imagine writing low - level systems code in a purely functional language and then reasoning about this code equationally and productively in an interactive theorem prover .imagine doing this without the need for a trusted compiler , runtime or garbage collector and letting this code interoperate with native c parts of the system , including your own efficiently implemented and formally verified additional data types and operations .cogentachieves this goal by certified compilation from a high - level , pure , polymorphic , functional language with linear types , specifically designed for certain classes of systems code . for a given well - typed cogentprogram, the compiler will produce a high - level shallow embedding of the program s semantics in isabelle / hol  , and a theorem that connects this shallow embedding to the c code that the compiler produces : any property proved of the shallow embedding is guaranteed to hold for the generated c.  the compilation target is c , because c is the language most existing systems code is written in , and because with the advent of tools like compcert  and gcc translation validation  , c is now a language with well understood semantics and existing formal verification infrastructure .if c is so great , why not verify c systems code directly ?after all , there is an ever growing list of successes in this space .the reason is simple : verification of manually written c programs remains expensive .just as high - level languages increase programmer productivity , they should also increase verification productivity .certifying compilation of a language with verification - friendly semantics is a key step in achieving this goal for cogent .the state of the art for certified compilation of a full featured functional language is cakeml  , which covers an entire ml dialect .cogentis targeted at a substantially different point in the design space .cakeml includes a verified runtime and garbage collector , while cogentworks hard to avoid these so it can be applicable to low - level embedded systems code .cakeml covers full turing - complete ml with complex semantics that works well for code written in theorem provers .cogentis a restricted language of total functions with intentionally simple semantics that are easy to reason about equationally .cakeml is great for application code ; cogentis great for systems code , especially layered systems code with minimal sharing such as the control code of file systems or network protocol stacks .cogentis not designed for systems code with closely - coupled , cross - cutting sharing , such as microkernels .cogent s main restrictions are the ( purposeful ) lack of recursion and iteration and its linear type system .the former ensures totality , which is important for both systems code correctness as well as for a simple shallow representation in higher - order logic .the latter is important for memory management and for making the transition from imperative c semantics to functional value semantics . even in the restricted target domains of cogent, real programs will of course contain some amount of iteration .this is where cogent s integrated foreign function interface comes in : the engineer provides her own verified data types and iterator interfaces in c and uses them seamlessly in cogent , including in formal reasoning .cogentis restricted , but it is not a toy language . we have used it to implement two efficient full - scale linux file systems a custom flash file system and an implementation of standard linux ext2 .we plan to report on the experience with these implementations in separate work .the focus of this paper is what can be learned from cogentabout the formal verification of certifying compilation .in particular , this paper discusses in detail the following contributions :  the self - certifying cogentcompiler and language ;  the formal semantics of the cogentlanguage and the switch from imperative update semantics to functional value semantics formally justified by the linear type system ( ) ;  the top - level compiler certificate ( ) , which is a series of language - level meta proofs and per - program translation validation phases ;  the verification stages that make up the correctness theorem ( ) , including automated refinement calculi , formally verified type checking , a - normalisation , and monomorphisation ; and  the lessons learned in this project on functional language formalisation and compiler correctness proofs ( ) .our aim in this paper is to build a self - certifying compiler from cogentto efficient c code , such that a proof engineer can reason equationally about its semantics in isabelle / hol and apply the compiler theorem to derive properties about the generated c code .formally , the certificate theorem is a refinement statement between the shallow embedding and the c code .this generated c code can be compiled by compcert .it also falls into the subset of the gcc translation validation tool by , whose theorem would compose directly with our compiler certificate .shallow embeddings are nice for the human user , but they do not provide much syntactic structure for constructing the compiler theorem . therefore , the compiler also generates a deep embedding for each cogentprogram to use in the internal proof chain .there are two semantics for this deep embedding .  a formal functional _ value semantics _ where programs evaluate to values and  a formal imperative _ update semantics _ where programs manipulate references to mutable global state.    shows an overview of the program representations generated by the compiler and the break - down of the automatic refinement proof that makes up the compiler certificate .the program representations are , from the bottom of : the c code , the semantics of the c code expressed in isabelle / simpl  , the same expressed as a monadic functional program  , a monomorphic a - normal deep embedding of the cogentprogram , a polymorphic a - normal deep embedding of the same , an a - normal shallow embedding , and finally a ` neat ' shallow embedding of the cogentprogram that is syntactically close to the cogentinput of the compiler .most of the theorems assume that the cogentprogram is well - typed , which is discharged automatically in isabelle with type inference information from the compiler .the solid arrows on the right - hand side of the figure represent refinement proofs and the labels on these arrows correspond to the numbers in the following description .the only arrow that is not formally verified is the one crossing from c code into isabelle / hol at the bottom of this is the c - to - isabelle parser  , which is a mature verification tool used in a number of large - scale verifications . as mentioned , it could additionally be checked by translation validation .we briefly describe each intermediate theorem , starting with the simpl code at the bottom of the figure . for well - typed cogentprograms ,we automatically prove :  1 .theorem : the simpl code produced by the c parser corresponds to a monadic representation of the c code .the proof is generated using an adjusted version of the autocorres tool .theorem : the monadic program terminates and is a refinement of the monomorphic cogentdeep embedding under the update semantics . 3 .theorem : if a cogentdeep embedding evaluates in the update semantics then it evaluates to the same result in the value semantics .this is a known consequence of linear type systems  , but to our knowledge it is the first mechanised proof of such a property , esp . for a full - scale language .theorem : if a monomorphic cogentdeep embedding evaluates in the value semantics then the polymorphic deep embedding evaluates equivalently in the value semantics . 5 .theorem : if the polymorphic cogentdeep embedding evaluates in the value semantics then the cogentshallow embedding evaluates to a corresponding shallow isabelle / hol value .theorem : the a - normal shallow embedding is ( extensionally ) equal in isabelle / hol to a syntactically neater shallow embedding , which is more convenient for human reasoning .this human - friendly shallow embedding corresponds to the cogentcode before the compiler s a - normalisation phase .arrow 7 indicates verification of user - supplied abstract data types ( adts ) implemented in c and further manual high - level proofs on top of the human - friendly shallow embedding .these are enabled by the previous steps , but are not part of this paper .  inwe define in more detail the relations that formally link the values ( and states , when applicable ) that these programs evaluate to .steps ( 3 ) and ( 4 ) are general properties about the language and we therefore prove them manually once and for all .steps ( 1 ) , ( 2 ) , ( 5 ) , and ( 6 ) are generated by the compiler for every program .the proof for step ( 1 ) is generated by autocorres .for steps ( 2 ) and ( 5 ) we define compositional refinement calculi that ease the automation of these proofs .step ( 6 ) , the correctness of a - normalisation , is straightforward to prove via rewriting because at this stage we can already use equational reasoning .in this section we formally define cogent , including its linear type system , its two dynamic semantics update and value mentioned earlier in , and the refinement theorem between them .we begin the section by walking through an example cogentprograms.   shows an excerpt of our cogentext2 implementation .the example uses not all , but many features of the language .  ....type exst type uarray a type opt a = < none ( ) | some a > type node = # { mbuf : opt buf , ptr : u32 , fr : u32 , to : u32 } type acc = ( exst , fsst , vfsinode ) type cnt = ( uarray node ,   ( u32 , node , acc , u32 , uarray node ) - > ( node , acc ) )  uarray_create : all ( a : < e ) .( exst , u32 )   - > < success ( exst , uarray a ) | err exst >  ext2_free_branch : ( u32 , node , acc , u32 )   - > ( node , acc , < expd cnt | iter ( ) > ext2_free_branch ( depth , nd,(ex , fs , inode),mdep ) =  if depth + 1 < mdep    then    uarray_create[node ] ( ex , nd.to - nd.fr ) !nd    | success ( ex , children ) = >     let nd_t { mbuf } = nd     and ( children , ( ex , inode , _ , mbuf ) ) =       uarray_map_no_break # {       arr  = children ,       f   = ext2_free_branch_entry ,       acc  = ( ex , inode , node_t.fr , mbuf ) ,       ... } !nd_t     and nd = nd_t { mbuf }     in ( nd , ( ex , fs , inode ) ,       expd ( children , ext2_free_branch_cleanup ) )    | err ex - > ( nd , ( ex , fs , inode ) , iter ( ) )   else ... ....  the first line in shows the cogentside of the foreign function interface. it declares an abstract cogentdata type `` , implemented in c. line 2 shows a parametric abstract type , and line 9 shows a corresponding abstract function ` ( ) ` , also implemented in c. note that this abstract function is polymorphic , with a kind constraint  ( see ) on type argument ` a ` .the integration of such foreign functions is seamless on the cogentside , but naturally has requirements on the corresponding c code .the c side must respect the cogenttype system , and , for example , keep all shared state internal to the abstract type to comply with linearity constraints .it must also be terminating and implement the user - supplied semantics that appear in the corresponding shallow embedding of the cogentprogram in isabelle / hol ideally the user should provide a formal proof to discharge the corresponding assumption of the compiler certificate theorem .abstract functions can be higher - order and provide the iteration constructs that are intentionally left out from core cogent .e.g. line 21 , ` ( ) ` implements a map iterator for arrays . in our file system applicationswe have found it sufficient to provide a small library of iterators for types such as arrays .we also interfaced to an existing mature red - black tree implementation .returning to the example in , lines 37 show basic type constructors and declarations of variants , records and tuples using type variables and the primitive type `` .for instance , type `` is defined as a pair of `` and a function type .types in cogentare structural  , i.e. two types with the same structure but different names are intensionally equal .moreover , line 17 calls the abstract polymorphic function ` ( ) ` , instantiated with type argument `` .nd ` notation temporarily turns a linear object of type `` into a read - only one ( see ) .the two basic , non - linear fields ` to ` and ` fr ` in type `` can directly be accessed read - only using projection functions .line 18 and 29 are pattern matches on the result of the function invocation .line 19 shows surface syntax for cogent s linear * take * construct ( see ) , accessing and binding the ` mbuf ` field of ` nd ` to the name ` mbuf ` ( punning as in haskell ) , as well as binding the rest of the record to the name ` nd_t ` .the linear type system tracks that the field ` mbuf ` is logically absent in ` nd_t ` .it also tracks that ` nd ` on line 19 has been used , so can not be accessed again .thus the programmer is safe to bind a new object to the same name ` nd ` ( on line 26 ) without worrying about name shadowing .line 26 shows surface syntax for , the dual to , which re - establishes the ` mbuf ` fields in the example . first noted that linear types can be used as a way to safely model mutable state and similar effects while maintaining a purely functional semantics . later proved wadler s intuition by showing that , for a linear language , imperative c code can implement a simple set - theoretic semantics .we use linear types for two reasons : to ensure safe handling of heap - allocated objects , without the need for runtime support , and to allow us to assign to cogentprograms a simple , equational , purely functional semantics implemented via mutable state and imperative effects .