\section{Fundamentals and Related Work} \label{fundamentals}

\subsection{From Probabilistic Language Models to modeling Evolution Theory} \label{fundamentalsB}

A probabilistic language model tries to approximate the probability dis\-tri\-bu\-ti\-on

\begin{equation}
	P(w_1, ..., w_n) = \Pi_{t=1}^{n} P(w_t | w_1, ..., w_{t-1})
\end{equation}

with $w_t$ being a word at position (time step) $t$ in a sentence of length $n$. To build language models \acp{RNN} were used to model such probability distributions.

\begin{figure}[ht]
	\centering
	\includegraphics[width=0.6\linewidth]{figures/rnn_architecture.png}
	\caption{Architecture of a conventional \ac{RNN} \cite[p. 46]{Gertz2020}}
	\label{rnn_architecture}
\end{figure}

At each time step $t$ it outputs a probability distribution $P(w_t | w_1, ..., w_{t-1})$ given the words read so far in the current instance (see \autoref{rnn_architecture}). Words are read as a vectorized numerical representation, often given by pretrained so-called word embeddings $x_t$ which are lower-dimensional and more semantically enriched compared to simple one-hot encodings. One then calculates the hidden state $h_t$ by

\begin{equation}
	h_t = f(W^{(h)} h_{t-1} + W^{(x)} x_t + b_1)
\end{equation}

and the corresponding output probability distribution by

\begin{equation}
	\hat{y}_t = softmax(U^{(h)} h_t + b_2).
\end{equation}

The applied weight matrix is always the same for each time step $t$ giving the \ac{RNN} its name. One can therefore simplify the unrolled \ac{RNN} architecture on the left side of \autoref{rnn_architecture} to the one on the right, where the hidden state is continuously passed as an input to the next time step. To achieve a better convergence behavior during training, one can also provide the expected hidden state of time step $t-1$ instead of using the predicted hidden state, which is called teacher forcing. \acp{RNN} can process input of arbitrary length and are by their recurrent character capable to use information from previous time steps. Unfortunately, they are vulnerable to vanishing and exploding gradient problems. \ac{LSTM} is a special \ac{RNN} architecture that solves such vulnerabilities by owning a separate long-term cell state besides a short-term hidden state (introduced in \autoref{fundamentalsF}). It can preserve information over many time steps. \cite{Gertz2020}

\begin{figure}[ht]
	\centering
	\includegraphics[width=0.6\linewidth]{figures/multi_layer_rnn.png}
	\caption{Architecture of a multi-layer  \ac{RNN} \cite[p. 87]{Gertz2020}}
	\label{multi_layer_rnn}
\end{figure}

One can also use two \acp{RNN}, one traversing a sentence from left to right and another one vice versa, with two different weight matrices to model the probability distribution bidirectionally. One therefore simply concatenates the hidden states of each \ac{RNN} before applying the weight matrix $U$ and the $softmax()$ function. Also multi-layer \acs{RNN} can be utilized to generate higher-order features (hidden states) for the prediction task (see \autoref{multi_layer_rnn}). \cite{Gertz2020}

The \acp{RNN} or even better \acp{LSTM} architectures used for probabilistic language modeling can be reused in a more complex domain called sequence to sequence modeling for \ac{NMT} from one lan\-gua\-ge to another. Here one first tries to learn a fixed-dimensional input re\-pre\-sen\-ta\-ti\-on from an input sequence using an encoder architecture based on an \ac{LSTM}. The so-called context vector is then decoded by a second \ac{LSTM} into a new sequence of words preserving the grammar but having a different meaning. \cite{Sutskever2014}

Sequence to sequence models are introduced together with the \ac{LSTM} architecture in \autoref{fundamentalsF}. Here the connection to evolution theory can be drawn. \ac{RNA} sequences made of a concatenation of nucleotides \footnote{We restrict the representation of nucleotides solely to their nucleobases parts consisting of the distinct nucleobases guanine, adenine, cytosine and thymine. We therefore do not include the phosphate group and the five-carbon sugar components.} can be represented textually using the FASTA format \cite{cockBiopythonFreelyAvailable2009}. A \ac{Seq2Seq} model can then transferable be applied in the domain of \ac{RNA} sequences to model how \ac{RNA}-based viruses change their structure to avoid the detection by the human immune system but still to preserve their in\-fec\-tivi\-ty and evolutionary fitness \cite{Hie2021}.

\subsection{GISAID EpiFlu Data Platform} \label{fundamentalsC}

The data needed for this project consists of the \ac{SARS-CoV-2} genome data and the corresponding metadata. The most complete database is hosted by the \ac{GISAID} initiative \cite{Gisaid2021}. It is a public-private partnership between the initiative itself and the governments of Germany (official host of the platform), Singapore and the United States of America. \cite{gisaideditorGISAID2021}

The main aim of \ac{GISAID} is to enable the fast sharing of epidemic and pandemic virus data. In comparison to other databases such as GenBank the genome sequences are shared fast through \ac{GISAID}. For enabling this fast sharing the \ac{GISAID} database is only usable after registration and the redistribution of the data is forbidden, whereas the GenBank database is publicly available. \cite{shuGISAIDGlobalInitiative2017}

Thus, until september 2021 over three million \ac{SARS-CoV-2} genome se\-quen\-ces are available through \ac{GISAID}, whereas only about one million \ac{SARS-CoV-2} genome se\-quen\-ces are available through GenBank. \autoref{gisaid} shows the selection view of the \ac{GISAID} database. \cite{gisaideditorGISAID2021, nationallibraryofmedicinencbieditorNCBISARSCoV2Resources}

\begin{figure}[ht]
	\centering
	\includegraphics[width=0.9\linewidth]{figures/gisaid.png}
	\caption{\ac{GISAID} database \cite{own screenshot}}
	\label{gisaid}
\end{figure}

\subsection{Domain-Specific Methodologies to create Evo\-lu\-tio\-na\-ry Datasets for Mutation Prediction} \label{fundamentalsD}

From databases such as \ac{GISAID} or GenBank an unordered list of genome sequences and metadata can be downloaded. For training a model to detect changes and predict future mutations the dataset must contain parent-child pairs.

Berman et al. \cite{Berman2020} have done this based on two steps. First, they created a phylogenetic tree from the genome sequences. Therefore first all genome sequences are aligned. The initial phylogenetic tree is calculated by Fasttree using the approximate maximum likelihood method. In the next step, the tree is refined by a generalized time-reversible (GTR) model and a gamma model. The final phylogenetic tree is achieved by optimizing the branch length and the used models for tree generation. Like in standard phylogenetic trees each leaf node corresponds to one data instance, whereas the inner nodes are inferred from the other data instances.
Secondly based on the rooted phylogenetic tree, parent-child pairs are calculated. Therefore first a marginal ancestral sequence reconstruction is executed based on the phylogenetic tree from the previous step. Now also the inner nodes correspond to data instances. In the next step BioPython's \cite{10.1093/bioinformatics/btp163} Bio.Phylo package is used to determine parent-child pairs. From each edge, one parent-child pair is generated. \cite{Berman2020}

Mohamed et al. \cite{Mohamed2021} used existing datasets from Ogali et al. \cite{ogaliMolecularCharacterizationNewcastle2018} in their work about mutation prediction. Ogali et al. \cite{ogaliMolecularCharacterizationNewcastle2018} performed a phylogenetic analysis. After selecting only genome sequences with high quality, they removed duplicate sequences and added reference sequences to the dataset. Now the alignment is executed. In the next step MEGA (Molecular Evo\-lu\-tio\-na\-ry Genetics Analysis) is used to create the phylogenetic tree. This is done by using the maximum likelihood method, the best-fit general time-reversible (GTR) model and gamma-distributed rate variation.

Hadfield et al. \cite{10.1093/bioinformatics/bty407} have created the nextstrain project. It aims to examine pathogen's spread and evolution by providing a viral genome database, a bioinformatics pipeline for phylodynamics analysis and a visualization plat\-form. Steps executed by the bioinformatics pipeline for phylodynamic analysis are: "subsampling, alignment, phylogenetic inference, temporal dating of ancestral nodes and discrete trait geographic reconstruction, including in\-fe\-rence of the most likely transmission events" \cite{10.1093/bioinformatics/bty407}. For calculating the phylogenetic tree, TreeTime's maximum likelihood method is used. \cite{10.1093/bioinformatics/bty407}

\subsection{Previous Work on Mutation Prediction} \label{fundamentalsE}

Even before the rise of Covid-19, there had been studies trying to predict mutations of \ac{RNA} viruses. In the collection of \cite{Yan2007, Wu2007, Wu2008} the authors predict the mutation positions in hemagglutinins from influenza A virus using logistic regression and plain neural networks and then use the resulting amino acid mutating probabilities to derive possible mutated amino acids. The same approach is further used for H5N1 neuraminidase proteins.

Salama et al. \cite{Salama2016} proved that nucleotides in an \ac{RNA} sequence can change based on their local neighborhood. Neural networks are used to predict new strains of the Newcastle virus and subsequently, a rough-set theory based algorithm is introduced to extract the according point mutation patterns.

Mohamed et al. \cite{Mohamed2021} used a more modern sequence to sequence approach based on \acp{LSTM} to learn nucleotide mutations between time-series species of H1N1 Influenza virus and the Newcastle virus as mutations can also be influenced by long-distance relations of amino acids. Therefore one-hot encoded \ac{RNA} sequences of a parent generation preprocessed to words are given as an input and the output is the predicted offspring generation evaluated by accuracy to the compared true offspring generation. The achie\-ved accuracy in this paper is questionably high with 98.9\% on the H1N1 Influenza virus and 96.9\% on the Newcastle virus, possibly because of over\-fit\-ting to the few 4.609 samples for H1N1 Influenza virus and only 83 for the Newcastle virus. The approach in this paper therefore tries to increase the number of samples available for training when building the dataset.

