\section{Protocols}
\label{Protocols}
The system uses Phalanx \cite{Delhi:2} for the underlying {\sf
read/write} operations. To maintain a graph for the quorum system, we
extend the protocols with {\sf join/leave}. Also {\sf register}
protocol is used to get quorum certificates with the threshold
password authentication.

{\em Notations}:
$\langle x, t, v, s_C, S \rangle$ is an ordered set that denotes the protocol
data. $s_C$ and $S$ can be omitted.

\begin{tabular}{cl}
  $x$ & \begin{minipage}[t]{0.8\columnwidth}%
    is the variable and an arbitrary length octet
    string. The variable will be the ``key'' of the key-value store.%
  \end{minipage}\\
  $t$ & \begin{minipage}[t]{0.8\columnwidth}%
    is the timestamp and a 64-bit non-negative
    integer. $2^{64}-1$ is a special value to denote that the variable is
    no longer able to be updated.%
  \end{minipage}\\
  $v$ & \begin{minipage}[t]{0.8\columnwidth}%
    is the value and an arbitrary length octet string.%
  \end{minipage}\\
  $s_C$ & \begin{minipage}[t]{0.8\columnwidth}%
    is an object of the signature and quorum certificate
    of a client $C$. $s_C.sig$ is the signature over $\langle x, t, v
    \rangle$ signed by the private key of $C$. $s_C.cert$ is the quorum
    certificate of $C$. $s_C.cert.ID$ is the unique ID to identify each
    node.%
  \end{minipage}\\
  $S$ & \begin{minipage}[t]{0.8\columnwidth}%
    is an unordered set of the signature object. Each $S_i
    \in S$ has the
    same structure of the $s_C$. The signers must be quorum members.%
  \end{minipage}\\
\end{tabular}

\subsection{Read / Write}
\label{rw}
{\sf read/write} protocols are done between a client ($C$) and a
quorum ($Q$). A quorum is chosen from a quorum system ($QS \subseteq
2^U$) which is a subset of the powerset of all nodes ($U$).  To write
a value $v$ into a variable $x$, we follow the write protocol
specified in Phalanx.\\

[ {\sf write} ]
\begin{align*}
  C :& \text{ choose a quorum from quorum cliques} \\
     & Q \in QC \\
  C \rightarrow Q :& \text{ \sf get timestamp}(x) \\
  C \leftarrow Q_i :& \text{ } t_i \\
  C :& \text{ collect } 2b+1 \text{ timestamps: } \\
     & \text{ } \{t_i\}_{i \in \mathcal{T}}, |\mathcal{T}|=2b+1,
       \mathcal{T} \subseteq Q \\
  C :& \text{ choose the maximum timestamp } \\
     & \text{ } t = max(t_i) + 1 \\
  C \rightarrow Q :& \text{ \sf get signature}(\langle x, t, v, s_C \rangle),\\
     & \text{ where } s_C = (Sign_C(\langle x, t, v \rangle), Cert_C) \\
  Q_i :& \text{ verify $s_C$ with $C$'s quorum certificates} \\
  Q_i :& \text{ check the TOFU policy} \\
  C \leftarrow Q_i :& \text{ } S_i = \{\langle x, t, v, s_C
  \rangle\}_{Q_i \in Q} \\
  C :& \text{ collect signatures from $|\mathcal{T}|$ members} \\
     & \text{ } S = \{S_i\}_{i \in \mathcal{T}} \\
  C :& \text{ choose a quorum from } Q' = U \setminus QC \\
  C \rightarrow Q' :& \text{ \sf write}(\langle x, t, v, s_C, S \rangle) \\
  Q'_i :& \text{ verify the signature set $S$} \\
  Q'_i :& \text{ do the equivocation check} \\
  Q'_i :& \text{ \sf store}(\langle x, t, v, S_C, S \rangle)
\end{align*}

[ {\sf read} ]
\setcounter{equation}{0}
\begin{align*}
  C :&\; \text{choose a quorum } Q \in U \setminus QC \\
  C \rightarrow Q :&\; \text{\sf read}(x) \\
  C \leftarrow Q_i :&\; M_i = \langle x, t, v, s_C, S \rangle \\
  C :&\; \text{collect } f + 1 \text{ responses} \\
  C :&\; \text{verify the signature set $S$} \\
  C :&\; \text{do the equivocation check} \\
  C :&\; \text{choose the latest timestamp } \\
     &\; t_L = max(M_i.t) \\
  C :&\; Q' = \{Q_i \subset Q | M_i.t < t_L\} \\
  C \rightarrow Q' :&\; \text{\sf write back}(\langle x, t_L, v, s_C, S \rangle)
\end{align*}

\subsection{Join / Leave}
Any node can join / leave anytime by sending its quorum certificate to
nodes it trusts. The node received the request verifies the
certificate and adds it to the local graph which will be returned to
the caller node. To leave the network, a node broadcasts its quorum
certificate to the quorum it belongs to.
The node that has received the graph constructs its own local graph
from the graphs, then sends the join request to nodes that have not
been connected.
See algorithm {\sf Join} \ref{Join}.

\subsection{Register}
\label{register}
Each node generates its own public/private key pair, then sends the
public key part to a quorum to get a quorum certificate. Each quorum
member keeps all certificate issued to clients along with a partial
password secret. If it finds a certificate request that has the same
ID as one of the stored certificates it will sign it only if the
password authentication is done. The client will get a ``proof'' of
the authentication when it is finished.
See algorithm {\sf Register} \ref{Register}

\subsection{Authenticate}
\label{authenticate}
{\sf auth} protocol is done in advance of {\sf read / write /
  register} to get a proof and each subsequence protocol verifies it
before processing the request. The follwing diagram is for a quick
review of $\mathcal{TPA}$ \ref{auth}.

\begin{align*}
  C &: \pi \leftarrow H(pw), \;
      g_{\pi} \leftarrow \pi^2, \;
      a \xleftarrow{\mathcal{R}} \mathbb{Z}_q \\
  C \rightarrow Q &: X := g_{\pi}^a \bmod p \\
  C \leftarrow Q_i &: Y_i := X^{y_i} \bmod p, u_i \\
  C &: G_S \leftarrow \textstyle \prod_{j \in \mathcal{T}}Y_i^{\lambda_j} \bmod p, \\
    & \; s_i \leftarrow H(pw, u_i), \;
      a' \xleftarrow{\mathcal{R}} \mathbb{Z}_q \\
  C \rightarrow Q_i &: X_i := G_S^{s_ia'} \bmod p \\
  Q_i &: K_i \leftarrow X_i^{b_i} \bmod p, \;
        b_i \xleftarrow{\mathcal{R}} \mathbb{Z}_q \\
  C \leftarrow Q_i &: B_i := v_i^{b_i} \bmod p \\
  C &: K_i \leftarrow B_i^{aa'} \bmod p \\
  C \rightarrow Q_i &: N_i := \text{\em MAC}(K_i, X_i || B_i) \\
  C \leftarrow Q_i &: Z_i := E_{K_i}(P_i, N_i) \\
  C &: (P_i, N_i) = D_{K_i}(Z_i)
\end{align*}
At the end of the protocol, $C$ obtains the proof $P = \{P_i\}_{i \in
  \mathcal{T}}$.

The servers keep track of the client ID, the number of attempts and
the time. If the process does not go through next time the first
response from each server will be slowed down to mitigate online
dictionary attacks.


\chapter{DelayBox: Per-Flow Delay and Loss}
\label{chap:delaybox}

DelayBox is an ns node that should be placed in between the source and
destination nodes. With Delaybox, packets from a TCP flow can be
delayed, dropped, and/or forced through a bottleneck link before being
passed on to the next node. A distribution can be used to specify
delay, loss, and/or bottleneck link speed for a source - destination
pair.  Each flow between that source - destination pair draws from the
distribution to determine its characteristics. Delays in DelayBox are
per-flow, rather than per-packet. Since DelayBox distinguishes between
flows, the {\tt fid\_} variable (flow identifier) should be set for
each flow in the simulation.  DelayBox can be used with both Tcp and
FullTcp agents.

\section{Implementation Details}

DelayBox maintains two tables: a rule table and a flow table.  Entries
in the rule table are added by the user in the OTcl simulation script
and give an outline of how flows from a source to a destination should
be treated.  The fields are source, destination, delay Random Variable
(in ms), loss rate Random Variable (in fraction of packets dropped),
and bottleneck link speed Random Variable (in Mbps).  The bottleneck
link speed field is optional.  Entries in the flow table are created
internally and specify exactly how each flow should be handled.  Its
values are obtained by sampling from the distributions given in the
rule table.  The fields are source, destination, flow ID, delay, loss,
and bottleneck link speed (if applicable).  Full-TCP flows are defined
as beginning at the receipt of the first SYN of a new flow ID and
ending after the sending of the first FIN.  Packets after the first
FIN are forwarded immediately (<i>i.e.</i>, they are neither delayed
nor dropped by DelayBox). For TcpAgent, flows are defined as beginning
at the receipt of the first 40 byte packet of a new flow ID.  Since
there are no FIN packets in TcpAgent, TcpAgent flows are never
considered finished nor are they removed from the flow table.

DelayBox also maintains a set of queues to handle delaying packets.
There is one queue per entry in the flow table.  These queues are
implemented as delta queues, in that the time to transfer the packet
is kept only for the head packet.  All other packets are stored with
the difference between the time they should be transferred and the
time the previous packet should be transferred.  The actual time the
previous packet should be transferred is stored in the variable {\tt
  deltasum\_}, named so because it is the sum of all delta values in
the queue (including the head packet's transfer time).  If the
bottleneck link speed has been specified for the flow, a processing
delay is computed for each packet by dividing the size of the packet
by the flow's bottleneck link speed.

When a packet is received, its transfer time (current time + delay) is
calculated.  (This transfer time is the time that the first bit of the
packet will begin transfer.  Packets that wait in the queue behind
this packet must be delayed by the amount of time to transfer all bits
of the packet over the bottleneck link.)  There are two scenarios to
consider in deciding how to set the packet's delta:

\begin{enumerate}
  \item If the packet is due to be transferred before the last bit of
    the last packet in the queue, its delta (the time between transferring
   the previous packet and transferring this packet) is set to the
   previous packet's processing delay.  This packet has to queue
   behind the previous packet, but will be ready to be transmitted as
   soon as the previous packet has completed its transfer.
  \item If the packet is due to be transferred after the last bit of
    the last packet in the queue, its delta is difference between this
   packet's transfer time and the previous packet's transfer time.
\end{enumerate}

If the current packet is the only packet in the queue, DelayBox
schedules a timer for the receipt of the packet.  When this timer
expires, DelayBox will pass the packet on to the standard packet
forwarder for processing.  Once a packet has been passed up,
DelayBox will look for the next packet in the queue to be
processed and schedule a timer for its transfer. All packets, both
data and ACKs, are delayed in this manner.

Packets that should be dropped are neither queued nor passed on.  All
packets in a queue are from the same connection and are delayed
the same amount (except for delays due to packet size) and are
dropped with the same probability.  {\bf Note:} Drops at DelayBox are
not recorded in the trace-queue file.