& t & & + & , & & + & & & t + & & & + & & & + & & = & \ { , , } + & & & + & & : : = & + & m & & + & & & , + & & & , + & & & + & & &   +  [ cols= " < , < " , ]   ( indicates lists , i.e. zero or more )  the type structure and associated syntax of cogentis presented in .our type system is loosely based on the polymorphic of .we restrict this polymorphism to be rank-1 and predicative , in the style of ml , to permit easy implementation by specialisation with minimal performance penalty . to ease implementation , and to eliminate any direct dependency on a heap allocator , we require that all functions be defined on the top - level .this eliminates the need for linear function types : any top - level function can be shared freely because they can not capture _ any _ local variables , let alone linear ones .we include a set of primitive integer types ( , etc . ) .records comprise ( 1 ) a sequence of fields , where is the type on an inaccessible field , and ( 2 ) a mode ( see and for a more detailed description ) .we also have polymorphic variants , a generalised sum type in the style of ocaml , the mechanics of which are briefly described in .abstract types are also parametrised by modes .we omit product types from this presentation ; they are desugared into unboxed records .the most obvious similarity to is our use of _ kinds _ to determine if a type may be freely shared or discarded , as opposed to earlier linear type systems , such as that of  , where a type s linearity is encoded directly into its syntactic structure .kinds in cogentare sets of _ permissions _ , denoting whether a variable of that type may be discarded without being used ( ) , shared freely and used multiple times ( ) , or safely bound in a expression ( ) . a _ linear _ type , values of which must be used exactly once , has a kind that excludes  and  , and so forbids it being discarded or shared .we discuss expressions in .another similarity to is that we explicitly represent the context operations of weakening and contraction , normally relegated to structural rules , as explicit judgements : for weakening ( discarding assumptions ) and for contraction ( duplicating them ) .the rules for these judgements are presented in . for a typing assumption to be discarded (respectively duplicated ) , the type must have kind ( resp . ) .+  +  +  +     the full kinding rules for the types of cogentare given in .basic types such as or , as well as functions , are simply passed by value and do not contain any heap references , so they may be given any kind .kinding for structures and abstract functions is discussed shortly in .a type may have multiple kinds , as a nonlinear type assumption may be used linearly , never being shared and being used exactly once .therefore , a type with a permissive kind , such as , would be an acceptable instantiation of a type variable of kind , as we are free to _ waive _ permissions that are included in a kind .we can prove formally by straightforward rule induction :  if and , then .this result allows for a simple kind - checking algorithm , not immediately apparent from the rules .for example , the maximal kind of an unboxed structure with two fields of type and respectively can be computed by taking the intersection of the computed maximal kinds of and .this result ensures that this intersection is also a valid kind for and .recall that cogentmay be extended with _ abstract types _ , implemented in c , which we write as in our formalisation .we allow abstract types to take any number of _ type parameters _ , where each specific instance corresponds to a distinct c type . for example , a abstract type , parameterised by its element type , would correspond to a family of c types , each one specialised to a particular concrete element type . because the implementations of these types are user supplied , the user is free to specialise implementations based on these type parameters , for example representing an array of boolean values as a bitstring , so long as they can show that every different operation implementation is a refinement of the same user - supplied cdsl semantics for that operation .values of abstract types may be represented by references to heap data structures .specifically , an abstract type or structure is stored on the heap when its associated _ storage mode _ is not `` '' . for boxed records and abstract types, the storage mode distinguishes between those that are `` '' vs. `` '' .the same is true for record types , written , which are discussed in more detail in .  the storage mode affects the maximal kind that can be assigned to the type .for example , an unboxed structure with two components of type is freely shareable , but if the structure is instead stored on the heap , then a writable reference to that structure must be linear .thus , the type given to such references has the `` '' mode , whose kind is , thereby preventing such a reference from being assigned a nonlinear kind such as .   like , we allow linear values to be shared read - only in a limited scope .this is useful for practical programming in a language with linear types , as it makes our types more informative .for example , to write a function to determine the size of a ( linear ) buffer object , a naive approach would be to write a function : this function has a cumbersome additional return value just so that the linear argument is not discarded .further , the type above does not express the fact that the input buffer and output buffer are identical this would need to be established by additional proof . to address this problem, we include a type operator  , in the style of wadler s operator , which changes all writable modes in a type to read - only ones .the full definition of is in .we can therefore write the type of our function as : for any valid type , the kind of will be nonlinear , which means that our function no longer needs to be encumbered by the extra return value .this kinding result is formally stated as :  for any type , if then .  to integrate this type operator with parametric polymorphism, we borrow a trick from odersky s observer types  , and tag type variables that have been made read only , using the syntax .whenever a variable is instantiated to some concrete type , we also replace with .the lemma above ensures that our kinding rule for such tagged variables is sound , and enables us to prove the following :  for any type , implies when , for each , .& o & & \{`+ ` , ` * ` , ` / ` , ` < = ` , ` = = ` , ` || ` , ` < < ` , } + & & & \{123 , , ` a ` , }+ & e & & + & & & + & & & + & & & + & & & + & & & + & & & + & & & + & & & + & d & & + & p & & + & & & , + & & & , + & & & , , + & & & , +    while cogentfeatures a rich surface syntax , due to space constraints , we only document the ( full ) core language in to which the surface syntax is desugared .+  +  p0.625|p0.25  c +  +  +  &   +   +  +  shows the typing rules for cogentexpressions .many of these are standard for any linear type system .we will discuss here the rules for , where we have taken a slightly different approach to established literature , and the rules for the extensions we have made to the type system , such as variants and record types .on the expression level , the programmer can use expressions , in the style of , to temporarily convert variables of linear types to their read - only equivalents , allowing them to be freely shared . in this example, we wish to copy a buffer onto a buffer only when will fit inside . note that even though and are used multiple times , they are only used once in a linear context . insidethe binding , they have been made temporarily nonlinear .our kind system ensures these read - only , shareable references inside bindings can not `` escape '' into the outside context .for example , the expression would violate the invariants of the linear type system , and ruin the purely functional abstraction that linear types allow , as both and would refer to the same object , and a destructive update to would change the shareable .we are able to use the existing kind system to handle these safety checks with the inclusion of the permission , for , which indicates that the type may be safely returned from within a .we ensure , via the typing rules of , that the left hand side of the binding ( in the example ) has the permission , which excludes temporarily nonlinear references via ( see ) .our solution is as powerful as odersky s , but we encode the restrictions in the kind system directly , not as side - condition constraints that recursively descend into the structure of the binding s type .a variant type is a generalised sum type , where each alternative is distinguished by a unique _ data constructor_  .the order in which the constructors appear in the type is not important .one can create a variant type with a single alternative simply by invoking a constructor , e.g. might be given the type .the original value of can be retrieved using the construct .the set of alternatives is enlarged by using expressions that are automatically inserted by the type - checker of the surface language , which uses subtyping to infer the type of a given variant .a similar trick is used for numeric literals and .  in order to pattern match on a variant ,we provide a construct that attempts to match against one constructor .if the constructor does not match , it is _ removed _ from the type and the reduced type is provided to the branch . in this way , a traditional multi - way pattern match can be desugared by nesting : note that because the typing rule for only applies when only one alternative remains , our pattern matching is necessarily total .some care is needed to reconcile record types and linear types .assume that is a type synonym for an ( unboxed ) record type containing an integer and two ( linear ) buffers . let us say we want to extract the field from an .if we extract just a single , we have implicitly discarded the other buffer .but , we ca nt return the entire along with the , as this would introduce aliasing .our solution is to return along with the an where the field can not be extracted again , and reflect this in the field s type , written as .this field extractor , whose general form is , operates as follows : given a record  , it binds the field of to the variable , and the new record to the variable in . unless the type of the field has kind , that field will be marked as unavailable , or _ taken _ , in the type of the new record .conversely , we also introduce a operation , which , given a record with a taken field , allows a new value to be supplied in its place . the expression returns the record in where the field has been replaced with the result of . unless the type of the field has kind , that field must already be taken , to avoid accidentally destroying our only reference to a linear resource .unboxed records can be created using a simple struct literal .we also allow records to be stored on the heap to minimise unnecessary copying , as unboxed records are passed by value .these boxed records are created by invoking an externally - defined c allocator function . for these allocation functions, it is often convenient to allocate a record with all fields already taken , to indicate that they are uninitialised .thus a function for allocating ` object`-like records might return values of type : .for any nonlinear record ( that is , ( 1 ) read - only boxed records , which can not have linear fields , as well as ( 2 ) unboxed records without linear fields ) we also allow traditional member syntax for field access .the typing rules for all of these expressions are given in .as mentioned earlier , we implement parametric polymorphism by specialising code to avoid paying the performance penalties of other approaches such as boxing .this means that polymorphism in our language is restricted to predicative rank-1 quantifiers .this allows us to specify dynamic objects , such as our value typing relations ( see ) and our dynamic semantics ( see ) , in terms of simple monomorphic types , without type variables .thus , in order to evaluate a polymorphic program , each type variable must first be instantiated to a monomorphic type .we show that typing of the instantiated program follows from the typing of the polymorphic program , if the type instantiation used matches the kinds of the type variables .