\subsection{\Tname{}\ Theorems}

\begin{theorem}[incomplete monitoring]\label{T-incomplete-monitoring}
  There exists\/ $\fwellformedO{\sexpr_0}{\stoptional}$
  such that\/ $\conf{\sexpr_0}{\semptymap}{\semptymap} \rredTanns \conf{\sexpr_1}{\vstore_1}{\bstore_1}$
  and for all\/ $\lstore_1$
  such that\/ $\lstore_1 \sWSOT \vstore_1$,
  we have\/ $\lstore_1; \cdot; \sowner \not \sWSOT \sexpr_1$.
\end{theorem}
\begin{lamportproof}
{\newcommand{\thetype}{(\tfun{\tint}{\tint})}
 \newcommand{\thefun}{\efun{\svar_0}{(\esum{\svar_0}{1})}}
 \newcommand{\theargval}{\efun{\svar_1}{0}}
 \newcommand{\theexprA}{\estab{\obnd{\sowner_0}{\thetype}{\sowner_1}}{\obars{\edynb{\obnd{\sowner_1}{\thetype}{\sowner_2}}{\obars{\thefun}{\sowner_2}}}{\sowner_1}}}
  \newcommand{\theexprB}{\obars{\eapp{\tdyn}{\sexpr_0}{(\thefun)}}{\sowner_0}}

  Let\/

  $\begin{array}{lll}
   \sexpr_f & \eeq & \theexprA\\
    \sexpr_0 & \eeq & \theexprB \\
    \svalue_f & \eeq & {\obbars{\eloc_0}{\fconcat{\sowner_2}{\fconcat{\sowner_1}{\sowner_0}}}}\\
    \sexpr_1 & \eeq &
    \obars{\eapp{\tdyn}{\svalue_f}{(\theargval)}}{\sowner_0}
  \end{array}$
  \smallskip

  By the reduction rules:

  \(\begin{array}[t]{l@{~}l}
    \conf{\sexpr_0}{\semptymap}{\semptymap}
    & \rredTanns  \conf{\sexpr_1}{\vstore_0}{\bstore_0}
    \\
    \zerowidth{\mbox{\it where\, $\vstore_0 \eeq \eset{\vrecord{\eloc_0}{\thefun}}$}}
    \\
    \zerowidth{\mbox{\it and\, $\bstore_0 \eeq \eset{\brecord{\eloc_0}{\eset{{\obnd{\sowner_0}{\thetype}{\sowner_1}},{\obnd{\sowner_1}{\thetype}{\sowner_2}}}}}$}}
  \end{array}\)

  In the result, $\sWSOT$ fails because $\svalue_f$ has multiple owners.
  }
\end{lamportproof}

\begin{theorem}[unsound blame]\label{T-unsound-blame}
  There exists\/ $\fwellformedO{\sexpr_0}{\stoptional}$
   such that\/
      \(\conf{\sexpr_0}{\semptymap}{\semptymap}
      \rredTanns
      \conf{\boundaryerror{\obnd{\sowner_0}{\stype_1}{\sowner_1}}{\svalue_1}}{\vstore_1}{\bstore_1}\)
         and $\fblistsenders{\sblist_1} \not \subseteq
         \fvalueowners{\svalue_1}$.
\end{theorem}
\begin{lamportproof}
  {\newcommand{\theexampleint}{5}
   \newcommand{\theexampletype}{(\tfun{\tint}{\tint})}

  Consider the following example $\sexpr_0$ where the $\slet$-expressions are sugar
  for untyped function applications:
  $ \begin{array}[t]{lll}
  \sexpr_0
    &=&
 (\eletdecl{f_0}{(\efun{\svar_0}{\epair{\svar_0}{\svar_0}})}
    \\ &&
      ~\eletdecl{f_1}{(\estab{\obnd{\sowner_0}{\theexampletype}{\sowner_1}}{\obars{\edynb{\obnd{\sowner_1}{\theexampletype}{\sowner_0}}{\obars{f_0}{\sowner_0}}}{\sowner_1}})}
    \\ &&
     {\estab{\obnd{\sowner_0}{\tint}{\sowner_2}}{\obars{\eapp{\tint}{(\edynb{\obnd{\sowner_2}{\theexampletype}{\sowner_0}}{\obars{f_0}{\sowner_0}})}{\theexampleint}}{\sowner_2}})^{\sowner_0}}
  \end{array}$
 \smallskip

  By the reduction rules:

  \(
    \begin{array}[t]{l}
      \conf{\sexpr_0}{\semptymap}{\semptymap}
      \\
    \rredTanns
      \conf{\obars{\estab{\obnd{\sowner_0}{\tint}{\sowner_2}}{\obars{\eapp{\tint}{\obbars{\eloc_0}{\fconcat{\sowner_0}{\sowner_2}}}{\theexampleint}}{\sowner_2}}}{\sowner_0}}{\vstore_0}{\bstore_0}
    \\
     \rredTanns
      \conf{\obars{\estab{\obnd{\sowner_0}{\tint}{\sowner_2}}{\obars{\echecktwo{\tint}{\obbars{\eloc_1}{\fconcat{\sowner_0}{\sowner_2}}}{\eloc_0}}{\sowner_2}}}{\sowner_0}}{\vstore_1}{\bstore_1}
    \\
    \rredTanns
      \conf{\boundaryerror{\fmapref{\bstore_0}{\eloc_1} \cup \fmapref{\bstore_0}{\eloc_0}}{\obbars{\eloc_1}{\fconcat{\sowner_0}{\sowner_2}}}}{\vstore_1}{\bstore_0}
    \\
      \mbox{\it where\, $\vstore_1 = \eset{\vrecord{\eloc_0}{\efun{\svar_0}{\epair{\svar_0}{\svar_0}}}, \vrecord{\eloc_1}{\epair{\theexampleint}{\theexampleint}}}$}
    \\\mbox{\it and\, $\bstore_1 = \eset{\brecord{\eloc_0}{\obnd{\sowner_1}{\theexampletype}{\sowner_0}, \obnd{\sowner_0}{\theexampletype}{\sowner_1}, \obnd{\sowner_2}{\theexampletype}{\sowner_0}}, \brecord{\eloc_1}{\semptymap}}$}