\section{Example}
More examples are available in the {\tt tcl/ex/delaybox/} directory of the
ns source code.  The validation script {\tt test-suite-delaybox.tcl}
is in {\tt tcl/test/} and can be run with the command {\tt
test-all-delaybox} from that directory.

\begin{verbatim}
# test-delaybox.tcl - NS file transfer with DelayBox

# setup ns
remove-all-packet-headers;            # removes all packet headers
add-packet-header IP TCP;             # adds TCP/IP headers
set ns [new Simulator];               # instantiate the simulator

global defaultRNG
$defaultRNG seed 999

# create nodes
set n_src [$ns node]
set db(0) [$ns DelayBox]
set db(1) [$ns DelayBox]
set n_sink [$ns node]

# setup links
$ns duplex-link $db(0) $db(1) 100Mb 1ms DropTail
$ns duplex-link $n_src $db(0) 100Mb 1ms DropTail
$ns duplex-link $n_sink $db(1) 100Mb 1ms DropTail

set src [new Agent/TCP/FullTcp]
set sink [new Agent/TCP/FullTcp]
$src set fid_ 1
$sink set fid_ 1

# attach agents to nodes
$ns attach-agent $n_src $src
$ns attach-agent $n_sink $sink

# make the connection
$ns connect $src $sink
$sink listen

# create random variables
set recvr_delay [new RandomVariable/Uniform];     # delay 1-20 ms
$recvr_delay set min_ 1
$recvr_delay set max_ 20
set sender_delay [new RandomVariable/Uniform];    # delay 20-100 ms
$sender_delay set min_ 20
$sender_delay set max_ 100
set recvr_bw [new RandomVariable/Constant];       # bw 100 Mbps
$recvr_bw set val_ 100
set sender_bw [new RandomVariable/Uniform];       # bw 1-20 Mbps
$sender_bw set min_ 1
$sender_bw set max_ 20
set loss_rate [new RandomVariable/Uniform];       # loss 0-1% loss
$loss_rate set min_ 0
$loss_rate set max_ 0.01

# setup rules for DelayBoxes
$db(0) add-rule [$n_src id] [$n_sink id] $recvr_delay $loss_rate $recvr_bw
$db(1) add-rule [$n_src id] [$n_sink id] $sender_delay $loss_rate $sender_bw

# output delays to files
$db(0) set-delay-file "db0.out"
$db(1) set-delay-file "db1.out"

# schedule traffic
$ns at 0.5 "$src advance 10000"
$ns at 1000.0 "$db(0) close-delay-file; $db(1) close-delay-file; exit 0"

# start the simulation
$ns run
\end{verbatim}
\section{Commands at a Glance}

The following commands on the DelayBox class can be accessed from OTcl:

{\tt [\$ns DelayBox]}\\
Creates a new DelayBox node.

{\tt \$delaybox add-rule <srcNodeID> <dstNodeID> <delayRV> [<lossRV>] [<linkSpeedRV>]}\\
  Add a rule to the rule table, specifying delay, loss rate, and
  bottleneck link speed RandomVariables for packets flowing from {\tt
  srcNode} to {\tt dstNode}.  Delay is required, but loss rate and
  link speed are optional.

{\tt \$delaybox list-rules}\\
List all rules in the rule table

{\tt \$delaybox list-flows}\\
List all flows in the flow table

{\tt \$delaybox set-asymmetric}\\
Specifies that the delay should be only on the data path rather than
applied to both the data and ACK paths

{\tt \$delaybox set-delay-file <filename>}\\
Output delays for each flow to {\tt filename}.  Format: {\tt srcNode
dstNode fid delay}

{\tt \$delaybox close-delay-file}\\
Closes the file where delays are written

{\tt \$delaybox set-debug <int>}\\
Set the debugging level
\begin{itemize}
\item{1: Output when packets are dropped at DelayBox}
\item{2: Level 1 + \\
Contents of the queue at each queue operation
}
\end{itemize}


\documentclass{article}
\usepackage[margin=2.5cm]{geometry}

\usepackage{kpfonts}
\usepackage{amsmath}
\usepackage{mathtools}
\usepackage{hyperref}
\usepackage{todonotes}
\usepackage{xspace}
\usepackage{listings}

\newcommand{\pOut}{{!}}
\newcommand{\bOut}{{!\!!}}
\newcommand{\pIn}{{?}}
\newcommand{\bIn}{{?\!?}}
\newcommand{\new}[2]{(\nu\!#1) #2}
\newcommand{\freshFor}{\mathrel{\#}}
\newcommand{\rec}{\mathtt{rec}}
\newcommand{\nil}{\mathbf{0}}
\newcommand{\invoke}[1]{\langle #1 \rangle}

\newcommand{\psicalculus}{psi-calculus\xspace}

\newcommand{\refinedBy}{\precsim}

\newtheorem{lemma}{Lemma}
\newtheorem{definition}{Definition}

\lstset{basicstyle=\ttfamily\small}
\lstdefinelanguage{Coq}{
  morekeywords={Require,Import,Open,Scope,Section,Context,Inductive,forall,Fixpoint,match,with,end,End,Arguments,return,Definition,Fact,Qed}
  }

\DeclareMathOperator{\bn}{bn}
\DeclareMathOperator{\n}{n}
\DeclareMathOperator{\len}{len}
\DeclareMathOperator{\chain}{chain}

\begin{document}

\title{Asynchronous Embedded Psi-Calculus}
\author{Edsko de Vries}
\maketitle

\section{Motivation}

The \psicalculus \cite{DBLP:journals/corr/abs-1101-3262} is a parametric process
calculus with support for broadcast communication \cite{Borgström2015} and
equipped with a formally verified metatheory. Its parameterization allows for
modelling of various cryptographic and other primitives, and its definition of
broadcast communication is very general. As such, it is a suitable candidate for
modelling the Proas algorithm and proving some of its properties. Its metatheory
includes a definition of bisimularity, along with a formal proof that
bisimularity is ``sound'', in the sense two bisimilar processes are
interchangeable in any context (sound with respect to a high-level observational
equivalence).

Unfortunately, such soundness comes at a cost. The relation between processes
(bisimilarity) must be detailed and is often complex; the definition of
bisimilarity for the \psicalculus in particular is non-trivial. Consequently,
proving bisimilarity between processes is often difficult and must be supported
by additional formal infrastructure. Although such infrastructure exists for the
\psicalculus in the form of up-to techniques, it currently does not support the
broadcast extension \cite{AmanPohjola:2016:BUT:2854065.2854080}.

Secondly, in order to be able to use \emph{any} kind of sound theory (one that
would allow us to conclude that we can replace a process by another in an
arbitrary context), we would have to fully characterize the behaviour of those
processes. This is a proof obligation which we currently don't have the
resources to take on, and instead we will only give partial specification.

On the positive side giving up on full specifications allows us to be more
flexible in what kind of calculus we use. When we use the \psicalculus directly,
every additional operation (such as encryption) that isn't explicitly supported
in the calculus must be encoded using the \psicalculus parameters. If however we
don't intend to use the existing \psicalculus metatheory, and don't intend to do
any metatheoretical reasoning ourselves (and instead only intend to reason about
concrete processes), we can define a process calculus that reuses infrastructure
from the host language (such as Isabelle) to give us additional power. For
example, in the Verdi project \cite{Wilcox:2015:VFI:2737924.2737958} processes
are simply host-language functions from inputs to outputs.

Embedding host-language functions in a calculus is known as higher order
abstract syntax (HOAS), and is typically associated with three problems in
formal verification. First, for a higher order abstract syntax the use of HOAS
is problematic as it requires a non-positive datatype. Since the psi-calculus is
first order, this is not an issue. Second, HOAS introduces ``exotic'' terms that
extend the power of the calculus; often these terms are undesirable but in our
case this is precisely the reason for introducing HOAS. We do have to be careful
that processes cannot distinguish one ``fresh'' name from another; it suffices
to require that the functions are equivariant. Finally, HOAS makes it difficult
or impossible to do induction over the syntax of the calculus (although there
are workarounds \cite{Röckl2001}). Since we don't intend to do metatheoretical
reasoning, but only plan to reason about concrete processes, I don't think that
this will be an issue.

Having said all that, it \emph{is} useful to stay as close to the \psicalculus
as possible, so that if in the future we do want to take advantage of the
\psicalculus metatheory the transition is not more difficult than it needs to
be. For this reason in this document we introduce an embedded process calculus
(``embedded'' in the sense that it is embedded in a host language with a
function space), which is closely modelled after the \psicalculus as it is
defined in \cite{Borgström2015}. The embedded nature of the calculus however
means that we can simplify the \psicalculus in various ways; this is documented
in detail in Section~\ref{sec:deviations}.

\section{Deviations from the \psicalculus}
\label{sec:deviations}

Since we want to work with a semantics in which we can model network
limitations, we work in an asynchronous process calculus (i.e., the output
process does not have a continuation). In an asynchronous process calculus there
is no guaranteed message delivery and no guaranteed message ordering. It
\emph{does} guarantee that messages don't get duplicated, but this is also
straight-forward to guard against in ``real'' code and moreover likely less
of a problem. The translation from an asynchronous calculus to the corresponding
synchronous calculus is trivial.

The \psicalculus as defined in
\cite{DBLP:journals/corr/abs-1101-3262,Borgström2015} uses the classical
``replication'' operator $!P$, modelling an unbounded number of instances of $P$
in parallel. This operator is convenient for modelling but less convenient for
interpretation. The \psicalculus workbench
\cite{Borgstrom:2015:PWG:2724585.2682570} uses named processes, effectively
introducing general recursion; we do the same. It is important that these named
processes are actually (host language) \emph{functions} from values to
processes, so that we can model things like process state.
Appendix~\ref{app:namedproc} shows one way in which we might model this formally
(the example uses Coq); I experimented also with using PHOAS for this purpose
but it turned out to be non-trivial (\emph{cf}.
\cite{Chlipala:2010:VCI:1706299.1706312}).

The rules for point-to-point communication in the \psicalculus rely on a
name-matching predicate $\xleftrightarrow{.}$; this is used for instance to
express that $\mathtt{fst}(c,d)$ and $c$ denote the same channel. Our use of
HOAS means that $\mathtt{fst}(c,d)$ will simply \emph{evaluate} to $c$ and hence
we don't need the name matching construct. Formally, we instantiate
$\xleftrightarrow{.}$ to be diagonal relation on the set of names (name
equality).

Similarly, the rules for broadcast connectivity use two predicates
$\overset{.}{\prec}$ and $\overset{.}{\succ}$, denoting ``output connectivity''
and ``input connectivity'' respectively. We simplify this to the trivial case:
we only use a single broadcast channel, that all processes can send to and
receive from. Formally, if $b$ is the single broadcast channel, we instantiate
both $\overset{.}{\prec}$ and $\overset{.}{\succ}$ to be trivial diagonal
relation on the set $\{b\}$.

In the \psicalculus the relations $\xleftrightarrow{.}$, $\overset{.}{\prec}$
and $\overset{.}{\succ}$ are all parameterized by the ``frame'' of the process;
a set of formulas that are asserted to be true at any point during the process'
lifecycle. Frames are also used to determine the branch to take in a case
statement. Since our instantiations of $\xleftrightarrow{.}$,
$\overset{.}{\prec}$ and $\overset{.}{\succ}$ are all trivial, and pattern
matching is taken care of by evaluation, we have no use for frames and omit them
from the calculus. Formally, we instantiate $\mathbf{A} = \{\top\}$, containing
only the trivial assertion, let $\mathbf{1} = \top$ and $\top \otimes \top =
\top$.