[ lemma : spec ] implies when , for each , .the above lemma is sufficient to show the monomorphic instantiation case , by setting ( the empty context ) .this lemma is a key ingredient for the refinement link between polymorphic and monomorphic deep embeddings ( see ) .   &v & & + & & & & + & & & & + & & & & + & & & & + & & & a_v & + & v & & + & a_v    & u & & + & & & & + & & & & + & & & & + & & & & + & & & a_u & + & & & p & + & u & & + & p & & + & a_u & & +    defines the big - step evaluation rules for the _ value _ semantics of cogent .the relation states that under environment , the expression evaluates to a resultant value .these values are documented in . in many ways ,the semantics is entirely typical of a purely functional language , albeit with some care to handle abstract function calls appropriately .this is intentional , since our goal is to automatically produce a purely functional shallow embedding from this semantics .as functions must be defined on the top level , our function values consist only of an unevaluated expression , which is evaluated when the function is applied .abstract function values , written , are instead passed more indirectly , as a pair of the function name and a list of the types used to instantiate any type variables .when an abstract function value is applied , the user - supplied semantics are invoked , which is simply a function from input value to output value .the _ update _ semantics , by contrast , is much more imperative .the semantic rules can also be found in , with associated definitions in .this semantics is also an evaluation semantics , written in the style of  .values in the update semantics may now be _ pointers _, written , to values in a mutable store or _ heap _this mutable store is modelled as a partial function from a pointer to an update semantics value .most of the rules in only differ from the value semantics in that they thread the store  through the evaluation of the program . however , the key differences arise in the treatment of records and of abstract types , which may now be represented as _ boxed _ structures , stored on the heap . in particular , note that the rule destructively updates the heap , instead of creating a new record value , and the semantics of abstract functions may also modify the heap .   +  +vprom +  +   +  + uprom +   +   in order to show that the update semantics is a refinement of the value semantics , we must exploit the information given to us by cogent s linear type system . a typical refinement approach to relate the two semantics would be to define a correspondence relation between update semantics states and value semantics values , and show that an update semantics evaluation implies a corresponding value semantics evaluation .however , such a statement is not true if aliasing exists , as a destructive update ( from , say , ) would result in multiple values being changed in the update semantics but not necessarily in the value semantics .as our type system forbids aliasing of writable references , we must include this information in our correspondence relation .written as  ] ) .in fact , the rules for both relations can be derived from the rules in simply by erasing either the value semantics parts ( highlighted like ) or the update semantics parts ( highlighted like ) .as we ultimately prove preservation for this correspondence relation across evaluation , this same erasure strategy can be applied to our proofs to produce a type preservation proof for either semantics .[ [ formalising - uniqueness ] ] formalising uniqueness + + + + + + + + + + + + + + + + + + + + + +  with this correspondence relation , we can prove our intuitions about linear types .for example , the following lemma , which shows that we do not discard any unique writable reference via weakening , makes use of the fact that a value is only given a discardable type when it contains no writable pointers . if and then there exists such that .we also prove a similar lemma about our context splitting judgement , which uses the fact that a value is only given a shareable type when it contains no writable pointers to conclude that the two output contexts give access to non - aliasing sets of writable pointers .  if and then there exists and where and , such that and and .in addition , we prove our main intuition about , necessary for showing refinement for expressions .    if   [ [ dealing - with - mutable - state ] ] dealing with mutable state + + + + + + + + + + + + + + + + + + + + + + + + + +  we define a _ framing _ relation which specifies exactly how evaluation may affect the mutable store . given an input set of writable pointers , an input store , an output set of pointers and an output store , the relation , written , ensures three properties for any pointer :  inertia : :  if , then   .leak freedom : :  if and , then   .fresh allocation : :  if and , then   .  framing implies that our correspondence relation , for both values and environments , is unaffected by unrelated store updates :  assume two unrelated pointer sets and that , then  * if then and . * if then and .  [ [ refinement - and - preservation ] ] refinement and preservation + + + + + + + + + + + + + + + + + + + + + + + + + + +  with the above lemmas and definitions , we are able to prove refinement between the value and the update semantics .this of course requires us to assume the same for the semantics given to abstract functions , and .let be an abstract function with type signature , and be an instantiation of the type variables such that for each , .let and be update- and value - semantics values such that .the user - supplied meaning of in each semantics gives and .then , there exists and such that and .we first prove that the correspondence relation is preserved when both semantics evaluate from corresponding environments . by erasing one semantics ,this becomes a type preservation theorem for the other .due to space constraints , we omit the details of the proof in this paper , but the full proof is available in our isabelle / hol formalisation . [ thm : preservation ] if and and and , then there exists and such that and .  in order to prove refinement , we must show that every evaluation on the concrete update semantics has a corresponding evaluation in the abstract value semantics . while already gets us most of the way there , we still need to prove that the value semantics can evaluate whenever the update semantics does .  if and and , then there exists a such that   composing this lemma and , we can now easily prove our desired refinement statement .[ thm : updvalrefinement ]  if and and , then there exists a value and pointer sets and such that , and and .   +  +  +  +  &   +  +with the formal semantics of cogentavailable , this section describes each of the proof steps that make up the compiler certificate , depicted in in .we start by describing the top - level theorem that forms the program certificate , emitted by the compiler .recall that for a well - typed cogentprogram , the compiler produces c code , a shallow embedding in isabelle / hol , and a refinement proof between them .we say a c program correctly implements its cogentshallow embedding if the following holds :  the c program terminates with defined execution ; and  if the initial c state and cogentstore are related , and the input values of the programs are related , then their output values are related .this means , the compiler correctness theorem states that a _ value relation _ is preserved .this relation is concrete and can be inspected . in , we introduced a value typing relation between update semantics and value semantics . at each other refinement stage in the following sections, we will introduce a further relation between values of the two respective programs . by composing these value relations ,we get the value relation between the result of the c program and the shallow embedding by going through the intermediate update semantics value and value semantics result .note that the relation in  also depends on a cogentstore .the c state and cogentstore are related using the _ state relation _ , defined in detail in .let and ( defined in ) be two functions that monomorphise expressions and ( function ) values , respectively , using a rename function provided by the compiler .further , let be a state relation , a shallow embedding , a monomorphic deep embedding , a c program , a cogentstore and a c state. then we define as follows : + if ( and , then successfully terminates starting at ; and after executing , for any resulting value and state , there exist , , and such that :   given a cogentfunction  that takes of type as input , let  be its generated c code , its shallow embedding , and its deep embedding .let  be an argument of  , and  and be the update and value semantics arguments , of appropriate type , for  . if is injective , then   this top - level refinement theorem additionally assumes that abstract functions in the program adhere to their specification and that their behaviour remains the same when they are monomorphised .intuitively , this theorem states that for related input values , all programs in the refinement chain evaluate to related output values .this can of course be used to deduce that there exist intermediate programs through which the c code and its shallow embedding are directly related .the proof engineer does not need to care what those intermediate programs are .before we present each refinement step , we briefly describe the well - typing theorems that are used in these steps .the cogentcompiler proves , via an automated isabelle / hol tactic , that the monomorphic deep embedding of the input program is well - typed .specifically , the compiler defines in isabelle / hol and proves that each cogentfunction  is well - typed in accordance with its type as given by .polymorphic well - typing is derived generically in the monomorphisation proof in .let  be a ( monomorphic ) cogentfunction , where. then .because , as we will see in , proving refinement requires access to the typing judgements for program sub - expressions and not just for the top level , the cogentcompiler also instructs isabelle to store all of the intermediate typing judgements established during type checking .these theorems are stored in a tree structure , isomorphic to the type derivation tree for the cogentprogram .each node is a typing theorem for a sub - expression of the program .this section describes the first three transformations from in . in the first step, the c code is converted to simpl  by the c - to - isabelle parser  , used in the sel4 project  .this step is kept as simple as possible and makes no effort to abstract from the details of c.  the second step in , which is the first link in the formal refinement chain , applies a modified version of the autocorres tool to produce a _ monadic _ shallow embedding of the c code semantics , and additionally proves that the simpl c semantics is a refinement of the