\documentstyle[12pt,twoside,amsfonts,amstex]{article}
\input{macros-course-lectures}

\parskip1.5ex
\parindent0pt

\begin{document}

\lecture{notes11}{Notes 11}{October 10, 1996}

In this lecture, we finish state machines. \\
An important discrete structure used for modeling both algorithms and
physical machines. \\
(Both software and hardware.) \\
Review definitions and features highlighted by examples of last time.\\
Introduce invariants and how to prove them by induction.\\
Then do more examples.

\section{Review}

A {\em state machine} is a triple $(Q, Q_0, \delta)$, 
where:
\begin{enumerate}
\item 
$Q$ is a nonempty (finite or infinite) set of {\em states}.
\item
$Q_0 \subseteq Q$ is a nonempty subset of the states known as the {\em
start states}.
\item
$\delta \subseteq Q \times Q$ is a binary relation over $Q$.
\end{enumerate}

Like a {\em binary relation}; formally, the only difference is
the specially distinguished start states. \\
\\
The point of a state machine is that it {\em executes\/}, producing
{\em executions}. \\
Starts from any start state, and moves along, following transitions. \\
In this way, it models a computational process. \\
\\
An {\em execution fragment} of a state machine is a finite or infinite
sequence $q_0, q_1, \ldots$ such that
$(q_i,q_{i+1}) \in \delta$ for every $i \geq 0$. \\
\\
An {\em execution} is an execution fragment in which the initial state
$q_0$ is an element of $Q_0$. \\
\\
A state of $Q$ is said to be {\em reachable} if it is the final state
of some finite execution. \\
\\
\\
We did several examples. \\
Ex. 1:  A simple counter.
This was an example of a {\em deterministic\/} state machine. 
Just one start, $0$, and one next place to go, by incrementing. 
Formally, $|Q_0| = 1$, and for every $q \in Q$, there is at most one
$q'$ such that $(q,q') \in \delta$. \\
\\
A state machine that isn't deterministic is called {\em
nondeterministic}.
\\
\\
Then did some hopscotch examples.
These were all {\em nondeterministic\/} state machines, because they
had options of going east or west, (or north or south in the
$2$-dimensional case). \\
\\
Ex. 2: Linear hopscotch \\
Allowed steps of $12$ or $18$ in either direction, $+$ or $-$. \\
\\
Then we introduced the idea of explicitly representing the {\em
structure\/} of the state machine's state by using {\em state
variables}. \\
This can almost always be done in practice. \\
\\
Ex. 3: $2$-dimensional hopscotch \\
With $12$ and $18$ in EW and $9$ and $12$ in NS direction. \\
$Q$: Consists of values for two {\em variables}: \\
$\ms{east-west} \in \integers$, initially $0$ \\
$\ms{north-south} \in \integers$, initially $0$ \\
\\
$Q$ is the Cartesian product, $\integers \times \integers$.\\
$Q_0$ consists of the single pair, $(0,0)$. \\
\\
$\delta$:  \\
Transitions of the following forms: \\
\\
$\ms{move-east}(12)$ \\
Effect: \\
  $\ms{east-west} := \ms{east-west} + 12$ \\
\\
$\ms{move-east}(18)$ \\
Effect: \\
  $\ms{east-west} := \ms{east-west} + 18$ \\
\\
$\ms{move-west}(12)$ \\
Effect: \\
  $\ms{east-west} := \ms{east-west} - 12$ \\
\\
$\ms{move-west}(18)$ \\
Effect: \\
  $\ms{east-west} := \ms{east-west} - 18$ \\
\\
$\ms{move-north}(9)$ \\
Effect: \\
  $\ms{north-south} := \ms{north_south} + 9$ \\
\\
Etc. \\
\\
\\
Then showed how sometimes it's convenient to give a predicate
restricting when the code
fragment is allowed to be applied: \\
\\
Ex. 4: \\
2-dim hopscotch on only northeast quadrant: \\
\\
The same as above, only now the two state components $\ms{east-west}$
and $\ms{north-south}$ take on nonnegative values only (values in
$\naturals$). \\
\\
E.g.: \\
$\ms{move-west}(12)$ \\
Precondition: \\
  $\ms{east-west} \geq 12$ \\
Effect: \\
  $\ms{east-west} := \ms{east-west} - 12$ \\
\\
\\
Finally, introduced important idea of an {\em invariant\/}, the main
notion used in practical methods for formal reasoning about the
correctness of algorithms/machines represented as state machines. \\
\\
Def.: 
An {\em invariant} of a state machine $M$ is any predicate  that is
true of all the reachable states of $M$. \\
\\
Observed that the general $2$-dimensional hopscotch has the invariant
that $\ms{east-west}$ is a multiple of $6$, \\
and $\ms{north-south}$ is a multiple of $3$. \\
\\
To prove these are invariants, we carried out an inductive proof on
the length of an execution of the $2$-dimensional hopscotch state
machine. \\
\\
Note this is essentially what we did earlier, in the inductive proof
lectures, 2 and 3, to reason about a simple bitwise multiplication
algorithm. \\
\\
Today, we will do more examples. \\
Illustrate how state machines are used to represent typical
computational processes, \\
and how interesting properties of those processes can be proved as
invariants, by induction. \\
\\
Examples will be chosen from number theory, posets, graphs, and
distributed computing.

