Logic for exact real arithmetic

Size: px

Start display at page:

Download "Logic for exact real arithmetic"

Mitchell Miles
5 years ago
Views:

1 Logic for exact real arithmetic Helmut Schwichtenberg Mathematisches Institut, LMU, München Oberwolfach, November / 5

2 Exact real numbers can be given in different formats: Cauchy sequences (of rationals, with Cauchy modulus). Infinite sequences ( streams ) of signed digits { 1, 0, 1}, or { 1, 1, } with at most one ( undefined ): Gray code. Want formally verified algorithms on reals given as streams. Consider formal proofs M and apply realizability to extract their computational content. Switch between different formats of reals by decoration: x A x (x co G A)) (abbreviated x co G A). Computational content of x co G is a stream representing x. / 5

3 Representation of real numbers x [ 1, 1] Dyadic rationals: n<m k n n+1 with k n { 1, 1} with 1 := 1. Adjacent dyadics can differ in many digits: , / 5

4 Cure: flip after 1. Binary reflected (or Gray-) code L R R L L R R L L R R L L R R L 7 8 L R R L L R R L L R R L 1 L 7 16 RRRL, 9 16 RLRL. 0 R 1 3 / 5

5 Problem with productivity: =? (or LRLL... + RRRL =?) What is the first digit? Cure: delay. For binary code: add 0. Signed digit code n<m k n n+1 with k n { 1, 0, 1}. Widely used for real number computation. There is a lot of redundancy: 11 and 0 1 both denote 1. For Gray-code: add U (undefined), D (delay), Fin L/R (finally left / right). Pre-Gray code. 5 / 5

6 Pre-Gray code D U 0 Fin R U 1 R R 3 8 R 7 16 L L D U Fin R Fin L 5 R D Fin 8 R FinL Can remove Fin a (by U Fin a a R, D Fin a Fin a L) U 1 U 9 16 L 3 U RRRLLL... RLRLLL... RUDDDD... all denote 1. Only keep the latter to denote 1. Result: unique representation, called pure Gray code. 6 / 5

7 Average for pre-gray code Pre-Gray code: cototal objects in the (simultaneously defined) free algebras G and H given by the constructors with B = {tt, ff} Lr: B G G U: H G Fin: B G H D: H H 7 / 5

8 Predicates co G and co H Let Γ(X, Y ) := { x r x X r a Psd (x = ax 1 ) r x Y (x = x ) }, (X, Y ) := { x r x X r a Psd (x = ax + 1 ) r x Y (x = x ) } and define ( co G, co H) := ν (X,Y ) (Γ(X, Y ), (X, Y )) (greatest fixed point) Consequences: x co G ( r x co G r a Psd (x = ax 1 ) r x co H (x = x )) x co H ( r x co G r a Psd (x = ax + 1 ) r x co H (x = x )) 8 / 5

9 Lemma (CoGUMinus) x ( co G( x) co Gx), x ( co H( x) co Hx). Proof by coinduction (:= Gfp-axiom), using properties of the unary minus functions. Implicit algorithm. f : G G and f : H H defined by f (Lr a (u)) = Lr a (u), f (U(v)) = U(f (v)), f (Fin a (u)) = Fin a (u), f (D(v)) = D(f (v)). 9 / 5

10 Using CoGUMinus we prove that co G and co H are equivalent. Lemma (CoHToCoG) x (x co H x co G), x (x co G x co H). Implicit algorithm. g : H G and h : G H: g(fin a (u)) = Lr a (f (u)), g(d(v)) = U(v), h(lr a (u)) = Fin a (f (u)), h(u(v)) = D(v) where f := ccoguminus (cl denotes the function extracted from the proof of a lemma L). No corecursive call is involved. 10 / 5

11 Informal proof U. Berger and M. Seisenberger 010. To prove x,y co G (x + y co G) consider two sets of averages, the second one with a carry : P := { x + y x, y co G }, Q := { x + y + i Suffices: Q satisfies the clause coinductively defining co G. x, y co G, i Sd }. By the greatest-fixed-point axiom for co G we have Q co G. Since also P Q we obtain P co G, which is our claim. 11 / 5