We follow the presentation of the psi-calculus from \cite{Borgström2015}
closely. In particular, we use nominal logic to deal with name binding
\cite{Pitts2001,DBLP:journals/corr/abs-0809-3960}. As stated, however, we use
HOAS for the input prefix, so that we can take advantage of the expressive power
of the host language to express processes. We do insist that these functions are
equivariant, to ensure that fresh names cannot be distinguished from each other.

The resulting calculus closely follows the \psicalculus, although the
resemblance is somewhat misleading: the introduction of HOAS significantly
extends the expressive power of the calculus. If and when we decide to use the
\psicalculus as stated in the literature, along with its metatheory, we need to
find ways to model all the primitives that we use in our processes.

\section{Formal Definition}

\subsection{Syntax}

\begin{tabular}{llll}
$P, Q$ & $::=$ && Process \\
  && $\nil$               & Nil                \\
  && $c \pOut V$          & Output             \\
  && $c \pIn \mathcal{F}$ & Input              \\
  && $\new{a}{P}$         & Restriction        \\
  && $P \parallel Q$      & Parallel           \\
  && $\bOut V$            & Broadcast output   \\
  && $\bIn \mathcal{F}$   & Broadcast input    \\
  && $\invoke{A} V$       & Process invocation \\
\\
\end{tabular}

We let $a, b, c$ range over channels, $V$ ranges over values, and $\mathcal{F}$
ranges over equivariant functions from values to processes, $\alpha$ over
arbitrary actions, and $A$ over process names. We allow arbitrary values in the
host language.

\subsection{Operational Semantics}

In the semantics below we do not give a rule for process invocation. Ideally,
all rules should be extended with an environment $\Gamma$ and an additional rule
should be added that $\invoke{A}(V)$ can take whatever step that $\Gamma(A)(V)$
can.

\begin{itemize}

\item Point-to-point communication

\begin{equation*}
%
% PIn
%
\frac{
}{
c \pIn \mathcal{F} \xrightarrow{c \pIn V} \mathcal{F}(V)
}
\mathtt{In}
%
\qquad
%
% POut
%
\frac{
}{
c \pOut V \xrightarrow{c \pOut V} \nil
}
\mathtt{Out}
%
\qquad
%
\frac{
P \xrightarrow{\new{\bar{a}}{c \pOut V}} P' \qquad
Q \xrightarrow{c \pIn V} Q' \qquad
\bar{a} \freshFor Q
}{
P \parallel Q \xrightarrow{\tau} \new{\bar{a}}{(P' \parallel Q')}
}
\mathtt{Com}
%
\end{equation*}
%
\begin{equation*}
\frac{
P \xrightarrow{\new{\bar{a}}{c \pOut V}} P' \qquad
b \freshFor \bar{a}, c \qquad
b \in \n(V)
}{
\new{b}{P} \xrightarrow{\new{\bar{a},b}{c \pOut V}} P'
}
\mathtt{Open}
\end{equation*}
%
where
%
\begin{itemize}
\item Symmetric version of $\mathtt{Com}$ elided.
\item Rule $\mathtt{Com}$ doubles as a closing rule.
\end{itemize}

\todo[inline]{The psi calculus paper states some additional assumptions here,
but I \emph{think} they online pertain to frames, which we make no use of. But
we may need an additional freshness requirement somewhere.}

\item Broadcast communication

\begin{equation*}
%
% BOut
%
\frac{
}{
\bOut V \xrightarrow{\bOut V} \nil
}
\mathtt{BrOut}
%
\qquad
%
% BrIn
%
\frac{
}{
\bIn \mathcal{F} \xrightarrow{\bIn V} \mathcal{F}(V)
}
\mathtt{BrIn}
%
\qquad
%
% BCom
%
\frac{
P \xrightarrow{\new{\bar{a}}{\bOut V}} P' \qquad
Q \xrightarrow{\bIn V} Q' \qquad
\bar{a} \freshFor Q
}{
P \parallel Q \xrightarrow{\new{\bar{a}}{\bOut V}} P' \parallel Q'
}
\mathtt{BrCom}
\end{equation*}
%
\begin{equation*}
%
% BrOpen
%
\frac{
P \xrightarrow{\new{\bar{a}}{\bOut V}} P' \qquad
b \freshFor \bar{a} \qquad
b \in \n(V)
}{
\new{b}{P} \xrightarrow{\new{\bar{a},b}{\bOut V}} P'
}
\mathtt{BrOpen}
%
\qquad
%
% Close
%
\frac{
P \xrightarrow{\new{\bar{a}}{\bOut V}} P'
}{
P \xrightarrow{\tau} \new{\bar{a}}{P'}
}
\mathtt{BrClose}
\end{equation*}
%
\begin{equation*}
%
% BrMerge
%
\frac{
P \xrightarrow{\bIn V} P' \qquad
Q \xrightarrow{\bIn V} Q'
}{
P \parallel Q \xrightarrow{\bIn V} P' \parallel Q'
}
\mathtt{BrMerge}
\end{equation*}
%
where
%
\begin{itemize}
\item Symmetric version of rule $\mathtt{BrCom}$ is elided; note that the psi
calculus paper also elides rule $\mathtt{BrOpen}$ (we stated it explicitly).
\item Rule $\mathtt{BrMerge}$ would not be necessary if we had an explicit rule
\begin{math}
\displaystyle
\frac{
P \equiv P' \xrightarrow{\alpha} Q' \equiv Q
}{
P \xrightarrow{\alpha} Q'
}
\end{math}.
If we want such a rule to be \emph{derivable} instead (which makes the semantics
easier to use) rule $\mathtt{BrMerge}$ is needed.
\item Rule $\mathtt{BrClose}$ is slightly more permissive than its equivalent in
the psi calculus presentation, where it only applies at the point where the
channel is bound. I'm not entirely sure why that restriction is in place; it
is unusual (the closing rule for point-to-point communication has no similar
restriction).
\item Since we assume the existance of a single, global, broadcast channel,
restriction does not apply to broadcast channels. However, it \emph{is} possible
to extrude a point-to-point communication channel through a broadcast communication.
\item The rules for broadcast communication together mean that a single
broadcast output can be paired with any number (zero or more) inputs, and once
paired  (i.e., after the action) the output is no longer available. No
assumptions can be made about who will receive the message, and so broadcast
communication is ``unreliable'' in the sense that message may be ``lost''.
Moreover, since broadcast output, like regular output, is asynchronous,
broadcast communication is unordered.
\end{itemize}

\item Congruence rules

\begin{equation*}
%
% Par
%
\frac{
P \xrightarrow{\alpha} P' \qquad
\bn(\alpha) \freshFor Q
}{
P \parallel Q \xrightarrow{\alpha} P' \parallel Q
}
\mathtt{Par}
%
\qquad
%
% Scope
%
\frac{
P \xrightarrow{\alpha} P' \qquad
a \freshFor \alpha
}{
\new{a}{P} \xrightarrow{\alpha} \new{a}{P'}
}
\mathtt{Scope}
%
\qquad
\end{equation*}

Symmetric version of $\mathtt{Par}$ elided.

\end{itemize}

\section{Stating properties}

\todo[inline]{This section serves as a rough sketch only on how we might state
properties.}
\newcommand{\node}{\mathtt{Node}}

One of the main properties we want to state and prove is that a node can always
evolve to a state where its internal chain matches the chain of the environment
(given some compatibility conditions). If $\node$ is the function from a node's
internal state to the corresponding \psicalculus process, for the published
Praos algorithm we can state this simply as:
%
\begin{lemma}[Praos]
In any state $s$ and for any chain $c$ such that $\len(c) > \len(\chain(s))$,
there exists state $s'$ such that
\begin{equation*}
\node_P(s) \xrightarrow{\bIn c} \node_P(s')
\end{equation*}
and $\chain(s') = c$.
\end{lemma}
%
For the ``block Proas'' algorithm, the property is somewhat more complicated
since the node might be missing blocks.
%
\begin{lemma}[Block Praos]
\label{lem:blockpraos}
In any state $s$ and for any block $b$ such that $b$ is a valid successor of
$\chain(s)$ (though perhaps not the \emph{immediate} successor), there exists
$s', s'', \mu^*$ such that
\begin{equation*}
\node_B(s) \xrightarrow{\bIn b} \node(s') \xRightarrow{\mu^*} \node_B(s'')
\end{equation*}
and $b \in \chain(s'')$.
\end{lemma}
%
We can also try to relate the two implementations more directly. For example,
we could state that whenever the Praos node broadcasts a chain, the Block Praos
nodes will broadcast a series of blocks using the following coinductive
definition:
%
\begin{definition}[Simulation]
We say that $\node_B(s_B)$ can simulate $\node_P(s_P)$, written
$\node_P(s_P) \refinedBy \node_B(s_B)$, iff for all $s_P', c$ such that
\begin{equation*}
\node_P(s_P) \xrightarrow{\bOut c} \node_P(s_P')
\end{equation*}
there exists $s_B'$ and blocks $b^*$, a suffix of $c$, such that
\begin{equation*}
\node_B(s_B) \xRightarrow{\bOut b^*} \node_B(s_B')
\end{equation*}
and $\node_P(s_P') \refinedBy \node_B(s_B')$.
\end{definition}
%
We would then prove that
%
\begin{lemma}[Block Praos simulates Praos]
\label{lem:BlockSimPraos}
For all $s_P, s_C$ such that $\chain(s_P) = \chain(s_B)$,
\begin{equation*}
\node_P(s_P) \refinedBy \node_B(s_B)
\end{equation*}
\end{lemma}
%
We may of course also wish to prove something about how the other actions
relate, or prove something in the other direction too (bisimulation rather than
simulation). Note that such a (bi)simulation doesn't necessarily obsolete the
need for additional lemmas such as Lemma~\ref{lem:blockpraos}, since in the
proof of Lemma~\ref{lem:BlockSimPraos} we can pick paths in which no messages
get lost.

\appendix

\section{Appendix: Named Processes}
\label{app:namedproc}

Example Coq development of defining a process calculus with named
process invocation. Relies on some supporting definitions for vectors and
dependent vectors, shown in Appendix~\ref{app:coqaux}.

\begin{lstlisting}[language=Coq]
Section Syntax.

  Context {n   : nat}.
  Context {typ : Vec Set n}.

  Inductive Proc : Type :=
      Done : Proc
    | Out  : nat -> Proc -> Proc
    | Inv  : forall (i : Fin n), nth i typ -> Proc.

  Definition Env := DepVec (fun a => a -> Proc) typ.

End Syntax.

Arguments Proc {n} typ.
Arguments Env  {n} typ.
Arguments Inv  {n} typ.

Section Semantics.

  Context {n   : nat}.
  Context {typ : Vec Set n}.
  Context {env : Env typ}.

  Inductive HasTrace : Proc typ -> list nat -> Prop :=
      TNil  : forall P, HasTrace P nil
    | TOut  : forall n P t, HasTrace P t ->  HasTrace (Out n P) (cons n t)
    | TInv  : forall i x t, HasTrace (dnth i env x) t -> HasTrace (Inv _ i x) t.

End Semantics.

Arguments HasTrace {n} {typ} env.

Section Example.

  Definition typ : Vec Set 2 := (nat, (nat, tt)).

  Definition left  (n : nat) : Proc typ := Out n (Inv typ (FS FZ) (n + 1)).
  Definition right (n : nat) : Proc typ := Out n (Inv typ     FZ  (n + 1)).

  Definition env : Env typ := (left, (right, tt)).

  Fact trace123 : HasTrace env (left 1) (1 :: 2 :: 3 :: nil).
    repeat constructor.
  Qed.