monadic shallow embedding .we modify autocorres to make its output more predictable by switching off its control - flow simplification and forcing it to always output the shallow embedding in the _ nondeterministic state monad _ of  . in this monad, computation is represented by functions of type . here is the global state of the c program , including global variables , while is the return - type of the computation .a computation takes as input the global state and returns a set , , of pairs with new state and result value .additionally the computation returns a boolean , , indicating whether it failed ( e.g. whether there was undefined behaviour ) .while autocorres was designed to facilitate manual reasoning about c code , here we use it as the foundation for automatically proving correspondence to the cogentinput program .one of the main benefits autocorres gives us is a _ typed _ memory model .specifically , the of the autocorres monadic representation contains a set of _ typed heaps _ , each of type  , one for each type  used on the heap in the c input program .proving that the autocorres - generated monadic embedding never fails implies that the c code is type- and memory - safe , and is free of undefined behaviour  .we prove non - failure as a side - condition of the refinement statement from the autocorres shallow embedding to the cogentmonomorphic deep embedding in its update semantics , essentially using cogent s type system to guarantee c memory safety during execution .this refinement proof is the third step in . to phrase the refinement statement we first define how deeply - embedded cogentvalues and types relate to their corresponding monadic shallowly - embedded c values .the value - mapping is captured by the _ value relation _ , defined in isabelle / hol automatically by the cogentcompiler using ad hoc overloading . is defined separately for each cogentprogram because the types used in the shallow c embedding depend on those used in the c program as , e.g. , c structs are represented directly as isabelle / hol records .the type relation is used to determine , for a cogentvalue  of type , which typed heap in the state of the monadic shallow embedding  should appear in . as with is defined automatically for each cogentprogram .  given and  for a particular cogentprogram , the _ state relation _ defines the correspondence between the store  over which the cogentupdate semantics operates , and the state  of the monadic shallow embedding . if and only if : for all pointers  in the domain of , there exists a value  in the appropriate heap of  ( as defined by ) at location  , such that holds .  with and , we define refinement generically between a monadic computation  and a cogentexpression  , evaluated under the update semantics .we denote the refinement predicate .because changes for each cogentprogram , we parameterise by an arbitrary state relation  .it is parameterised also by the typing context  and the environment  , as well as by the initial update semantics store  and monadic shallow embedding state  .monad - to - update correspondence )\longrightarrow \\ \quad \;\ ;   ( \mu,\sigma ) \in r \longrightarrow \\ \quad\quad  \;(\neg\ \failed \ ( p_m \ \sigma)\ ; \wedge \\ \quad\quad  \;(\forall v_m \;\sigma^\prime . \ ( v_m,\sigma^\prime ) \in \results\ ( p_m\;\sigma ) \longrightarrow\\ \quad\quad\quad   ( \exists \mu^\prime \\updsem{u}{e}{\mu}{u}{\mu^\prime } \wedge     ( \mu^\prime,\sigma^\prime ) \in r \wedge\valrel\ u\ v_m ) ) ) \end{array}\ ] ]  the definition states that if the state relation  holds initially , then the monadic computation  can not fail and , moreover , for all executions of  there must exist a corresponding execution under the update semantics of the expression  such that the final states are related by  and holds between their results .autocorres proves automatically that : .[ [ refinement - proof ] ] refinement proof + + + + + + + + + + + + + + + +  the refinement proof is automatic in isabelle , driven by a set of syntax - directed rules , one for each cogentconstruct . the proof procedure makes use of the fact that the cogentterm is in a - normal form to reduce the number of cases that need to be considered and to simplify the higher - order unification problems that some of the proof rules pose to isabelle .this refinement theorem does not need an explicit formal assumption of well - typedness of the cogentprogram .the proof tactic will simply fail for programs that are not well - typed .depicts two rules , one for expressions  that are variables and the other for  .these correspond respectively to the two basic monadic operations , which yields values , and , for sequencing computations .observe that the rule corres - let is _ compositional _ : to prove that corresponds to the rule involves proving that ( 1 )  corresponds to and ( 2 ) that  corresponds to  when each are executed over corresponding results  and  ( e.g. as yielded by and respectively ) .compositionality significantly simplifies the automation of the correspondence proof .the typing assumptions of corres - let are discharged by appealing to the type theorem tree generated by the compiler ( see ) .c corres - var +  + corres - let +  the rules for some of the other constructs , such as , , and , contain non - trivial assumptions about and about the types used in the program .once a program and its are fixed , a set of simpler rules is automatically generated by _specialising _ the generic rules for each of these constructs to the particular and types used in the input program .this in effect discharges the non - trivial assumptions of these rules once - and - for - all , allowing the automated proof of correspondence to proceed efficiently .conceptually , the refinement proof proceeds bottom - up , starting with the leaf functions of the program and ending with the top - level entry points ; results proved earlier are used to discharge assumptions for callees .the proof tactic thus follows the call - graph of the input program .currently , the tactic is limited to computing call graphs correctly only for programs containing up to second - order functions .we did not need higher orders in our applications yet , but the tactic can certainly be extended if needed .the resulting refinement theorem at this stage assumes that holds for all the abstract functions used in the program .let  be a ( monomorphic ) cogentfunction , such that .let  be its monadic shallow embedding , as derived from its generated c code .let  and be arguments of appropriate type for  and respectively . then:    to complete this step , the compiler simply applies .[ s : mono ] having made the transition to the value semantics , the proof now establishes the correctness of the compiler s monomorphisation pass , moving upwards in from a monomorphic to a polymorphic deep embedding of the input program .  in this pass, the compiler generates an injective renaming function that , for a polymorphic function name and types , yields the specialised monomorphic function name , mapping names downwards , from the polymorphic to the monomorphic level .just as we assume abstract functions are correctly implemented in c , we also assume that their behaviour remains consistent under .to establish correctness of monomorphisation , we essentially have an isabelle function that repeats the monomorphisation process on behalf of the cogentcompiler , and prove that ( 1 ) the monomorphised program it produced is identical to that produced by the compiler , and ( 2 ) that the monomorphised program is a correct refinement of the polymorphic one .we define two isabelle / hol functions , both parameterised by  : one for monomorphising expressions , called , and the other for monomorphising ( function ) values , called .the functions specialise function calls and use to monomorphise all function calls in expressions and values , respectively .the functions are defined compositionally for all other cogentconstructs .step ( 1 ) is proved by straightforward rewriting , and is automated on a per - program basis .step ( 2 ) is embodied in the following refinement theorem , which we prove , once and for all , by rule induction over the value semantics .the specialisation lemma  of , is a key ingredient of this proof .let be a ( polymorphic ) cogentfunction whose definition given by is .let  be an appropriately - typed argument for  .let  be an injective renaming function .then :   note that on the left - hand - side of the implication , the computation runs under the value semantics where the renaming is applied across the of the right - hand side .the compiler generates a well - typedness proof for the monomorphic deeply embedded program ( ) .we use the top - level theorem s injectivity assumption on to infer well - typedness of the polymorphic deeply embedded program .   in this section ,the proof makes the transition from deep to shallow embedding , where the shallow embedding is a pure function in isabelle / hol .this shallow embedding is still in a - normal form and is produced by the compiler as a separate isabelle / hol theory file .there is a second , neater shallow embedding , explained in the following section , that is closer to the cogentinput program .  for each cogenttype ,the compiler generates a corresponding isabelle / hol type definition , and for each cogentfunction , a corresponding isabelle / hol constant definition .we can drop the linear types at this stage and remain in isabelle s simple types , because we have already made use of them : we are in the value semantics .in addition to these definitions , the compiler produces a theorem that the deeply embedded polymorphic cogentterm under the value semantics correctly refines this isabelle / hol function .refinement is formally defined here by the predicate that defines when a shallowly embedded expression  is refined by a deeply embedded one  when evaluated under the environment  .  that is , corresponds to under variable bindings if whenever evaluates to an under , then and are in the value relation .similarly to the proof from monadic c to update semantics , the value relation here is one polymorphic constant in isabelle / hol , defined incrementally via ad - hoc overloading .the program - specific refinement theorem produced is :  let be an a - normal cogentfunction such that , and let  be s shallow embedding .then   note that ensures that and are of matching type , and that the shallow expression ensures in isabelle s type system that it is the appropriate one .like the c refinement proof in , this proof is automatic and driven by a set of syntax - directed rules , specialised to cogenta - normal form .depicts the final top - level shallow embedding , only mildly polished for presentation , for the cogentexample of .  ....ext2_free_branch ( cnt.mk depth nd ( acc.mk ex fs inode ) mdep ) \<equiv > if depth + 1 < mdep then  case uarray_create ( rr.mk ex ( to\<^sub > f nd - fr\<^sub > f nd ) ) of  r\<^sub>1\<^sub>1.success ds\<^sub>1\<^sub>0 \<rightarrow >   let ( ex , ds\<^sub>1\<^sub>2 ) = take ds\<^sub>1\<^sub>0 rr.p1\<^sub > f ;     ( children , ds\<^sub>1\<^sub>3 ) = take ds\<^sub>1\<^sub>2 rr.p2\<^sub > f ;     ( mbuf , nd_t ) = take nd mbuf\<^sub > f ;     ( children , ds\<^sub>1\<^sub>6 ) = take      ( uarray_map_no_break       ( arraymapp.mk children ( fr\<^sub > f nd_t )        ( to\<^sub > f nd_t ) ext2_free_branch_entry        ( cnt.mk ex inode ( fr\<^sub > f nd_t ) mbuf ) ( ) ) )      rr.p1\<^sub > f ;  ...   ....  as shows , the isabelle definitions use the same names as the cogentinput program and they have the same structure as the input program . in this example, it remains visible that the compiler replaces tuples from the surface syntax with records in the core language , e.g.`cnt.mk ` is the isabelle record constructor for the type ` cnt ` , and instead of tuple pattern matching , the compiler generates a sequence of ` take ` expressions . in practice , these disappear by rewriting when reasoning about the function .tuple syntax could be reconstructed in an additional small proof pass if so desired .the correctness statement for this phase is simple : it is pure isabelle / hol equality between the a - normal and neat shallow embedding for each function .for instance : the proof is simple as well .since we can now use equational reasoning with isabelle s powerful rewriter , we just unfold both sides , apply extensionality and the proof is automatic given the right congruence rules and equality theorems for functions lower in the call graph .this proof stage was the easiest and fastest of the stages to construct ; it took about 1 person day .this is a strong indication that this representation of the program is well suited for further reasoning on top .