  \end{array}\)
  \smallskip

  \noindent
  Thus $\fbsetsenders{\fmapref{\bstore_0}{\eloc_1} \cup
  \fmapref{\bstore_0}{\eloc_0}} \eeq \eset{\sowner_0, \sowner_1}
  \not\subseteq \eset{\sowner_0, \sowner_2} \eeq
  \fvalueowners{\obbars{\eloc_1}{\fconcat{\sowner_0}{\sowner_2}}}$.}
\end{lamportproof}

\begin{theorem}[incomplete blame]\label{T-incomplete-blame}
  There exists\/ $\fwellformedO{\sexpr_0}{\stoptional}$
  such that\/
      \(\conf{\sexpr_0}{\semptymap}{\semptymap}
      \rredTanns
      \conf{\boundaryerror{\obnd{\sowner_0}{\stype_1}{\sowner_1}}{\svalue_1}}{\vstore_1}{\bstore_1}\)
         and $\fblistsenders{\sblist_1} \not \supseteq
         \fvalueowners{\svalue_1}$.
\end{theorem}
\begin{lamportproof}

   Consider the following example $\sexpr_0$ where the $\slet$-expressions are sugar
  for untyped function applications:
{
  \newcommand{\raisedsowner}{\raisebox{0.8ex}{$\scriptstyle\sowner_0$}} % hack for proof terms
  \newcommand{\theexamplefun}{\efun{\svar_0}{\svar_0}}
  \newcommand{\typea}{(\tfun{\tint}{\tint})}
  \newcommand{\typeb}{(\tfun{\tint}{\tpair{\tint}{\tint}})}
  \newcommand{\typeatxt}{\stype_0}
  \newcommand{\typebtxt}{\stype_1}
  \newcommand{\deepfowners}{\fconcat{\sowner_2}{\fconcat{\sowner_1}{\fconcat{\sowner_0}{\fconcat{\sowner_3}{\fconcat{\sowner_4}{\fconcat{\sowner_3}{\fconcat{\sowner_0}{\sowner_5}}}}}}}}

  \(
  \begin{array}[t]{l}
    (\eletdecl{f_0}{\estab{\obnd{\sowner_0}{\typeatxt}{\sowner_1}}{(\edynb{\obnd{\sowner_1}{\typeatxt}{\sowner_2}}{(\theexamplefun)})}}
    \\[0.7ex]
    ~\eletdecl{f_1}{\estab{\obnd{\sowner_0}{(\tfun{\typeatxt}{\typebtxt})}{\sowner_3}}{(\edynb{\obnd{\sowner_3}{(\tfun{\typeatxt}{\typebtxt})}{\sowner_4}}{(\efun{\svar_1}{\svar_1})})}}
    \\[0.7ex]
    ~\estab{\obnd{\sowner_0}{(\tpair{\tint}{\tint})}{\sowner_5}}{}
    \\\qquad\conf{\zeroheight{\obars{\eapp{\tpair{\tint}{\tint}}{(\edynb{\obnd{\sowner_5}{\typebtxt}{\sowner_0}}{\obars{\eapp{\tdyn}{f_1}{f_0}}{\sowner_0}})}{42}}{\sowner_5})^{\raisedsowner}}}{\semptymap}{\semptymap}
    \\[1.4ex]
    \rredTanns
    (\estab{\obnd{\sowner_0}{(\tpair{\tint}{\tint})}{\sowner_5}}{}
    \\\qquad\qquad\conf{\zeroheight{\obars{\eapp{\tpair{\tint}{\tint}}{(\edynb{\obnd{\sowner_5}{\typebtxt}{\sowner_0}}{\obars{\eapp{\tdyn}{\obbars{\eloc_1}{\fconcat{\sowner_4}{\fconcat{\sowner_3}{\sowner_0}}}}{\obbars{\eloc_0}{\fconcat{\sowner_2}{\fconcat{\sowner_1}{\sowner_0}}}}}{\sowner_0}})}{42}}{\sowner_5})^{\raisebox{1.5ex}{$\scriptstyle\sowner_0$}}}}{\vstore_0}{\bstore_0}
    \\[0.6ex]
    \rredTanns
      \conf{\obars{\estab{\obnd{\sowner_0}{(\tpair{\tint}{\tint})}{\sowner_5}}{\obars{\eapp{\tpair{\tint}{\tint}}{\obbars{\eloc_0}{\sownerlist_0}}{42}}{\sowner_5}}}{\sowner_0}}{\vstore_1}{\bstore_1}
    \\[0.6ex]
    \rredTanns
      \conf{\obars{\estab{\obnd{\sowner_0}{(\tpair{\tint}{\tint})}{\sowner_5}}{\obars{\echecktwo{(\tpair{\tint}{\tint})}{\obbars{42}{\sownerlist_1}}{\eloc_0}}{\sowner_5}}}{\sowner_0}}{\vstore_2}{\bstore_2}
    \\[1.2ex]
    \rredTanns
      \conf{\boundaryerror{\fmapref{\bstore_2}{\eloc_0}}{\obbars{42}{\sownerlist_1}}}{\vstore_2}{\bstore_2}
    \\[1.2ex]
      \mbox{\quad where $\typeatxt = \typea$}
    \\[0.3ex]
      \mbox{\quad and $\typebtxt = \typeb$}
    \\[0.5ex]
      \mbox{\quad and $\sownerlist_0 = \deepfowners$}
    \\[0.5ex]
      \mbox{\quad and $\sownerlist_1 = \fconcat{\fconcat{\sowner_5}{\sownerlist_0}}{(\frev{\sownerlist_0})}$}
    \\[0.5ex]
      \mbox{\quad and $\vstore_2 = \eset{(\vrecord{\eloc_0}{\theexamplefun}), (\vrecord{\eloc_1}{\efun{\svar_1}{\svar_1}})}$}
    \\[0.5ex]
      \mbox{\quad and $\bstore_2 = \{(\vrecord{\eloc_0}{\eset{\obnd{\sowner_0}{\typeatxt}{\sowner_1}, \obnd{\sowner_1}{\typeatxt}{\sowner_2}, \obnd{\sowner_5}{\typebtxt}{\sowner_0}}}),$}
    \\[0.2ex]
      \mbox{\quad \hphantom{and $\bstore_2 = \{$}$(\vrecord{\eloc_1}{\eset{\obnd{\sowner_0}{(\tfun{\typeatxt}{\typebtxt})}{\sowner_3}, \obnd{\sowner_3}{(\tfun{\typeatxt}{\typebtxt})}{\sowner_4}}})\}$}
  \end{array}\)\smallskip
}

