\documentclass{article} 
\input{../../lib.sty} 
 
\title{\texttt{fn make\_count}} 
\author{S\'ilvia Casacuberta, Grace Tian, Connor Wagaman} 
\date{} 
 
\begin{document} 
 
\maketitle 
 
Proves soundness of \rustdoc{transformations/fn}{make\_count} in \asOfCommit{mod.rs}{f5bb719}. 
 
\texttt{make\_count} returns a Transformation that computes a count of the number of records in a vector. 
The length of the vector, of type \texttt{usize}, is exactly casted to a user specified output type \texttt{TO}. 
If the length is too large to be represented exactly by \texttt{TO},  
the cast saturates at the maximum value of type \texttt{TO}. 
 
\section{Hoare Triple} 
\subsection*{Precondition} 
 
\subsubsection*{Compiler-verified} 
\begin{itemize} 
    \item Generic \texttt{TIA} (atomic input type) is a type with trait \rustdoc{traits/trait}{Primitive}. 
    \item Generic \texttt{TO} (output type) is a type with trait \rustdoc{traits/trait}{Number}. 
    \item Argument \texttt{input\_domain} is of type \texttt{VectorDomain<AtomDomain<TIA>{}>}. 
    \item Argument \texttt{input\_metric} is of type \texttt{SymmetricDistance}. 
\end{itemize} 
 
\subsubsection*{Caller-verified} 
None 
 
\subsection*{Pseudocode} 
\lstinputlisting[language=Python,firstline=2,escapechar=|]{./pseudocode/make_count.py} 
 
\subsection*{Postcondition} 
\validTransformation{\texttt{(input\_domain, input\_metric, TIA, TO)}}{\texttt{make\_count}} 
 
\section{Proofs} 
 
\begin{proof} \textbf{(Part 1 -- appropriate output domain).} 
    The \texttt{output\_domain} is \texttt{AtomDomain(TO)}, so it is sufficient to show that \texttt{function} always returns non-null values of type \texttt{TO}. 
    By the definition of the \texttt{ExactIntCast} trait, \texttt{TO.exact\_int\_cast} always returns a non-null value of type \texttt{TO} or raises an exception. 
    If an exception is raised, the function returns \texttt{TO.MAXIMUM\_CONSECUTIVE}, which is also a non-null value of type \texttt{TO}. 
    Thus, in all cases, the function (from line \ref{line:try-catch}) returns a non-null value of type \texttt{TO}. 
\end{proof} 
 
Before proceeding with proving the validity of the stability map, we provide a couple lemmas. 
 
\begin{lemma} 
    \label{dsym-sens} 
    $|\function(x) - \function(x')| \leq |\texttt{len(x)} - \texttt{len(x')}|$,  
    where \texttt{len} is an alias for \\ \texttt{input\_domain.size}. 
\end{lemma} 
 
\begin{proof} 
    As \texttt{arg} has type \texttt{Vec<TIA>}, it supports the Rust standard library function \texttt{len}
    that returns the number of elements in the \texttt{arg} as type \texttt{usize} on line \ref{line:size}.
    By the definition of \texttt{ExactIntCast},  
    the invocation of \texttt{TO.exact\_int\_cast} on line \ref{line:exact-int-cast} can only fail if the argument is greater than \texttt{TO.MAX\_CONSECUTIVE}. 
    In this case, the value is replaced with \texttt{TO.MAX\_CONSECUTIVE}. 
    Therefore, $\function(x) = \min(\texttt{len(x)}, c)$, where $c = \texttt{TO.MAX\_CONSECUTIVE}$. 
    We use this equality to prove the lemma: 
 
    \begin{align*} 
        |\function(x) - \function(x')| &= |\min(\texttt{len(x)}, c) - \min(\texttt{len(x')}, c)| \\ 
        &\leq |\texttt{len(x)} - \texttt{len(x')}| &&\text{since clamping is stable} \\ 
    \end{align*} 
\end{proof} 
 
\begin{lemma} 
    \label{lemma:len-sum-equiv} 
    For vector $x$ with each element $\ell\in x$ drawn from domain $\mathcal{X}$, $\texttt{len(x)} = \sum_{z\in\mathcal{X}} h_x(z)$. 
\end{lemma} 
 
\begin{proof} 
    Every element $\ell \in x$ is drawn from domain $\mathcal{X}$, so summing over all $z\in \mathcal{X}$ will sum over every element $\ell\in x$.  
    Recall that the definition of \texttt{SymmetricDistance} states that $h_x(z)$ will return the number of occurrences of value $z$ in vector $x$. 
    Therefore, $\sum_{z\in\mathcal{X}} h_x(z)$ is the sum of the number of occurrences of each unique value;  
    this is equivalent to the total number of items in the vector.  
 
    By the postcondition of \texttt{Vec.len} in the Rust standard library, 
    the variable \texttt{size} is of type \texttt{usize} containing the number of elements in \texttt{arg}. 
    Therefore, $\sum_{z\in\mathcal{X}} h_x(z)$ is equivalent to \texttt{size}. 
\end{proof} 
 
\begin{proof} \textbf{(Part 2 -- stability map).}  
    Take any two elements $x, x'$ in the \texttt{input\_domain} and any pair $(\din, \dout)$,  
    where \din\ has the associated type for \texttt{input\_metric} and \dout\ has the associated type for \texttt{output\_metric}. 
    Assume $x, x'$ are \din-close under \texttt{input\_metric} and that $\texttt{stability\_map}(\din) \leq \dout$.  
    These assumptions are used to establish the following inequality: 
    \begin{align*} 
        |\function(x) - \function(x')| &\leq |\texttt{len(x)} - \texttt{len(x')}| &&\text{by }\ref{dsym-sens} \\ 
        &= |\sum_{z\in \mathcal{X}} h_{\texttt{x}}(z) - \sum_{z\in \mathcal{X}} h_{\texttt{x'}}(z)| &&\text{by } \ref{lemma:len-sum-equiv} \\ 
        &= |\sum_{z\in \mathcal{X}}\left(h_{\texttt{x}}(z) - h_{\texttt{x'}}(z)\right)| &&\text{by algebra} \\ 
        &\leq \sum_{z\in \mathcal{X}}|h_{\texttt{x}}(z) - h_{\texttt{x'}}(z)| &&\text{by triangle inequality} \\ 
        &= d_{Sym}(x, x') &&\text{by } \rustdoc{metrics/struct}{SymmetricDistance}\\ 
        &\leq \din &&\text{by the first assumption} \\ 
        &\leq \texttt{TO.inf\_cast}(\din) &&\text{by } \rustdoc{traits/trait}{InfCast} \\ 
        &\leq \texttt{TO.one().inf\_mul(TO.inf\_cast(\din))} &&\text{by } \rustdoc{traits/trait}{InfMul} \\ 
        &=\texttt{stability\_map}(\din) &&\text{by line } \ref{line:stability-map} \text{, see } \rustdoc{core/struct}{StabilityMap} \\ 
        &\leq \dout &&\text{by the second assumption} 
    \end{align*} 
 
    It is shown that \function(x), \function(x') are \dout-close under \texttt{output\_metric}. 
\end{proof} 
 
\end{document} 