[ [ language - restrictions - totality ] ] language restrictions : totality + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +  the current version of cogentpurposefully omits primitive constructs for iteration and recursion , because we wanted to ensure that the language was total for a neat shallow embedding in hol ( which is total ) .however , since our language meta - level proofs do not require totality , we only require that _ each program _ is terminating .we are therefore contemplating to relax this restriction and allow cogentiterator constructs where termination is obvious enough for isabelle to prove automatically .[ [ formal - language - semantics ] ] formal language semantics + + + + + + + + + + + + + + + + + + + + + + + + +  the cogentsemantics in isabelle departs slightly from that presented in . in particular , we enriched the update semantics to carry enough value type information to infer their corresponding c types , and adjusted the typing rules accordingly . while not needed for any of the proofs of , this information is used in the automatic c - correspondence proof . in addition , we found ourselves repeating parts of the ( linear ) type preservation proof in rule inductions on the semantics that make use of typing assumptions .this means , while type erasure is an important property for languages to enjoy ( and _ is _ enjoyed by cogent ) , dynamic semantics with type information are helpful for mechanised reasoning . ideally , there should be an erased and a typed dynamic semantics , with type safety implying their equivalence .  [ [ optimisation ] ] optimisation + + + + + + + + + + + +  the current cogentcompiler performs little optimisation when generating c code and leaves low - level optimisation to gcc or compcert .clever optimisations in the cogent - to - c stage would complicate our current syntax - directed correspondence approach .cogent - to - cogentoptimisations , however , are different . the ease by which we prove the correctness of the a - normalisation over the shallow embedding via rewriting , suggests fruitful ground for optimisation .we leave exploring this idea for future work .  [[ effort - and - size ] ] effort and size + + + + + + + + + + + + + + +  cogenthas been under development for over 2 years and has continually evolved as we have scaled the language to ever larger applications .all up , the combined language development and certifying compiler took person - years .engineering the cogentcompiler , excluding person - monthsspent on proof automation and proof framework development , consumed person - months .the remaining person - monthswas for the design , formalisation and proof of cogentand its properties ( e.g. the theorems of ) , a small amount of which was also spent on early compiler development .the total size of the development in the isabelle theorem prover is lines of code ( including comments and whitespace ) , which includes the once - and - for - all language proofs plus automated proof tactics to perform the translation validation steps , given appropriate hints from the cogentcompiler .the cogentcompiler , written in haskell , is source lines of code ( excluding comments and whitespace ) . for 6,454lines of etx2 cogentcodewe generate 76,759lines of isabelle / hol proofs and embeddings .like us , the high - assurance systems programming  project seeks to improve systems software by combining formal methods and programming language research . likecogent , hasp s systems language , habit , is a domain specific functional language . show the correctness of a garbage collector in this project ; however , to the best of our knowledge , there exist no full formal language semantics yet .ivory  is a domain specific language embedded in haskell also for implementing correct systems software .it generates well - defined , memory safe c code ; however , unlike cogentit does not _ prove _ correctness of the generated code .linear types have been used in several general purpose imperative languages to ensure memory safety without depending on a runtime , such as in vault  and .paclang is an imperative domain - specific language which uses linear types to guide optimisation of packet processing applications on network processors .similar substructural type systems , namely uniqueness types , have been integrated into functional programming languages such as clean  .however , the type system there is only used as a way to provide a purely functional abstraction over effects , and thus clean still depends on a run - time garbage collector .to the best of our knowledge , is the only work which proves the equivalence of the functional and imperative interpretation of a language with a linear type system .the proof is by pen and paper , from a first order functional language with linear types to its translation in c. cogentin comparison is higher order and its compiler produces a machine checked proof linking a purely functional shallow embedding to its c implementation .examples for verified compilers for high - level languages are cakeml  , discussed in more detail in , which compiles a full ml dialect , including verified runtime and garbage collection . in contrast , focuses on a compositional approach to compiler verification for a relatively simple functional language , pilsner , to an idealised assembly language . also generate a shallow embedding representation of a program to facilitate proofs about properties via a proof assistant , as we do .however , they do not address the verification of the code generated by the compiler .we have presented the cogentlanguage , its self - certifying compiler , their formal definitions and top - level compiler certificate theorem , and the correctness theorems for each compiler stage .the language targets systems code where data sharing is minimal or can be abstracted , performance and small memory footprint are requirements , and formal verification is the aim .cogentis a pure , total functional language to enable productive equational reasoning in an interactive theorem prover .it is higher - order and polymorphic to increase conciseness .it uses linear types to make memory management bugs compile time errors , and to enable efficient destructive in - place update .it avoids garbage collection and a trusted runtime to reduce footprint .it supports a formally modelled foreign - function interface to interoperate with c code and to implement additional data types , iterators and operations .   cogentsets a new benchmark for trustworthy systems languages , and demonstrates , through the careful application of language design with verified compilation in mind , that writing systems code that supports purely functional equational reasoning is possible

Abstract: we present a self - certifying compiler for the cogentsystems language . cogentis a restricted , polymorphic , higher - order , and purely functional language with linear types and without the need for a trusted runtime or garbage collector . it compiles to efficient c code that is designed to interoperate with existing c functions . the language is suited for layered systems code with minimal sharing such as file systems or network protocol control code .  for a well - typed cogentprogram , the compiler produces c code , a high - level shallow embedding of its semantics in isabelle / hol , and a proof that the c code correctly implements this embedding . the aim is for proof engineers to reason about the full semantics of real - world systems code productively and equationally , while retaining the interoperability and leanness of c.  we describe the formal verification stages of the compiler , which include automated formal refinement calculi , a switch from imperative update semantics to functional value semantics formally justified by the linear type system , and a number of standard compiler phases such as type checking and monomorphisation . the compiler certificate is a series of language - level meta proofs and per - program translation validation phases , combined into one coherent top - level theorem in isabelle / hol .     [ applicative ( functional ) languages ] [ formal methods ]  verification , semantics , linear types , domain - specific languages , file systems , isabelle / hol


if a group of mutants is introduced into a population of wild - type individuals , how long does it take for the population to reach a homogeneous state ?this is a typical question asked in population genetics and evolutionary biology .it can be addressed using the theory of stochastic processes and approaches from statistical physics .  in its simplest form, evolutionary dynamics is modeled as a markov process in a population of individuals of two types .fixation occurs when the process arrives at one of its absorbing states .as the time to fixation is itself a random variable , only the computation of the distribution of fixation times provides a complete answer to our opening question .the majority of existing studies avoid this mathematical challenge and instead focus on calculating only the mean fixation time .while the first moment can provide a good indication of the outcome in some circumstances , this approach can be insufficient when the distribution of fixation times is broad . as we show in this paper ,such scenarios arise in examples from evolutionary game theory .although the master equation describing the birth - death dynamics is linear , calculating fixation time distributions is more intricate than one may initially think .nested expressions for all moments of fixation times are known and from these the distribution can in principle be constructed recursively up to arbitrary precision . however, this approach does not provide a simple closed - form solution or a means of efficiently sampling from the arrival time distribution .an alternative approach is to diagonalize the linear operator of the master equation and to carry out the analysis in eigenspace .this leads to a theorem attributed to karlin and mcgregor , which states that arrival times can be written as the sum of independent , exponentially distributed random variables parametrized by the eigenvalues of the master equation .alternatively stated , the arrival time distribution is given by the convolution of the exponential distributions from which the independent random numbers are sampled , i.e. , it is a phase - type distribution .this theorem has been discussed in numerous sources in the probability theory literature .the discussion of these matters is usually very terse , and not easily accessible to physicists or researchers in adjacent disciplines .researchers in the theoretical biosciences are only recently beginning to use these ideas for the purpose of model reduction .existing results are limited to specific initial conditions and types of birth - death chains , and a clear understanding of the analysis in eigenspace is lacking .we consider one - step birth - death processes with two absorbing states and a general initial condition .this model describes the invasion ( or extinction ) of a number of mutants in a wild - type population .it is a generalization of existing studies , which focus on a single absorbing boundary and a specific initial condition .the purpose of our work is to provide a systematic and explicit closed - form solution for fixation time distributions , and a physical interpretation of different representations in eigenspace . by generalizing the karlin - mcgregor result to account for arbitrary initial conditions and multiple absorbing states ,we show that these different representations can be traced back to one common origin .to generate samples from the fixation time distribution it is sufficient to simulate forward - only processes in eigenspace .this provides effective model - reduction schemes .we use our results to relate fixation processes to the equilibration dynamics of evolutionary systems with mutation ( and hence with no absorbing states ) .these equilibration processes are often characterized by the so - called mixing time , the time it takes the system to come within a set distance of its stationary distribution .we thus discuss an appropriate analog of the fixation time in the limit of small mutation rates , and outline the limitations of this relation .the paper is organized as follows : in sec .