  Hence,
$\fbsetsenders{\fmapref{\bstore_2}{\eloc_0}}
  \eeq
  \eset{\sowner_0, \sowner_1, \sowner_2}
  \not\supseteq
  \eset{\sowner_0, \sowner_1, \sowner_2, \sowner_3, \sowner_4, \sowner_5}
  \eeq \fvalueowners{\obbars{42}{\sownerlist_1}}
$.
  The crucial labels $\sowner_3$ and $\sowner_4$ are nowhere to be found.
\end{lamportproof}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%% All-path
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\newcommand{\Tdyn}{$\sexpr_0
                      \rredTanns
                      \oconf{\ctx_0[\edynb{\obnd{\sowner_1}{\stype_1}{\sowner_2}}{\svalue_1}]}
                      {\vstore_0}{\bstore_0}{\lstore_0}
                      \nredTXanns
                      \oconf{\boundaryerror{\obnd{\sowner_1}{\stype_1}{\sowner_2}}{\svalue_1}}
                      {\vstore_1}{\bstore_1}{\lstore_1}$}
\newcommand{\Tdynitems}{%
  \begin{enumerate}
      \item
      \(\fhasbnd{\sexpr_0}{\obnd{\sowner_1}{\stype_1}{\sowner_2}}\)
      \item
        \( \svalue_1 = \obbars{\svalue}{\sowner_n...\sowner_2}\)
        \end{enumerate}}

\newcommand{\Tapp}{$\sexpr_0
                      \rredTanns
                      \oconf{\ctx_0[{\eapp{\stoptional}
                        {\svalue_0}
                        {\svalue_1}}]}
                      {\vstore_0}{\bstore_0}{\lstore_0}
                      \nredTXanns
                      \oconf{\boundaryerror{\sblist_1}{\svalue_1}}
                      {\vstore_1}{\bstore_1}{\lstore_1}$}
\newcommand{\Tappitems}{%
 \begin{enumerate}
        \item
      \(\forall\,\sbnd_1 \in \sblist_1\),  either \(\fhasbnd{\sexpr_0}{\sbnd_1}\) or \(\fhasbnd{\sexpr_0}{\fflip{\sbnd_1}}\)
    \item
         $\svalue_1 = \obbars{\eloc_1}{\sownerlist_0}$, $
         \exists\,\sownerlist_1~.~\rbstoresimbasic{\sownerlist_1}{\sblist_1}$
         and $\sownerlist_0 \cup {\lstore_1(\eloc_1)} \subseteq \sownerlist_1$.
  \end{enumerate}}

\newcommand{\Tchecka}{$\sexpr_0
                      \rredTanns
                      \oconf{\ctx_0[{\echeck{\sdirection}{\stype_0}{\svalue_0}
                                        {\eloc_1}}]}{\vstore_0}{\bstore_0}{\lstore_0}
                      \nredTXanns
                      \oconf{\boundaryerror{\sblist_1}{\svalue_0}}{\vstore_0}{\bstore_0}{\lstore_0}$}
\newcommand{\Tcheckitemsa}{%
  \begin{enumerate}
        \item
      \(\forall\,\sbnd_1 \in \sblist_1\),  either \(\fhasbnd{\sexpr_0}{\sbnd_1}\) or \(\fhasbnd{\sexpr_0}{\fflip{\sbnd_1}}\)
    \item
         $\svalue_0 = \obbars{\svalue_1}{\sownerlist_0}$,
         $\exists\,\sownerlist_1~.~\rbstoresimbasic{\sownerlist_1}{\sblist_1}$,
         and $\sownerlist_0 \cup \lstore_1(\svalue_1) \cup \lstore_1(\eloc_1) \subseteq  \fbsetsenders{\sblist_1}$.
  \end{enumerate}}