\section{Number-Theoretic State Machines}

Euclid's GCD algorithm, fast multiplication

\subsection{Euclid's GCD Algorithm}

Recall what it does:  \\
Takes $x,y \in \naturals$, initially arbitrary,
subject to: not both $0$, $x \geq y$. \\
Returns $\gcd({x},{y})$. \\
\\
$Q$ consists of state components: \\
$x, y \in \naturals$, initially arbitrary, subject to:  not both $0$,
$x \geq y$ \\
These are the values for which we want to find the GCD \\
\\
Also need auxiliary components: \\
$x_1, y_1 \in \naturals$, the current values on which we're working \\
Initially, $x_1 = x$, $y_1 = y$ \\
\\
And a component to hold the final answer: \\
$\ms{answer} \in \naturals \cup \{ \ms{null} \}$, initially
$\ms{null}$. \\
\\
$\delta$: \\
\\
Two kinds of things happen:  recursive calls, and final decisions. \\
\\
$\ms{recursive-call}$ \\
Precondition: \\
  $\ms{answer} = \ms{null}$ \\
  $y_1 \neq 0$ \\
Effect: \\
  $(x_1,y_1) := (y_1,x_1 \bmod y_1)$ \\
\\
$\ms{final-decision}$ \\
Precondition: \\
  $\ms{answer} = \ms{null}$ \\
  $y_1 = 0$ \\
Effect: \\
  $\ms{answer} := x_1$ \\
\\
Would like to prove: \\
If $\ms{answer} \neq \ms{null}$ then $\ms{answer} = \gcd({x},{y})$. \\
This says that the state machine, if it ever reaches an answer,
reaches the correct answer (partial correctness). \\
\\
Can't prove just this by induction -- not strong enough. \\
Need to strengthen the inductive hypothesis (as usual), this time to
say something about the case where $\ms{answer} = \ms{null}$. \\
\\
Here, what works is a 2-part invariant:
\begin{enumerate}
\item
If $\ms{answer} \neq \ms{null}$ then $\ms{answer} = \gcd({x},{y})$. \\
\item
If $\ms{answer} = \ms{null}$ then $\gcd({x_1},{y_1}) = \gcd({x},{y})$. \\
\end{enumerate}
Now can prove this 2-part invariant by induction on number of steps in
an execution. \\
BASE: $0$ steps. \\
In initial state, $\ms{answer} = \ms{null}$.  \\
Since $x_1 = x$ and $y_1 = y$, obviously $\gcd({x_1},{y_1}) =
\gcd({x},{y})$. \\
\\
INDUCTIVE STEP: Assume true after $n$ steps and show after $n+1$
steps. \\
So consider and $n+1$-step execution. \\
It arises from an $n$-step execution, by adding one step at the end. \\
Consider cases based on the type of action -- $\ms{recursive-call}$ or
$\ms{final-decision}$ -- in that last step. \\
\\
If it's $\ms{recursive-call}$, then the precondition says that before
the last step, $\ms{answer} = \ms{null}$; this step keeps it
$\ms{null}$. \\
So we are in the second case, and we must show that $\gcd({x_1},{y_1}) =
\gcd({x},{y})$ after the step. \\
We may assume this before the step, by inductive hypothesis. \\
That is, assume $\gcd({q.x_1},{q.y_1}) = \gcd({q.x},{q.y})$. \\
Prove $\gcd({q'.x_1},{q'.y_1}) = \gcd({q'.x},{q'.y})$. \\
\\
This follows from: \\
(a) $q.x = q'.x$, $q.y = q'.y$ -- these remain unchanged, \\
(b) the interesting fact, proved earlier in the course: \\
$\gcd({q.x_1},{q.y_1}) = \gcd({q.y_1},{q.x_1 \bmod q.y_1})$, \\
and 
(c) the behavior of the code fragment, which ensures that \\
$q'.x_1 = q.y_1$ and $q'.y_1 = q.x_1 \bmod q.y_1$. \\
\\
\\
On the other hand, it the last step is $\ms{final-decision}$, then the
precondition says that $\ms{answer} = \ms{null}$ and $y_1 = 0$ before
the last step; \\
after the last step, $\ms{answer} \neq \ms{null}$. \\
So we are in the first case, and we must show that $\ms{answer} =
\gcd({x},{y})$. \\
We may assume the invariants before the step: \\
$\gcd({q.x_1},{q.y_1}) = \gcd({q.x},{q.y})$. \\
We must prove $q'.\ms{answer} = \gcd({q'.x},{q'.y})$. \\
\\
This follows from: \\
(a) $q.x = q'.x$, $q.y = q'.y$, \\
(b) the interesting fact that $\gcd({q.x_1},{0}) = q.x_1$, and \\
(c) the behavior of the code fragment, which ensures that
$q'.\ms{answer} = q.x_1$. \\
\\
This example has illustrated strengthening the hypothesis in order to
prove it.  \\
That strategy is very common in inductive proofs in general.  \\
It is almost always used in proofs for state machines.