\vspace{0.5cm}
The approach in this paper will neither use any of the just mentioned architectures but uses a transformer-based architecture coupled with a \ac{GAN}-style training architecture. A short introduction into \ac{Seq2Seq} models and the underlying \ac{LSTM} components shall be given to better point out the architectural decisions made.

\subsection{Sequence-to-Sequence Models based on Long Short-Term Memory} \label{fundamentalsF}

The original \ac{LSTM} unit was introduced by Hochreiter and Schmidhuber in \cite{Hochreiter1997} and can be used for language modeling instead of using plain \acp{RNN} to prevent running into vanishing or exploding gradient problems \cite{Sundermeyer2012}. The architecture of an \ac{LSTM} is shown in \autoref{lstm_architecture}.

\begin{figure}[ht]
	\centering
	\includegraphics[width=\linewidth]{figures/lstm_architecture.png}
	\caption{Architecture of an \ac{LSTM} \cite{Gertz2020}}
	\label{lstm_architecture}
\end{figure}

It consists of a hidden state $h_t$ and an additional cell state $c_t$. The cell state stores long-term information and is used to derive a new hidden state. Information flows through three different gates inside the \ac{LSTM}. The forget gate is used to control which parts of the cell state are potentially carried on to the next time step, the input gate is responsible to decide which parts of the cell state should be updated and the output gate determines what is being passed on as the new hidden state. All three gates depend on the previous hidden state and the current input. They provide factors limited to the interval [0,1] by the sigmoid function and are multiplied with the cell state, the changes to be added to the cell state and the new hidden state derived from the cell state. Through the cell state, an \ac{LSTM} therefore makes it possible to capture long-distance dependencies. \cite{Gertz2020}

Sutskever et al. \cite{Sutskever2014} introduced \ac{Seq2Seq} learning following a multi-layer encoder-decoder style model architecture. One layer consists of one \ac{LSTM} that is used as an encoder to learn a large fixed-dimensional vector representation of a size-unrestricted input sequence called the context vector. This vector consists of the last cell and hidden state of the encoder and incorporates the structure of the input sequence helping the following decoder \ac{LSTM} to provide qualitative predictions for the output sequence. The second \ac{LSTM} therefore serves as a beam search\footnote{Do not choose the most probable word but the $B$ most likely word hypothesis and pass them to the next time step in the \ac{LSTM}. Whichever hypothesis results in the lowest loss is kept. To avoid combinatorial explosion limit the beam depth size.} decoder to map the context vector to a corresponding output sequence whose length does not need to match with the length of the input sequence. The output probability distribution is therefore given by the equation

\begin{equation}
	p(y_1, ..., y_{T'} | x_1, ..., x_{T}) = \Pi_{t=1}^{T'} p(y_t | v, y_1, ..., y_{t-1})
\end{equation}

with $v$ being the context vector. Using an \ac{LSTM} is preferred over a normal \ac{RNN} as it is used to capture the long-range temporal dependencies of the input data. The encoder-decoder architecture uses four layers in total partitioned onto four \acp{GPU}. A corpus of 160k words for the input sequence and another one of 80k words for the target sequence was used to create the word embeddings of dimension 1000. Unknown words were replaced by an \textit{UNK} token. The \ac{Seq2Seq} model approach was evaluated for \ac{NMT} and reached a 34.81 \ac{BLEU} score. One finding during training was that reversing the input sequence introduces many short-term dependencies as the minimal time lag of the problem is reduced making optimization easier. \cite{Sutskever2014}

\subsection{Applying Generative Adversarial Networks} \label{fundamentalsG}

Using a plain \ac{Seq2Seq} model for mutation prediction does not necessarily guarantee that the generated sequences are evolutionary offsprings of a parent generation as not being included as is in the ground truth data. The generated sequences might occur realistic and biologically relevant, but a plain sequence to sequence architecture does not inherently check for natural parental descent and therefore does not make sure whether the predicted mutations lead to improved fitness. Berman et al. \cite{Berman2020} developed a novel \ac{Seq2Seq} framework based on the \ac{GAN} idea to predict genetic mutations and future biological populations of the influenza virus (see \autoref{mutagan}). Muta\-GAN describes a \ac{Seq2Seq} generator within an adversarial framework that predicts protein sequences augmented with possible mutations. By using a \ac{Seq2Seq} generator and a discriminator specialized on separating fake evolutionary mutations from real ones, one can then guarantee to a certain degree that the evo\-lu\-tio\-na\-ry parent-childhood coherence is given. In MutaGAN a mutation is considered correct if the change in amino acid and location within the \ac{RNA} sequence is equal to the parent's true offspring. \cite{Berman2020}

\begin{figure}[ht]
	\centering
	\includegraphics[width=\linewidth]{figures/mutagan.png}
	\caption{Architecture of MutaGAN \cite{Berman2020}}
	\label{mutagan}
\end{figure}

MutaGAN's generator consists of a \ac{Seq2Seq} model. The encoder is built of a bidirectional \ac{LSTM} and the resulting context vector of dimensionality 512 is combined with noise from a standard normal dis\-tri\-bu\-ti\-on. The decoder \ac{LSTM} predicts the resulting sequence of amino acids greedily using the $argmax()$ of the $softmax()$ output for every time step. The discriminator is trained on three different parent-child pair configurations to optimally compete against the generator, real parent-child pairs, real parent and ge\-ne\-ra\-ted child pairs and pairs of real sequences that are not parent-child pairs. Two bidirectional \ac{LSTM} encoders sharing the same weight matrix as the encoder of the generator produce a fixed-dimensional encoding of the provided parent-child pair used for classification of evolutionary descent by a plain neural network. The child encoder in the discriminator uses a dense layer having the same weight matrix as the embedding layer of the encoder of the generator. The dense layer is required to directly input the predicted child sequence as its probability distribution rather than the final output after applying the $argmax()$ as it would not enable backpropagation to train the generator. When a true child sequence is given a simple one-hot encoding is used. \cite{Berman2020}

Interestingly Berman et al. \cite{Berman2020} state planned improvements by utilizing bigger datasets acquired from the \ac{GISAID} database EpiFlu and by using more length-robust attention-based models to directly work on nucleotide sequences instead of sequences of amino acids. Therefore transformers and the attention mechanism are introduced in the following section.

\subsection{Transformer and Attention Mechanism} \label{fundamentalsH}

Using a \ac{Seq2Seq} model as introduced based on an encoder-decoder ar\-chi\-tec\-tu\-re of \ac{LSTM} cells has some drawbacks. First, the input needs to be processed sequentially in time steps which makes parallelization difficult and increases training time, especially for longer sequences. Fur\-ther\-mo\-re, the hidden and cell state vector passed through every timestep tries to encode information of \textit{all} previous time steps without knowing which information is especially important for the current time step. This not only makes long-distance dependencies hard to capture but also might not get the prioritization of the previous time step inputs right. \cite{Bahdanau2016, Vaswani2017}

To tackle these problems the so-called transformer architecture was in\-tro\-du\-ced in \cite{Vaswani2017}. It feeds an entire sequence into the encoder to be processed in parallel denying any concept of recurrence or convolution. Only using a so-called self-attention mechanism the transformer makes sure that during processing every input position, receives the information that is most im\-portant to it. This way modeling long dependencies becomes much easier compared to \acp{LSTM} as the view on the input sequence is more global. In this architecture, the encoder also passes all computed hidden states of every position to the decoder, which therefore can generate the target sequences based on more semantically enriched features and also in parallel for every position. \cite{Vaswani2017}

The transformer architecture achieved state-of-the-art quality results with a \ac{BLEU} score of 41.8 on the WMT 2014 English-to-French translation task (cf. \ac{BLEU} score of \cite{Sutskever2014} was 34.8), while still being much faster to train due to its parallelization capabilities. State-of-the-art results are already achieved after just twelve hours of training on eight P100 \acp{GPU}. As this is still far beyond the scope and resources given for this project, this project provides a proof-of-concept transformer model trained for far shorter and fewer sequences as one would need to predict entirely new \ac{RNA} sequences. \cite{Vaswani2017}

First the transformer architecture should be introduced in the following:

\begin{figure}[ht]
	\centering
	\includegraphics[width=0.5\linewidth]{figures/transformer.png}
	\caption{Architecture of the transformer \cite{Vaswani2017}}
	\label{transformer}
\end{figure}

The transformer consists of an encoder and a decoder part just as normal \ac{Seq2Seq} models. One layer of the encoder contains a self-attention layer before passing the hidden state representations of an input sequence to a feed-forward neural network consisting of two linear trans\-for\-ma\-ti\-ons separated by \ac{ReLU}. Thus it makes sure that semantic and contextual dependencies between different positions in the input sequence are also modeled. Also, skip connections are added for both components with subsequent layer normalization. \cite{Alammar2018, Vaswani2017}

To calculate the self-attention output of a sequence, a query $Q$, key $K$ and value $V$ matrix is calculated through the multiplication of the sequence representation\footnote{A matrix containing the hidden state representations of every input position} with learned transformation matrices. Each row of the three received matrices corresponds to a specific input position. The output of the self-attention layer is then calculated through

\begin{equation}
	(Scaled Dot-Product) Attention(Q, K, V) = softmax(\frac{QK^T}{\sqrt{d_k}})V.
\end{equation}

The dot product between $Q$ and $K$ calculates scores that are used as weighting factors for $V$. This describes for every input position how relevant all other input positions are for each of the hidden state encodings. The scores are divided by the square root of the dimensionality of the query/key values of the hidden state representations, which is chosen to be 64 (square root eight), to receive more stable non-vanishing gradients. The softmax guarantees that the positional scores lie between zero and one and add up to one. Note that the score of the current input position itself will most likely have the highest score. \cite{Alammar2018, Vaswani2017}

\begin{figure}[ht]
	\centering
	\includegraphics[width=\linewidth]{figures/multi_head_attention.png}
	\caption{Multi-head attention architecture \cite{Alammar2018}}
	\label{multi-head-attention}
\end{figure}