\begin{theorem}[all-path sound blame]\label{T-all-path-blame-soundness}
  If\/ $\fwellformedO{\sexpr_0}{\stoptional}$:
  \begin{itemize}
    \item \Tdyn{} then \Tdynitems
    \item \Tapp{} then \Tappitems
    \item \Tchecka{} then \Tcheckitemsa
  \end{itemize}
\end{theorem}
\begin{proofsketch}
  The proof relies on a straight-forward subject reduction
  argument showing that the evaluation trace of any well-formed term $\sexpr_0$ satisfies two
  invariants:
  \begin{itemize}
  \item
  for all
  $\edynb{\obnd{\sowner_1}{\stype_1}{\sowner_2}}{\svalue_1}$
  that occur in all configurations $\oconf{\sexpr}{\vstore}{\bstore}{\lstore}$ in the trace,
      \(\fhasbnd{\sexpr_0}{\obnd{\sowner_1}{\stype_1}{\sowner_2}}\)
      and
        \( \svalue_1 = \obbars{\svalue}{\sowner_n...\sowner_2}\);
   \item
   for all configurations
  $\oconf{\sexpr}{\vstore}{\bstore}{\lstore}$ in the trace, (i)
  if $\sexpr\neq\boundaryerror{\sblist}{\svalue}$ then
  for all
  $\eloc$ in the domain of $\lstore$,
  $\lstore(\eloc) \subseteq \sowner^*$
  where $\rbstoresimbasic{\sowner^*}{\bstore(\eloc_0)}$ and (ii)
\(\forall\,\sbnd_1 \in \bstore(\eloc_0)\),  either
  \(\fhasbnd{\sexpr_0}{\sbnd_1}\) or
  \(\fhasbnd{\sexpr_0}{\fflip{\sbnd_1}}\).
  \end{itemize}
    We employ the first invariant to establish the first case of the
    theorem and the second for the others.
\end{proofsketch}

\newcommand{\Tcheckitemsanot}{%
  \begin{enumerate}
        \item
      \(\forall\,\sbnd_1 \in \sblist_1\),  either \(\fhasbnd{\sexpr_0}{\sbnd_1}\) or \(\fhasbnd{\sexpr_0}{\fflip{\sbnd_1}}\)
    \item
         $\svalue_0 = \obbars{\svalue_1}{\sowner^*}$, $\svalue
         \neq \eloc$, $ \rbstoresimbasic{\sowner_1 ... \sowner_n}{\sblist_1}$
         and $\sowner_1 ... \sowner_n \not \supseteq \lstore_1(\eloc_1) \cup
         \sowner^*$.
  \end{enumerate}}

\begin{theorem}[all-path incomplete blame]\label{T-allpath-incomplete-blame}
  There exists\/ $\sexpr_0$
  such that\/ $\cdot; \sownertop \sWL \sexpr_0$,
  \begin{itemize}
  \item
  \Tchecka and \Tcheckitemsanot{}
   \end{itemize}
\end{theorem}
\begin{lamportproof}
  {
  \newcommand{\theexamplefun}{\efun{\svar_0}{\svar_0}}
  \newcommand{\typea}{(\tfun{\tint}{\tint})}
  \newcommand{\typeb}{(\tfun{\tint}{\tpair{\tint}{\tint}})}
  \newcommand{\typeatxt}{\stype_0}
  \newcommand{\typebtxt}{\stype_1}
  \newcommand{\deepfowners}{\fconcat{\sowner_2}{\fconcat{\sowner_1}{\fconcat{\sowner_0}{\fconcat{\sowner_3}{\fconcat{\sowner_4}{\fconcat{\sowner_3}{\fconcat{\sowner_0}{\sowner_5}}}}}}}}

   Consider the following example $\sexpr_0$ where the $\slet$-expressions are sugar
  for untyped function applications:
  $\begin{array}[t]{lll}
    \sexpr_0
    &=&
    (\eletdecl{f_0}{\estab{\obnd{\sowner_0}{\typeatxt}{\sowner_1}}{(\edynb{\obnd{\sowner_1}{\typeatxt}{\sowner_2}}{(\theexamplefun)})}}
    \\&&
    ~\eletdecl{f_1}{\estab{\obnd{\sowner_0}{(\tfun{\typeatxt}{\typebtxt})}{\sowner_3}}{(\edynb{\obnd{\sowner_3}{(\tfun{\typeatxt}{\typebtxt})}{\sowner_4}}{(\efun{\svar_1}{\svar_1})})}}
    \\&&
    ~\estab{\obnd{\sowner_0}{(\tpair{\tint}{\tint})}{\sowner_5}}{}
    \\&&\obars{\eapp{\tpair{\tint}{\tint}}{(\edynb{\obnd{\sowner_5}{\typebtxt}{\sowner_0}}{\obars{\eapp{\tdyn}{f_1}{f_0}}{\sowner_0}})}{42}}{\sowner_5})^{\sowner_0}
  \end{array}$
 \smallskip

   With a straight-forward application of the reduction rules we obtain:

  \(
  \begin{array}[t]{l}
    \oconf{\sexpr_0}{\semptymap}{\semptymap}{\semptymap}