\subsection{Fast Multiplication}

``Russian peasant's multiplication'' \\
\\
The states are composed of variables, all in $\naturals$: \\
$x$, $y$, the values to be multiplied, initially arbitrary positive \\
$a$, the accumulator for the answer \\
$r$, $s$, temporaries \\
\\
Initially, $r = x$, $s = y$, $a = 0$. \\
\\
Transitions: \\
\\
$\ms{even}$ \\
Pre: \\
$s$ is even \\
$s > 0$ \\
Eff: \\
$r := 2r$ \\
$s := {s \over 2}$ \\
\\
\\
$\ms{odd}$ \\
Pre: \\
$s$ is odd \\
Eff: \\
$a := a + r$ \\
$r := 2r$ \\
$s := {s-1 \over 2}$ \\
\\
The answer is the value in the accumulator $a$ when $s = 0$. \\
\\
This may not be completely obvious. \\
Example execution: \\
\\
\begin{verbatim}
$x$   $y$   $r$   $s$   $a$
 5     9     5     9     0
            10     4     5
            20     2     5
            40     1     5
            80     0    45
\end{verbatim}
Proof: To see this is correct, would like to prove invariant: \\
\\
Invariant 1: If $s = 0$ then $a = x y$. \\
\\
Of course, need to strengthen in order to prove. \\
Turns out that the key is: \\
\\
Invariant 2: $x y = r s + a$ \\
\\
Notice how this expresses the idea that explains why the algorithm
works. \\
This is typical for invariants. \\
\\
So, can prove Invt1 and Invt2 together by induction, as before. \\
Alternatively, and slightly better, can just prove Invt2 by itself, by
induction, and then infer Invt1 as a corollary. \\
\\
Proving Invt2 is straightforward by induction: \\
\\
BASE: \\
True initially because $r = x$, $s = y$ and $a = 0$. \\
\\
INDUCTIVE STEP: \\
Consider cases based on type of action, $\ms{even}$ or $\ms{odd}$. \\
\\
$\ms{even}$: \\
Doubling $r$ while halving $s$ doesn't change the product $rs$, \\
and $a$ doesn't change, so easy. \\
\\
$\ms{odd}$: \\
Assuming $(q.x)(q.y) = (q.r)(q.s) + q.a$. \\
Must show $(q'.x)(q'.y) = (q'.r)(q'.s) + q'.a$. \\
\\
Now $q'.x = q.x$, $q'.y = q.y$, so LHS unchanged. \\
Also, $q'.r = 2 (q.r)$, $q'.s = {q.s - 1 \over 2}$, and $q'.a = q.a + q.r$. \\
So $(q'.r)(q'.s) + q'.a = 2 (q.r)({ q.s - 1 \over 2 }) + q.a + q.r$. \\
Reorganizing terms yields $(q.r)(q.s) + q.a$, which suffices. 
\\
\\
So Invt2 is proved. \\
For Invt1, don't even need an induction: \\
\\
Already know that in all reachable states, $xy = rs + a$. \\
Need to show in all reachable states, if $s = 0$ then $a = xy$. \\
\\
So let $q$ be any reachable state. \\
We know that $(q.x)(q.y) = (q.r)(q.s) + (q.a)$. \\
If $q.s = 0$, we get $(q.x)(q.y) = q.a$. \\
As needed. \\
\\
\\
This has illustrated the idea of strengthening an invariant, then
proving only a part of it by induction and getting the rest as a
consequence (corollary). \\
\\
This strategy extends: \\
Sometimes to prove an invariant must extend it to a long list. \\
Then useful to prove one or a batch first, by induction. \\
After that, we can assume their results in proving another batch by
induction. \\
Etc. \\
Anywhere along the way, might get some as consequences, without using
induction. 