One can expand self-attention towards multi-head attention. In this configuration, each head produces its own query, key and value matrices and therefore its own self-attention output in its own representation subspace. The resulting hidden state is calculated by concatenating each hidden state output of the different heads and multiplying it with a contraction matrix that outputs a hidden state vector in its single-head dimensionality. Multi-head attention is needed to be able to better focus on multiple parts of the input sequence when encoding an input position, otherwise, it might happen that most of the focus is set on the input position itself. Vaswani et al. \cite{Vaswani2017} used 8 heads. \cite{Alammar2018, Vaswani2017}

Overall six layers of encoder and decoder components having individual weight matrices are stacked on top of each other to capture low-level as well as high-level features. The dimensionality of the hidden state is 512. Note that each position of the input sequence is encoded on an individual path through the transformer, which makes parallelization possible compared to \ac{LSTM} based architectures. \cite{Alammar2018, Vaswani2017}

The decoder uses almost the same architecture as the encoder but contains an additional multi-head attention component that integrates all the hidden state encodings from the encoder. Therefore the final hidden state encodings resulting from the top most encoder are transformed into key and value attention vectors and given to the integrating multi-head attention component of every decoder. Once again this helps to better focus on the relevant input positions for the current output position based on hidden state information extracted from the encoder. Note that the decoder works in a sequential manner again meaning that the input to the decoder are the already decoded sequence tokens of previous time steps, future input positions are masked away. The first multi-head attention component therefore captures inter-dependencies in the generated output sequence, the second one, the so-called encoder-decoder attention, enriches the hidden state encoding with the in\-for\-ma\-ti\-on given from the encoder hidden states. Finally, a linear layer mapping the hidden state vector to a logits vector with the dimensionality of the given output dictionary and a $softmax()$ function produce the output sequence using the greedy or beam search approach. The \textit{EOS} token symbolizes the end of the output to be generated. \cite{Alammar2018, Vaswani2017}

Input to the transformer are word embeddings also of fixed dimensionality of 512. Onto each word embedding a positional encoding following a specific pattern is added. These patterns are either learned or fixed and make sure that the distances of the input positions are projected onto the queue, key and value representations to be utilized during scaled dot-product attention. This also enables self-attention to be scaled to unseen lengths of sequences. Transformers usually contain an upper bound of sequence length to be pro\-ces\-sed, which is different from recurrent architectures that can process inputs of ar\-bi\-tra\-ry length. Input sequences are usually padded up until the specified sequence length, the used \textit{PAD} tokens are masked to be excluded from the self-attention components. \cite{Alammar2018, Vaswani2017}

% One is the total computational complexity per layer. Another is the amount of computation that can be parallelized, as measured by the minimum number of sequential operations required. The third is the path length between long-range dependencies in the network.

%\subsection{Other Techniques} \label{fundamentalsI}

%\begin{itemize}
%	\item NNs/SVMs: \url{https://bsb-eurasipjournals.springeropen.com/articles/10.1186/s13637-016-0042-0}
%	\item BiLSTM: \url{https://science.sciencemag.org/content/371/6526/284}
%\end{itemize}

\newpage


%%% -*- mode: LaTeX; TeX-master: "main.tex"; -*-

\ifx\master\undefined
\documentclass[a4paper]{easychair}
\usepackage{submission}
\begin{document}
{\let\master\relax\input{frontmatter}}
\fi
%%%% PLEASE DO NOT EDIT ABOVE THIS LINE

\section{Introduction}
\label{sec:intro}

\tlaplus\ is a language for specifying the behaviour of concurrent and
distributed systems and asserting properties of those
systems~\cite{lamport03tla}.  However, it provides no way to write
proofs of those properties.  We have designed an extended version of
the language that allows writing proofs, and we have begun
implementing a system centered around a \textit{Proof Manager} (\PM)
that invokes existing automated and interactive proof systems to check
those proofs. For now, the new version of \tlaplus\ is called \tlatwo\
to distinguish it from the current one.  We describe here the \tlatwo
proof constructs and the current state of the proof system.

The primary goal of \tlatwo\ and the proof system is the mechanical
verification of systems specifications. The proof system must not only
support the modal and temporal aspects of TLA needed
to reason about system properties, but must also support
ordinary mathematical reasoning in the underlying logic. Proofs in
\tlatwo are natural deduction proofs written in a hierarchical style
that we have found to be good for ordinary
mathematics~\cite{lamport93amm} and crucial for managing the
complexity of correctness proofs of systems~\cite{gafni:disk-paxos}.

The \PM\ computes proof obligations that establish the correctness of
the proof and sends them to one or more back-end provers to be
verified.  Currently, the back-end provers are Isabelle/\tlaplus, a
faithful axiomatisation of \tlaplus\ in Isabelle/Pure, and
Zenon~\cite{bonichon07lpar}, a tableau prover for classical
first-order logic with equality.  The \PM\ first sends a proof
obligation to Zenon.  If Zenon succeeds, it produces an Isar script
that the \PM\ sends to Isabelle to certify.  Otherwise, the \PM
directs Isabelle to try to find a proof with its automated tactics.
In both cases, the proofs are certified by Isabelle/\tlaplus.
%%
%% SM: I changed the following sentence because its original
%% formulation seems to defeat certifiability, an issue that we
%% highlight.
%%
%This system
%architecture allows us in the future to add other back-end provers
%whose proofs need not be certified by Isabelle/\tlaplus.
The system architecture easily accomodates other back-end provers; if
these are proof-producing, certification by Isabelle/\tlaplus\ gives
us high high confidence in the overall correctness.

The \tlatwo\ proof constructs are described in
Section~\ref{sec:proof-language}.  Section~\ref{sec:obligations}
describes the proof obligations generated by the \PM, and
Section~\ref{sec:backend} describes how the \PM\ uses Zenon and
Isabelle to verify them.  The conclusion summarizes what we have done
and not yet done and briefly discusses related work.

%%%% PLEASE DO NOT EDIT BELOW THIS LINE
\ifx\master\undefined
{\let\master\relax\input{rearmatter}}
\end{document}
\fi


\documentclass{article}

\setlength{\evensidemargin}{.25in}
\setlength{\oddsidemargin}{.25in}
\setlength{\textwidth}{6.0in}
%\setlength{\parindent}{0.25in}
\setlength{\topmargin}{-0in}
\setlength{\textheight}{8.0in}
%\newtheorem{theorem}{Theorem}
%\newtheorem{proposition}{Proposition}
%\newtheorem{lemma}{Lemma}
%\newtheorem{corollary}{Corollary}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{document}
\bibliographystyle{siam}

\title{\bf The Volume Algorithm for Combinatorial Linear Programs}
\author{Francisco Barahona}
\date{January 24, 2001}
\maketitle

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Introduction}

Here we have an implementation of the Volume algorithm (VA) originally
presented in \cite{BA}. We focus on {\it Combinatorial Linear Programs},
these are linear programs where the matrix has 0, 1, -1 coefficients
and the variables are bounded between 0 and 1. The VA has been very
effective at producing fast approximate solutions to these LPs, see
\cite{BA2}.
As a first step, a new user should be able to run our code ``as is''.
The input should be an MPS file.
We hope to receive reports about bugs and/or
successful experiences.

\smallskip

Initially this directory contains the files: {\tt Makefile, volume.hpp,
volume.cpp, lp.hpp, lp.cpp, lp.par, data, doc.ps, lpc.h, lpc.cpp,
names.h, names.cpp}. On a Unix system one
should type
\begin{center} {\tt make} \end{center}

\noindent and then

\begin{center} {\tt bin/myprogram} \end{center}

\noindent Then the code would run and produce the files {\tt primal.txt}
and {\tt dual.txt} that contain approximate solutions to both the primal
and the dual problem.

\smallskip

We assume that we have an LP like
\begin{eqnarray}
&\min c x  \label{fp1} \\
&Ax \sim b \label{fp2} \\
&l \leq x \le u. \label{fp3}
\end{eqnarray}

Let $\pi$ be a set of
Lagrange multipliers for constraints (\ref{fp2}). When we dualize
them we obtain the {\it lagrangian problem}

\begin{eqnarray*}
L(u) & = & \min (c-\pi A) x + \pi b, \\
&&l \leq x \le u.
\end{eqnarray*}

We apply the VA to maximize $L(\cdot)$ and to produce a
dual vector $\bar \pi$, and
primal vector $\bar x$ that is an approximate solution of
(\ref{fp1})-(\ref{fp3}).

In what follows we describe the files {\tt lp.par} and
{\tt data}.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{lp.par}

This file contains a set of parameters that control the algorithm and contain
information about the data. Each line has the format

{\tt keyword=value}

\noindent where {\tt keyword} should start in the first column. If we add any
other character in the first column, the line is ignored or considered as a
comment. The file looks as below

\bigskip
\begin{verbatim}
fdata=data.mps
*dualfile=dual.txt
dual_savefile=dual.txt
primal_savefile=primal.txt
h_iter=0
var_ub=1.0

printflag=3
printinvl=20
heurinvl=100000000

greentestinvl=2
yellowtestinvl=2
redtestinvl=10

lambdainit=0.1
alphainit=0.01
alphamin=0.0001
alphafactor=0.5
alphaint=80

maxsgriters=2000
primal_abs_precision=0.02
gap_abs_precision=0.
gap_rel_precision=0.01
granularity=0.

\end{verbatim}

The first group of parameters are specific to LP and the user should
define them. {\tt fdata} is the name of the file containing the data. {\tt
dualfile} is the name of a file containing an initial dual vector. If we add
an extra character at the beginning ({\tt *dualfile}) this line is ignored,
this means that no initial dual vector is given. {\tt dual\_savefile} is the
name of a file where we save the final dual vector. If this line is missing,
then the dual vector is not saved. {\tt primal\_savefile} is the name of a file
to save the primal solution, if this
line is missing, then this vector is not saved. {\tt h\_iter} is the number of
times that the heuristic is run after the VA has finished. We did not include
a heuristic in this implementation. {\tt var\_ub} is an upper bound
for all primal variables, for 0-1 problems we set {\tt var\_ub=1}.