    \\
    \rredT
    ~\estab{\obnd{\sowner_0}{(\tpair{\tint}{\tint})}{\sowner_5}}{}
    \\\qquad\qquad\oconf{\obars{\eapp{\tpair{\tint}{\tint}}{(\edynb{\obnd{\sowner_5}{\typebtxt}{\sowner_0}}{\obars{\eapp{\tdyn}{\obbars{\eloc_1}{\fconcat{\sowner_4}{\fconcat{\sowner_3}{\sowner_0}}}}{\obbars{\eloc_0}{\fconcat{\sowner_2}{\fconcat{\sowner_1}{\sowner_0}}}}}{\sowner_0}})}{42}}{\sowner_5})^{\sowner_0}}{\vstore_0}{\bstore_0}{\lstore_0}
    \\
    \rredT
      \oconf{\obars{\estab{\obnd{\sowner_0}{\tpair{\tint}{\tint}}{\sowner_5}}{\obars{\eapp{\tpair{\tint}{\tint}}{\obbars{\eloc_0}{\sownerlist_0}}{42}}{\sowner_5}}}{\sowner_0}}{\vstore_1}{\bstore_1}{\lstore_1}
    \\
   \rredT
      \oconf{\obars{\estab{\obnd{\sowner_0}{\tpair{\tint}{\tint}}{\sowner_5}}{\obars{\echecktwo{\tpair{\tint}{\tint}}{\obbars{42}{\sownerlist_1}}{\eloc_0}}{\sowner_5}}}{\sowner_0}}{\vstore_2}{\bstore_2}{\lstore_2}
    \\
    \nredTX
      \oconf{\boundaryerror{\fmapref{\bstore_2}{\eloc_0}}{\obbars{42}{\sownerlist_1}}}{\vstore_2}{\bstore_2}{\lstore_2}
    \\
      \mbox{\it where $\typeatxt = \typea$ and $\typebtxt = \typeb$}
    \\\mbox{\it and $\sownerlist_0 = \deepfowners$ and $\sownerlist_1 = \fconcat{\fconcat{\sowner_5}{\sownerlist_0}}{(\frev{\sownerlist_0})}$}
    \\\mbox{\it and $\vstore_2 = \eset{(\vrecord{\eloc_0}{\theexamplefun}), (\vrecord{\eloc_1}{\efun{\svar_1}{\svar_1}})}$}
    \\\mbox{\it and $\bstore_2 = \{(\vrecord{\eloc_0}{\eset{\obnd{\sowner_0}{\typeatxt}{\sowner_1}, \obnd{\sowner_1}{\typeatxt}{\sowner_2}, \obnd{\sowner_5}{\typebtxt}{\sowner_0}}}),$}
    \\\mbox{\it \hphantom{and $\bstore_2 =
    \{$}$(\vrecord{\eloc_1}{\eset{\obnd{\sowner_0}{(\tfun{\typeatxt}{\typebtxt})}{\sowner_3},
    \obnd{\sowner_3}{(\tfun{\typeatxt}{\typebtxt})}{\sowner_4}}})\}$}
  \end{array}\)\smallskip
  }

  \noindent
  Thus $\rbstoresimbasic{\eset{\sowner_0,\sowner_1,
  \sowner_2, \sowner_5}}{\fmapref{\bstore_2}{\eloc_0}}$
  and  $\eset{\sowner_0,
  \sowner_1, \sowner_2, \sowner_5} \not\supseteq
  \fmapref{\lstore_2}{\eloc_0} \cup \eset{\sowner_0, \sowner_1,
  \sowner_2, \sowner_3, \sowner_4, \sowner_5}$
  independently of the details of
  $\lstore_2$.
\end{lamportproof}

%\begin{lemma}[All-path/path consistency]\label{T-all-path-path}
%  If\/ $\sexpr_0$ is a surface expression and $\sexpr_0 \rredT
%  \oconf{\sexpr_1}{\vstore_0}{\bstore_0}{\lstore_0}$ where
%  $\sexpr_1\neq\boundaryerror{\sblist}{\svalue}$,
%  then for all $\obbars{\eloc_0}{\sowner_1...\sowner_n}$ that appear in
%  $\sexpr_1$, ${\sowner_1...\sowner_n \subseteq \lstore_0(\eloc_0)}$.
%\end{lemma}
%\begin{proofsketch}
%  By straight-forward induction on the length of $\sexpr_0 \rredT
%  \oconf{\sexpr_1}{\vstore_0}{\bstore_0}{\lstore_0}$. For the inductive step
%  we proceed with the obvious case analysis on
%  $\oconf{\sexpr_i}{\vstore_i}{\bstore_i}{\lstore_i} \rrTX
%  \oconf{\sexpr_{i+1}}{\vstore_{i+1}}{\bstore_{i+1}}{\lstore_{i+1}}$.
%\end{proofsketch}

\begin{theorem}[type soundness]\label{T-S-type-soundness}
  If\/ $\fwellformed{\sexpr_0}{\stoptional}$
  then one of the following holds:
  \begin{itemize}
    \item $\conf{\sexpr_0}{\semptymap}{\semptymap} \rredT
      \conf{\svalue_0}{\vstore_0}{\bstore_0}$
      and\/ $\exists\,\vstoretype_0~.~\vstoretype_0; \snil \sWTT \svalue_0 : \tagof{\stoptional}$
    \item $\conf{\sexpr_0}{\semptymap}{\semptymap}$ diverges
    \item $\conf{\sexpr_0}{\semptymap}{\semptymap} \rredT
      \conf{\ctx_0[\edynb{\sbnd_1}{\ctx[\sexpr_1]}]}{\vstore_0}{\bstore_0}$
      and\/ $\conf{\sexpr_1}{\vstore_0}{\bstore_0} \nredTX \conf{\tagerrorD}{\vstore_1}{\bstore_1}$
    \item $\conf{\sexpr_0}{\semptymap}{\semptymap} \rredT \conf{\divisionbyzeroerror}{\vstore_0}{\bstore_0}$
    \item $\conf{\sexpr_0}{\semptymap}{\semptymap} \rredT \conf{\boundaryerror{\sblist_1}{\svalue_1}}{\vstore_0}{\bstore_0}$
  \end{itemize}
\end{theorem}
\begin{proofsketch}
  By progress and preservation lemmas; preservation constructs a heap typing ($\vstoretype$) at each step.
\end{proofsketch}