\section{Posets}

Algorithms can also manipulate other data structures besides just
numbers. \\
Here we do algorithms that manipulate posets. \\
Comparison-based algorithms. 

\subsection{Bubble Sort}

A comparison-based sorting algorithm. \\
\\
Fix $n \geq 2$, length of sequence to sort. \\
\\
State has: \\
$a$, a length $n$ sequence of integers, write components $a(1), a(2),
\ldots a(n)$. \\
Initially arbitrary. \\
$i$, $j$, pointers in range $[2,n+1]$, initially $2$ \\
\\
$i$ keeps track of which pass we're up to -- pass corresponds to the
initial position of the element that we're trying to insert in its
correct position in the sequence. \\
$j$ keeps track of our progress in trying to locate the proper
position for the element we're currently working on. \\
\\
Only one type of transition, though it has some cases: \\
\\
$\ms{compare}$ \\
Precondition: \\
$i \leq n$ \\
Effect: \\
if $a(j-1) \leq a(j)$ then $i, j := i+1$ \\
else \\
\hspace{2mm} interchange $a(j-1)$ and $a(j)$ \\
\hspace{2mm} if $j > 2$ then $j := j-1$ else $i, j := i+1$ \\
\\
\\
Describe operation informally. \\
$a(j-1) \leq a(j)$ means have placed current element in correct
position relative to ones that begin ahead of it. \\
Now go on to next pass, to place next element. \\
\\
Otherwise, interchange.  See if have reached top -- if so go on to
next element, if not, continue this pass. \\
\\
Final invariant will be: \\
If $i = n+1$ then $a$ is sorted (in nondecreasing order). \\
\\
To prove this by induction, need invariants representing partial
progress: \\
\begin{enumerate}
\item
$2 \leq j \leq i \leq n+1$ \\
(Just gives range of index values.)
\item
$i = n+1$ if and only if $j = n+1$. \\
(Special case -- if indices hit end we're done.)
\item
$a(k) \leq a(l)$ for all $k,l$, $1 \leq k \leq l \leq \min{(i,n)}$,
$k, l \neq j$. \\
(That is, all elements up to and including $i$, except possibly 
the $j$th element, are in sorted order.) 
\item
$a(j) \leq a(k)$ for all $k$, $j+1 \leq k \leq \min{(i,n)}$. \\
(That is, the $j$th element is in the right place with respect to the
elements in higher-numbered positions -- up to and including $i$th
position.)
\end{enumerate}
Note that these statements represent the key reasons why this
algorithm works. \\
\\
Must argue these invariants are preserved.  \\
\\
Invt1 is trivial, prove by itself. \\
By induction. \\
Base:  True in initial state, since $2 \leq 2 \leq 2 \leq n+1$. \\
Inductive: Cases.  \\
Could set $i,j:=i+1$, but only in case $i \leq n$.  This implies $2
\leq j \leq i \leq n+1$. \\
Could set $j := j-1$, but only in case $j > 2$.  This preserves. \\
\\
\\
Invt2 likewise trivial, by induction. \\
\\
\\
Invts 3 and 4 less trivial. \\
Prove them together, again by induction. \\
Argue in cases, based on which clause in the effect is followed. \\
\\
Case 1: \\
The first test comes out positive, saying $a(j-1) \leq a(j)$. \\
Informally, this means that the $j$th element is already in the right
position relative to all others, so we have a total order for $a(1),
\ldots, a(i)$. \\
As needed to start next phase with new $i$. \\
Formally, we need to show Invts 3 and 4 after the step. \\
These are both implied by the claim that
$a(1) \leq a(2) \ldots a(q.i)$ after the step. \\
That is, the entire list through position $q.i$ (the old value of $i$)
is now sorted. \\
\\
Say why this implies both Invt3 and Invt4. \\
Invt3 excludes the last element $a(q'.i)$ (may not even exist, in case
$i = n+1$) and Invt4 is vacuous. \\
\\
So, show $q'.a(1) \leq q'.a(2) \ldots q'.a(q.i)$. \\
\\
By inductive hypothesis, we know that 
$q.a(1) \leq q.a(2) \leq \ldots \leq q.a(q.j-1) \leq q.a(q.j+1) \leq
\ldots \leq q.a(q.i)$. \\
Also, $q.a(j) \leq q.a(k)$ for all $k$, $q.j+1 \leq k \leq q.i$.
By precondition, we know that $q.a(q.j-1) \leq q.a(q.j)$. \\
\\
Draw Hasse diagrams, Figure 1. \\
\\
This all implies that 
$q.a(1) \leq q.a(2) \leq \ldots \leq q.a(q.j-1) \leq q.a(q.j) \leq
q.a(q.j+1) \leq \ldots \leq q.a(q.i)$. \\
That is, \\
$q.a(1) \leq q.a(2) \leq \ldots \leq q.a(q.i)$. \\
But the elements in the array are unchanged by the step. \\
So $q'.a(1) \leq q'.a(2) \leq \ldots \leq q'.a(q.i)$, \\
as needed. \\
\\
\\
Case 2: \\
The test comes out negative. \\
In this case, a single interchange occurs.  \\
Informally, the new element is correctly ordered with respect to all later
elements, after the exchange, which yields Invt4 in the new state. \\
And all other elements are still correctly sorted, which gives Invt3
in the new state. \\
There are then two subcases, based on whether we are done with this
$i$. \\
\\
The formal argument breaks up into these two cases. \\
Argument in same style as above.  \\
LTTR to do carefully. \\
DO THIS TO MAKE SURE YOU UNDERSTAND WHAT'S GOING ON HERE. \\
Do in recitation. \\
\\
E.g., need to use arguments like:
$q.a(q.j) < q.a(q.j-1)$ implies
$q'.a(q'.j-1) < q'.a(q.j)$ (after interchange). 
\\
Technical, must keep notation straight for before-after states. \\
Need distinction for all variables -- indices too, since these
sometimes change. \\
\\
\\
Once Invts 3 and 4 are proved, still need to show the final invt: \\
If $i = n+1$ then $a$ is sorted (in nondecreasing order). \\
Follows from Invt3, applied with $j = n+1$ (using Invt2 to deduce that
also $i=n+1$).