The remaining parameters are specific to the VA. {\tt printflag} controls the
level of output, it should be an integer between 0 and 5. {\tt printinvl=k}
means that we print algorithm information every {\tt k} iterations. {\tt
heurinvl=k} means that the primal heuristic is run every {\tt k} iterations.
{\tt greentestinvl=k} means that after {\tt k} consecutive green iterations
the value of $\lambda$ is multiplied by 2. {\tt yellowtestinvl=k} means that
after {\tt k} consecutive yellow iterations the value of $\lambda$ is
multiplied by 1.1. {\tt redtestinvl=k} means that after {\tt k} consecutive
red iterations the value of $\lambda$ is multiplied by 0.67. {\tt lambdainit}
is the initial value of $\lambda$. {\tt alphainit} is the initial value of
$\alpha$. {\tt alphafactor=f} and {\tt alphaint=k} mean that every {\tt k}
iterations we check if the objective function has increased by at least 1\%,
if not we multiply $\alpha$ by {\tt f}.

There are three termination criteria. First {\tt maxsgriter} is the maximum
number of iterations. The second terminating criterion is as follows. {\tt
primal\_abs\_precision} is the maximum primal violation to consider a primal
vector ``near-feasible''. Let {\tt gap\_rel\_precision=$g$}, let $z$ be the
value of the current dual solution, and $p$ be the value of a current
near-feasible primal solution. If $|z| > 0.0001$ and
$$
        { | z - p | \over | z | } < g,
$$
then the algorithms stops. Let {\tt gap\_abs\_precision=$f$}, if $|z| \le
0.0001$ and $| z - p | < f$ then we stop. Finally, let {\tt granularity=$k$},
and let $U$ be the value of the best heuristic integer solution found. Then if
$ U - z < k$ we stop. We did not include any heuristic in this
implementation.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{data}

This is an MPS file. If a different type of input should
be used, one has to change the code in {\tt reader.cpp}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\bibliography{doc}

\end{document}


\chapter{Building a Certified Kernel}
\label{chap:kernel-correctness}

\margintoc

With the meta-theory set down, we can turn to building a kernel – and proving that it is
correct. The first step (\cref{sec:kernel-bidir})
is to move from the declarative specification of
\cref{chap:metacoq-general} to a bidirectional presentation,
closer to the kernel we wish to implement.
Once this specification is set down, we can get to the kernel itself.
\cref{sec:kernel-subroutines} goes over the implementation of the \kl{global environment} and the
\kl{cumulativity} check, and \cref{sec:kernel-typing} describes the type-checker.
Finally, \cref{sec:kernel-beyond-typing} describes two extra functions belonging to the safe
\kl{kernel}: re-typing, and checking of \kl{global environment}.

I personally contributed the formalizations of \cref{sec:kernel-bidir},
the completeness part of \cref{sec:kernel-typing} –
by modifying the pre-existing proven-correct type-checker –,
and heavily modified re-typing – part of \cref{sec:kernel-beyond-typing}.

\section{Formalized Bidirectional Typing}
  [Bidirectional Typing, Formalized]
\label{sec:kernel-bidir}

We already saw the main theoretical ideas around our approach to bidirectional typing in
\arefpart{bidir}, so let us get to their implementation in the formalization.

\subsection{Definitions}

Before we can get to the definition of typing, we must go through the small
\pcuicfile[Bidirectional][BD]{EnvironmentTyping}, which is dedicated to refining a few
definitions on contexts in the bidirectional setting. First,
in the case of a definition \coqe{Γ,, vdef na b T},
\coqe{wf_local} enforces that \coqe{T} is a well-formed type, and that
\coqe{b} has type \coqe{T}. In the bidirectional setting we want to use constrained inference
$\pity{\uni}$ for the first, and checking for the second, but the generic definition
on which \coqe{wf_local} is built%
\sidenote{Called \coqe{All_local_env}.}
only allows for a single parameter – instantiated with \coqe{typing} in the case
of \coqe{wf_local}.
Similarly, we need a definition expressing that a context $\Delta$ is well-formed
\emph{over another context $\Gamma$}, but which does not enforce $\Gamma$ to be well-formed
\textit{a priori} – \eg something more precise than simply $\vdash \Gamma , \Delta$. This
allows to stay faithful to McBride’s discipline%
\sidenote{Taken from \textcite{McBride2018}, see its exposition in \cref{sec:bidir-mcbride}.}%
\margincite{McBride2018}
when typing context extensions,
by only demanding that the extension is well-formed, but not the initial segment.%
\sidenote{Which is an input, and thus should not be re-checked.}

The bidirectional typing judgment is defined in
\pcuicfile[Bidirectional][BD]{Typing}, as a set mutual defined inductive predicates:
one for inference, one for checking, and one for each constrained inference, \eg respectively
sorts, Π-types and inductive types. The definition of the predicates themselves
is very close to that of \cref{fig:ccw-bidir-infer,fig:bidir-ccw-other} for the
functional fragment, the main innovation being that constrained inference –
written \coqe{Σ ;;; Γ |- t |>Π (na,A,B)} for Π-types –
takes the variable name, domain and codomain of the inductive type as three separate arguments,
which our pen-and-paper notation did not make explicit.
The predicates defined in \pcuicfile[Bidirectional][BD]{EnvironmentTyping} are used in the
definition of inference for the \coqe{tCase} node, where we want to ensure that the
context extensions used to type the \kl{predicate} and \kl{branches} are well-formed.

Regarding the notions of computation, the definitions of \kl{constrained inference} use
\kl{full reduction} rather than \kl{weak-head reduction}, mainly because MetaCoq currently
lacks a treatment of the latter adequate for our needs.%
\sidenote{In particular, a standardization theorem is missing,
which would be needed to show the analogue
of \cref{lem:conv-red-tycons} for weak-head reduction.}
As for \kl{cumulativity}, the \kl(conv){algorithmic} variant is used in the \kl{checking} rule,
but this is relatively irrelevant,
since the equivalence between both presentations of \kl{cumulativity}
appears much earlier in the development than bidirectional typing.

Maybe more interesting from the formalization point of view is how we obtain a usable
induction principle. This is a common issue in \kl{MetaCoq}: while
\kl{Coq} is able to detect that our inductive definitions are well-founded,
the default generation is often unable to derive a sensible induction principle,
and neither are the \coqe{Scheme} specialized commands. This is due to their nested
character, \ie the presence of lists and records containing recursive instances
of the inductive types as arguments to the type constructors.
The bidirectional typing predicate is the paroxysmal example of this, as it
reaches the limit of expressiveness offered by
\kl{Coq}’s inductive types: it is not only nested, but also mutual.
We thus have to prove our desired induction principle by
hand. To do so, we introduce a notion of “generic” typing object
\pcuicline[Bidirectional][BD]{Typing}{typing\_sum}{256},
together with a notion of size for such a typing object,
and finally show the induction principle
\pcuicline[Bidirectional][BD]{Typing}{bidir\_ind\_env}{312}
by well-founded induction on that size.

This induction principle is not as strong as we might expect, as it does not provide the extra induction hypothesis on inputs that would go with McBride's discipline.
Ideally, we could use this discipline
in order to thread the well-formation invariants, giving stronger induction
hypotheses. I did not try to take this path and prove such a strong induction principle,
as it did not seem so easy: it would effectively correspond to an inline proof
of \kl{validity}.
Instead, the discipline is reflected in the choice of the predicates proven by induction.
For instance, in the case of correctness, the mutually proven predicate for inference
is \coqe{wf_local Σ Γ -> Σ ;;; Γ |- t : T}, and more generally
assumptions are added as pre-condition for all inputs.
Still, I conjecture that such a strong induction principle should be provable, if the need
would arise, and might be nice in order to factor proofs, by showing once and for all that
the rules follow the discipline correctly.

\subsection{Equivalence with undirected typing}

\kl(bidir){Correctness}%
\sidenote{Bidirectional typing implies undirected typing, akin to \cref{thm:corr-ccomega}.}
is shown in \pcuicfile[Bidirectional][BD]{ToPCUIC}.
The main proof is by induction on the derivation,
its key point being to show that well-formation invariants are preserved, and in particular
that all contexts that are constructed are valid.

There is one particular difficulty linked to the \coqe{tCase} constructor, and the question
of its representation evoked at the very end of \cref{sec:bidir-pcuic-inductives}.
More precisely, the issue is related to the fact that case nodes store the universe
instance and parameters of the inductive type being matched upon, in order to be able to
construct the context in which the \kl{predicate} and \kl{branches} are typed.
In undirected typing, the hypothesis on the \kl{scrutinee} is that it should be of some type
\coqline|mkApps (tInd ci.(ci_ind) p.(puinst)) (p.(pparams) ++ indices)|
where \coqe{ci.(ci_ind)}, \coqe{p.(puinst)} and \coqe{p.(pparams)}
are respectively the inductive type being matched upon, its universe instance, and its
parameters – all stored in the case node –, and \coqe{indices}
are free. From the point of view of bidirectional typing, this rule is invalid:%
\sidenote{It is not mode correct \cite{Dunfield2021}.}%
\margincite{Dunfield2021}
because \coqe{indices} is free, this cannot be turned into a checking premise, but it also
cannot be directly turned into inference, or even constrained inference, because it is
not free enough due to the presence of \coqe{p.(pparams)} and \coqe{p.(puinst)}.
The solution is still to turn it into an inference premise
\coqe/Σ ;;; Γ |- c |>{ci} (u,args)/, and to compare the inferred universe instance \coqe{u}
and parameters – the first part of the list \coqe{args} – to those stored in the node, \eg
\coqe{p.(puinst)} and \coqe{p.(pparams)}. But it requires some work to
show that this relation between the two lists of parameters is enough to use the second part
of \coqe{args}, the inferred indices, in place of \coqe{indices} above.