End Example.
\end{lstlisting}

\section{Appendix: Supporting definitions}
\label{app:coqaux}

Some supporting Coq infrastructure for the development in Appendix~\ref{app:namedproc}.

\begin{lstlisting}[language=coq]
Section Vec.

  Context (A : Type).

  Inductive Fin : nat -> Set :=
      FZ : forall {n}, Fin (S n)
    | FS : forall {n}, Fin n -> Fin (S n).

  Fixpoint Vec (n : nat) : Type :=
    match n with
      O    => unit
    | S n' => A * Vec n'
    end.

  Fixpoint nth {n : nat} (i : Fin n) : Vec n -> A :=
    match i with
      FZ    => fun xs => match xs with (x, xs') => x          end
    | FS i' => fun xs => match xs with (x, xs') => nth i' xs' end
    end.

End Vec.
Arguments nth {A} {n} i.

Section DepVec.

  Fixpoint DepVec (f : Set -> Set) {n : nat} : Vec Set n -> Set :=
    match n return Vec Set n -> Set with
      0    => fun _  => unit
    | S n' => fun As => match As with (A, As') => (f A * DepVec f As')%type end
    end.

  Fixpoint dnth {n : nat} {f : Set -> Set} (i : Fin n) :
     forall {xs : Vec Set n}, DepVec f xs -> f (nth i xs) :=
    match i in Fin n return forall (xs : Vec Set n), DepVec f xs -> f (nth i xs) with
      FZ    => fun As =>
                 match As with (A, As') => fun xs =>
                   match xs with (x, xs') => x end
                 end
    | FS i' => fun As =>
                 match As with (A, As') => fun xs =>
                   match xs with (x, xs') => dnth i' xs' end
                 end
    end.

End DepVec.
\end{lstlisting}

\bibliographystyle{acm}
\bibliography{references}

\end{document}


In this section, we assess our framework for characterizing process variation
presented in \sref{bayes-solution}. All the experiments are conducted on a
\up{GNU}/Linux machine equipped with an Intel Core i7 2.66~\up{GH}z and
8~\up{GB} of \up{RAM}. All the configuration files used in the experiments are
available online at \cite{eslab2014a}.

Our goal is to infer the effective channel length \g from temperature \h. Such a
high-level parameter as temperature constitutes a challenging task for the
inference of such a low-level parameter as the effective channel length, which
implies a rigorous assessment of the proposed technique. The performance of our
approach is expected only to increase when the auxiliary parameter \h is closer
to the target parameter \g with respect to the data model $\h = \f(\g)$
described in \sref{bayes-data-model}. For instance, such a closer quantity \h
could be the leakage current, but this might not always be the most preferable
parameter to measure. Lastly, let us note that the chosen effective channel
length is an important target, as it is strongly affected by process variation
and considerably impacts power consumption and heat dissipation
\cite{chandrakasan2000, srivastava2010, juan2011, juan2012}. It also affects
other process-related parameters, such as the threshold voltage.

We first describe the default configuration, which will be adjusted later on
according to the purpose of each particular experiment. We consider a 45-nm
technological process. The diameter of the wafer is 20 dies, and the total
number of dies \nd is 316. The number of measured dies \hnd is 20, and these
dies are chosen by an algorithm that strives for even coverage of the wafer. The
fabricated platform has four processing elements, and they are the points at
which measurements are taken; that is, $\np = 4$. The floorplan of the platform
is constructed in such a way that the processing elements form a regular grid.
The dynamic power profiles involved in the experiments are based on simulations
of applications randomly generated by \up{TGFF} \cite{dick1998}. The model of
static power parameterized by temperature and the effective channel length is
constructed by fitting to \up{SPICE} simulations of reference electrical
circuits that are composed of \up{BSIM4} devices \cite{bsim} configured
according to the 45-nm \up{PTM} \up{HP} model \cite{ptm}. The construction of
thermal \up{RC} circuits is delegated to HotSpot \cite{skadron2003}, and
temperature analysis is performed as described in \sref{transient-solution}. The
sampling interval of power and temperature profiles is 1~ms.

The input data set $H$ is obtained as follows: \one~draw a sample of \g from a
Gaussian distribution with a mean of 17.5~nm (in accordance with the
technological process under consideration \cite{ptm}) and a covariance function
equal to \eref{bayes-covariance} with a standard deviation of 2.25~nm;
\two~perform one fine-grained temperature simulation for each of the \hnd dies
selected for measurement; \three~thin the obtained temperature profiles so that
each has only \ns, which is 20 by default, evenly spaced moments in time; and
\four~perturb the resulting data using white Gaussian noise with a standard
deviation of \celsius{1}.

Let us turn to the statistical model in \sref{bayes-statistical-model} and
summarize the intuition behind the model's parameters and the process by which
they are assigned. In the correlation function given in
\eref{bayes-correlation}, the weight parameter $w$ and the two length-scale
parameters $\ell_\SE$ and $\ell_\OU$ should be set according to the variation
patterns that are typical for the fabrication process at hand
\cite{chandrakasan2000, cheng2011}; we set $w$ to 0.7 and $\ell_\SE$ and
$\ell_\OU$ to half the radius of the wafer. The threshold parameter $\eta$ of
the model-order-reduction procedure shown in \eref{karhunen-loeve} and utilized
in \eref{bayes-reduction} should be set high enough in order to preserve a
sufficiently large portion of the variance of the data, thereby keeping the
model sufficiently accurate; we set it to 0.99. The resulting dimensionality \nz
of \vz in \eref{bayes-reduction} is found to be 27 or 28. The parameters $\mu_0$
and $\tau_\g$ of the prior given in \eref{bayes-prior} are specific to the
technological process under consideration; we set $\mu_0$ to 17.5~nm and
$\tau_\g$ to 2.25~nm. The parameters $\sigma_0$ and $\nu_\g$ used in
\eref{bayes-prior} determine the precision of the information about $\mu_0$ and
$\tau_\g$ and are set according to the beliefs of the designer; we set
$\sigma_0$ to 0.45~nm and $\nu_\g$ to 10. The latter can be thought of as the
number of imaginary observations that the choice of $\tau_\g$ is based on. The
parameter $\tau_\epsilon$ in \eref{bayes-prior} represents the precision of the
equipment utilized for collecting $H$ and can be found in the technical
specification of that equipment; we set $\tau_\epsilon$ to \celsius{1}. The
parameter $\nu_\epsilon$ in \eref{bayes-prior} has the same interpretation as
$\nu_\g$; we set it to 10 as well. In \eref{bayes-proposal}, $\nu$ and $\alpha$
are tuning parameters, which are configured based on experiments; we set $\nu$
to 8 and $\alpha$ to 0.5. The number of sample draws is another tuning
parameter, which we set to \power{10}{4}. The first half of these samples is
ascribed to the burn-in period mentioned in \xref{bayesian-statistics}, and the
second one constitutes $G$; in this case, $\no = 5 \times 10^3$. In the
optimization described in \sref{bayes-optimization}, we use the quasi-Newton
algorithm \cite{press2007}. For parallel computations, we utilize four
computational cores.

In order to ensure that the experimental setup is adequate, we first perform a
detailed inspection of the results obtained for one particular example with the
default configuration. The true and inferred distributions of the quantity of
interest are shown in \fref{bayes-motivation-distribution} where the \ac{NRMSE}
is below 2.8\%, and the absolute error is bounded by 1.4~nm, which suggests that
our framework produces a close match to the true value of the quantity. We also
investigate the behavior of the constructed Markov chains and the quality of the
proposal distribution. All the observations indicate that the optimization and
sampling procedures are properly configured.

In the following subsections, we consider the experimental setup described above
and alter a single parameter at a time in order to investigate its impact.
Specifically, we change \one~the number of measurement sites \hnd, which is 20
by default; \two~the number of measurement points per site \np, which is 4 by
default; \three~the number of data instances per point \ns, which is 20 by
default; and \four~the standard deviation of measurement noise
$\sigma_\epsilon$, which is \celsius{1} by default.

\subsection{Number of Measurement Sites}

\inputtable{bayes-sites}
Let us vary the number of measured sites or dies \hnd. The scenarios being
considered are 1, 10, 20, 40, 80, and 160 dies. The obtained results are shown
in \tref{bayes-sites}. In this and the following tables, we report the
optimization time and sampling time separately, which correspond to Stage~2 and
Stage~3 in \fref{bayes-overview}, respectively. In addition, the sampling time
is given for two cases: sequential and parallel computing, which is followed by
the total time and resulting error. The computation time of the post-processing
stage, Stage~4, is not given, as it is negligibly small. The sequential sampling
time is the most representative indicator of the computational complexity of the
proposed framework, since the number of samples is always fixed, and there is no
parallelization. Therefore, we refer to this value in most of the discussions
given below.

It can be seen in \tref{bayes-sites} that the more data the proposed framework
needs to process, the longer the execution time becomes, which is reasonable.
The trend, however, is modest: when \hnd is doubled, the computation time
increases by less than a factor of two. Regarding accuracy, the error decreases
definitively and drops below 4\% when around 20 sites are measured, which is
only 6\%--7\% of the total number of dies on the wafer under consideration.

\subsection{Number of Measurement Points}

\inputtable{bayes-points}
In this subsection, we consider five platforms with different numbers of
processing elements or, equivalently, measurement points \np. The scenarios
being considered are 2, 4, 8, 16, and 32 processing elements. The results are
summarized in \tref{bayes-points}. The computation time grows along with \np.
This is expected, since the granularity of the temperature model is bound to the
number of processing elements: each processing element contributes four thermal
nodes to the thermal \up{RC} circuit that temperature analysis is based on;
recall \sref{temperature-model}. Hence, temperature analysis becomes more
expensive. Nevertheless, even for large examples, taking into account the
complexity of the inference procedure and the yielded accuracy, the time
requirement is readily acceptable. An interesting observation can be made with
respect to the \ac{NRMSE}: the error tends to decrease as \np grows. The reason
is that, with each measurement point, $H$ delivers more information for the
inference to work with.

\subsection{Number of Data Instances}

\inputtable{bayes-instances}
Now we change the number of data instances \ns, which, in this case, is the
number of moments in time captured by temperature profiles. The scenarios being
considered are 1, 10, 20, 40, 80, and 160 moments. The results are aggregated in
\tref{bayes-instances}. It can be seen that the growth in computation time is
relatively small. One might expect this growth due to \ns to be the same as the
one due to \np, since, technically, the influence of \np and \ns on the
dimensionality of $H$ is identical; recall that $\hvh \in \real^{\hnd \np \ns}$.
However, the meanings of \np and \ns are completely different, and hence the
ways they manifest themselves in the inference algorithm are also different,
which explains the discordant figures shown in \tref{bayes-points} and
\tref{bayes-instances}. The \ac{NRMSE} in \tref{bayes-instances} has a
decreasing trend; however, this trend is less steady than the ones noted before.
The finding can be explained as follows. The temporal distribution of the
moments in time that are present in $H$ changes, since these moments are kept
evenly spaced across the time spans of the corresponding applications. Some
moments can be more informative than others. Consequently, more or less
representative samples can be accumulated in $H$, helping or misleading the
inference. Additionally, we can conclude that a larger number of spatial
measurements is more advantageous than a larger number of temporal measurements.