\section{Graph Algorithms}

Algorithms can also manipulate graphs.

\subsection{Acyclic Graph Maintenance}

State is a directed graph $G$ with no self-loops. \\
Represented by components $V$ and $E$. \\
Initially, it is any acyclic graph (define). \\
Transition:  Pick a node with only incoming edges. \\
Reverse all the edges simultaneously: \\
\\
$\ms{reverse}(v)$ \\
Precondition: \\
$E$ contains no edge of the form $(v,w)$ \\
Effect: \\
let $W \ \{ w \in V | (w,v) \in E \}$. \\
$E := E \cup \{ (v,w) \mid w \in W \} - \{ (w,v) \mid w \in W \}$ \\
\\
Invariant: Graph $(V,E)$ is acyclic. \\
Prove by induction. \\
Inductive step: \\
Suppose graph is acyclic. \\
Claim one reversal can't introduce a cycle. \\
If it did, then one of the new edges inserted by the reversal would
have to be involved in the cycle. \\
(Uses inductive hypothesis -- no cycles in pre-state.)
But each such edge starts at $v$, so the cycle would have to have an
edge that ends with $v$.  \\
But this can't be, since we are reversing {\em all} edges incoming to
$v$.

\subsection{Minimum Weight Paths (``Shortest Paths'')}

State contains a digraph $G$ again, represented by components $V$ and
$E$. \\
Also $v_0$, a distinguished node in $V$. \\
\\
Also, each edge $(v,w)$ in $E$ has a nonnegative real-valued {\em
weight}, $\ms{weight}(v,w)$. \\
(Could be different from $\ms{weight}(w,v)$.) \\
Represented in matrix. \\
\\
The goal is for each node to determine the total weight of the
minimum-weight path from $v_0$ to itself in the digraph. \\
A.K.A. ``shortest path'', using strange mix of weight and length
terminology. \\
\\
Another state component: \\
Each node $v$ has a path-weight estimate, $\ms{pweight}(v)$, either
a nonnegative real or $\infty$. \\
Initially, $\ms{pweight}(v_0)$ is set to $0$, and all the others are
$\infty$. \\
\\
There is only one type of transition, in which one of the vertices, $v$,
improves (lowers) its path weight estimate based on the latest estimate
of one of its neighbors, $w$: \\
\\
$\ms{improve}(w,v)$ \\
Pre: \\
$(w,v) \in E$ \\
$\ms{pweight}(w) + \ms{weight}(w,v) < \ms{pweight}(v)$ \\
Eff: \\
$\ms{pweight}(v) := \ms{pweight}(w) + \ms{weight}(w,v)$ \\
\\
\\
Very nondeterministic -- this has lots of different executions,
depending on which vertices improve based on which neighbors, in which
order. \\
What happens?  \\
First, at any time, for each vertex that has a finite estimate, 
the estimate corresponds correctly to some path from $v_0$ to itself. \\
Second, if all vertices keep trying to improve based on all incoming
neighbors, then eventually each will have as its estimate the actual
minimum-weight of a path from $v_0$ to itself. \\
\\
The second is a termination property, and invariants aren't much help
in proving termination. \\
There are other methods for this, ``beyond the scope'' of this course. \\
So we only concentrate on the first property. \\
This is proved as an invariant: \\
\\
Invt1: For any $v$, if $\ms{pweight}(v) \neq \infty$, then
$\ms{pweight}(v)$ is
the total weight of some path from $v_0$ to $v$. \\
\\
Prove by induction as usual. \\
BASE: \\
Only non-$\infty$ node is $v0$, and there is a path of total
weight $0$, namely trivial $0$-length path. \\
INDUCTIVE STEP: \\
By inductive hypothesis, $\ms{pweight}(w)$ before the step is the
total weight of some path from $v_0$ to $w$. \\
Augment this path with one additional edge to get a path to $v$.

