimate $f$
as accurately as possible, so that $f(S)\approx f(\vec{S})$.
Finally, to be able to assign a clear functional meaning to
a particular $f(S)=R$ relationship,
$S$ and $R$ must be closely connected.

A common approach to modeling signaling pathways,
that allows for both non-linearity and temporal feedback, is to assemble systems
of ordinary differential equations for
every known node and edge in the network and to explore the behavior
of the system computationally. Even a small non-linear network
can generate a wide variety of outcomes given different parameters
or small changes in topology
\cite{Shoval2010a,Wang2013b,Goentoro2009,Kholodenko2006}. Therefore, we can test
the completeness of our understanding of a signaling pathway by, for example,
testing the robustness of the model's output
against a wide array of biologically reasonable parameters (analogous to experimental
perturbations). Such approaches can
uncover deficiencies in our knowledge, as the fragility or
failures of the model may indicate a missing function or node.
Unfortunately, it is not true that successful recapitulation of a biological behavior by a
mathematical or computational model implies that we have captured
the true biology with that model.

Given the potential complexity of biological signaling models, and
the high likelihood that any given model is incomplete or flat-out
wrong, what is the value in developing models at all? I have already noted
that models give us the
potential to identify deficiencies in our knowledge, and
that building models forces us to rigorously define the questions
we seek to address. There is an additional important benefit, which is
that models may allow us to uncover underlying simplicity.

If a model
is built that recapitulates a biological phenomenon, then parts of
the model can be removed in order to determine the minimal set of
components that could create the observed biological behaviors. Having identified
these nodes one can convert a complex mechanistic model into a simple conceptual one
\cite{Ku2012,Dutkowski2011}. Additionally, if a behavior can be represented by
a highly simplified version of the functions that cause it, we can begin to
ask why the system is more complicated than it needs to be. We must be
careful with such ``why'' questions, since biological functions are created
via a random evolutionary process. However, such questions can
lead to biological insights about benefits to regulation or signal processing
of the more complex observed signaling network.


% Written by:
% * Joachim Trescher
% * Hans de Vreught

\section{Types}

In \Booster\ a {\em type} is specified by an expression in
\Language{\NT{Type}} and represents a set of values.  \Booster\ uses
structural type equivalence: two types are the same if their
definitions become the same when expanded; i.e.\ when all constant
expressions are replaced by their values and all type names are
replaced by their definitions.

Every expression has a statically determined type, which contains
every value that the expression can produce. The type of a designator
is the type of the variable it produces.

{\em Assignability} and {\em type compatibility} are defined in terms
of a syntactically specified inclusion relation on types. In the
following we discuss type constructors and type inclusion rules in more
detail.

\subsection*{Intrinsic Types}

There are six intrinsic types which are denoted by the following
predeclared identifiers.

\begin{tabular}{ll}
\hlf
\T{BOOLEAN} & the enumeration $\{$ {\sf true, false} $\}$\\
\T{NATURAL} & all natural values represented by the implementation\\
\T{INTEGER} & all integers represented by the implementation\\
\T{REAL}    & all real values represented by the implementation\\
\T{COMPLEX} & all complex values represented by the implementation\\
\T{STRING}  & the elements of \Language{\TC{StringLiteral}}\\
\hlf
\end{tabular}

\subsection*{Shape and view types}

A shape type specifies an indexed collection of component variables,
called the {\em elements} of the shape. A shape type declaration has
the syntactical form:

\begin{frag}
TYPE S = SHAPE \{ E \} OF BaseType;
\end{frag}

\noindent where {\tt E} is a constant expression of type natural and
{\tt BaseType} is a type specification.

The indices are the natural values in the range {\tt [0..E-1]}, where
the value of {\tt E} is determined at compile time and is called the
length of the shape. The elements of a shape all have the same size
and the same type, called the {\em base type}.

An expression of the syntactical form

\begin{frag}
SHAPE \{<E$_{\tt 0}$>  \verb'#' <E$_{\tt 1}$>  \verb'#' \ldots \verb'#'
<E$_{\tt n}$>\} OF <T>;
\end{frag}

\noindent is understood as an abbreviation of

\begin{frag}
SHAPE \{<E$_{\tt 0}$>\} OF\\
\> SHAPE \{<E$_{\tt 1}$>\} OF\\
\>\> \dots\\
\>\>\> SHAPE \{<E$_{\tt n}$>\} OF <T>;
\end{frag}

\noindent The form of a shape is the sequence of its lengths in each
dimension. More precisely, the form of a shape is its length followed
by the form of its base type. The length of the form of a shape is
called its {\em rank}.

In the declaration of formal parameters of functions and procedures
\Booster\ allows to specify the length of a dimension by a
\texttt{CONST <Id>} declaration. The corresponding
dimension of such a parameter is arbitrary but does not change during
the execution of a procedure call. The {\em generic} constant
\texttt{<Id>} may be used as a constant in the body of the
corresponding function or procedure. Each function or procedure call
initializes the generic constant \texttt{<Id>} with the length of the
corresponding dimension of the actual parameter.