In this section, we evaluate the performance of our approach to reliability
analysis and optimization presented in \sref{chaos-reliability-analysis} and
\sref{chaos-optimization} considering the illustrative application described in
\sref{chaos-optimization-application}. The technique for dynamic steady-state
analysis under process variation delineated in
\sref{chaos-dynamic-steady-analysis} is also a part of the assessment, since it
is included in the reliability model. All the experiments are conducted on a
\up{GNU}/Linux machine equipped with 16 Intel Xeon E5520 2.27~\up{GH}z
processors and 24~\up{GB} of \up{RAM}. All the configuration files used in the
experiments are available online at \cite{eslab2015}.

We consider a 45-nm technological process and rely on the 45-nm open cell
library by NanGate \cite{nangate} as explained in
\sref{chaos-optimization-application}. The effective channel length and gate
oxide thickness are assumed to have nominal values equal to 22.5~nm and 1~nm,
respectively. Based on the International Technology Roadmap for Semiconductors
\cite{itrs}, each parameter is assumed to deviate by up to 12\% of its nominal
value; the percentage is treated as three standard deviations, and the
assumption should be understood accordingly. Regarding the correlation function
in \eref{bayes-correlation}, the weight coefficient $w$ is set to 0.5, and the
length-scale parameters $\ell_\SE$ and $\ell_\OU$ are set to half the size of
the die. The model order reduction described in
\xref{probability-transformation} is set to preserve 95\% of the variance of the
problem. The parameter $\gamma$ used in \eref{chaos-anisotropic-weight}, which
controls the anisotropy of \ac{PC} expansions and integration grids, is set to
0.25.

Heterogeneous platforms and periodic applications are randomly generated via
\up{TGFF} \cite{dick1998} in such a way that the execution time of each task is
uniformly distributed between 10 and 30~ms, and its dynamic power between 6 and
20~W. The floorplans of the platforms being considered are regular grids with
each processing element occupying 4~\power{mm}{2}. The sampling interval \dt of
power and temperature profiles is set to 1~ms. The stopping condition used in
\aref{chaos-dynamic-steady-solution-iterative} is that the \ac{NRMSE} between
two successive temperature profiles becomes smaller than 1\%, which typically
requires 3--5 iterations.

\subsection{Approximation Accuracy}

Our first task is to evaluate the accuracy of the proposed framework. To this
end, in this subsection, the quantity of interest given in
\eref{chaos-optimization-quantity}---which encompasses the total energy
consumption, maximum temperature, and parameterization of the reliability model
of the system---is considered in isolation. This quantity plays the key role in
the subsequent optimization, since the optimization objective and constraints
depend on it, as discussed previously.

We compare the performance of our technique with that of direct \ac{MC} sampling
applied to the quantity shown in \eref{chaos-optimization-quantity}. The
operations performed by direct sampling for one sample are the same as those
performed by our framework for one quadrature point. The only difference is that
no model order reduction of any kind is undertaken prior to \ac{MC} sampling,
which ensures that the resulting accuracy is not compromised. The number of
\ac{MC} samples is set to \power{10}{4}, which is a practical assumption based
not only on our experience but also on the literature, as discussed in
\sref{chaos-transient-results}.

\inputtable{chaos-optimization-accuracy}
The results are displayed in \tref{chaos-optimization-accuracy} where we
consider a quad-core platform ($\np = 4$) with 10 randomly generated
applications and vary the level of polynomial expansions \lc from one to five.
The errors for the three components of $\vg = (E, Q, \life)$ are denoted by
\error{E}, \error{Q}, and \error{\life}, respectively. Each error metric shows
the distance between the empirical probability distributions produced by our
approach and the ones produced by direct sampling. The measure of this distance
is the \ac{KLD} \cite{gelman2013, hastie2013} where the results of direct
sampling are treated as the true ones. The \ac{KLD} takes non-negative values
and reaches zero only when two distributions are equal almost everywhere
\cite{durrett2010}. In general, the errors decrease as \lc increases. This
trend, however, is not monotonic for \ac{PC} expansions of high levels; see
\error{Q} and \error{\life} for $\lc = 5$ in \tref{chaos-optimization-accuracy}.
This observation can be ascribed to the random nature of sampling and to the
reduction procedures that we undertake in order to gain speed; they reasonably
impose limitations on the accuracy that can be attained by polynomial
surrogates. \tref{chaos-optimization-accuracy} additionally contains the number
of polynomial terms \nc and the number of quadrature points \nq that correspond
to each value of \lc. We have performed the above experiment for platforms with
both fewer and more processing elements and have observed similar results.