12 Lemma (CoGAvToAvc) x,y co G r i Sd r x,y co G (x + y Proof needs CoGPsdTimes: using CoGClause. a Psd nc = x + y + i ). x co G (ax co G). Rest easy, Implicit algorithm. Write f for ccogpsdtimes and s for ccohtocog. f (Lr a (u), Lr a (u )) = (a + a, f ( a, u), f ( a, u )), f (Lr a (u), U(v)) = (a, f ( a, u), s(v)), f (U(v), Lr a (u)) = (a, s(v), f ( a, u)), f (U(v), U(v )) = (0, s(v), s(v )). 1 / 5

13 Lemma (CoGAvcSatCoICl) i Sd x,y co G r j Sd r k Sd r x,y co G (x + y + i = x +y +j + k ). Proof. Define J, K : Z Z such that i (i = J(i) + K(i)) i ( J(i) ) i ( i 6 K(i) 1) Then we can relate x+d and x+y+i by x+d + y+e + i Implicit algorithm. = x+y+j(d+e+i) + K(d + e + i) f (i, Lr a (u), Lr a (u ))=(J(a+a +i), K(a+a +i), f ( a, u), f ( a, u )), f (i, Lr a (u), U(v))=(J(a + i), K(a + i), f ( a, u), s(v)), f (i, U(v), Lr a (u))=(j(a + i), K(a + i), s(v), f ( a, u)), f (i, U(v), U(v ))=(J(i), K(i), s(v), s(v )).. 13 / 5

14 Lemma (CoGAvcToCoG) z ( r x,y co G r i Sd (z = x + y + i ) z co G), z ( r x,y co G r i Sd (z = x + y + i ) z co H). Proof (by coinduction) uses CoGAvcSatCoICl. We need a lemma: SdDisj: d Sd (d = 0 r r a Psd (d = a)). Here r is an (inductively defined) variant of where only the content of the right hand side is kept. 1 / 5

15 Implicit algorithm. g(i, u, u ) = let (i 1, k, u 1, u 1) = ccogavcsatcoicl(i, u, u ) in case csddisj(k) of 0 U(h(i 1, u 1, u 1)) a Lr a (g( ai 1, f ( a, u 1 ), f ( a, u 1))), h(i, u, u ) = let (i 1, k, u 1, u 1) = ccogavcsatcoicl(i, u, u ) in case csddisj(k) of 0 D(h(i 1, u 1, u 1)) a Fin a (g( ai 1, f ( a, u 1 ), f ( a, u 1))). 15 / 5

16 Theorem (CoGAverage) x,y co G (x + y co G). Implicit algorithm. Compose ccogavtoavc with ccogavctocog. 16 / 5

17 Multiplication for pre-gray code To prove x,x (x, x co G x x co G), consider the two sets P := { x y x, y co G }, Q := { x y + z + i x, y, z co G, i Sd }. Suffices: Q satisfies the clause coinductively defining co G. By the greatest-fixed-point axiom for co G we have Q co G. Since also P Q we obtain P co G, which is our claim. 17 / 5

18 Lemma (CoGMultToMultc) x,y co G r i Sd r x,y,z co G (xy = x y + z + i ). Implicit algorithm. We use s for ccohtocog, and au for f (a, u). g(lr a (u), Lr b (u )) = case ccogaverage( abu, abu ) of Lr c (u ) (c + ab, au, bu, cu ) U(v) (ab, au, bu, s(v)) g(lr a (u), U(v))) = (0, au, s(v), as(v)) g(u(v), Lr a (u)) = (0, s(v), au, as(v)) g(u(v), U(v )) = (0, s(v), s(v ), ccogzero). 18 / 5