[ sec : model ] we describe the model used and the principal idea behind the work . in sec . [ sec : analysis ] we outline the mathematical procedure that takes us from the model to the arrival time distributions .details of the calculations can be found in the appendixes . in sec . [sec : evogames ] we apply our results to specific examples of evolutionary games , confirming both the accuracy and efficiency of our method . in sec .[ sec : equilibration ] we discuss the relationship between the fixation time and mixing time in the limit of small mutation rates , before drawing conclusions in sec . [ sec : conclusion ] .we study a one - step birth - death process with states and characterized by the birth and death rates ( ) , as illustrated in fig .[ fig : fig1 ] .this describes a population of constant size with individuals of the mutant type and of the resident wild type .the states and are absorbing in the absence of mutation , and so the dynamics will end at one of these two states eventually .our objective is to calculate the distribution of arrival times at these absorbing states for a general starting point .the variable denotes the number of invading mutants .the states ( extinction ) and ( fixation ) are absorbing .birth rates are labeled and death rates . ]the outcome of our analysis ( detailed below ) are the reduced forward - only processes in eigenspace illustrated in fig . [fig : fig2 ] , which have the same arrival time distribution as the original birth - death process .the forward jump rates are determined by the eigenvalues of the original birth - death process .the schematic in fig .[ fig : fig2](a ) shows multiple forward - only channels , where dashed arrows indicate that some steps are to be skipped .figure [ fig : fig2](b ) shows a single forward - only channel .long arrows indicate direct jumps to the final eigenstate . in both cases ,the number of possible paths is determined by the initial condition and the final state ( or ) of the original birth - death process .arrival time samples of the original process are generated from fig .[ fig : fig2](a ) in the following way : one of the channels is chosen with probability determined by the birth - death rates , the initial condition , and the arrival state of the original real - space process .after a channel has been selected , the clock is started and the forward - only process of the channel is traversed .the clock is stopped when the final state in the schematic is reached ( absorption ) .arrival time samples are generated from fig .[ fig : fig2](b ) by traversing the forward - only chain .the quantities are the probabilities to reach absorption directly from the intermediate eigenstate . these probabilities are again determined by the birth - death rates , the initial condition and the final state of the original process , and explicit formulas can be found in appendix [ app : compute][app : matching ] .   are ( absolute ) eigenvalues of the process in fig .[ fig : fig1 ] , each arrow represents an exponential process with the rate indicated .( a ) shows a set of alternative reaction channels . in each runone channel is chosen with appropriate probability .transitions indicated by dashed arrows are skipped ( zero time ) .( b ) shows a single forward - only chain , in which the final state can be reached directly from some of the intermediate states .both representations are equivalent and generate samples from the arrival time distribution of the process in fig .[ fig : fig1 ] .the case shown here is for arrival at , starting from in the original space . ]to derive these results it is convenient to focus on the interior states in the birth - death process in fig . [fig : fig1 ] .the probability to be in state at time , , satisfies the equation with formal solution .the matrix describes the transient states and has elements , and .the initial condition is ( ) .probability continuously flows into the two absorbing states .hence all eigenvalues of are negative , and so we focus on and its eigenvalues .the matrix exponential can be evaluated by laplace transformation , and subsequent back transformation allows one to calculate and .mathematical details can be found in appendix [ app : calculate ] . up to normalizationthese are the conditional arrival time distributions at states and respectively . for the remainder of the paper we focus only on absorption at state .analogous expressions for absorption at can be found in the appendixes .we find the following expression for the probability flux ( per unit time ) into state  where , and is the determinant of the top - left sub - matrix of ( denoted as ) .we have introduced , where the are exponential distributions with the eigenvalues of , , as parameters .the symbol represents a convolution .the object is of the form where are the eigenvalues of the sub - matrix . in these expressions is the usual dirac distribution , and is its derivative , as described in appendix [ app : background][app : dirac ] .we can identify the prefactor as the probability that the original system gets absorbed in state ( as opposed to ) .the effective dynamics shown in fig . [ fig : fig2 ] are obtained by evaluating the convolutions in eq . .to illustrate this it is useful to first consider the convolution of the exponential distribution with an object of the form ( ) . in appendix [ app :background][app : conv ] we show that \!. \label{eq : expconv}\ ] ] assuming ( which will be the case throughout our analysis ) this describes a convex combination of a point mass at zero and an exponential distribution . for samples ,set with probability , otherwise draw from .  to arrive at the dynamics depicted in fig .[ fig : fig2](a ) , each of the terms of the form in eq .is paired up with a separate exponential , as described in appendix [ app : compute][app : pairing ] .this creates a total of possible forward - only channels with up to exponential steps skipped , as shown in fig .[ fig : fig2](a ) .to arrive at the dynamics shown in fig .[ fig : fig2](b ) , the objects of the form are successively convoluted with the full chain from the right , as described in appendix [ app : compute][app : matching ] .this leads to channels , in which exponential steps are skipped .this can be illustrated as a single forward - only channel , with appropriate rates of jumping from intermediate eigenstates to absorption . by considering theseforward - only processes we arrive at closed - form expressions for the arrival time distributions . for arrival at state , the distribution is given by ( see appendix [ app : compute][app : bottomline ] ) .\label{eq : bottomline}\ ] ]  the representation shown in fig .[ fig : fig2](a ) corresponds to the picture obtained for a restricted set of processes by probabilistic methods in ref . . on the other hand , fig .[ fig : fig2](b ) reflects the findings of refs . , derived from the construction of intertwining processes .our analysis shows that these different decompositions originate from one common structure , eq . .the explicit schemes in fig .[ fig : fig2 ] provide a computational method to generate samples from the arrival time distribution efficiently , for example by carrying out simulations of these forward processes using the gillespie algorithm .it is important to keep in mind that the eigenstates shown in figs .[ fig : fig2](a ) and [ fig : fig2](b ) can not be mapped one to one to the states in fig .[ fig : fig1 ] .the equivalence of the real and eigenspace representations only holds on the level of arrival time statistics .as an application of this theory we now consider examples of evolutionary dynamics with frequency - dependent selection .such models are used to describe the interaction of invading mutants ( ) and resident wild - type individuals ( ) .these scenarios can be formulated as evolutionary games .we focus on a normal form game , where and are the expected payoffs in a population of individuals of type and individuals of type . for this examplewe assume a pairwise comparison process , leading to birth and death rates given by { i(n - i)}/{n} ] , respectively , where and .the parameter is the so - called intensity of selection .the parameters specify the interaction , and we consider three possible scenarios : coexistence ( and , stable heterogeneous population ) ; coordination ( and , unstable heterogeneous population ) ; and the prisoner s dilemma ( , stable homogeneous population ) .   for different evolutionary games .main panel : lines show results from the theory [ eq .] , symbols are from simulations ( runs per game ) .the mean fixation time ( arrows ) is not a good description of the distribution .inset : open markers / dashed lines show computer time needed to obtain arrival time distributions from simulations , full markers / solid lines are for the semi - analytical approach and indicate the polynomial scaling .direct simulations can only approximate the exact arrival time distribution to a given accuracy ( see appendix [ app : compute][app : accuracy ] for details ) .( , , .coexistence game : ; coordination game : ; prisoner s dilemma : , , ) . ]  as shown in fig .[ fig : fig3 ] , arrival time distributions can be broad and skewed , such that the mean fixation time contains only limited information . figure [ fig : fig3 ] also demonstrates the computational benefits of our formalism . evaluating the distribution in eq .  requires operations as the spectra of and are needed .generating arrival time distributions from simulation of the original birth - death process instead can take exponentially long .for the coordination game and the prisoner s dilemma , fixation at is rare and the bottleneck of direct simulations is the limited sampling . for coexistence games ,fixation times are exponentially long in .this impedes accurate simulations .direct numerical integration of the master equation would suffer from the same problem .we now consider birth - death processes without absorbing states by adding mutation occurring at a rate , such that and .all other transition rates depicted in fig . [ fig : fig1 ] are and are only affected at sub - leading order by ( exact transition rates can be found in appendix [ app : equilibration][app : mutation ] ) .the timescale of the dynamics is characterized by the so - called ` mixing time ' , .this is the time taken for the probability distribution , , to come within a specified distance of the stationary distribution , i.e. , is the first time at which =\varepsilon ] ( found from numerical integration of the master equation with mutation ) .the probability quickly approaches the fixation distribution , , before slowly leaking to the stationary state , . for ,the trajectory starts at and leaves the shaded area at time .for any point inside the shaded area , the distance to the points and in our metric ( solid lines ) are equal .payoff parameters are and , which corresponds to a coordination game .remaining parameters are , , , and . ]  however , equilibration in many systems with rare mutations is a two - step process ; the system first reaches an intermediate distribution that is dependent on the initial condition , before ` leaking ' on a longer timescale into the final stationary state .this is analogous to the quasi - stationary distribution before reaching absorption in systems without mutation .our analysis suggests that this intermediate distribution of systems with is close to the terminal distribution of the system with , and that both systems initially evolve along similar trajectories ( see appendix [ app : equilibration][app : mutation ] ) .this can be seen in fig .[ fig : fig4 ] where we represent the probability distribution as single points in the -plane .the distribution first approaches the terminal distribution before slowly converging to the stationary distribution .the most appropriate analog of fixation times in systems with small mutation rates is thus the time to reach this intermediate distribution , not the time to stationarity ( mixing time ) .  ) .( b ) depicts the mixing time for and ( from numerical integration of the master equation ) .reaction rates and parameters are as in fig .