\remove{
MST \\
Skip for now. \\
State has graph with weights, current forest. \\
Transition adds in another edge -- smallest from some component.
\\
Invariant: \\
The current forest is always a subgraph of a MST. \\
Proof: The usual argument forms the inductive step.
} % end remove

\section{Distributed Algorithms}

The technique of modeling programs as state machines in order to
reason about their behavior (reachable states, invariants) extends to
parallel programs as well as sequential. \\
Even to {\em distributed algorithms}, in which there are many programs
running independently at different nodes of a network. \\
\\
Give two examples, one simple, one not so simple. \\
Will represent each as a single state machine. 

\subsection{Leader Election}

Token-based leader election, in a ring of processes. \\
\\
Imagine a collection of processes numbered $1,\ldots, n$, arranged in
a ring (mod $n$). \\
Want to elect exactly one as a leader. \\
Each starts with a {\em unique identifier}, say a natural number. \\
(Any combination of identifiers can appear in the ring, as long as
there are no repeats.) \\
\\
Each process sends its own identifier clockwise to its neighbor, pass
around ring. \\
But: Each process only passes on identifiers greater than its own. \\
If a process receives its own identifer, it elects self leader. \\
(The idea is that only the max uid will succeed in getting all the way
around the ring.) \\
\\
Formally, state consists of: \\
For each $i$, $1 \leq i \leq n$: \\
$\ms{val}(i)$, $i$'s identifier (initially, all are unique) \\
$\ms{buffer}(i,i+1 \bmod n)$, a finite sequence, initially containing
just $\ms{val}(i)$ \\
(Communication buffer for messages from process $i$ to process $i+1$.) \\
$\ms{leader}(i)$, a Boolean, initially $\ms{false}$ \\
\\
\\
$\ms{move}(i)$ \\
Pre: \\
$\ms{buffer}(i-1,i)$ is nonempty \\
Eff: \\
let $t = \ms{head}(\ms{buffer}(i-1,i))$ \\
remove $\ms{head}$ of $\ms{buffer}$ \\
if $t > \ms{val}(i)$ then add $t$ to end of $\ms{buffer}(i,i+1)$ \\
if $t = \ms{val}(i)$ then $\ms{leader}(i) := \ms{true}$ \\
\\
\\
We would like to prove that exactly one $\ms{leader}(i)$ flag gets
set. \\
For now, we'll content ourselves with just showing that {\em at
most\/} one flag is set. \\ 
\\
Invt1: At most one $\ms{leader}(i)$ is $\ms{true}$. \\
\\
Needs strengthening: \\
\\
Invt2: \\
Loosely: ``A uid in a buffer is greater than the uids of all processes
that it has passed.'' \\
More formally:  If $\ms{val}(i)$ is in $\ms{buffer}(j,j+1)$, then
$\ms{val}(i)$ is greater than all of $\ms{val}(i+1), \ms{val}(i+2),
\ldots, \ms{val}(j)$. \\
\\
Can prove by induction. \\
Key is that a node only lets the value pass if it's greater. \\
\\
Do more carefully in recitation? \\
\\
Showing some leader is eventually elected is a liveness property;
however, showing it uses an auxiliary invariant saying that the
maximum uid is always {\em somewhere} in the state. \\
(Conservation of max uid). \\
\\
Do in recitation? \\