A view type is a ``virtual'' shape type whose rank and (intrinsic)
base type are determined by a view type specification. Unlike shapes,
a view type specification may specify the length of one or more
dimensions to be arbitrary (and possibly changing dynamically) using
the operator \T{*}. Informally, views may be considered as bounded set
of references which point to elements (whose type is an intrinsic
type) of a single variable, thus ``viewing'' the elements of this
variable through a different indexing scheme. However, the declaration
of a view will not cause the allocation of computer memory. Therefore,
during the compilation process views will be eliminated by replacing
accesses to them by calls to the appropriate access function.

A view type declaration has the syntactical form

\begin{frag}
TYPE V = VIEW \{<E$_{\tt 0}$>  \verb'#' <E$_{\tt 1}$>  \verb'#'
\ldots \verb'#'  <E$_{\tt n}$>\} OF IntrinsicType;
\end{frag}

\noindent where the form of \textsf{V} is defined by the expressions
{\tt <E$_{\tt 0}$>} \ldots {\tt <E$_{\tt n}$>}. And {\tt
IntrinsicType} is an intrinsic type.

\subsection*{Defined-by and Uses relations}

The type declarations visible in a scope $S$ define two relations on
type identifiers. The {\em defined-by} relation ``$\succ$'' is used to
track down type equivalences, and is defined as follows:

A type identifier $Id_2$ is defined by a type identifier $Id_1$, or
$Id_2 \succ Id_1$, iff

\begin{itemize}

\item there is a type declaration of the form {\tt <Id$_{\tt 2}$> =
<Id$_{\tt 1}$>}  visible in $S$, or

\item there exists a type identifier $Id_3$ in $S$ such that,
\(
Id_2 \succ Id_3 \wedge  Id_3 \succ Id_1
\)
\end{itemize}

The {\em uses} relation ``$\gg$'' is used to check which type is used
in the type declaration of an other type identifier. A type identifier
$Id_1$ uses a type identifier $Id_2$, or $Id_1 \gg Id_2$, iff

\begin{itemize}

\item in $S$ a type declaration of the following form is visible

\begin{frag}
<Id$_{\tt 1}$> =
SHAPE <CardList> OF <Id$_{\tt 2}$>;
\end{frag}

\item there exists a type identifier $Id_3$ such that,
\(
Id_1 \gg Id_3 \wedge  Id_3 \gg Id_2
\)
\end{itemize}

\noindent The identifiers of a given scope and name space must be
well-defined. Therefore, we require the ordering induced by the union
of the relations $\succ$ and $\gg$ to be a strict partial ordering
(i.e.\ there are no cycles in the defined-by and uses relations). The
minimal elements of this induced ordering are intrinsic types (i.e.\
all \Booster\ types are defined in terms of intrinsic types and type
constructors). Moreover, there is no identifier $Id: Types.tex,v 1.1.1.1 1995/10/17 13:34:01 leo Exp $ such that \(
\mbox{\em IntrinsicType} \gg Id \; \vee \; \mbox{\em IntrinsicType}
\succ Id \) for any intrinsic type (i.e.\ intrinsic types may not be
redefined).

We define the set of all types {\em used} by a variable declaration as
the set of type identifiers {\small \tt <Id'>} such that

\begin{itemize}

\item the variable declaration has the form {\tt "<IdList> : SHAPE
<CardList> OF <Id>;" }

\item the variable declaration has the form { \tt "<IdList> : <Id>;" }
\item there exists an {\small \tt <Id>} such that {\small \tt <Id>}
$\gg$ {\small \tt <Id'>} and one of the above conditions hold for
{\small \tt <Id'>}.

\end{itemize}

\subsection*{Relations on types}

\noindent In order to define some relations on types we first
introduce two functions on \Booster\ types. The function {\em form}
computes the form of a member of a type and represents it as a
sequence. In the result of the function \form\ a definite length is
represented by a natural number, the generic constants in the
declaration of a formal parameter are represented by a {\em generic
variable}, and an indefinite dimension of a view type is represented
by a {\em free variable}. The base type function \bt\ yields the base
type of a type identifier by first expanding a type (i.e.\ recursively
replacing all identifiers by their definition) and then returning the
base type of the expanded type. Thus the result of an application of
the function \bt\ is always an intrinsic type. More formally:

Let \genvar\ and \freevar\ be infinite sets of generic and free
variables, respectively, such that $\freevar \cap \genvar =
\emptyset$. Let $\Forms ~ \widehat{=} ~ \mbox{\bf seq}(\mbox{\tt
NATURAL} \cup \genvar \cup \freevar)$, and let the operator $\concat$
denote the concatenation of sequences. In the following definitions
the identifiers $F$ and $G$ denote a fresh free or generic variable,
respecitvely, $C$ and $C'$ denote an element of
$\Language{\NT{CardinalityList}}$, $c$ denotes an element of
$\Language{\NT{Cardinality}}$, $E$ denotes an element of
$\Language{\NT{Expressions}}$, and {\em Id} denotes an element of
$\Language{\TC{Identifier}}$. Given the set \TypeDefSet\ we define:

\[
\begin{array}{rcl}
\multicolumn{3}{c}{
\form: \Language{\NT{Type}} \rightarrow \Forms}\\
\hlf
\form(T) & \widehat{=} &
\left\{\begin{array}{ll}
\langle \rangle
        & \mbox{if } T = \T{STRING} \vee\\
	& \mbox{if } T = \T{BOOLEAN} \vee\\
	& \mbox{if } T = \T{NATURAL} \vee\\
	& \mbox{if } T = \T{INTEGER} \vee\\
	& \mbox{if } T = \T{REAL} \vee\\
	& \mbox{if } T = \T{COMPLEX} \vee\\
\form_c(C)\concat\form(T')
	& \mbox{if } T = \T{SHAPE}\ \T{\{}\ C\ \T{\}}\ \T{OF}\ T' \\
\form_c(C)\concat\form(T')
	& \mbox{if } T = \T{VIEW}\ \T{\{}\ C\ \T{\}}\ \T{OF}\ T' \\
\form(T')
        & \mbox{if } T' \in \Language{\NT{Type}}\ \mbox{for some } (T,
	T') \in \TypeDefSet \\
\end{array}
\right.\\
\end{array}
\]

\noindent
The cardinality function $\form_{c}: \Language{\NT{CardinalityList}}
\rightarrow \Forms$, auxiliar to \form, is defined as follows:

\[
\begin{array}{rcl}
form_{c}(C) & \widehat{=} & \left\{
\begin{array}{ll}
\langle v(E)\rangle
	& \mbox{if } C = Id\ \T{:}\ E \\
	& \mbox{or } C = E \\
\langle F \rangle
	& \mbox{if } C = Id\ \T{*}\\
\langle G \rangle
	& \mbox{if } C = \T{CONST}\ Id \\
\form_c(c)\concat\form_c(C')
	& \mbox{if } C = c\ \T{\#}\ C' \\
\end{array}
\right.\\
\end{array}
\]

\noindent where the function $v$ evaluates to a natural value if its
argument is a constant expression, or returns a free new variable from
\genvar:

\[
\begin{array}{rcl}
\multicolumn{3}{c}{
v: \Language{\NT{Expression}} \rightarrow \mbox{\tt NATURAL} \cup
\genvar}\\
\hlf
v(E) & \widehat{=} & \left\{
\begin{array}{ll}
n
  & \mbox{if $E$ is a constant expression that evaluates to } n\\
G
  & \mbox{for a fresh free variable $G \in \genvar$ otherwise}
\end{array}
\right.
\end{array}
\]

\noindent We now define the base type function \bt:

\[
\begin{array}{rcl}
\multicolumn{3}{c}{
\bt: \Language{\NT{Types}} \rightarrow \Language{\NT{Types}}}\\
\hlf
\bt(T) = \left\{\begin{array}{ll}
\bt(T') & \mbox{if } T = \T{SHAPE}\ C\ \T{OF}\ T'\\
T'      & \mbox{if } T = \T{VIEW}\ C\ \T{OF}\ T'\\
\bt(T') & \mbox{if } (T,T') \in \TypeDefSet \mathrm{ for\ some } T'\\
T	& \mbox{otherwise}
\end{array}
\right.
\end{array}
\]

\noindent Given the following transitive and symmetric {\em inclusion}
relation on intrinsic types

\begin{quote}
\(
\T{COMPLEX} \sqsupseteq \T{REAL} \sqsupseteq
\T{INTEGER} \sqsupseteq \T{NATURAL}
\)
\end{quote}

\noindent we say two types $T_1$ and $T_2$ are {\em compatible}
$(\approx$) if the base type of $T_1$ includes the base type of $T_2$
and $\form(T_1)$ and $\form(T_2)$ can be made equal by an appropriate
substitution of the occuring free and generic variables. A type $T_1$
{\em includes} $(\sqsupseteq)$ a type $T_2$, if $T_1$ is a
(multi-dimensional) shape of type $T$ and $T$ is compatible to $T_2$. In
the following we define the type compatibility and type inclusion
relations formally.

\[
\begin{array}{rcl}
T_1 \approx T_2 & \widehat{=}
   & \bt(T_1) \sqsupseteq \bt(T_2) \wedge\\
 & & \mathrm{Let}\ \form(T_1) = \langle e_1,\ldots,e_m\rangle;
 \form(T_2) = \langle d_1,\ldots,d_n\rangle\ \mathrm{then} \\
 & & \tab n = m \wedge \forall i \in \{1,\ldots,n\} \bullet (e_i = d_i \vee\\
 & & \tab \tab (\{e_i, d_i\} \cap \freevar \cup \genvar \neq \emptyset)\\
\hlf
T_1 \sqsupseteq T_2 & \widehat{=}
   & \bt(T_1) \sqsupseteq \bt(T_2) \wedge\\
 & & \mathrm{Let}\ \form(T_1) = \langle e_1,\ldots,e_m\rangle;
     \form(T_2) = \langle d_1,\ldots,d_n\rangle\ \mathrm{then} \\
 & & \tab \exists i \in \{1,\ldots,m\} \bullet \langle e_i,\ldots,e_m\rangle
     = \langle d_1,\ldots,d_n\rangle
\end{array}
\]