[ fig : fig4 ] . ]the mixing time can related to the fixation time in a different way : the probability distribution initially satisfies = d[{\mathbf{p}}(t),{\mathbf{\phi}}] ] for the cumulative fixation time distribution .the condition =1/2 ] .we consider initial conditions of the form ( ) .our strategy is to compute and , and from these the rates and , with which probability arrives in the absorbing states , can be obtained .thus we are interested in {1,i_0 } , \nonumber\\ \widehat{p}_{n-1|i_0}(s ) & = \bigl[(s{{\rm 1\!\!i}}-\mathbb{a})^{-1}\bigr]_{n-1,i_0}.\end{aligned}\ ] ]  the element of the inverse of an invertible matrix is given by {ij}=c_{j , i}/\det \mathbb{b} ] , we can perform the inverse laplace transform of the expressions in eq . .we find { \mathcal{e}^{(\lambda_1 ) } } * \dots * { \mathcal{e}^{(\lambda_{n-1 } ) } } *  \left(\delta+x_1^{-1}\delta'\right ) * \dots * \left(\delta+x_{n - i_0 - 1}^{-1}\delta'\right),\nonumber\\ \dot{p}_{n|i_0}(t ) & =  \left[\frac{\prod\limits_{i = i_0}^{n-1 } b_i  \prod\limits_{\alpha=1}^{i_0 - 1 } y_\alpha}{\prod\limits_{\beta=1}^{n-1}\lambda_\beta}\right ] { \mathcal{e}^{(\lambda_1 ) } } * \dots * { \mathcal{e}^{(\lambda_{n-1 } ) } } * \left(\delta+y_1^{-1}\delta'\right ) * \dots * \left(\delta+y_{i_0 - 1}^{-1}\delta'\right ) .\label{eq : app : general_solutions}\end{aligned}\ ] ]  this is the expression shown in eq . .we identify the prefactors in square brackets as the fixation probabilities and , respectively .   by choosing the initial conditions and , the expressions in eq .can be reduced to { \mathcal{e}^{(\lambda_1 ) } } * \dots * { \mathcal{e}^{(\lambda_{n-1 } ) } } \nonumber\\ & = \phi_{0|n-1 } e_{n-1 } , \nonumber\\ \dot{p}_{n|1}(t ) & =  \left[\prod_{i=1}^{n-1}\frac{b_i}{\lambda_i}\right ] { \mathcal{e}^{(\lambda_1 ) } } * \dots * { \mathcal{e}^{(\lambda_{n-1 } ) } } \nonumber\\ & = \phi_{n|1 } e_{n-1 } , \label{eq : app : antal}\end{aligned}\ ] ] where . from thiswe conclude that is the conditional arrival time distribution at state given is equal to the conditional arrival time distribution at state given .this symmetry has been known for the mean fixation time , and it was recently shown that the correspondence holds for the full distribution .our approach offers an alternative way to obtain this intriguing result .as the convolution operator is commutative , we can order the convolutions in eq .  in any way . the exponential distributions and the objects of the form in eq .can hence be combined in multiple ways .   in this sectionwe choose to couple with for the purposes of , and with when we calculate . carrying out these convolutions in eq . , we arrive at   * \dots * \left[\frac{\lambda_{n-1}}{x_1}\delta+\left(1-\frac{\lambda_{n-1}}{x_1}\right){\mathcal{e}^{(\lambda_{n-1})}}\right ] , \nonumber\\ \dot{p}_{n|i_0}(t ) & = \phi_{n|i_0}\times { \mathcal{e}^{(\lambda_1 ) } } * \dots * { \mathcal{e}^{(\lambda_{n - i_0 } ) } } * \nonumber \\ & \qquad \left[\frac{\lambda_{n - i_0 + 1}}{y_{i_0 - 1}}\delta+\left(1-\frac{\lambda_{n - i_0 + 1}}{y_{i_0 - 1}}\right){\mathcal{e}^{(\lambda_{n - i_0 + 1})}}\right ] * \dots * \left[\frac{\lambda_{n-1}}{y_1}\delta+\left(1-\frac{\lambda_{n-1}}{y_1}\right){\mathcal{e}^{(\lambda_{n-1})}}\right].\end{aligned}\ ] ]  we stress that the objects [ or ] can be paired with any of the exponential distributions .we chose to match these at the end of the exponential chain so that the reduced chains can be systematically compared .this is the representation described in fig .[ fig : fig2](a ) .if we write eqs .  in the form where , then we can recursively convolute the objects involving functions onto the chain of exponentials from the right .we note that ,\ ] ] which follows directly from eq . .from this , each of the recursive convolutions introduces a new exponential chain with one step less .for example ,    * \left(\delta+x_2^{-1}\delta'\right ) * \dots* \left(\delta+x_{n - i_0 - 1}^{-1}\delta'\right)\nonumber\\ & = \biggl\{\left(1-\frac{\lambda_{n-1}}{x_1}\right)\left(1-\frac{\lambda_{n-1}}{x_2}\right)e_{n-1}+\left[\left(1-\frac{\lambda_{n-1}}{x_1}\right)\frac{\lambda_{n-1}}{x_2 } + \frac{\lambda_{n-1}}{x_1}\left(1-\frac{\lambda_{n-2}}{x_2}\right)\right]e_{n-2}\nonumber\\ & \hspace{.5cm}+\frac{\lambda_{n-1}}{x_1}\frac{\lambda_{n-2}}{x_2 } e_{n-3}\biggr\ } * \left(\delta+x_3^{-1}\delta'\right ) * \dots * \left(\delta+x_{n - i_0 - 1}^{-1}\delta'\right).\nonumber\\\end{aligned}\ ] ]  performing all the convolutions leads to the following expressions : ,\nonumber\\ \frac{\dot{p}_{n|i_0}(t)}{\phi_{n|i_0 } } & = \left(\prod_{\alpha=1}^{i_0 - 1 } \frac{1}{y_\alpha}\right ) \sum_{\alpha=1}^{i_0}\biggl[e_{n-\alpha}(t ) \left(\prod_{\beta=1}^{\alpha-1 } \lambda_{n-\beta}\right ) \times\nonumber\\ & \hspace{0cm}\sum_{j_1=1}^{\alpha}\left(y_{j_1}-\lambda_{n - j_1}\right ) \sum_{j_2=j_1}^{\alpha}\left(y_{j_2 + 1}-\lambda_{n - j_2}\right ) \sum_{j_3=j_2}^{\alpha}~~ \dots \sum_{\substack{j_{i_0-\alpha}=\\j_{i_0-\alpha-1}}}^{\alpha}\left(y_{j_{i_0-\alpha}+i_0-\alpha-1}-\lambda_{n - j_{i_0-\alpha}}\right ) \biggr ] .\label{eq : app : convolution2}\end{aligned}\ ] ]  these expressions can be written as where and are constants ( independent of time ) .the fixation time distributions are thus linear combinations of the distributions .we note here the equalities   we now proceed to express the above linear combination of exponential chains [ eq . ] as the single chain shown in fig . [fig : fig2](b ) . in the schematic shown in this figure the system can transition to two possible states if currently in eigenstate : either or .these paths have transition rate and , respectively. the total rate of transitioning out of is then , and the waiting time at is an exponential distribution with parameter , no matter whether the system transitions to or to .the quantity denotes the probability that the next state of dynamics in eigenspace is , if the system is currently in eigenstate . with probability the next state is eigenstate . evaluating the probability of a trajectory in terms of , and then matching with eq .  gives   we can express all transition rates in fig .[ fig : fig2](b ) as    the final expressions for the ( un - normalized ) arrival time distributions follow directly from eq . .first we note that the convolution of exponential distributions has the form   substituting this expression into eq . , or equivalently eq ., we arrive at the final expressions , \nonumber\\ \dot{p}_{n|i_0}(t ) & = \left(\prod_{\ell = i_0}^{n-1}b_\ell\right ) \sum_{\alpha=1}^{n-1}\left [ \frac{\prod\limits_{\gamma=1}^{i_0 - 1 } \left(y_\gamma-\lambda_\alpha\right)}{\prod\limits_{\substack{\beta=1\\\beta\ne \alpha}}^{n-1}(\lambda_\beta-\lambda_\alpha)}e^{-\lambda_\alpha t}\right ] .\label{eq : app : bottom_line}\end{aligned}\ ] ] evaluating these expressions requires the calculation of the eigenvalues , and .   in the inset of fig .[ fig : fig3 ] we show that computing arrival time distributions directly from simulations is less efficient than computing them exactly using our formalism . to generate the cpu - time curve for the simulation method we measure the distance , , between the histogram of arrival times at state , , against the exact distribution .this distance is defined by where is the number of histogram bins .note that this is the continuous analog of the distance measure between distributions to be discussed in the next section .the histogram , , is populated with an increasing amount of independent realizations until the distance falls below .we then plot the time taken to complete this number of simulation runs of the given process .in the system without mutation all realizations reach fixation eventually .if the dynamics is started from state [ i.e. , the stationary state of the birth - death process , i.e. , the terminal distribution , is of the form the quantity is the probability that the process reaches the absorbing state .the probability of being absorbed at is .let us now consider the distance of the distribution from this distribution . in line with the existing literature we use the distance measure =\frac{1}{2}\sum_{i=0}^n \left|p_i - q_i\right|,\ ] ] for two distributions and .we then have & = \frac{1}{2}\biggl[\left|p_0(t)-(1-\phi_{n|i_0})\right| \nonumber\\ & \quad+ \sum_{i=1}^{n-1 } p_i(t ) + \left|p_n(t)-\phi_{n|i_0}\right|\biggr].\end{aligned}\ ] ] probability continuously flows into the absorbing states , hence and [ approaches from below with time , and similarly for . we can therefore simplify the above expression , and we are left with & = \frac{1}{2}\left[1-p_0(t)-p_n(t)+\sum_{i=1}^{n-1}p_i(t)\right]\nonumber\\ & = 1-p_0(t)-p_n(t ) .\label{eq : app : fixdistance}\end{aligned}\ ] ] this means that the distance  ] be the probability distribution of the system without mutation .the time evolution is described by the master equation where is an transition matrix ( to be distinguished from the truncated matrix ) .let be the distribution in the system with mutation whose evolution is described by where the matrix reflects the difference between the systems with and without mutation .the elements of both matrices and are .now , let , such that we want to calculate how the separation , , grows in time given that both systems ( with and without mutation ) start from the same initial condition [ i.e. , . for this purpose it is convenient to work in the eigenspace of .this matrix has two zero eigenvalues , , with eigenvectors and .these are the absorbing states of the system without mutation .   on short timescales ( ) , and hence the separation is also .that is to say in the limit , both systems ( with and without mutation ) initially evolve along the same trajectory . on this time scaleboth systems approach the distribution .  on a longer time scale [ , differences between the two systems become of . however these differences are concentrated on the states and .effectively , a redistribution of probability mass between the boundary states takes place .the distribution of the system with mutation evolves from to , as shown in fig .[ fig : fig5 ] .   approximating the stationary distribution of the system with small mutation rate as we have & \approx \frac{1}{2}\biggl[\left|p_0^{(u)}(t)-(1-\sigma)\right| \nonumber\\ & \quad+ \sum_{i=1}^{n-1 } p_i^{(u)}(t ) + \left|p_n^{(u)}(t)-\sigma\right|\biggr ] , \label{eq : app : distu}\end{aligned}\ ] ] for the distance between the distribution of the system with mutation at time and the stationary distribution .while and are monotonically increasing with time in the system without mutation , this is not necessarily the case if there is mutation .hence we can not easily drop the absolute values in eq .  as in the case without mutation .we observe , though , that and for . hence there is an initial phase of the dynamics in which and .let us write for the first time at which either or ( whichever happens first ) .prior to this time we have & \approx \frac{1}{2}\biggl[(1-\sigma)-p_0^{(u)}(t ) \nonumber\\ & \quad+ \sum_{i=1}^{n-1}p_i^{(u)}(t ) + \sigma - p_n^{(u)}(t)\biggr]\nonumber \\ & = 1-p_0^{(u)}(t)-p_n^{(u)}(t).\end{aligned}\ ] ] this is the same as the distance to the fixation distribution , , in the system without mutation , given in eq . .from this we can conclude that = d[{\mathbf{p}}^{(u)}(t),{\mathbf{\phi } } ] ~~\mbox{for}~t < t^*.\ ] ] this is illustrated in figs .[ fig : fig4 ] and [ fig : fig6 ] , where the distributions and are represented as single points in the plane .therefore , for times , we have the relation & = d[{\mathbf{p}}^{(u)}(t),{\mathbf{\phi } } ] \nonumber\\ & \approx d[{\mathbf{p}}^{(u=0)}(t),{\mathbf{\phi } } ] = \pr(t_{\rm fix}>t ) .\label{eq : app : equivalence}\end{aligned}\ ] ] that is to say , the mixing time is related to the cumulative distribution of fixation times .the first time at which =\varepsilon ] .31ifxundefined [ 1 ] ifx#1 ifnum [ 1 ] # 1firstoftwo secondoftwo ifx [ 1 ] # 1firstoftwo secondoftwo `` `` # 1'''' [ 0]secondoftwosanitize [ 0 ] + 12$12 & 12#1212_12%12[1][0] _ _ ( , ) * * ,  ( ) * * ,  ( ) * * ,  ( ) * * ,  ( ) * * ,  ( ) _ _( , ) _ _ ( , ) * * ,  ( ) _ _ ( , ) * * ,  ( ) * * ,  ( ) * * ,  ( ) * * ,  ( ) * * ,  ( ) * * ,  ( ) * * ,  ( ) * * ,  ( ) * * ,  ( ) * * ,  ( ) * * ,  ( ) _ _ ( , ) * * ,  ( ) * * ,  ( ) * * ,  ( ) * * ,  ( ) * * ,  ( ) * * ,  ( ) _ _ ,  ed .( , ) * * ,  ( ) _ _ , vol .