19 Lemma (JKLr) i Sd a Psd nc v co G r j Sd r d Sd r z co G (v + a + i Implicit algorithm We use s for ccohtocog. = z + j + d). g(i, a, Lr b0 (Lr b (w))) = (J( b 0 b+b 0 +a+i), K( b 0 b+b 0 +a+i), b 0 bw) g(i, a, Lr b0 (U(w))) g(i, a, U(Lr b (w))) g(i, a, U(U(w))) Lemma (JKU) = (J(b 0 + a + i), K(b 0 + a + i), b 0 s(w)) = (J(b + a + i), K(b + a + i), bw) = (J(a + i), K(a + i), s(w)) i Sd v co G r j Sd r d Sd r z co G (v + i = z + j + d) 19 / 5

20 Lemma (CoGMultcSatCoICl) y co G nc i Sd x,z co G r d Sd r j Sd r x,z co G (xy + z + i = x y+z +j + d Implicit algorithm. We use h for ccogavctocog, w 0 for ccogzero g(u 0, i, Lr a (u), Lr b (u )) = let (j, d, w) = cjklr(i, b, h(i, au 0, bu )) in (d, j, au, w) g(u 0, i, Lr a (u), U(v)) = let (j, d, w) = cjku(i, h(i, au 0, s(v))) in (d, j, au, w) g(u 0, i, U(v), Lr a (u)) = let (j, d, w) = cjklr(i, a, h(i, w 0, au)) in (d, j, s(v), w) g(u 0, i, U(v), U(v )) = let (j, d, w) = cjku(i, h(i, w 0, s(v ))) in (d, j, s(v), w) ). 0 / 5

21 Lemma (CoGMultcToCoG) z 0 ( r i Sd r x,y,z co G (z 0 = xy + z + i ) z 0 co G), z 0 ( r i Sd r x,y,z co G (z 0 = xy + z + i ) z 0 co H). Proof (by coinduction) uses CoGMultcSatCoICl. We need SdDisj. 1 / 5

22 Implicit algorithm. g(i, u, u, u ) = let (d, j, u 1, u 1) = ccogmultcsatcoicl(u, i, u, u ) in case csddisj(d) of 0 U(h(j, u 1, u, u 1)) a Lr a (g( aj, u 1, f ( a, u ), f ( a, u 1))), h(i, u, u, u ) = let (d, j, u 1, u 1) = ccogmultcsatcoicl(u, i, u, u ) in case csddisj(d) of 0 D(h(j, u 1, u, u 1)) a Fin a (g(aj, u 1, f (a, u ), f (a, u 1))). / 5

23 [iggg](corec sdtwo yprod ag yprod ag yprod ag=>ag sdtwo yprod ag yprod ag yprod ag=>ah)iggg ([iggg0][let djgg (ccogmultcsatcoicl clft crht crht iggg0 clft iggg0 clft crht iggg0 crht crht crht iggg0) [case (csddisj clft djgg) (DummyL -> InR(InR(clft crht djgg pair clft crht crht djgg pair clft crht crht iggg0 pair crht crht crht djgg))) (Inr boole -> InL(boole pair InR(cIntTimesSdtwoPsdToSdtwo clft crht djgg(cpsduminus boole)pair clft crht crht djgg pair ccogpsdtimes clft crht crht iggg0 (cpsduminus boole)pair ccogpsdtimes crht crht crht djgg (cpsduminus boole))))]]) ([iggg0][let djgg...]) 3 / 5

24 Theorem (CoGMult) x,y co G (xy co G). Implicit algorithm. Compose ccogmulttomultc with ccogmultctocog. / 5

25 Conclusion Want formally verified algorithms on real numbers given as streams (signed digits or pre-gray code). Consider formal proofs M and apply realizability to extract their computational content. Switch between different representations of reals by labelling x as x and relativise x to a coinductive predicate whose computational content is a stream representing x. The desired algorithm is obtained as the extracted term et(m) of the proof M. Verification by (automatically generated) formal soundness proof of the realizability interpretation. 5 / 5

Proofs and computations

Proofs and computations (j.w.w. Kenji Miyamoto) Mathematisches Institut, LMU, München Leeds University, 7. March 2012 Formalization and extraction One can extract from a (constructive) proof of a formula with computational content