\subsection{Alternating Bit Protocol}

A common communication protocol. \\
Sending a sequence of messages from a set $M$, from process $1$ to
process $2$. \\
Using underlying FIFO communication channels, can lose or duplicate
messages. \\
Process $1$ keeps sending first message tagged with $1$. \\
When process $2$ receives, accepts and outputs. \\
Acks (repeatedly) with tag $1$. \\
When process $1$ receives $1$, starts sending next message, tagged
with $0$. \\
Process $2$ ignores tag $1$, until is sees first $0$; then accepts and
outputs, and then acks repeatedly with $0$. \\
Process $1$ now waits to receive $0$, then goes back to tag $1$. \\
Alternates. \\
\\
The claim is that this causes process $2$ to output a {\em prefix\/}
of the sequence of process $1$. \\
(To see that it gives all requires a liveness argument.) \\
\\
States: \\
$\ms{buf}_1$, a finite sequence of $M$ elements, initially arbitrary,\\
$\ms{work-buf}_1$, same, initially equal to $\ms{buf}_1$ \\
(This represents the remaining messages to be sent, whereas
$\ms{buf}_1$ represents all the messages ever submitted.) \\
$\ms{tag}_1 \in \{ 0, 1 \}$, initially $1$. \\
\\
$\ms{buf}_2$, a finite sequence of $M$ elements, initially empty,\\
$\ms{tag}_2  \in \{ 0, 1 \}$, initially $0$. \\
\\
$\ms{channel}_{1,2}$, a finite sequence of elements of $M \times \{ 0, 1 \}$, 
  initially empty, \\
$\ms{channel}_{2,1}$, a finite sequence of elements of 
  $\{ 0, 1 \}$, initially empty \\
\\
Transitions: \\
\\
$\ms{send}(m,b)_{1,2}$ \\
Pre: \\
$m = \ms{head}(\ms{work-buf}_1)$ \\
$b = \ms{tag}_1$ \\
Eff: \\
add $(m,b)$ to end of $\ms{channel}_{1,2}$, any number $\geq 0$ of times \\
\\
$\ms{send}(b)_{2,1}$ \\
Pre: \\
$b = \ms{tag}_2$ \\
Eff: \\
add $b$ to end of $\ms{channel}_{2,1}$, any number $\geq 0$ of times \\
\\
$\ms{receive}(m,b)_{1,2}$ \\
Pre: \\
$(m,b) = \ms{head}(\ms{channel}_{1,2})$ \\
Eff: \\
remove $\ms{head}$ \\
if $b \neq \ms{tag}_2$ then \\
\hspace{2mm} add $m$ to $\ms{buf}_2$ \\
\hspace{2mm} $\ms{tag}_2 := \ms{tag}_2 + 1 \bmod 2$ \\
\\
$\ms{receive}(b)_{2,1}$ \\
Pre: \\
$b = \ms{head}(\ms{channel}_{2,1})$ \\
Eff: \\
remove $\ms{head}$ \\
if $b = \ms{tag}_1$ then \\
\hspace{2mm} remove head of $\ms{work-buf}_1$ (if nonempty) \\
\hspace{2mm} $\ms{tag}_1 := \ms{tag}_1 + 1 \bmod 2$ \\
\\
\\
Goal invariant, Invt1: \\
$\ms{buf}_2$ is a prefix of $\ms{buf}_1$ \\
\\
Needs intermediate invariant: \\
\\
Let $\ms{tag-sequence}$ be the sequence consisting of elements of
$\ms{channel}_{2,1}$, \\
followed by $\ms{tag}_2$, \\
followed by the tag components of the elements of $\ms{channel}_{1,2}$, \\
followed by $\ms{tag}_1$. \\
\\
Use sequence concatenation notation. \\
\\
Invt2: \\
$\ms{tag-sequence}$ consists of one of the following:
\begin{enumerate}
\item
All $0$'s.
\item
All $1$'s. 
\item
A positive number of $0$'s followed by a positive number of $1$'s.
\item
A positive number of $1$'s followed by a positive number of $0$'s.
\end{enumerate}
What is being ruled out is more than one switch of tag value. \\
\\
This is proved easily by induction (no extra hypotheses needed); talk
through. \\
\\
Also need: \\
\\
Invt3: \\
If $(m,\ms{tag}_1)$ is in $\ms{channel}_{1,2}$ then $m =
\ms{head}(\ms{work-buf}_1)$. \\
\\
This again follows by induction.  Uses Invt2 in the proof. \\
(BASE:  Obvious, since no message is in the channel initially. \\
INDUCTIVE: \\
If add new message to channel, obvious.  \\
Only interesting case is if $\ms{tag}_1$ changes and there is something
else already in $\ms{channel}_{1,2}$ with the same tag. \\
But this can't happen, by Invt2 applied before the step -- since
incoming tag $= \ms{tag}_1$, all the tags in the state must be the same.) \\
\\
Finally, need: \\
Invt4: \\
1. If $\ms{tag}_1 \neq \ms{tag}_2$ then: \\
$\ms{buf}_2 \cdot \ms{work-buf}_1 = \ms{buf}_1$. \\
2. If $\ms{tag}_1 = \ms{tag}_2$ then \\
$\ms{work-buf}_1$ and $\ms{buf}_2$ are nonempty, \\
$\ms{head}(\ms{work-buf}_1) = \ms{last}(\ms{buf}_2)$, and \\
$\ms{buf}_2 \cdot \ms{tail}(\ms{work-buf}_1) = \ms{buf}_1$. \\
\\
$\ms{tail} =$ all but head. \\
\\
Invt4, part 2, easily implies the goal Invt1. \\
Also implies that $\ms{work-buf}_2$ is always nonempty when the
$\ms{receive}_1$ occurs for equal tags. \\
(So parenthetical check is always true.)
\\
Prove Invt4 by induction. \\
BASE:  \\
tags unequal, $\ms{work-buf}_1 = \ms{buf}_1$ and $\ms{buf}_2$
empty. \\
Suffices. \\
INDUCTIVE STEP: \\
When send, don't change tags or buffers. \\
So can't change the truth of the invariants. \\
So only consider receives.\\
\\
$\ms{receive}(m,b)_{1,2}$: \\
If $b = \ms{tag}_2$, nothing happens, so preserved. \\
If $b \neq \ms{tag}_2$, arriving message is same as first on
$\ms{work-buf}_1$, by Invt3. \\
Change tag to make equal, replicate $\ms{first}(\ms{work-buf}_1)$ at
end of $\ms{buf}_2$. \\
Since concatenation previously held (by inductive hypothesis),
now the modified concat does. \\
\\
$\ms{receive}(b)_{2,1}$ \\
Similar argument. \\
If $b \neq \ms{tag}_1$, nothing happens, preserved. \\
If $b = \ms{tag}_1$, change tag to make unequal, remove first element
of work-buf. \\
Since modified concat previously held (by inductive hypothesis), now
ordinary concat does. 