\subsection{Deviation of Measurement Noise}

\inputtable{bayes-noise}
In this subsection, we vary the standard deviation of measurement noise, which
corrupts $H$. The cases being considered are \celsius{0}, \celsius{0.5},
\celsius{1}, and \celsius{2} \cite{mesa-martinez2007}. Note that the
corresponding prior in \eref{bayes-prior} is kept unchanged. The results are
given in \tref{bayes-noise}. It can be seen that the sampling time is
approximately constant. However, we observe an increase in the optimization time
when the level of noise decreases, which can be ascribed to greater
opportunities for perfection for the optimization procedure. Another observation
revealed by this experiment is that, in spite of the fact that the inference
operates on indirect and incomplete data, a thoroughly calibrated piece of
equipment can considerably improve the quality of prediction. However, even with
a noise of \celsius{2}---meaning that measurements are dispersed over a wide
band of \celsius{8} with a probability of more than 0.95---the \ac{NRMSE} is
still only 4\%.

\subsection{Sequential and Parallel Sampling}

Lastly, we elaborate on the sequential and parallel sampling strategies. In the
sequential Metropolis--Hastings algorithm, the optimization time is typically
smaller than the time needed for drawing posterior samples. The situation
changes when parallel computing is utilized. When four cores are working in
parallel, the sampling time decreases by a factor of 3.81 on average, which
indicates good parallelization properties of the chosen sampling strategy. The
overall speedup ranges from 1.49 to 2.75 with an average value of 1.77, which
can be pushed even further by employing more computational cores.


\section{Language Versions and Cost Models}
\label{sec:protocol-parameters}

We require the following types (see Figure~\ref{fig:defs:protocol-parameters})
in addition to those that are already defined in the Shelley specification~\cite{XX}. \TODO{Add the citation}

\vspace{12pt}
\begin{tabular}{lp{5in}}
  $\Language$ &
  This represents the language name/tag (including the
  version number).
  \\
  $\ExUnits$ &
  A term of this type contains two integer values,
  $(mem, steps)$.
  These represent abstract notions of the relative memory usage and script execution steps,
  respectively.
  \\
  $\CostMod$ &
  A term of this type represents the vector of coefficients that are used to generate
  a term of type $\ExUnits$ given a vector of some resource primitives. The mapping is defined
  concretely by the specific version of the Plutus interpreter that is associated with $\Language$.
  We keep this type as abstract in the specification.
  \\
  $\Prices$ &
  A term of this type comprises two integer values that correspond to the components of $\ExUnits$,
  $\var{pr_{mem}, pr_{steps})}$:
  $pr_{mem}$ is the price (in Ada) per unit of memory, and $pr_{steps}$ is the price (in Ada) per
  reduction step. This is used to calculate the Ada cost for a specific script execution.
\end{tabular}
\vspace{12pt}

We also need a number of additional protocol parameters and accessor functions: ...\todo{List these.}

\begin{tabular}{||l|l||}
  \textbf{Item} & \textbf{Use} \\
  \
  \end{tabular}

\subsection{Language Versions and Backwards Compatibility Requirements}
\label{sec:versions}

In the $\Language$ type, each \emph{version} of a language is considered to be a different language (so there might be several versions of the Plutus language, each of which would be considered to
be different).
Each such language needs to be interpreted by a language-specific interpreter that is called from the ledger implementation.
The interpreter is provided with the (language- and version-specific) arguments that it requires.
It is necessary for the ledger to be capable of executing scripts in languages it ever supported.
This implies that it is necessary to maintain all forms of ledger
data that is needed by any past or current language, which constrains future ledger designs.
Introducing a new language will require a major protocol version update, since the datatypes need to support the new language and the ledger rules must be updated to use the new interpreter.

\subsection{Determinism of Script Evaluation}
\label{sec:determinism}

The data that is passed to the interpreter
includes the validator script, the redeemer, possibly a datum from the UTxO, information about the transaction that
embeds the script, any relevant ledger data, and any relevant protocol parameters.
It is necessary for the validation outcome of any scripts to remain the same during the entire
period between transaction
submission and completion of the script processing.
%
In order to achieve this,
any data that is passed to the interpreter must be determined by the transaction itself.
The transaction therefore includes a hash of any data that is not determined by the transaction or the UTXO.
When the transaction is processed, as part of the UTXOW rule, this hash is compared with a hash of the data that is passed to the interpreter. This
ensures that scripts are only executed if they have been provided with the intended data.

The $\fun{getLanguageView}$ function (Figure~\ref{fig:defs:protocol-parameters}) selects the protocol parameters that are relevant to
a given set of languages.
%
At the time of writing, the only parameter that needs to be passed to the interpreter is the cost model.

\subsection{Script Evaluation Cost Model and Prices}
\label{sec:cost-mod}

To convert resource primitives into the
more abstract $\ExUnits$ during script execution a cost model needs to be supplied to the interpreter.
The cost models required for this purpose are recorded in the $\var{costmdls}$ protocol parameter.
%
The calculation of the actual cost, in Ada, of running
a script that takes $\var{exunits} \in \ExUnits$ resources to run,
is done by a formula in the ledger rules, which uses the
$\var{prices}$ parameter. This is a parameter that applies to all
scripts and that cannot be varied for individual languages. This parameter
reflects the real-world costs in terms of energy usage, hardware resources etc.

\textbf{Limiting Script Execution Costs.}
The $\var{maxTxExUnits}$ and $\var{maxBlockExUnits}$ protocol parameters are
used to limit the total per-transaction and per-block resource use. These only apply to non-native scripts.
The parameters are used to ensure that the time and memory that are required to verify a block are bounded.

\begin{figure*}[htb]
  \emph{Abstract types}
  %
  \begin{equation*}
    \begin{array}{r@{~\in~}l@{\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad}r}
      \var{cm} & \CostMod & \text{Coefficients for the cost model} \\
      \var{ldv} & \LangDepView & \text{Language-dependent view of the protocol parameters}
    \end{array}
  \end{equation*}
  %
  \emph{Derived types}
  \begin{equation*}
    \begin{array}{r@{~\in~}l@{\quad=\quad}l@{\qquad}r}
      \var{lg}
      & \Language
      & \{\Plutus, \dotsb\}
      & \text{Script Language}
      \\
      \var{pr_{mem}, pr_{steps})}
      & \Prices
      & \Coin \times \Coin
      & \text {Coefficients for $\ExUnits$ prices}
      \\
      \var{(mem, steps)}
      & \ExUnits
      & \N \times \N
      & \text{Abstract execution units} \\
    \end{array}
  \end{equation*}
  %
  \emph{Protocol Parameters}
  %
  \begin{equation*}
      \begin{array}{r@{~\in~}l@{\qquad}r}
        \var{costmdls} \mapsto (\Language \mapsto \CostMod) & \PParams & \text{Script exec. cost model}\\
        \var{prices} \mapsto \Prices & \PParams & \text{Coefficients for $\ExUnits$ prices} \\
        \var{maxTxExUnits} \mapsto \ExUnits & \PParams & \text{Max. total tx script exec. resources}\\
        \var{maxBlockExUnits} \mapsto \ExUnits & \PParams & \text{Max. total block script exec. resources}\\
      \end{array}
  \end{equation*}
  %
  \emph{Accessor Functions}
  %
  \begin{center}
  \fun{costmdls},~\fun{maxTxExUnits},~\fun{maxBlockExUnits},~\fun{prices}
  \end{center}
  %
  \emph{Helper Functions}
  %
  \begin{align*}
    & \fun{getLanguageView} \in \PParams \to \Language \to \LangDepView \\
    & \fun{getLanguageView}~\var{pp}~\Plutus = \{\Plutus\} \restrictdom \fun{costmdls}~{pp}
  \end{align*}
  %
  \caption{Definitions Used in Protocol Parameters}
  \label{fig:defs:protocol-parameters}
\end{figure*}


% Abstract

% We show however, that if mass-dependent heating is responsible, the
% differential heating rate is not constant over logarithmic time intervals
% which implies that different heating processes must be acting before and after
% ages of around 1 Gyr.
% Perhaps a more likely scenario is that the relation between rotation period
% and color changes over time, undergoing a particularly sharp transition at
% around 1 Gyr.
% If we assume that mass-dependent heating does not affect the data,

% (similar to the age of the rotation gap and the 1.1 Gyr NGC 6811
% cluster, shown to have a different period-color relation to Praesepe).
% We find that the ages of field stars with measured rotation periods do not
% exceed 4-6 Gyrs, resolving a long-standing degeneracy between age and magnetic
% braking efficiency.
% We also show that stars rotating just below the rotation period gap are
% dynamically young, ruling out the possibility that the rotation period gap is
% caused by incorrect period measurements or binary companions.

% INTRO

% This relation was calibrated by fitting a 5th-order polynomial to the relation
% between (log) rotation period and (log) \gaia\ \gcolor\ color for around 800
% members of the Praesepe cluster, and a straight line in (log) age to Praesepe
% and the Sun.

% In this paper, we shed light on the rotational evolution of old K dwarfs using
% population-based dynamical ages.
% Unfortunately, open clusters with rotation period measurements are mostly
% young -- currently the oldest is 2.5 Gyr (NGC 6819).
% Without rotation periods for precisely dated old stars, it is extremely
% difficult to calibrate the relationship between rotation period and color at
% old ages.
% For this reason, we used a population-based stellar age indicator, velocity
% dispersion, to investigate the period-color relations at old ages in the
% field.

% Stellar velocities have a history of being used as an age proxy, with several
% notable examples within stellar astronomy \citep[\eg][]{faherty2009,
% west2011}.

% Vertical {\it actions} are better age indicators than velocities, because
% actions are calculated by integrating angular momentum over the Milky Way's
% potential, and are therefore position invariant -- \eg\ a star will have the
% same action at periapsis and apoapsis.
% In contrast, orbital velocities are different at periapsis and apoapsis -- so
% in this sense, {\it actions} are the natural quantities to use as age proxies.

% \subsection{The degeneracy between gyrochronology and mass-dependent heating}

% Although only calibrated using Praesepe ($\sim$ 650 Myr) and the Sun (4.56
% Gyr), the \citet{angus2019} gyrochronology relation predicts accurate ages for
% members of NGC 6819, a 2.5 Gyr open cluster.
% However there are no rotation periods for K or M dwarfs in this cluster -- its
% coolest members with rotation periods are G dwarfs.
% The period-color relation of Praesepe is nearly identical to the period-color
% relation of the Hyades, a cluster of around the same age: $\sim$ 650 years
% \citep{douglas2016, douglas2017, rebull2017}.
% However, Praesepe and the Hyades do {\it not} have the same period-color
% relation as NGC 6811, a 1.1 Gyr cluster \citep{curtis2019}.
% The G dwarfs in NGC 6811 rotate at the same rate as the K dwarfs and it
% appears as though the K stars have `stalled' -- their spin-down has been
% halted.

% The \citet{angus2019} gyrochronology relation assumes that the rotation
% period-color relation of Praesepe is applicable to stars of all ages: the same
% polynomial relation fit to Praesepe is used to describe the period-color
% relation for all stars.
% However, the NGC 6811 cluster suggests that this assumption does not hold for
% K dwarfs past around 1 Gyr.
% If the period-color relation of the \citet{angus2019} gyrochronology model
% {\it were} a perfect model for the rotational evolution of stars, then groups
% of stars selected to be similar ages using this relation should fall on an
% isochrone on a CMD.
% % and have the same velocity dispersion across all colors.
% Unfortunately, uncertainties on \gaia\ photometry and parallaxes, plus
% variations in metallicity and extinction, blur out the main sequence enough
% that differences between stars in different age and rotation bins are not
% easily discernable on the CMD, although there is still a general age and
% rotation period gradient on the CMD, as seen in figures \ref{fig:CMD_cuts} and
% \ref{fig:age_gradient}.
% For this reason, we chose to use {\it kinematic} `isochrones', instead of
% magnitude and color-based isochrones: although kinematics as an age indicator
% is not necessarily as well calibrated to an absolute age scale as CMD
% position, it can be very sensitive to {\it differences} in the ages of stellar
% populations.