In the opposite direction, \kl(bidir){completeness}%
\sidenote{Undirected typing implies bidirectional typing, akin to \cref{thm:compl-ccomega}.}
is also proven by induction, once we have used
the injectivity properties of \pcuicfile{Conversion} to show that
inference of a type related by \kl{cumulativity} to a sort, Π- or inductive type implies
constrained inference of the corresponding kind.
In order to simplify proofs in the case of projections,
\kl(bidir){correctness} is used in conjunction
with \kl{validity}, but this could probably be avoided, making the two proofs independent.

\subsection{Properties of bidirectional typing}

As we did in \cref{thm:unique-inf}, we show that two inferred types have a common reduct in
\pcuicfile[Bidirectional][BD]{Unique}. While the proof requires some playing with
well-scoping predicates,%
\sidenote{
  To relate the reduction used to defined \kl{constrained inference} and the one on which most lemmas
  around confluence are stated, which is defined directly on well-scoped terms.}
it is conceptually \emph{much} simpler than the direct proof of \pcuicfile{Principality},
which shows the existence of \kl{principal types} without going through bidirectional typing.
Indeed, due to the difficulty of the proof,
for quite some time only a weaker version was proven.
This version that if $T$ and $T'$ are both types
for the same term $t$ then there exists a third $T''$ which
is both a type for $t$ and smaller than
$T$ and $T'$ for cumulativity.

Finally, \pcuicfile[Bidirectional][BD]{Strengthening} shows strengthening.
Its first important property is that if $\Gamma \vdash t \ity T$ then
$T$ can only use variables appearing in either $t$ or in the types of $\Gamma$
(\pcuicline[Bidirectional][BD]{Strengthening}{infering\_on\_free\_vars}{487}),
which is \emph{not} true in general in undirected typing.%
\sidenote{Consider for instance $n : \Nat \vdash 0 : (\l x : \Nat.\ \Nat)\ n$: $n$ appears in the
type, but neither in the body of the term nor any types in the context.}
It then goes on with the proof that bidirectional typing is stable under any renaming, while
\pcuicfile{RenameTyp} only shows stability of undirected typing under unconditional renaming.
Finally, we get to the proof of \pcuicline[Bidirectional][BD]{Strengthening}{strengthening}{989}
\textit{per se}, once we have shown that strengthening is indeed a well-formed renaming.

\section{Before Typing: Environment Querying and Cumulativity Checking}[Before Typing]
\label{sec:kernel-subroutines}

Before we can get to typing, we need to have a look at its two main sub-routines:
querying the \kl{global environment}, and \kl{cumulativity} check.

\subsection{Abstract environment}

The type and \kl{cumulativity} checking algorithms both need to query the \kl{global environment},
for two main purposes: retrieving information about previous definitions
of constants and inductive types, and checking that (in)equalities between
universe expression hold.

While this might seem anecdotal,
a surprisingly important amount of time is spent in the actual checker
on the second problem, which requires a form of shortest-path algorithm
on a graph obtained from the universe constraints, in order
to detect the presence of negative cycles.
These correspond to violations of the universe stratification.
\kl{MetaCoq} implements such an algorithm, with a proof that it is correct and complete, meaning that
the algorithm answers “yes” exactly when there is a mapping from universe levels to integers satisfying
all constraints declared in the environment.
More details on this can be found in \sidetextcite[][Section 3.3]{Sozeau2020}.

Sadly, said algorithm is too naive to be actually run on reasonable examples: it is currently the main
performance bottleneck of the extracted type-checker. Similarly, the representation of the
\kl{global environment} as a list of definitions is too naive to allow for efficient lookups –
\kl{Coq} uses hash maps instead.
While we hope to replace that naive implementation with a more efficient but still certified one,
for the moment it is convenient to be able to plug an uncertified but efficient implementation
into the extracted type-checker. To do so, we rely on abstract interfaces for the
\kl{global environment}, containing all the possible queries we need to perform,
presented in \safefile{WfEnv}. The naive implementation is shown to be a valid implementation of
that interface in \safefile{WfEnvImpl}.

\subsection{Cumulativity checking}

The most important sub-routine of the type-checker is the test of \kl{cumulativity} between two terms.
The naive way to perform this, since we assume \kl{normalization}, would be to brutally normalize terms,
and compare normal forms up to \coqe{leq_term}.%
\sidenote{The extension of \kl{α-equality} to handle \kl{cumulativity}.}
But this strategy does not scale as soon as definitions are present, because it
eagerly unfolds all of these, resulting in a very inefficient test.
\kl{MetaCoq} implements a more practical strategy, which coarsely does the following:
\begin{enumerate}
  \item reduce both terms being compared to \kl(red){weak-head} normal form
    \emph{without unfolding any definition};
  \item if the two heads match, recursively compare sub-terms;
  \item if the two heads do not match, or if the recursive sub-term comparison failed, check if
    an unfolding is possible which would unblock one of the terms, and if yes, unfold it and
    go back to the first step.
\end{enumerate}
This means that the \kl{cumulativity} test must itself resort to a \kl{weak-head reduction}
function.

The difficulty with those functions is that they do not operate by a simple structural induction on
terms. Rather, they are defined using a complex abstract machine, operating on terms decomposed into
a sub-term and a stack. The termination of that abstract machine is shown using a
dependent lexicographic pre-order, which handles both the well-founded reduction order given by
\kl{normalization}, a structural order on sub-terms and stacks corresponding to a given term, and
the different phases of the algorithm.
A detailed description of this algorithm and its formalization%
\sidenote{In files \safefile{SafeReduce} for the implementation of \kl{weak-head reduction}, and
\safefile{SafeConversion} for the cumulativity checker.} is given by Théo Winterhalter,
who implemented it,%
\sidenote{It was only proven correct at the time. Jakob Botch Nielsen
wrote most of the completeness proof.
}
in his PhD thesis \sidecite[][Chapters 21-24]{Winterhalter2020}.

An interesting point that the test of \kl{cumulativity} and that of typing have in
common, is the way they handle their propositional content. First, because
we want to avoid issues linked with proof-irrelevance,
in most of the formalization definitions are in \coqe{Type},
including the reduction, conversion and typing relation.
But in the verified \kl{kernel} we want to enforce the
separation between propositional and relevant content. Thus, we use explicit squashing —
written $\| T \|$ – to cast a type into a proposition.%
\sidenote{Technically,
  $\| T \|$ is defined as a record of type $\Prop$ with a single field of type $T$.}
The main elimination of propositional content into the relevant world we rely on that
of accessibility, so that we can define \kl{reduction} and \kl{cumulativity} by well-founded induction. As customary in dependently typed code, we also use elimination of falsity in
inaccessible branches.

Second, we write code using the \kl{Equations} plugin, which lets us write the
relevant part of the definition in direct style, but to leave proofs to be filled-in using the
proof-mode. The definitions are given in monadic style, relying on what looks like the error monad:%
\sidenote{Given a type of errors $E$, the functor associated with that monad is $T \mapsto T + E$,
its unit is the left injection, and its bind $x >>= f$ either propagates $x$ if it is an error, or applies $f$ otherwise.}
the \kl{cumulativity}- and type-checker return a valid output, or an error message. However, since
we wish the functions to be correct by constructions, they must also return a proof, either a
witness for the positive answer, or a proof of impossibility in the negative case.
This means that the bind of the monad must actually perform a proof when re-raising the error,
in order to propagate the impossibility witness.%
\sidenote{For instance, if we are typing some \coqe{tProd na A B} and the call to typing for \coqe{A}
fails, we must transform a proof that \coqe{A}
cannot be well-typed into a proof that \coqe{tProd na A B}
as a whole cannot either.}
At function definition, this is hidden by notations, so it feels like we are actually using a
monad, but under the hood proof obligations are generated each time we use a bind.

\section{Correct and Complete Inference}
\label{sec:kernel-typing}

Given the work already done in \cref{sec:kernel-bidir}, the definition of a
type checking algorithm \safefile{TypeChecker}
itself is rather straightforward: it follows closely
the structure laid out by the mutually defined bidirectional judgments, and
poses no termination issue as \kl{cumulativity} does, since it
operates by induction on the structure of the term.
Actually, rather than a type-checker, the main function we define is
\safeline{SafeChecker}{infer}{1323}, which performs type inference,%
\sidenote{
  Which is decidable thanks to our \kl{Church-style} syntax.}
from which we can easily define type-checking.

In more details, the function takes as inputs:
\begin{enumerate}
  \item an abstract environment implementation;
  \item a \kl{global environment} implemented using that implementation;
  \item a context, and a squashed proof that it is well-formed;
  \item a term
\end{enumerate}
and it returns either a type and a (squashed) proof that the term infers that type, or
an error and a proof that the term cannot infer any type, using the inductive type presented in
\cref{fig:meta-error-mon}.
\begin{figure}
  \coqfile[firstline=1,lastline=4]{./code/PCUICSafeTyping.v}
  \caption{The “error monad” used for \safeline{SafeChecker}{infer}{1323}’s return type}
  \label{fig:meta-error-mon}
\end{figure}
Thus, the function is correct and complete by construction.
In fact, we cannot separate
the definition from the correctness proof, since the conversion checker
expects a well-typed term as input in order to be terminating when it is called.

\begin{figure*}
  \coqfile[firstline=6]{./code/PCUICSafeTyping.v}
  \caption{Definition of \safeline{SafeChecker}{infer}{1323} (excerpt)}
  \label{fig:meta-infer}
\end{figure*}