Abstract: studies of fixation dynamics in markov processes predominantly focus on the mean time to absorption . this may be inadequate if the distribution is broad and skewed . we compute the distribution of fixation times in one - step birth - death processes with two absorbing states . these are expressed in terms of the spectrum of the process , and we provide different representations as forward - only processes in eigenspace . these allow efficient sampling of fixation time distributions . as an application we study evolutionary game dynamics , where invading mutants can reach fixation or go extinct . we also highlight the median fixation time as a possible analog of mixing times in systems with small mutation rates and no absorbing states , whereas the mean fixation time has no such interpretation .


planktonic foraminifera ( pf ) are unicellular organisms that commonly live in the sea surface and intermediate water rarely in the deepest part of water column .pf are very sensible to the seasonal temperature variations , and in particular some species prefer sea surface tropical water , while other species prefer temperate or polar water .the study of dynamic population of pf permit to obtain climatic curves through two methods : i ) study of the percentage ratio between tropical and temperate / polar species ; ii ) analysis of the oxygen isotope variations by carbonatic test of pf .pf are in fact good markers for the reconstruction of earth climate .moreover other methods are used to reconstruct the earth s climate history , as that based on the analysis of variations of ( ) , present in the ice cores from greenland and antarctic . according to refs . , climatic fluctuations were essentially produced by cyclical variations of sun energy received by earth , that periodically change its astronomical parameters ( equinox precession , 21 ky ( ) ; obliquity of earth s axis , 41 ky ; eccentricity of the orbit ky ) .these astronomical cyclicities are known in earth sciences as milankovitch s cycles , and they can be considered a quasi - deterministic signal that periodically produced drastic changes in earth climate .the astronomical forcing is not the only reason for glacial / interglacial oscillations .in fact insolation variations produce changes in the atmospheric temperature , but the geographical distribution , and position , of continent and margin plates are extremely important .the presence of a barrier , as the continental marginal plate , indeed can influence the atmospheric and oceanic currents .in addition to these global events , other `` randomic '' events occur : ( i ) tectonic uplift of belt ridge ; ( ii ) volcanic activity , in particular explosive eruptions ; ( iii ) meteor impacts , that occasionally strike the earth and that caused several catastrophic mass extinctions . the mediterranean sea ,because of its geographical position , between tropical and temperate area , is a good laboratory for the study of the climatic variations of earth history .high resolution studies carried out on marine sediments and ice cores from greenland and antarctic , have demonstrated that in the last kyr , in addition to the classic milankovitch cycles , other cyclic variations were present with a higher frequencies , known as sub - milankovian cycles . in particular spectral analysis carried out on these sequenceshas permitted to recognize periodicities of , , and years .recently geochemical isotopes of ice cores from greenland have suggested that earth s climate variations occur according to the model based on stochastic resonance phenomenon .in this work we analyze data from : ( i ) mediterranean core sediments ( sites , leg ) , taken during ocean drilling program ( odp ) , and compared with upper pleistocene ice cores ( grip and gisp2 ) , from greenland ; ( ii ) landscape section outcropping in southern sicily , and compared with pliocene - pleistocene core sediments come from atlantic ocean sites  . for detailed description of experimentssee refs . .-0.6 cm  -0.6 cm  -0.6 cm [ fig.3 ]  \(i ) * _ mediterranean odp sites _ * - the core from site 963 ( central part of mediterranean sea , sicily channel ) , consisting of grey marls rich of pf , was sampled each cm in order to have a continuous sequence from today to ky before present ( b.p . ) .the pf fluctuation abundances are compared with oxygen isotope of gisp2 .there is a good correlation between the fluctuation percentage ratio of a particular warm species ( _ globigerinoides ruber _ ) and variations . in particularg. ruber _ is always present in the interval today- ky , even if small oscillations in percentage ratio have been observed , in some particular intervals , between ky and ky , _g. ruber _ is absent or very rare ( fig .2 ) due to the drastic decrease of global temperature during younger dryas and last glacial maximum periods .\(ii ) * _ southern sicily _ * - the bonsignore section ( near ribera ) is characterized by a continuous sequence of marly - limestone and marls of trubi and monte narbone formations , rich in pf .this sedimentary sequence is coeval with punta piccola section ( agrigento ) , where lithological cycles were described .bonsignore section recover a time interval between my ( million years ago ) and my . from  my , lithological and foraminifera cyclicities are mostly controlled by precession forcing ( fig .3a ) , while after my the obliquity forcing becomes dominant .this change in climatic earth system is connected with a casual event as the uplift of panama area and , consequently , with the closure of panamian isthmus .3a represents the time interval around the major step in panama closure .this event produced a drastic change in oceanic and atmospheric circulation with the amplification of gulf current gyre and an increase of the formation of north atlantic deep water ( nadw ) in consequence . in fig .3 it is possible to observe that the drastic increase of oscillation amplitude of cold species , recognized in the mediterranean sea , starts in coincidence with sharp increase of oxygen isotope ( atlantic ocean ) .the mediterranean sea has perfectly recorded this important global climatic cooling that favored the formation of polar ice sheet .the dynamics of the biological system above described appear rather complex due to the presence of periodicities which sometimes disappear .the main peculiarities observed from experimental time series of pf are : ( i ) geological events produce `` time windows '' characterized by quasi - periodic fluctuations with almost constant intensity , which can be ascribed to different _ `` noise levels '' _ ; ( ii ) some periodicities appear in one of this `` time window '' , while are absent in all the other ones ; ( iii ) the two species _ g. ruber _ and _ globigerina bulloides _ coexist in a competing dynamical regime . as a first approximation we try to describe the behavior of our ecosystem by a stochastic model of two competing species by using the following generalized lotka - volterra ( lv ) equations   -0.6 cm where and are statistically independent -correlated gaussian white noises with zero mean .the multiplicative noise models the interaction between the environment and the species .the interaction parameters is characterized by a critical value corresponding to . for a coexistence regime of the two speciesis established , while for an exclusion regime takes place , i.e. in a finite time one of the two species extinguishes .it is then interesting to investigate the time evolution of the ecosystem for varying around the critical value in the presence of fluctuations , due to the significant interaction with the environment .this behavior can be obtained assuming subjected to a bistable potential and a periodic driving according to the following stochastic differential equation  where , , and is a generalized bistable potential .the stable states correspond to the two regimes of the deterministic lv model . in eq.([beta_eq ] ) is a -correlated gaussian white noise with zero mean .-0.3 cm  -0.3cm [ time_series ]  to analyze the dynamics of the two species we fix the additive noise intensity at the value  . the time series of the two species are obtained for two different values of the multiplicative noise intensity ( see fig .[ time_series ] ) . for two species coexist and quasi - periodic oscillations appear with random periodical inversions of populations ( fig .[ time_series ] ) .an increase of the noise ( ) produces an enhancement of the amplitude of these quasi - periodical oscillation as observed in experimental data ( see fig . 3 ) .the appearance of some periodicities , previously `` hidden '' , are due to the stochastic resonance phenomenon .the periodical signal of small amplitude , that is the obliquity in fig . 3 , is enhanced by the presence of the noise  .we note finally that the theoretical model , based on the stochastic resonance phenomenon , predicts a time behavior of the two species abundances , which can not be obtained by using models which are simply periodic or stochastic .the main peculiarities observed by analyzing our experimental data of pf in sicily channel can be explained within the proposed model of sr in population dynamics .the nonlinearity of the natural system together with a periodical forcing and a `` _ _ noise signal _ _ '' produces a coherent response of the ecosystem , by enhancing the effect of the geological causes .c. , pujol , c. , _ vergnaud - grazzini .distribution patterns of live planktic foraminifers as related to regional hydrography and productive systems of the mediterranean sea _ , _ marine micropaleontology _ * 25 * ( 1995 ) 187 - 217 .r. sprovieri , e. di stefano , a. incarbona , m.e .gargano , _ a high - resolution record of the last deglaciation in the sicily channel based on foraminifera and calcareous nannofossil quantitat . distribution _ , _ palaeogeo .paleoeco . _ * 202 * ( 2003 ) 119 - 142 .

Abstract: the study of planktonic foraminifera abundances permits to obtain climatic curves on the basis of percentage ratio between tropical and temperate / polar forms . climatic changes were controlled by several phenomena as : ( i ) milankovitch s cycles , produced by variations of astronomical parameters such as precession , obliquity and eccentricity ; ( ii ) continental geodynamic evolution and orogenic belt ; ( iii ) variations of atmospheric and oceanic currents ; ( iv ) volcanic eruptions ; ( v ) meteor impacts . but while astronomical parameters have a quasi - regular periodicity , the other phenomena can be considered as `` noise signal '' in natural systems . the interplay between cyclical astronomical variations , the `` noise signal '' and the intrinsic nonlinearity of the ecologic system produces strong glacial or interglacial period according to the stochastic resonance phenomenon .