Based on the figures reported in \tref{chaos-optimization-accuracy}, we consider
the results delivered by third-level \ac{PC} expansions, where the \ac{KLD}
drops to the third decimal place for all the three quantities, sufficiently
accurate. Therefore, we fix \lc---and hence \lq, as they are kept
synchronized---to three for the rest of the experiments.

\subsection{Computational Speed}

\inputtable{chaos-optimization-speed}
Our task now is to assess the speed of the proposed solution. To this end, we
consider the same setup as the one outlined in the previous subsection.
\tref{chaos-optimization-speed} displays the time needed to perform one
characterization of \vg for the number of processing elements \np increasing
from 2 to 32. Note that, in this experiment, no parallel computing is utilized.
It can be seen that the computation time ranges from a fraction of a second to
around two seconds. More importantly, \tref{chaos-optimization-speed} provides
information about a number of complementary quantities that are of great
interest to the designer, which we discuss below.

The primary quantity to pay heed to is the number of random variables \nz
preserved after the reduction procedure noted in \sref{chaos-transformation} and
described in \xref{probability-transformation}. Without this reduction, \nz
would be $2 \np$, since there are two process parameters per processing element;
recall \sref{chaos-optimization-application}. It can be seen in
\tref{chaos-optimization-speed} that there is no reduction in the case of the
dual-core platform, whereas around 80\% of the stochastic dimensions are
eliminated in the case of the platform with 32 processing elements. One can also
note that \nz is the same for the last two platforms. The magnitude of reduction
is determined solely by the assumed correlation structure (see
\sref{chaos-optimization-application}) and the floorplan of the platform at
hand, which we also observe and discuss in \sref{chaos-transient-results}.

Another important quantity displayed in \tref{chaos-optimization-speed} is the
number of quadrature points \nq. This number is the main indicator of the
computational expense of our probabilistic analysis: it is equal to the number
of times Algorithm~G in \aref{chaos-construction} must be executed in order to
construct a \ac{PC} expansion of the quantity of interest \g, which, in this
case, is the one in \eref{chaos-optimization-quantity}. Note that \nq is very
low. In order to substantiate this, the last column of
\tref{chaos-optimization-speed} shows the speedup of our approach with respect
to \power{10}{4} \ac{MC} samples. The proposed solution is 100--200 times faster
while delivering highly accurate results, as discussed earlier. It should be
noted that the comparison has been drawn based on the number of evaluation
points rather than on the wall-clock time, since the relative cost of other
computations is negligible.

To summarize, the proposed framework for probabilistic analysis of electronic
systems under process variation has been assessed using the composite quantity
given in \eref{chaos-optimization-quantity}. The results shown in
\tref{chaos-optimization-accuracy} and \tref{chaos-optimization-speed} indicate
that our approach is both accurate and computationally efficient.

\subsection{Optimization Effectiveness}

\inputtable{chaos-optimization-objective}
In this subsection, the results of the optimization procedure formulated in
\sref{chaos-optimization} are reported. To reiterate, the objective is to
minimize the expected energy consumption as shown in
\eref{chaos-optimization-objective} while satisfying a set of constraints on the
maximum end-to-end delay, maximum temperature, and minimum lifetime as shown in
\eref{chaos-optimization-constraints}. For optimization, we employ a genetic
algorithm and evaluate candidate solutions in parallel using 16 cores.

The goal of this experiment is to justify the following assertion: reliability
analysis has to account for the effect of process variation on temperature. To
this end, for each problem (a pair of a platform and an application), we run the
optimization procedure twice: the first run assumes the setup discussed in this
section so far, and the second run treats the objective in
\eref{chaos-optimization-objective} and the constraints in
\eref{chaos-optimization-constraints} as deterministic. Specifically, the second
run assumes that temperature is deterministic and can be computed using the
nominal values of the process parameters. Therefore, in this deterministic case,
only one execution of the system is needed in order to evaluate a chromosome's
fitness. \eref{chaos-optimization-objective} and
\eref{chaos-optimization-constraints} become, respectively,
\[
    \min_{\schedule} E(\schedule)
\]
and
\begin{align*}
  & \period(\schedule) \leq \period_\maximum, \\
  & Q(\schedule) \geq \q_\maximum, \text{ and} \\
  & \life(\schedule) \leq \life_\minimum.
\end{align*}

We consider five platforms with the number of processing elements \np taking
values in $\set{2^i}_{i = 1}^5$ and 10 applications with the number of tasks \nt
equal to $20 \np$; therefore, there are 50 problems in total. In
\eref{chaos-optimization-constraints}, $\rho_\burn$ and $\rho_\wear$ are set to
0.01. Due to the diversity of the problems, $\period_\maximum$, $\q_\maximum$,
and $\life_\minimum$ are found individually for each problem in order to ensure
that their values are sensible to the subsequent optimization. For instance,
$\q_\maximum$ ranges from \celsius{90} to \celsius{120}, depending on the
problem. Note, however, that these three parameters stay the same in both the
probabilistic and deterministic cases.

The results are reported in \tref{chaos-optimization-objective}. The most
important message is in the last column. \emph{Failure} refers to the percentage
of the solutions produced by the deterministic optimization that, after being
re-evaluated using our probabilistic approach (that is, after taking process
variation into account), have been found to violate the probabilistic
constraints given in \eref{chaos-optimization-constraints}. For example, for the
quad-core platform, 6 out of 10 schedules that are proposed by the deterministic
approach violate the constraint on the maximum temperature or the minimum
lifetime (or both) when process variation is taken into consideration. As the
problem becomes more and more complex, the failure rate attains higher and
higher values. With 16 and 32 processing elements (320 and 640 tasks,
respectively), all the deterministic solutions violate the imposed constraints.
Moreover, the difference between the acceptable 1\% of burn and wear
($\rho_\burn = \rho_\wear = 0.01$) and the actual probability of burn and wear
is found to be as high as 80\% in some cases, which is unacceptable.