% Isochrones and stellar evolution tracks are highly dependent on choices made
% about input physics and assumptions.
% % and have often been calibrated using
% % different types of stars.
% As a result, different sets of models can have very different shapes on the
% CMD, particularly at low masses.
% In fact, only empirical models, not physical ones, are currently able to
% reproduce the CMD positions of M dwarfs.
% Instead of relying on CMD position to age-date groups of stars, we opted to
% explore age trends via kinematics.
% Kinematic age-dating has the advantage of being relatively model independent,
% or at least, having a very simple model: that velocity dispersion increases
% over time.
% This means that it is relatively easy to rank groups of stars by age: older
% groups have a larger velocity dispersion.

% METHOD

% \begin{figure}
%   \caption{
% A \gaia\ color magnitude diagram showing the \citet{mcquillan2014} sample with
%     extinction-corrected magnitudes, colored by rotation period.
% We excluded photometric binaries and subgiants from our analysis by removing
% stars above the two dashed lines.
% % The rotation periods of binaries and subgiants do not follow a Skumanich-like
% % braking law.
% % The rotation period gradient across the main sequence is visible by eye in
% %     this figure: young, rapidly rotating stars are located below the old,
% %     slowly rotating stars.
% % since we rely on a simple scaling
% % between rotation period and age to make the argument that the rotation period
% % is not caused by incorrect period measurements.
% }
%   \centering
%     \includegraphics[width=1\textwidth]{CMD_cuts}
% \label{fig:CMD_cuts}
% \end{figure}
% To explore the age of this stellar population from a rotation standpoint, it
% was first necessary to remove visual binaries and subgiants from the sample.
% The rotational evolution of these two types of stars is generally different to
% that of single stars which more usually follow a Skumanich-like spin-down law.
% Tidal and magnetic interactions between the two components of a binary system
% can influence the rotation periods of both stars, and the expanding envelopes
% of subgiants drive rapid spin-down through conservation of angular momentum.

% \begin{figure}
%   \caption{
% the rotation periods of stars in the \citet{mcquillan2014} sample vs.
% effective temperature.
% black points are dwarf stars identified as non-photometric binaries, hotter
% than 4800 k.
% blue circle points are non-photometric binary dwarfs, cooler than 4800 k, with
% a rotation period and \gaia\ color indicating they are older than 1.1 gyr.
% orange squares are stars that with rotation periods that fall just below the
% gap: they have rotation-ages between 0.5 and 1.1 gyrs.
% green triangles are stars with rotation periods faster than the main envelop
% of stars.
% these are probably binaries whose rotation periods are synchronized to their
% orbits and have been spun-up via tidal interactions.
% }
%   \centering
%     \includegraphics[width=1\textwidth]{period_teff}
% \label{fig:period_teff}
% \end{figure}

% This allowed us to remove the degeneracy between mass and age that would
% confound evidence for mass-dependent heating among more massive stars.
% In a sample of massive stars with short MS lifetimes, lower-mass stars
% typically have greater velocity dispersion, but this could be either because
% dynamical heating is more efficient in lower mass stars, or because lower mass
% stars tend to be older because they live longer.
% In a sample of late K and M dwarfs, whose MS lifetime is longer than the age
% of the Universe, we can assume that none have evolved into giants and any
% additional heating seen in the lower-mass stars must be caused by
% mass-dependent heating.

% \begin{figure}
%   \caption{
% A \gaia\ color-magnitude diagram, showing all \kepler\ targets.
% We selected K and M dwarfs by applying color and magnitude cuts at \gcolor\ =
%     1.2 (\teff\ $\sim$ 4800 K) and $G$ = 4.
% We eliminated visual binaries by fitting a 6th order polynomial to the MS and
%     removing stars above it.
% Selected K and M dwarfs are shown as darker points.
% }
%   \centering
%     \includegraphics[width=1\textwidth]{mdwarf_CMD}
% \label{fig:mdwarf_CMD}
% \end{figure}

% A slight excess of non-Gaussian outliers at lower temperatures leads to a
% marginal increase in velocity dispersion at low temperatures when sigma
% clipping is not performed.
% Figure \ref{fig:vb_vs_color} shows velocity and velocity dispersion as a
% function of \gaia\ \gcolor\ color.
% There is no clear trend between velocity dispersion and color.

% \begin{figure}
%   \caption{
%       Top: Stellar velocity (\vb) as a function of \gaia\ \gcolor\ color for
%       \kepler\ K and M dwarfs.
% Vertical lines indicate different color-groupings used to calculate velocity
%     dispersion.
% Pink stars were not included in velocity dispersion calculations as they were
%     removed as outliers during a sigma clipping process.
% Bottom: velocity dispersion as a function of color.
% There is no obvious trend between velocity dispersion and stellar color
%     indicating that mass-dependent heating does not significantly effect
%     low-mass stars in the \kepler\ field.
% }
%   \centering
%     \includegraphics[width=1\textwidth]{vb_vs_color}
% \label{fig:vb_vs_color}
% \end{figure}

% RESULTS

% The shape of the upper envelope of rotation periods in the top panels of
% figures \ref{fig:age_cut} and \ref{fig:dispersion_period_teff} also hints at
% this.

% If we assume that the gap is located at a single (gyrochronal) age, its age is
% remarkably similar to the NGC 6811 cluster (measured from MS turn-off) of 1.1
% Gyr \citep{meibom2011}.

% DISCUSSION

% The \vb\ AVR is not directly comparable to the \vz\ AVR, so, to draw a
% comparison with results from the literature, we calculated a \vz\ AVR for
% the subset of 290 cool stars in the \mct\ sample with \gaia\ RVs.
% We measured an AVR exponent of 0.47 $\pm$ 0.1, which falls within the range of
% values (0.45-0.53) reported from measurements of F and G stars in the Solar
% neighborhood \citep{holmberg2009, aumer2009, aumer2016}.
% It is a little lower than the values of 0.56 $\pm$ 0.14 (for low-z) and 0.51
% $\pm$ 0.15 (for high-z stars), calculated using \LAMOST\ \racomment{(LAMOST
% citation)} K giants \citep{yu2018}.
% K giants are more massive than K dwarfs \racomment{(how much more massive?)},
% so this slightly higher value contradicts the mass-dependent heating
% hypothesis.
% \racomment{Add some words about selection functions...}

% To investigate further, we calculated the exponent of the (\vb) AVR for each
% temperature bin in figure \ref{fig:age_cut}.
% \begin{figure}
%   \caption{
%       The exponent of the (\vb) AVR as a function of effective temperature.
% }
%   \centering
%     \includegraphics[width=1\textwidth]{AVR_exponent}
% \label{fig:AVR_exponent}
% \end{figure}
% Figure \ref{fig:AVR_exponent} shows the significant rise the in AVR exponent
% as a function of effective temperature.
% The hottest stars in our sample (\teff\ = 4833-5000 K) have a (\vb) AVR
% exponent of 0.39 $\pm$ 0.02 and the coolest (\teff\ = 3500-3667 K) have an
% exponent of 0.74 $\pm$ 0.02.
% The masses of stars in our sample differ by less than a factor of two,
% so mass-dependent heating cannot be entirely responsible for this large spread
% in heating rates.
% \racomment{Need to look into this further.}

% If mass-dependent heating is strongly affecting our data, the exponent of the
% AVR should increase with decreasing effective temperature, \ie\ the heating
% rate should be greater for lower-mass stars.
% Figure \ref{fig:AVR_exponent} shows the AVR exponent does indeed increase with
% decreasing effective temperature, however, the AVR exponent calculated using
% more massive stars from the Geneva Copenhagen Survey (GCS)
% \citep{holmberg2009} is also shown on this plot as a dashed horizontal line.
% Most GCS stars are F and G type: 1-3 times more massive than the K dwarfs used
% in our study.
% If mass-dependent orbital heating is the main cause the rise in velocity
% dispersion with decreasing \teff\ seen in figure \ref{fig:age_cut}, then the
% AVR exponent of the more massive GCS stars should fall {\it below} the AVR
% exponent for the most massive stars in our sample.
% In other words, the dynamical heating rate should be lowest for the highest
% mass stars and highest for the lowest mass stars.
% % nordstrom2004, jorgensen2005,
% These AVR exponents were calculated with different populations of stars,
% subject to different selection effects, so directly comparing them comes with
% some risk.
% The most important difference is that the GCS AVR is calculated using \vz,
% however our AVRs are calculated using \vb\ since most stars in our sample do
% not have radial velocities.
% The median galactic latitude of these \kepler\ stars is 12.3\degrees, with
% latitudes ranging from 5.5\degrees\ to 21.4\degrees, so \vb\ is a relatively
% close approximation to \vz.
% Only 290 out of the 6820 stars in our sample, plotted in color in figure
% \ref{fig:age_cut}, have \gaia\ radial velocities, however we used the ones
% that do to compare the \vz\ AVR to the \vb\ AVR, across all temperatures
% between 3500 and 5000 K.
% For stars with gyrochronal ages between 0.5 and 4.5 Gyr, we measured a \vz\
% AVR exponent of 0.519 $\pm$ ... and a \vb\ AVR exponent of 0.514 $\pm$... .
% The similarity of these two AVR exponents suggests that directly comparing
% these two quantities {\it may} be a reasonable approach.
% For now, given the large difference between the (\vz) AVR exponent of the GCS
% sample and the (\vb) AVR exponent of the hottest stars in our sample, we
% assume that the increased velocity dispersion at cooler temperatures is mostly
% caused by incorrect age-grouping due to an incorrect period-color relation at
% old ages, and that any mass-dependent heating, while it may contribute at a
% low level to this result, is not the dominant driver.
% However, differentiating the effects of mass-dependent heating and the shape
% of the gyrochronology relations is certainly warranted in a follow-up study.
% }

% Figure \ref{fig:age_comparison} shows the ages of star groups, predicted with
% the \citet{angus2019} gyrochronology relation, compared with the ages of star
% groups, predicted with the \citet{holmberg2009} AVR.
% \citet{holmberg2009} only provide an exponent (0.53), not an intercept, for the
% relation between logarithmic age (in Gyr) and logarithmic, \vz\ velocity
% dispersion (in \kms), so we fit the intercept to the mean \vb\ velocity
% dispersion across all temperatures, of our sample.
% \begin{figure}
%   \caption{
%       Ages predicted by the \citet{holmberg2009} \vz\ AVR, against ages
%     predicted by the \citet{angus2019} gyrochronology relation, for stars in
%     different temperature ranges.
% Points are colored by the effective temperature in the center of the \teff\
% bin.
% The dashed line shows the y=x relation.
% Predicted kinematic ages fan out over gyrochronal time, either because the AVR
%     is temperature-dependent or because the gyrochronology relations have an
%     age-dependent period-color relation.
% }
%   \centering
%     \includegraphics[width=1\textwidth]{age_comparison}
% \label{fig:age_comparison}
% \end{figure}
% Figure \ref{fig:age_comparison} shows a comparison between ages predicted by
% the \citet{holmberg2009} \vz\ AVR (using \vb\ as a proxy for \vz) and ages
% predicted by the \citet{angus2019} gyrochronology relation, for stars in
% different temperature ranges.
% The predicted kinematic ages fan out over gyrochronal time, either because the
% AVR is temperature-dependent or because the gyrochronology relations have an
% age-dependent period-color relation.
% Figure \ref{fig:age_comparion} also suggests that dynamical heating does not
% begin until after around ... Gyr:

% Alternatively, the ages of these young stars could be under-predicted by
% gyrochronology.
% These young stars have similar rotation periods to the Praesepe cluster, which
% was used to calibrate the gyrochronology relation used in this analysis.
% The ages of these young stars should, therefore, be the most accurate of the
% entire sample.
% However, they are tied to the age of the Praesepe cluster, whose age is not
% accurately known.
% \citet{angus2019} adopted an age for Praesepe of 650 Myrs, however the
% kinematic age-prediction for these stars is around 400 Myrs.
% Other studies have assigned a much older age of 800 Myrs to Praesepe
% \citep{brandt2015}.
% If the age assumed for Praesepe in the \citet{angus2019} gyrochronology
% calibration was inaccurate, the entire age {\it scale} would be incorrect.
% However, this is not what figure \ref{fig:age_comparion} shows -- it shows
% that the {\it relative} age of these youngest stars are under-predicted by
% kinematics or over-predicted by gyrochronology.