\cref{fig:meta-infer} gives – an excerpt of – the algorithm.
%
For a variable \coqe{tRel n}, it checks that the variable is bound in
\coqe{Γ}, returns its type when it is, and fails otherwise.
%
In the case of a sort \coqe{tSort u}, it checks that the universe is well-formed in the current
environment, and returns a sort at the next level when it is.
%
In that of a dependent function type \coqe{tProd na A B}, it computes the sort of
\coqe{A} and \coqe{B} – in the context extended by
\coqe{na:A} –  using the \coqe{infer_type} sub-routine,%
\sidenote{Defined beforehand in an “open recursion” flavour, \eg as a function taking \coqe{infer}
as argument.}
and builds from those the sort of the product using \coqe{sort_of_product}.
Functions are similar.
%
The cases of \coqe{tLetIn} and \coqe{tApp} clearly show the bidirectional
structure. For instance, in
\coqe{tApp t u}, one needs to infer the type \coqe{ty} of \coqe{t},
then reduce it to some \coqe{tProd na A B} using the
\coqe{reduce_to_prod} function, and finally check that \coqe{u} has
type \coqe{A}.
%
All underscores \coqe{_} in the terms denote proof obligations, that are filled later on
in tactic mode. Although they are hidden, the monadic notations \coqe{;;}
and \coqe{raise} also contain underscores for the propagation of completeness
information.%
\sidenote{For instance, \coqe{raise e} is syntactic sugar for \coqe{TypeError_comp e _}.}

Interestingly, the proofs of \kl(bidir){completeness} use uniqueness of inferred types a lot.
To see why, consider \eg the case of an application $t\ u$ where the recursive call succeeds on $t$
– say it infers a product type $\P x : A.\ B$ – but the one on $u$ fails – giving us a proof $p$
that $u \cty A$ is absurd. We want to raise an error, and thus need to prove
that $t\ u \ity T$ for any $T$ is absurd.
An inversion on that last hypothesis gives some $A'$ and $B'$ such that
$t \pity{\P} \P x : A'.\ B'$ and $u \cty A'$.
But this second property cannot be directly fed $p$, because the type against which $u$ checks is
different! We thus need to use the two inference judgments and uniqueness to conclude that in
fact $A \conv A'$, and thus that $u \cty A$,
which this time we can the use to derive a contradiction from $p$.

\section{Beyond Typing: Environment Checking and Re-Typing}
\label{sec:kernel-beyond-typing}

There are two more functions defined in \kl{MetaCoq} that are very close to the type-checker.

\subsection{Re-Typing}

The first, which is defined in \safefile{SafeRetyping}, aims at computing a type for a term
which is known to be well-typed. While this seems tautological, it is not: the aim is
to extract relevant content out of propositional one. This is useful in practice in \eg
the extraction procedure, which maintains the invariant that it operates on well-typed terms,
but at times needs to actually compute types to decide whether terms should be erased.

This is also different from standard inference,
because knowing \textit{a priori} that the term under consideration is well-typed allows to
skip a lot of checks. For instance, to re-type an application $t\ u$, it suffices to infer a
product type $\P x : A.\ B$ for $t$, and to return $\subs{B}{x}{u}$, since we know that $u$
has type $A$.

In order to be useful, this re-typing procedure needs to compute a \kl{principal type}, and
thus its definition was quite complex prior to the formalization of bidirectional typing,
effectively inlining a proof of uniqueness of types. Instead, bidirectional typing
simplifies greatly both the definition of re-typing and its proof of correctness, by
clarifying its specification:
instead of computing a principal type out of any type,
the function should compute an unsquashed inferred type out of a squashed one.

\subsection{Environment Checking}

The second thing we need to handle is the verification that a whole \kl{global environment}
is well-formed. While the main thing to check is that all definitions are well-typed,
there are quite a few more things to be done: checking universes constraints, that inductive
definitions are strictly positive, that the variance information used by universe polymorphism is
valid… All these are covered in \safefile{SafeChecker}.


\appendix
\section{Run programs: instructions}

	\subsection{Exact Method}
		In order to use the exact method program the only things to do is call the following command:
		\begin{center}
			\verb|./main "<path_filename>.dat"|
		\end{center}
		Where \verb|<path_filename>| is the path of the instance file. I put all of them into \verb|data| folder for convenience.

	\subsection{Meta Heuristic}
		In order to use all the features and property of the solvers developed the program should be run with the following commands:

		\begin{itemize}
			\item path of instance \verb|.dat| (with quotation marks), example:
			\begin{center}
				\verb|./main "<path_filename>.dat"|
			\end{center}
			\item Solvers:
			\begin{enumerate}
				\item \verb|--ls| or \verb|-l|: Local Search;
				\item \verb|--ts| or \verb|-t|: Tabu Search;
			\end{enumerate}
			\item Solvers features:
			\begin{enumerate}
				\item \verb|--bi| or \verb|--fi|: Best Improvement or First Improvement (\textit{default} is BI);
				\item \verb|--ac|: Aspiration Criteria (only for TS);
				\item \verb|--maxIter|: Max iteration (\textit{default} is 1000, only for TS);
				\item \verb|--tenure|: Tenure of Tabu List (\textit{default} is 50, only for TS);
				\item \verb|--secs|: Max seconds (\textit{default} is 30, only for TS);
			\end{enumerate}
		\end{itemize}

		\paragraph{Example} In order to start or instance \verb|tsp60.dat| a Tabu Search with Best Improvement, Aspiration Criteria, tenure of 20 and max iterations of 10000:
		\begin{center}
			\begin{verbatim}
				./main "data/tsp60.dat" -t --ac --maxiter 10000 --tenure 20
			\end{verbatim}
		\end{center}


\chapter{Evaluation and Data Acquisition}
In this chapter we will provide and discuss an evaluation of our rendering approaches. For this purpose we compare our method's (peak) viewing angles with maximum reflectance for a fixed incident beam with those resulting from the grating equation at different wavelengths. But first we revisit the term diffraction grating and provide a detailed definition.

\section{Diffraction Gratings}
\label{sec:diffractiongrating}
%TODO 1. purpose
In order to evaluate the quality of our simulations, it is important to understand all underlying elements involved in the rendering process. One particular element, which we have not investigated in detail is the diffraction grating represented by our height field. Thus, in this section we will examine in detail, what a diffraction grating actually is and how it works. \\

%TODO 2. what is it
By the term $\emph{diffraction grating}$ we are referring to the surface of a flat piece of an opaque material that contains a large number of parallel, closely and evenly spaced slits$\footnote{Usually, these slits are either engraved or etched into the surface of the material.}$ or bumps. Therefore, these slits are forming a periodically packed, groove-like structure along the surface of the material. \\

% TODO 3. Purpose
A diffraction grating alters the state of an incident light beam by diffracting its component waves. According to Huygen's principle (see section $\ref{sec:huygensprincipledef}$), when an incident light beam hits the grating points on the slits, the grating will act as point light sources that emits spherical wavelets. Basically, a diffraction grating can be either transmissive (see figure $\ref{fig:idealizedtransmissivegrating}$) or reflective (see figure $\ref{fig:reflgrating}$). As light transmits through or reflects off a grating, the grooves on the grating cause different wavelengths of the light to diffract differently and thus divide the light into its component wavelengths. This also implies that the emitted wave will have a different outgoing angle with peak intensity than the incident light. In general, the closer the spacing of the slits is to the wavelength of the incident wave, the more the emitted wave will be diffracted. \\

Figure $\ref{fig:spectometer}$ illustrates what happens when a monochromatic light passes through a transmissive grating. Using a spectrometer, we see that the outgoing angle of the emitted wave will be different from the incident angle. Hence, the diffracted light is composed of the sum of interfering wave components emanating from each slit in the grating.

\begin{figure}[H]
  \centering
  \includegraphics[scale=0.5]{evaluation/spectometer.png}
  \caption[Spectrometer]{Illustration of a spectrometer: When a beam of monochromatic light passes through a grating placed on a spectrometer, images of the sources can be seen through the telescope at different angles.}
\label{fig:spectometer}
\end{figure}

Suppose an incident plane wavefront, composed of a monochromatic light source, is directed at a transmissive diffraction grating, parallel to its axis(i.e. its surface normal) as shown in figure $\ref{fig:lighthitsgrating}$. Let the distance between successive slits on the grating be equal to $d$. Furthermore, at a distance $L$, there is a screen parallel to the grating. Then the emitted waves will form a diffraction pattern on the screen which is the result of interference effects (constructive or destructive interference) among outgoing wavelets as shown in figure $\ref{fig:idealizedtransmissivegrating}$.

\begin{figure}[H]
  \centering
  \subfigure[Idealized transmissive grating]{
    \includegraphics[scale=0.44]{evaluation/idealizeddiffgrating.png}
    \label{fig:idealizedtransmissivegrating}
  }
~
  \subfigure[Parallel transmitted rays]{
    \includegraphics[scale=0.65]{evaluation/gratingsparallellines.png}
    \label{fig:gratingparallelreflectedrays}
  }

\caption[Idealized Diffraction Grating]{Light directed to parallel to grating}
\label{fig:lighthitsgrating}
\end{figure}

If the distance to the screen is much larger than the slits width, i.e. $L >> d$, then all the rays emanating from the surface and ending up at the receiver are parallel. Thus, the path difference between waves from any two adjacent slits can be derived by drawing a perpendicular line between the parallel rays. Applying simple trigonometry gives us this path difference as $e = d sin(\theta)$ as shown in figure $\ref{fig:gratingparallelreflectedrays}$. If the path difference equals one wavelength or a multiple of the wave's wavelength, the emerging, reflected waves from all slits will be in phase and a bright line will be observed at that point. Therefore, the condition for a local maxima in the interference pattern is:

\begin{equation}
 d sin(\theta) = m \lambda
\label{eq:simplegratingequation}
\end{equation}

where $m \in \mathds{N}_0$ is the order of diffraction and $\lambda$ is the wavelength. Because $d$ is very small for a diffraction grating, a beam of monochromatic light passing through it is split into very narrow bright fringes at large angles $\theta$ (see figure $\ref{fig:diffractionslits}$). Without the loss of generality, either for a transmissive or a reflective diffraction grating type, an analogous derivation for equation $\ref{eq:simplegratingequation}$ can be derived.