In addition, we take a close look at those few deterministic solutions that have
passed the probabilistic re-evaluation and observe that the reported reduction
in the maximum temperature and energy consumption as well as the reported
increase in the lifetime are overoptimistic. To elaborate, the predictions
produced by the deterministic optimization, which neglects process variation,
are compared with the expected values obtained when process variation is taken
into account. The comparison shows that the expected energy consumption and
temperature are up to 5\% higher while the expected lifetime is up to 20\%
shorter than the ones estimated by the deterministic approach. This aspect of
the deterministic optimization can mislead the designer. Hence, when studying
those characteristics of electronic systems that are concerned with power,
temperature, and reliability, ignorance of the effect of process variation can
severely compromise the associated design decisions, making them less profitable
in the best case and dangerous in the worst case.

Let us now comment on the optimization time shown in
\tref{chaos-optimization-objective}. It can be observed that our framework takes
from around one minute to six hours (utilizing 16 cores) in order to perform the
optimization, and that the deterministic technique is 2--40 times faster.
However, the price to pay when relying on the latter is quite high, as discussed
above. The deterministic approach is blind-guessing with highly unfavorable odds
of succeeding. Therefore, the computation time of our framework is considered
reasonable and affordable.

Lastly, we perform an experiment targeted at investigating the impact of the
lifetime constraint in \eref{chaos-optimization-constraints} on the reduction in
the expected energy consumption. To this end, we run our probabilistic
optimization (all 50 problems) without the reliability constraint and compare
the corresponding results with those obtained when the lifetime constraint is
included. We observe that the expected energy consumption is higher when the
constraint is taken into account; however, the difference vanishes when the
complexity of the problem increases. On average, the cost of the lifetime
constraint is below 5\% in terms of energy consumption. Without the constraint,
however, no (probabilistic) guarantees on the system's lifetime can be given.


\chapter{Conclusion}\label{chpt:conclusion}

In summary, the main contribution of the work underlying this thesis is
\gls{PyExaFMM}; a three dimensional \gls{KIFMM} simulation library
with some parallel features. The software has been designed to be well
testable and extensible, however it is currently someway behind state of the art
implementations in terms of speed \cite{Malhotra:2015:CCP, exafmm}.
Furthermore, from table (\ref{table:3_1_jit}),
we see that some current optimisations, namely \gls{JIT} compilation for some
Numpy based functions, have been naively applied. To bring
 \gls{PyExaFMM} in line with state of the art \gls{KIFMM} software,
extensions which fully take advantage of modern computing hardware will
have to be implemented. Modern heterogenous computers have access to
multiple multi-core \gls{CPU} and \gls{GPU} units, with multiple levels of
memory-cache, and vectorisation available at the processor level
\cite{Malhotra:2015:CCP}. The current optimisations within \gls{PyExaFMM} do not
take advantage of shared or distributed memory parallelism. As mentioned in
Chapter \ref{chpt:1_introduction}, Section \ref{sec:1_1_fmm_overview}, the near-field
\gls{P2P} calculations can be transferred to \gls{GPU}s for acceleration
\cite{Hwu:2011:MKP}, alternatively as discussed above fast Newton iterations and
\gls{AVX} vectorisation at the \gls{CPU} level
is used to accelerate the \gls{P2P} calculations in both major \gls{KIFMM}
implementations \cite{Malhotra:2015:CCP, exafmm}. These optimisations are
dependent on the available hardware, however they share a common approach in distributing
a single \gls{P2P} instruction, across multiple particle interactions, following
the \gls{SIMD} paradigm. The calculation of the far-field \gls{M2L} operator
matrices can also be accelerated by the above techniques. Furthermore, randomised
\gls{SVD} compression \cite{Erichson:2019:JOSS, Halko:2011:SIAM} can be implemented
to also take advantage of shared memory parallelism as described in Chapter
\ref{chpt:2_strategy_for_practical_implementation}, Section \ref{sec:2_4_svd_compression},
reducing further the cost of computing low-rank approximations of the \gls{M2L} operator matrices.
The mixed performance of \gls{JIT} compilation for the construction of trees,
leaves a lot of room for for further optimisation in \gls{PyExaFMM}. Specifically,
state of the art implementations construct adaptive trees in parallel, taking
advantage of the distributed memory programming paradigm with \gls{MPI} \cite{Malhotra:2015:CCP}.
PVFMM, for example, chunks particle data across processors, constructing subtrees in parallel,
and uses \gls{MPI} to pass multipole and local expansion coefficients to other processes
as required during the main \gls{FMM} loop. In addition to the above optimisations,
the current \gls{PyExaFMM} codebase can be further sanitised. Specifically, integration tests
that test the way in which modules interact, should be added on top of the current
unit test suite. Additionally, it should be a priority to perform more
detailed code profiling to clearly identify the most significant memory and
 \gls{CPU} bottlenecks.

Despite its limitations, \gls{PyExaFMM} achieves the complexity bound of the
\gls{FMM} algorithm. Furthermore, it represents a significant first step towards the goal
of an open source Python \gls{KIFMM} implementation which sacrifices as little
computational performance as possible, in comparison to major compiled language
implementations.