% If we assume that the rise in velocity dispersions at cooler effective
% temperatures is caused by an inaccurate period-color relation rather than
% mass-dependent dynamical heating, we can estimate what the shape of the
% period-color relations {\it should} be.
% Figure \ref{fig:age_cut} indicates that the period-color relation flattens
% out, so we applied the same analysis to groups of stars with similar rotation
% periods, equivalent to a completely flat period-color relation.
% The top panel of figure \ref{fig:period_cut} shows the \mct\ sample with stars
% in different period ranges plotted in different colors.
% The bottom panel shows the velocity dispersion of each group as a function of
% effective temperature.
% \begin{figure}
%   \caption{
% This figure is similar to figure \ref{fig:age_cut}, with stars divided into
%     period groups rather than age groups.
% The velocity dispersion is more constant across effective temperatures for the
%     most slowly rotating stars, compared to the stars selected with the
%     \citet{angus2019} gyrochronology model, indicating that the gyrochronology
%     models flatten out, and possibly even invert, at old ages.
% }
%   \centering
%     \includegraphics[width=1\textwidth]{period_cut}
% \label{fig:period_cut}
% \end{figure}
% Once again, the velocity dispersion increases with rotation period overall.
% For the most rapidly rotating groups of stars, velocity dispersion decreases
% with \teff\ as expected given the positively sloped period-color relation of
% Praesepe and other young clusters: late K dwarfs rotate more slowly than early
% K dwarfs of the same age.
% Between rotation periods of 15 and 25 days, the temperature dependence of the
% velocity dispersion starts to disappear, indicating that the period-color
% relation becomes flat: late K dwarfs rotate at the same rate as early K dwarfs
% of the same age.
% At long rotation periods, the velocity dispersion still increases with
% effective temperature, although the increase is much more modest compared to
% the oldest stars in figure \ref{fig:age_cut}.

% If we assume the rise in velocity dispersion at cooler effective temperatures
% is caused by an inaccurate period-color relation rather than mass-dependent
% dynamical heating, we can generate a graphical representation of what the
% relations {\it should} look like.

% Aside from the assumption that mass-dependent dynamical heating is {\it not}
% the main cause of the increased velocity dispersion for cooler stars, a number
% of assumptions went into this analysis which should be addressed before a
% strong conclusion about the nature of stellar spin down is drawn.
% There are some potential confounders that could produce trends between
% velocity dispersion and effective temperature, of which the main ones are
% listed below.
% \begin{itemize}

    % \item{{\bf Extinction.}
% Although we dereddened stars before their ages were estimated, if the
    %     reddening values were underestimated, the gyrochronal ages of stars
    %     would be under-estimated.
% This effect would be largest for the late Ks and early Ms, where the shape of
    %     the period-color relation is more steeply sloped, and stars can more
    %     easily move into the wrong age bin with a small perturbation in color
    %     or temperature.
% Old stars would be incorrectly assigned young ages, and this would happen more
    %     often for cooler stars.
% This effect could lead to an increase in velocity dispersion with \teff, even
% if the gyrochronology relation was perfect.}

    % \item{{\bf Mass-dependent orbital heating.}
% A key assumption going into this analysis is that the orbits of all stars are
% heated at the same rate, regardless of their mass.
% However, if the heating mechanism leads to preferential heating of lower mass
% stars, those stars would have a larger velocity dispersion, not caused by
% ageing.
% No strong evidence has yet been provided to show a mass-dependence in orbital
% heating, however this is an extremely difficult exercise because mass and age
% are so strongly correlated.
% The mass-age degeneracy is reduced in the lowest mass stars which represent
    %     the initial mass function of the Solar neighborhood.
% No mass-dependent heating was found by \citet{faherty2009} who looked
% at the velocity dispersions of low-mass stars.
% Another argument against the increased velocity dispersion as a function of
    %     \teff\ being caused by mass-dependent orbital heating, is that heating
    %     acts most strongly at young ages and most weakly at old ages, \ie\ on
    %     a logarithmic timescale.
% This is related to the fact that stars are more difficult to scatter once they
% are on orbits with a large out-of-plane component and they spend more time out
% of the mid-plane.
% Our data show the opposite trend: stars show little mass-dependent heating
    %     before around 1 Gyr.
% Moreover, the stars in the Geneva-Copenhagen study, used to calibrate the AVR
    %     \citep{holmberg2009} are F and G stars, around 1-3 times as massive as
    %     the K stars in our sample.
% % nordstrom2004, jorgensen2005,
% The ages for our sample of K stars, predicted by gyrochronology agree with the
    %     AVR calibrated using F and G stars, which implies that either
    %     mass-dependent heating is a weak effect, or, mass-dependent heating is
    %     strong and, by coincidence, gyrochronology underpredicts the ages of
    %     the early K dwarfs by just the right amount that they still appear to
    %     agree with the \citet{holmberg2009} AVR.
% We therefore expect that the increased velocity dispersion at cooler
    %     temperatures is mostly caused by incorrect age-grouping, \ie\ the
    %     period-color relation is incorrect for old, low-mass stars, and that
    %     any mass-dependent heating, while it may contribute at a low level to
    %     this result, is not the dominant cause.
% }

    % \item{{\bf Selection bias.}
% The \gaia\
% catalog is incompletebecause they are too faint.
% This is simply due to the fact that \kepler's field of view was aimed at low
    %     galactic latitudes, so nearby \kepler\ stars are close to the galactic
    %     plane.
% The heights of stars above the galactic plane, and correspondingly their
    %     velocities and ages, are therefore correlated with distance.
% Almost no high velocity stars appear in our sample at temperatures cooler than
% 3500, which is why the coolest stars were excluded from our sample, however
% the selection function could still affect stars hotter than 3500 K, and is
% suggested by the decrease in velocity dispersions for cool stars of all ages
% in figure \ref{fig:age_cut}.
% However, this selection effect would act in opposition to the observed trend.
% }

% \item{{\bf Weakened magnetic braking.}
% The rotation periods of old stars are faster than predicted by Skumanich-like
% magnetic braking \citep{angus2015, vansaders2016, metcalfe2019}.
% Magnetic braking is expected to become inefficient once stars approach a
% Rossby number (the ratio of rotation period to convective turnover time) of
% around 2 \citep{vansaders2016, vansaders2018}.
% Since hot stars have shallow convection zones and shorter overturn timescales,
% they reach $Ro = 2$ and stop spinning down at shorter rotation periods than
% cool stars.
% For this reason, some of the hotter stars in the sample may already have
% stopped spinning down, and could be much older than a traditional
% gyrochronology relation (like the simple Praesepe-based relation used in this
% analysis) would suggest.
% However, this effect would work to cancel out the trend observed in figure
% \ref{fig:age_cut} because hotter groups of stars would contain more old stars
% with large velocities.
% }

% \item{Stellar or exoplanet companions.}
% Hotter stars are more likely to be binaries.
% This would make synchronized some stars seem younger, more likely for massive
% stars, although really only likely at short rotation periods.

% \end{itemize}

% CONCLUSION

% This indicates that either the \citep{angus2019} period-color relation is
% incorrect, or that mass-dependent dynamical heating is affecting this data set.
% We presented three pieces of evidence that suggest mass-dependent heating
% cannot be responsible for all of the increasing velocity dispersion.

% \begin{itemize}

% \item{
%         No strong evidence for mass-dependent heating has been found among M, L
% and T-type stars.
% These low-mass stars live longer than the current age of the Universe and
%         therefore do not suffer from a mass-age degeneracy
%         \citep{faherty2009}.
% }

% \item{
%         Literature measurements of the (\vz) AVR exponent are slightly higher
% than the value measured from our data set, but calculated using more massive
% stars.
% Mass-dependent dynamical heating should however produce a {\it smaller} AVR
%         exponent for higher-mass stars.
% We acknowledge that the stars in the \mct\ sample, analyzed in this work, are
%         subject to different selection biases than those used to calculate
%         AVRs in the literature \citep{holmberg2009, aumer2009, yu2018}, so
%         drawing direct comparisons between them does not provide a reliable
%         test.
% }

% \item{
%         The differences in the (\vb) AVR exponent between the hottest and
% coolest K dwarfs in our sample are extremely large, spanning values between
% 0.4 and 0.75, yet the difference in mass is less than a factor of two.
% Such a large spread in AVR exponents cannot be explained by mass-dependent
%         heating alone.
% }

% \end{itemize}

% \racomment{Words about the significance of an inverted period-color relation.}

% \racomment{How does the weakened van Saders braking law fit into all this?}

% \racomment{Talk about the fact that the stars in each bin are not necessarily
% the same age.}

% \racomment{Dispersion could be dependent on the selection function.
% We cut stars at high b, because we find that these do lead to a bias.
% We find no evidence for increased velocity dispersion with decreasing teff in
% either vb or vz.
% We find that sigma clipping is necessary for vb but not vz and do not find
% that the outliers are distributed towards higher galactic latitudes.
% }

% \racomment{Trevor suggest that stars forming in clusters could be the reason
% why young stars are so dynamically cool.}

% \racomment{Are there any asteroseismic stars in this sample that could help
% pin down the age?}