\begin{figure}[H]
  \centering
  \includegraphics[scale=0.55]{evaluation/GratingSurface.png}
  \caption[Different Diffraction Orders]{Illustration of different diffraction orders when light is diffracted on a reflective diffraction grating. An incident beam of light hits a surface at an angle $\theta_i$ w.r.t. the surface normal $n$. The angle $\theta_r$ denotes the angle of the reflected beam (zero order).}
\label{fig:gratingdiffractionorders}
\end{figure}

When a beam of white light is directed at a diffraction grating along its axis, instead of a monochromatic bright fringe, a set of colored spectra are observed on both sides of the central white band. Figure $\ref{fig:diffractionslits}$ illustrates this for different number of slits on a diffraction grating.

\begin{figure}[H]
  \centering
  \subfigure[one slit]{
    \includegraphics[scale=0.19]{evaluation/slits/spalt1.png}
    \label{fig:diffractionSlits1}
  }
  \subfigure[seven slits]{
    \includegraphics[scale=0.19]{evaluation/slits/spalt07.png}
    \label{fig:diffractionSlits7}
  }

\caption[N Slit Diffraction Grating Pattern]{Difference of diffraction pattern$\footnotemark$ between a monochromatic (top) and a white (bottom) light spectra for different number of slits.}
\label{fig:diffractionslits}
\end{figure}
\footnotetext{These images have been taken from \texttt{http://www.itp.uni-hannover.de/\textasciitilde zawischa/ITP/multibeam.html}}

Since the reflection angle $\theta_r$ for a maxima increases with wavelength $\lambda$, red light, which has the longest wavelength, is diffracted through the largest angle. Similarly violet light has the shortest wavelength and is therefore diffracted the least. Thus, white light is split into its component colors from violet to red light. The spectrum is repeated in the different orders of diffraction, emphasizing certain colors differently, depending on their order of diffraction like shown in figure $\ref{fig:gratingdiffractionorders}$. Note that only the zero order spectrum is pure white. Figure $\ref{fig:nslitdiffractionintensity}$ shows the relative intensity resulting when a beam of light hits a diffraction grating with different number of slits. From the graph we recognize that the more slits a grating has, the sharper more slopes the function of intensity gets. This is similar like saying that, the more periods a grating has, the sharper the diffracted color spectrum gets like shown in figure $\ref{fig:diffractionslits}$.

\begin{figure}[H]
  \centering
  \includegraphics[scale=0.6]{evaluation/relativeintensivity.png}
  \caption[Intensity Plots for Different Number of Slits]{Relative intensities of a diffracted beam of light with wavelength $\lambda=500nm$ on a grating for different number of slits $N$. A slit width of 30 microns and a slit separation of 0.15 mm was used. The viewer is 0.5m away from the grating.}
  \label{fig:nslitdiffractionintensity}
\end{figure}

\section{Data Acquisition}
Our goal is to perform physically accurate simulations of diffraction effects due to natural gratings. As for every simulation, its outcome highly depends on the input data and thus we also require measurements$\footnote{All measured data has been provided by the Laboratory of Artificial and Natural Evolution at Geneva - Website:\texttt{www.lanevol.org}}$ of real natural gratings. For that purpose, samples of skin sheds of Xenopeltis and Elaphe snake species were fixed on a glass plate. Then, by using an Atomic Force Microscope (AFM), their surface topography was measured and digitally stored$\footnote{Note these measured height fields can be visualized using grayscale images, indicating their relative depth.}$. In general, an AFM is a microscope that uses a tiny probe mounted on a cantilever to scan the surface of an object. The probe is extremely close to the surface, but does not touch it. As the probe traverses the surface, attractive and repulsive forces arising between it and the atoms on the surface inducing forces on the probe that bends the cantilever. The amount of bending is measured and recorded, providing a depth-map of the atoms on the surface. An atomic force microscope is a very high-resolution probe scanner with its demonstrated resolution on the order of a fraction of a nanometer, which is more than 1000 times better than the optical diffraction limit. The resolution of any optical system is limited by the optical diffraction limit due to the effect of diffraction. Thus, no matter how well a lens of an optical system is corrected, its resolution is fundamentally limited by this optical barrier.

\section{Verifications}
\label{sec:approachesverifications}
\begin{figure}[H]
  \centering
  \includegraphics[scale=0.65]{evaluation/evalsetup2.png}
  \caption[Experimental Setup]{Experimental setup for evaluation: A light beam with direction $L$ hits the surface, representing a grating pattern with periodicity $d$, at the incident plane$\footnotemark$ relative to the surface normal $n$ at angle $\theta_i$ and emerges at an angle $\theta_r$ with viewing direction $V$.}
  \label{fig:experimentalsetup}
\end{figure}
\footnotetext{Remember that in general a direction vector is determined by two angles. In our evaluation setup one angle is initially fixed. Thus, regardless what value we choose for our free angle parameter the incident light will always be parallel to a so called incident plane (green plane shown in figure $\ref{fig:experimentalsetup}$.}

The physical reliability of our BRDF models has been verified by applying it to a height field for a synthetic blazed grating. Figure $\ref{fig:experimentalsetup}$ illustrates the geometrical setup for our evaluation approach: A monochromatic beam of light with wavelength $\lambda$ hits a surface with periodicity $d$ at an angle $\theta_i$ relative to the normal $n$ along its incident plane. The beam emerges from the surface at the angle $\theta_r$ with certain intensity as predicted by our model. Note that actually two angles are necessary in order to define a direction vector, using spherical coordinates. However, in our evaluation we fixed the azimuthal angle of these directional vectors (Further information can be found in section $\ref{sec:evalprecomp}$). \\

In our evaluation we compare the local peak angles predicted by our model with those resulting from the grating equation $\ref{eq:gratingeq}$. The grating equation models the relationship between the grating spacing, the incident light angle and the angle for a local maxima for the diffracted light beam.

\begin{figure}[H]
  \centering
  \includegraphics[scale=0.45]{evaluation/reflgrating.png}
  \caption[Reflective Grating]{Reflecting grating: When the incident light direction is not parallel to its axis at the grating there is another $sin(\phi)$ involved. See also the grating equation $\ref{eq:gratingeq}$.}
  \label{fig:reflgrating}
\end{figure}
\noindent
Figure $\ref{fig:reflgrating}$ shows that if the incident light is not along the axis of the diffraction gratings then it effects the optical path differences. The angles with locally maximum intensity is given by the grating equation derived from the equation $\ref{eq:simplegratingequation}$ following figure $\ref{fig:reflgrating}$:

\begin{equation}
  sin(\theta_i) = sin(\theta_r) + \frac{m \lambda}{d}
\label{eq:gratingeq}
\end{equation}

In our evaluation we are interested in the first order diffraction, i.e. $m=1$. We further assume that the incident light direction $L$ is given. In contrast the direction of the reflected wave $V$ is a free parameter. \\

In Mathematics, a three dimensional direction vector is fully defined by two angles, i.e. it can be represented by spherical coordinates. Hence, $\theta_i$, is a given constant whereas $\theta_r$ is a free parameter for our evaluation simulation. Therefore, we are going to compare the maxima or the peak viewing angles corresponding to each wavelength using data produced from our method against the maxima resulting by the grating equation $\ref{eq:gratingeq}$.

\subsection{Numerical Comparisons}
\label{sec:evalprecomp}
In this section we explain how we evaluated the quality of our BRDF models. For a fixed incident light direction we want to compare the peak viewing angles with maximum reflectance for our method with those resulting from the grating equation for different wavelengths. For this purpose we realized the BRDF models corresponding to different gratings for each of our shading approaches, FLSS, NMM and PQ, in Java. By fixing the azimuth angle$\footnote{Each direction vector in space can be expressed by spherical coordinates. Then, such a unit vector is defined by a pair of two angles, the inclination and the azimuth angle. For further information, please have a look at appendix $\ref{sec:sphericalcoordinates}$}$ of the incident light $L$- and viewing direction $V$, we reduced the degrees of freedom due to these directions, during our evaluation. Thus, any BRDF is then defined by a function that expects as input arguments a wavelength $\lambda$, the inclination angle of the incident light $\theta_i$ - and the viewing direction $\theta_r$. The return value of such a function, denoted by $BRDF(\lambda, \theta_i, \theta_r)$, is the intensity value of the corresponding BRDF at these given input arguments. \\

For further details how we evaluated our BRDF in Java and how we generated the corresponding evaluation plots, please refer the appendix chapter $\ref{chap:appendixevaldatagen}$.

\subsection{Virtual Testbench}
\label{sec:virtualtestbench}
\begin{figure}[H]
  \centering
  \subfigure[Blazed Grating]{
    \includegraphics[scale=0.26]{evaluation/verification/flss_blazed.png}
    \label{fig:blazeval}
  }
~
  \subfigure[Xenopeltis Grating]{
    \includegraphics[scale=0.26]{evaluation/verification/flss_xeno.png}
    \label{fig:xenopeltiseval}
  }

\subfigure[Elaphe Grating]{
  \includegraphics[scale=0.5]{evaluation/verification/flss_elaphe.png}
  \label{fig:elapheeval}
}

\caption[Validation of FLSS Approach applied on our Gratings]{Reflectance obtained by using the FLSS approach described in algorithm $\ref{alg:fragmentshaderall}$.}
\label{fig:evaluationdiffshaderalllambda}
\end{figure}

In this section we discuss the quality of our BRDF models applied to different surface structures. For that purpose we compare the resulting relative reflectance computed as described in section $\ref{sec:evalprecomp}$ for each of our BRDF models to the idealized grating equation $\ref{eq:gratingeq}$.