\remove{
Liveness?  Temporal logic?
Progress functions?
Simulations?
} % end remove



Study problems on state machines:

1. Consider a state machine whose state consists of: \\
$V$, a set of vertices, initially containing one vertex. \\
$E$, a subset of $V \times V$, initially empty \\
$n \in \naturals$, initially $1$. \\
\\
Transitions:
\\
$\ms{expand}(v,w,x)$
Precondition: \\
$v \in V$ \\
there is at most one edge incident on $v$ in $E$ \\
$w, x \not \in V$ \\
Effect: \\
$V := V \cup \{ w,x \}$ \\
$E := E \cup \{ (v,w), (v,x) \}$ \\
$n := n + 2$
\\
Prove the following invariants (in order): \\
1. $|V| = n$ \\
2. $(V,E)$ is a tree
3. if $|V| \geq 2$ then $(V,E)$ has ${n-1 \over 2}$ internal nodes. 


2. (Binary search)
Fix $k$. \\
Consider a state machine whose state consists of: \\
$a$, an array indexed by $\{ 1, \ldots, 2^k - 1 \}$ of $\naturals$,
initially arbitrary, subject to $a(i) \leq a(j)$ if $i < j$ (i.e.,
sorted). \\
$v \in \naturals$ \\
$i \in \naturals$, initially $2^{k-1}$ \\
$\ms{jump} \in \naturals$, initially $2^{k-1}$ \\
$\ms{ans} \in \{ 1, \ldots, 2^k-1 \} \cup \{ \ms{unknown}, \ms{no}
\}$, initially $\ms{unknown}$ \\
\\
Transitions: \\
\\
$\ms{less}$ \\
Precondition: \\
$\ms{ans} = \ms{unknown}$ \\
$v < a(i)$ \\
Effect: \\
if $\ms{jump} > 0$ then \\
\hspace{2mm} $\ms{jump} := \ms{jump} - 1$ \\
\hspace{2mm} $j := j - 2^{\ms{jump}}$ \\
else $\ms{ans} := \ms{no}$

$\ms{greater}$
Precondition: \\
$\ms{ans} = \ms{unknown}$ \\
$v > a(i)$ \\
Effect: \\
if $\ms{jump} > 0$ then \\
\hspace{2mm} $\ms{jump} := \ms{jump} - 1$ \\
\hspace{2mm} $j := j + 2^{\ms{jump}}$ \\
else $\ms{ans} := \ms{no}$

$\ms{equals}$
Precondition: \\
$\ms{ans} = \ms{unknown}$ \\
$a(i) = v$ \\
Effect: \\
$\ms{\ms{ans} := i}$

Prove invariants:
1. If $\ms{ans} = \ms{no}$ then $(\forall i) v \neq a(i)$
2. If $\ms{ans} = i \in \naturals$ then $a(i) = v$
(Hint:  You will need to strengthen these invariants in order to prove
them.)
\end{document}