\section{Channel Hypergraph Grammar and Cognitive State Semantics}
\p{In my opinion, a well-motivated philosophy of language will be oriented
to other sciences, both formal and humanistic \mdash{} language as a
\q{bridge} between multiple disciplines.  Linguistics should not
aspire to analytic completeness, or explanatory autonomy: language
understanding requires many cognitive faculties which are \i{not}
governed by linguistic theories; and the pragmatic and situational
contexts surrounding discourse likewise need extra-linguistic
sociological treatments.  So a valid goal for a philosophy of language
is to establish which theories \i{are} proper to language.
Ideally, these theories should engender both philosophical
analysis and formal models: there is a systematic, structural
dimension to language whose properties can be revealed through
rigorous (even computational) representations.  At the same time,
there is also a subtlety and intersubjectivity to language
which call for analyses grounded in philosophy rather than any
computational or logicomathematical commitments.
}
\p{Having presented objections and, I believe, counter-examples to
\q{truth-theoretic} semantics, I now want to present some ideas
for an alternative theory which retains some formal or logical
(or at least mathematical) structuration \mdash{} but not so as
to \q{reduce away} linguistic nuances; nor structures in language
whose semiotic foundation draws from a spectrum of cognitive
(perceptual, situational, narrative, empathic) facilities, which cannot be
reduced to deterministic logic.  My plan is to describe a grammar
framework which integrates such perspectives as Link Grammar,
Applicative and Cognitive Grammar (\ACG{}), and Type Logical Grammar, but
with a distinct underlying formal model.  Like other theories,
this model proposes a broad categorization for semantics by
identifying a small set of primitive types, and defining other types
as functional or combinatory derivates on those base types
(from which the type system overall is \q{generated}).
}
\p{A common paradigm is to consider natural-language types as generated
by just two bases \mdash{} a noun type \N{} and a proposition type
\Prop{}, the type of sentences and of sentence-parts which are
complete ideas \mdash{} having in themselves a propositional content
(see e.g. \cite{BarkerShanTG} or \cite{KubotaLevine}).
Different models derive new types on this basis in different ways.
One approach, inspired by mathematical \q{pregroups}, establishes
derivative types in terms of word pairs \mdash{} an adjective followed
by a noun yields another noun (a noun-phrase, but \N{} is the phrase's
\i{type}) \mdash{} e.g., \i{rescued dogs}, like \i{dogs}, is conceptually
a noun.  Adjectives themselves then have the type of words which form
nouns when paired with a following noun, often written as
\NOverN{}.  Pregroup grammars distinguish left-hand and right-hand
adacency \mdash{} \i{bark loudly}, say, demonstrates an adverb \i{after} a
verb, yielding a verb phrase: so \q{loudly} here has the type of a
word producing a verb in combination with a verb to its \i{left}
(sometimes written \VUnderV{}); by contrast adjectives combine with
nouns to their \i{right}.
}
\p{A related formalization, whose formal
analogs lie in Typed Lambda Calculus, abstracts from left-or-right
word order to models derived types as equivalent (at least
for purposes of type attribution) to \q{functions}.
This engenders a fundamental notion of functional \i{application}
and operator/operand distinctions:
\begin{quote}\i{Categorial Grammars} make the connection between the
first and the second level of the ACG.  These models are
typed applicative systems that verify if a linguistic
expression is syntactically well-formed, and then construct
its functional semantic interpretation.  They use the
\i{fundamental operation of application} of an operator to an
operand.  The result is a new operand or a new operator.
This operation can be repeated as many times as necessary
to construct the linguistic expressions' functional semantic
representation.
\cite[p. 1]{AurelieRossi}
\end{quote}
So, e.g., an adverb becomes a function which takes a verb and produces another verb;
an adjective takes a noun and produces another noun;
and a verb takes a noun and produces a proposition
(see \i{students complained}).  By \q{function} we can consider
some kind of conceptual tranformation: \i{loudly} transforms the
concept \i{bark} into the concept \i{loud bark}.  Another
feature of this \q{function type} interpretation is that
words can be treated as functions taking multiple arguments
\mdash{} a verb, for example, can have as many as three
\q{inputs} (subject, direct object, and indirect object).
}
\p{While informed by the aforementioned theories,
instead of pregroups or lambda calculus,
the type system I propose here is inspired by
computer programming languages, and specifically
by frameworks for assigning types to
computational procedures.  Implemented \q{functions} in
this sense are different than functions in mathematical
contexts, like the lambda calculus.  Mathematical
functions have input and output parameters, but
\i{procedures} (functions implemented in computer code)
have different \i{kinds} of input and output.
Procedures can draw information from many sources
\mdash{} e.g. files, databases, and network resources
\mdash{} and likewise can produce many sorts of effects
(changing the state of some software or physical
component; e.g., writing text to a monitor).
These sources and effects lie alongside explicit
inputs and outputs, as in $x$ as input to $f$
(and $y$ carrying $f$'s output) in \yeqfx{}.  Modern programming
languages also have special features, like \q{objects}
and exceptions (special kinds of inputs and outputs
respectively) which complicate the picture of functions
\q{mapping} inputs to outputs.  One strategy for
analyzing computer code is to take all procedural
inputs and outputs \mdash{} including any means by which
a procedure can obtain data or cause effects outside
its own internal execution environment \mdash{} as
\q{channels of communication}, so the \i{type} of
a procedure is defined by the types of data carried
in each of its channels.
A formal model of channels can then play a role analogous
to input-to-output maps in lambda-calculus inspired grammars,
and to adjacent-word left-or-right pairs in pregroup grammars.
}
\p{Complementary to a \q{channel-oriented} theory of
procedures is the idea of channel \i{states}, representing
procedural effects on any data accessed or modified
by procedures.  The data in an
output channel, for instance, is in a \q{pre-initialized} state
until the procedure terminates and control returns to a
calling procedure, where that output data is then
typically used as input data to other procedures and/or
held in a \q{carrier}, embodied by a source-code symbol
like $y$ in \yeqfx{}.  Channels as such can be formally
defined as higher-scale structures on (labeled and directed)
hypergraphs (where procedures are expressed via hypernodes,
making this a variation on \q{hypergraph grammars} as in
\cite{BrendanFongThesis} or \cite{BrendanFong}).
Transforms in channel state are,
in this framework, informally analogous to \q{beta-reduction} in
the lambda calculus and to \q{identity laws} in pregroup grammars.
}
\p{A detailed outline of channels is beyond the scope of this
paper (I have written about \q{channel algebra} in
\cite{NathanielChristenCyberphysical} and \cite{NathanielChristen}).
Briefly, though, I believe that this \q{Channel Hypergraph Grammar}
(formulated in particular to analyze \i{computer} languages) can
be applied to \i{natural} language because of how
the entirety of a sentence can influence our interpretation of
specific word-pairs and inter-word relations.  Assuming we accept
the intuitive analogy of words as \i{procedures}
(maybe scripts or conceptualizing operations in some cognitive
processing space), then \q{non-local} semantic effects correspond
to alternative procedural channels.
}
\p{For this model, assume we have a baseline lamba-calculus-like
functional summary of sentences and derived types.  That is,
any sentence can be rewritten as if a sequence of \q{function calls},
assuming an underlying representational vocabulary of a typed
lambda calculus, with sentences having overall \Prop{} types:
\begin{sentenceList}\sentenceItem{} I believe that he is at school.
\sentenceExample{(believe I (that (is he (at school))))}
\sentenceItem{} Student after student complained about tuition hikes.
\sentenceExample{((about (tuition hikes) complained) (after student student))}
\sentenceItem{} Three times, students asked an interesting question.
\sentenceExample{((three times) (asked students (an (interesting question))))}
\end{sentenceList}
In this representation \q{function-like} types (verbs, adjectives,
adverbs, and so on) are notated preceding one or more words or
expressions which are functional \q{arguments}
(sometimes the \q{functions} are expressions with their own
inner function-argument structure, as in \i{(about (tuition hikes) complained)}
qua verb-phrase).  This reconstruction presents one layer of structure
\mdash{} for example, the connection of verbs to their one, two, or three arguments
\mdash{} which can then be overlaid with Link-Grammar style pairs,
like verb-to-subject and verb-to-direct-object.
}
\p{These word-links are then \q{local} connections in that they nest within
a functionally reconstructed phrase hierarchy.  We can call them
\i{local} channels.  Meanwhile, semantic effects outside the
local phrase structure \mdash{} like anaphora or \q{space-building} insofar
as it influences nonlocal morphosyntax \mdash{} can then be
modeled via \i{nonlocal} channels.  To clarify these claims I will
demonstrate this style of analysis with respect to examples like
I have just cited.
}
\p{My overall goal is to embrace a hybrid methodology \mdash{}
accepting formal analyses when they shed light on linguistic
processes, but not going so far as to treat logical, mathematical,
or computational models as full explanations for linguistic
rationality qua scientific phenomenon.
The path toward such a hybrid methodology, as I will sketch it
here, takes its inspiration and orientation from Cognitive Grammar.
This perspective, in particular, challenges our assumption that
grammar and semantics are methodologically separate.  Received
wisdom suggests that grammar concerns the \q{form} of sentences
whereas semantics considers the meaning of words \mdash{} implicitly
assuming that \i{word combinations} produce new meanings, and
that the \i{order} by which words are combines determines how
new meanings are produced.  This notion, in turn, is allied
with the essentially logical or propositional picture of
signifying via doxa: the idea that inter-word relations cue up
different logically salient transformations of an underlying
predicate model.  Thus \i{many students} as a phrase is
more significatorily precise than \i{students} as a word, because
the phrase (with intimations of quantitative comparison) has
more logical detail.  Similarly \i{many students complained}
is more logically complete because, provisioning both a verb-idea
and a noun-idea, it represents a whole proposition.
}
\p{In general, then, phrases are more complete than words because
they pack together more elements which have some logical role,
establishing individuals, sets, spatiotemporal setting, and
predicates which collectively establish sufficiently
completed propositional attitudes.  On this account the
key role of phrase-structure is to establish phrases as
signifying units on a logical level analogous to
how lexemes are signifying units on a referential or conceptual
level.  Moreover, phrases' internal structure are understood
to be governed by rule defining \i{how} word-combinations
draw in extra logical detail.  A link between words is not a
random synthesis of concepts, but rather implies a certain
logical connective which acts as a de facto \q{third party} in
a double-word link, proscribing with orientation to predicate
structures \i{how} the words' semantic concepts are to be
joined.  In \i{many students} the implied connector is
the propositional act of conceiving a certain quantitative
scale to a conceptualized set; in \i{students complained} the
implied connector is a subject-plus-verb-equals-proposition
assertiveness.  Phrases acquire logical specificity by
building up word-to-word connections into
more complex aggregates.
}
\p{One implication of this model is that phrases are semantically
substitutable with individual lexemes that carry similar meanings,
having been entrenched by convention to capture a multipart concept
which would otherwise be conveyed with the aggregation of a
phrase: consider \q{MP} for \i{member of parliament}, or
\q{primaried} for \i{subject without your own party to a primary
challenge}.  Conversely, phrases can be repeatedly used in a
specific context until they function as quasi lexical units in
their own right.  These patterns of entrenchment imply that we
hear language in term of phrases bearing semantic content; and
insofar as we are comfortable with how we parse a sentence, each
word sited in its specific phrasal hierarchy, we do not tend to
consider individual words semantically outside of their
constituent phrases.
}
\p{This theory of the syntax-to-semantic relationship is a paradigmatic
partner, at the grammatic level, to truth-theoretic semantics and as
such, I maintain, is subject to similar critiques as I developed
semantically in the last two sections.  A critique of grammatic theories
based on, let's say, \q{\i{proprositional semantics of phrase-structure}}
can address two concerns: first, the idea that lexemes retain some
syntactic and semantic autonomy even within clearly defined phrases
where they are included; and, second, that the shape of phrases
insofar as they are perceived as holistic signifying units
is often driven by figurative or \q{gestalt} principles rather than
neat logical structuration.  I'll call the former the issue of
\q{phrasal isolation} (or lack thereof): syntactic and semantic effect
often cross phrasal boundaries, even outside the overarching hierarchy
whose apex is the whole sentence.  Both of these lines of reasoning
\mdash{} arguably especially the second \mdash{} are developed in
Cognitive Grammar literature.
}
\p{}