\begin{table}[H]
\centering
\begin{tabular}{|l|c|c|c|c|c|c|}
\hline
\multicolumn{1}{|c|}{\multirow{3}{*}{\begin{tabular}[c]{@{}c@{}}Measuring\\ periodicity $d$\\ in [nm]\end{tabular}}} & \multicolumn{6}{c|}{Method}                                                    \\ \cline{2-7}
\multicolumn{1}{|c|}{}                                                                                & \multicolumn{2}{c|}{FLSS} & \multicolumn{2}{c|}{NMM} & \multicolumn{2}{c|}{PQ} \\ \cline{2-7}
\multicolumn{1}{|c|}{}                                                                                & mean        & variance    & mean        & variance   & mean       & variance   \\ \hline
Blazed Grating                                                                                & 2499.997    & 0.377       & 2499.997    & 0.377      & 2502.428   & 0.390    \\ \hline
Elaphe Grading                                                                                & 1144.262    & 0.401       & 1144.179    & 0.677      & 1052.308   & 49.678     \\ \hline
Xenopeltis Grating                                                                                & 1552.27     & 0.45        & -           & -          & -          & -          \\ \hline
\end{tabular}
\caption[Estimated Grating Spacings]{Statistics of periodicity $d$ of our used gratings $\ref{fig:gratingpatches}$ estimated by using the grating equation $\ref{eq:gratingeq}$.}
\label{tab:gratingsmeanvariance}
\end{table}

Figure $\ref{fig:evaluationdiffshaderalllambda}$ shows the reflectance graphs (BRDF response) resulting from the FLSS approach over the \emph{wavelength-spectrum-reflected-light-angle} grid $\left( \Lambda, \Theta \right)$ (according to the equations $\ref{eq:lambdaspacesetup}$ and $\ref{eq:thetaspacesetup}$ as described in the appendix chapter $\ref{chap:appendixevaldatagen}$) as described in algorithm $\ref{alg:fragmentshaderall}$. This evaluation was applied to an idealized periodic structure, namely to the Blaze- $\ref{fig:blazeval}$ and to two natural gratings, the Elaphe- $\ref{fig:elapheeval}$ and Xenopeltis grating $\ref{fig:xenopeltiseval}$. For all our evaluation plots, we used an illumination angle of $\theta_i$ equal to $75\degree$. \\

Note that higher response values are plotted in yellow and lower values in green. For each of the graphs we determine the viewing angles with peak reflectance for each wavelength and then plot these peak viewing angles versus corresponding wavelengths as solid red curves. The blue curve represents diffraction angles for an idealized periodic structure with a certain periodicity $d$ according to the grating equation $\ref{eq:gratingeq}$. In the following we explain how the value $d$ is computed. \\

By rearranging the terms of the grating equation defined in equation $\ref{eq:gratingeq}$ and using the peek reflectance angle $\alpha_{r_k}$ derived like in algorithm $\ref{alg:evalmatlab}$ using the matrix $R$ of equation $\ref{eq:responsematrix}$, we can compute a periodicity vale $d_k$ for any wavelength $\lambda_k$.
\begin{equation}
  d_k = \frac{\lambda}{sin(\alpha_{r_k}) + sin(\theta_i)}
\end{equation}

By computing the mean value of these $d_k$ values for all $\lambda$ in $\Lambda$ we can compute an estimated periodicity value $d$. We estimated these periodicity values for every grating structure and every method we are using. The corresponding periodicity values are tabulated in table $\ref{tab:gratingsmeanvariance}$. \\

The red and blue curve are closely overlapping in the figure $\ref{fig:blazeval}$ (for a blazed grating) and $\ref{fig:elapheeval}$ (for an Elaphe grating). For Blaze and Elaphe there is only diffraction along one direction perceivable. Since the Blazed grating is synthetic we use its exact periodicity to plot the blue curve instead of estimating it. For Xenopeltis it is interesting to see that the red curve for the peak viewing angle toggles between two ridges corresponding to two different periodicities. This happens because there are multiple subregions of the nanostructure with slightly different orientations and periodicity. Each subregion carves out a different yellowish ridge. Depending on the viewing angle, the reflectance of such a subregion can be higher than others. \\

Figure $\ref{fig:evaluationdiffshadernminmax}$ shows the evaluation plots for the NMM approach applied to the Blazed- (see figure $\ref{fig:elapheneval}$) and the Elaphe-grating (see figure $\ref{fig:elapheneval}$). The NMM approach is an optimization of the FLSS approach and is discussed in section $\ref{sec:nmmapproach}$. The response curve of each plotted NMM approach graph closely matches the corresponding grating equation curve. Furthermore, the evaluation graphs of the NMM approach look similar to the corresponding evaluation plots of the FLSS approach shown in figure $\ref{fig:evaluationdiffshaderalllambda}$. Thus, this confirms that the NMM optimization works well.

\begin{figure}[H]
  \centering
  \subfigure[Blaze grating]{
    \includegraphics[scale=0.26]{evaluation/verification/nmm_blazed.png}
    \label{fig:blazneval}
  }
~
  \subfigure[Elaphe grating]{
    \includegraphics[scale=0.26]{evaluation/verification/nmm_elaphe.png}
    \label{fig:elapheneval}
  }
\caption[Validation of NMM Approach applied on our Gratings]{Reflectance obtained using NMM optimization approach.}
\label{fig:evaluationdiffshadernminmax}
\end{figure}

Last, let us consider the evaluation graphs from figure $\ref{fig:evaluationdiffshaderpq}$ for the PQ approach as described in section $\ref{sec:pqapproach}$. The PQ approach assumes the given grating being periodically distributed on the surface of a shape. For this approach we have plotted evaluation graphs of the Blaze- (See figure $\ref{fig:blazepqeval}$) and Elaphe grating (See figure $\ref{fig:elaphepqeval}$). The response curves of both PQ evaluation graphs exhibit some similarities, but also some differences, compared to their corresponding grating equation curves. We could say that the response curve of the blaze grating is weakly oscillating around the grating equation curve (blue), but basically following it even with some outliers. The response curve of the Elaphe grating is not following its corresponding first order grating equation curve well. This could be due to the PQ's assumption that a given height field has to be periodically distributed along the surface. But in general, for natural gratings, this assumption usually does not hold true. Nevertheless, the red curve fits one of the response curves. We conclude that the PQ approach produces inaccurate results compared to the FLSS approach. Thus, the PQ approach is sub-optimal and unusable in practice.

\begin{figure}[H]
  \centering
  \subfigure[Blaze grating]{
    \includegraphics[scale=0.26]{evaluation/verification/pq_blazed2.png}
    \label{fig:blazepqeval}
  }
~
  \subfigure[Elaphe grating]{
    \includegraphics[scale=0.26]{evaluation/verification/pq_elaphe.png}
    \label{fig:elaphepqeval}
  }
\caption[Validation of PQ Approach applied on our Gratings]{Reflectance obtained using PQ optimization approach.}
\label{fig:evaluationdiffshaderpq}
\end{figure}


\chapter{Proofs}
\label{chap:a10proofs}

This chapter contains proofs that
were too long or too technical to include them in the main text.
For convenience, the corresponding propositions and theorems are repeated
before the proofs, using the same numbering as in their
original chapter.

\addtocontents{lop}{\protect\iffalse}
\isincluded{tex/document/20sparseGrids}{\input{tex/document/a11chapter2}}{}
\isincluded{tex/document/30BSplines}{\input{tex/document/a12chapter3}}{}
\isincluded{tex/document/40algorithms}{\input{tex/document/a13chapter4}}{}
\addtocontents{lop}{\protect\fi}

\cleardoublepage


\documentclass[11pt]{article}

\usepackage[
top    = 2.50cm,% presumably you don't want it to be 0pt as well?
bottom = 2.50cm,
left   = 2cm,
right  = 2cm,
marginparsep = 0pt,
marginparwidth=0pt,
]{geometry}
\usepackage{amssymb}
\usepackage{fancyhdr}
\usepackage[most]{tcolorbox}
\usepackage{siunitx}
\usepackage{amsmath}
\usepackage{tikz}
\usetikzlibrary{decorations.markings}
\usepackage{caption}
\usepackage{pgfplots}
\usepackage{multicol}
\pagestyle{fancy}
\fancyhead[l]{Electrostatics - Abridged edition}
\fancyhead[r]{Giorgio Grigolo {\textcopyright}}
\tikzset{
	mypath/.style={
		postaction=decorate,
		decoration={markings,
			mark=at position #1 with {\coordinate (x);\arrow{>}}},
		thick},
	>=stealth
}
\begin{document}
\section{Coulomb's Law}
\begin{center}
	\textit{The force between two point charges $Q_1$ and $Q_2$ is directly proportional to the product of the two charges and inversely proportional to the square of their distance apart.}
\end{center}
\begin{equation}
	F=\frac{1}{4\pi\varepsilon}\frac{Q_1Q_2}{d^21}
\end{equation}
\begin{center}
	Where $F$ is the \textbf{electrostatic force}, $\varepsilon$ is the \textbf{absolute permittivity} (\si{\farad\per\meter}) of the medium, $Q_1$ and $Q_2$ are two different point \textbf{charges} (\si{\coulomb}) and $d$ the \textbf{distance} (\si\meter) between them.
\end{center}
\section{Gain in K.E. = Loss in P.E.}
\begin{equation}
	\Delta{\rm P.E.} = qV = \Delta\rm{K.E.}\tag{\si{\joule}}
\end{equation}
\begin{center}
	Where $q$ is the particle's charge and $V$ the \textbf{potential difference} (\si{\volt}) between two charged plates.
\end{center}
\section{Electric field strength between plates}

	\subsection{Equation: }
	\begin{equation}
	E=\frac{V}{d}\quad,\quad V=V_2-V_1\tag{\si{\newton\per\coulomb}}
	\end{equation}
	\subsection{Diagram: }
	\begin{center}
		\begin{tikzpicture}[scale=1.4]
		\draw(0,0) --(0,4) node[left]{$V_1$};
		\draw(4,0)--(4,4)node[right]{$V_2$};
		\draw[thick, <->] (0.1,3.5) -- node[above]{$d$} (3.9,3.5);
		\node[circle,fill,inner sep=4pt,label=right:{\tiny$q\,\mu\si{\coulomb}$}] at (0.14,2) {};
	\end{tikzpicture}
	\end{center}

\end{document}

Physics/8. Electrostatics and Capacitors/Electrostatics/electrostatics.tex