Formal verification for numerical methods

Transcription

1 Formal verification for numerical methods Ioana Paşca PhD thesis at INRIA Sophia Antipolis, Marelle Team Advisor: Yves Bertot 1 7 1

2 Robots 2 7

3 Robots efficiency 2 7

4 Robots efficiency safety 2 7

5 Inside the robot lots of wires 3 7

6 Inside the robot lots of wires code computations numerical methods 3 7

7 Ensure correctness of the code tests 7

8 Ensure correctness of the code tests proofs proof assistants formal verification 7

9 Proof assistants define data define functions prove properties trust proofs 5 7

10 Proof assistants COQ and SSREFLECT define data define functions prove properties trust proofs 5 7

11 Example tasks and methods compute a valid position for the robot by solving a system of equations use Newton s method and its properties use interval analysis based methods 6 7 6

12 Newton s method Definition: x n+1 = x n f (xn) f (x n) Properties: convergence to the root of function f speed of convergence local unicity of the root local stability 7 7

13 Kantorovitch s theorem in one dimension Consider an equation f (x) = 0, where f :]a, b[ R, a, b R, f C (1) (]a, b[). Let x 0 ]a, b[ such that U ε (x 0 ) = {x : x x 0 ε} ]a, b[. If: 1. f (x 0 ) 0 and 1 f (x 0 ) A 0; 2. f (x 0 ) f (x 0 ) B 0 ε 2 ; 3. x, y ]a, b[, f (x) f (y) C x y. µ 0 = 2A 0 B 0 C 1. then, the Newton process x n+1 = x n f (xn) f (x n), n = 0, 1, 2,... converges and lim x n = x is a solution of the initial equation, so that n x x 0 2B 0 ε

14 Idea of the proof for every element of the Newton s sequence show that hypotheses 1 - are verified, with different constants; infer that Newton s sequence is a Cauchy sequence and, by the completeness of R, a convergent sequence; prove that the limit of the sequence is a root of the given function

15 Working with real numbers use the COQ standard library on real numbers axiomatic definition: archimedean, total order field, satisfying the least upper bound principle classical real analysis proofs close to pen and paper mathematics other approaches constructive definition intuitionistic logic non-standard analysis

16 Formal proof in one dimension axiomatic reals inequalities absolute value sequences topology derivation Kantorovitch 11 7

17 Some COQ code: Theorem k a n t o _ e x i s t : xs : R, Un_cv Xn xs c_ disc X0 (2 B0 ) xs f xs =

18 Kantorovitch s theorem in several dimensions Let f (x) = 0 be a system with p equations and p variables, with f C (2) (ω) and U ε (x 0 ) = { x x 0 ε} ω. If: 1. the Jacobian matrix W (x) = [ f i x j ] for x = x 0 has an inverse Γ 0 = W 1 with Γ 0 A 0 ; 2. Γ 0 f (x 0 ) B 0 ε 2 ; 3. p k=1 2 f i (x) x j x k C for i, j = 1, 2,..., p and x U ε (x 0 );. 2pA 0 B 0 C 1. Then, Newton s process: x n+1 = x n W 1 (x n )f (x n ) converges to x = lim x n. n 1 7 1

19 Kantorovitch s theorem in several dimensions Let f (x) = 0 be a system with p equations and p variables, with f C (2) (ω) and U ε (x 0 ) = { x x 0 ε} ω. If: 1. the Jacobian matrix W (x) = [ f i x j ] for x = x 0 has an inverse Γ 0 = W 1 with Γ 0 A 0 ; 2. Γ 0 f (x 0 ) B 0 ε 2 ; 3. p k=1 2 f i (x) x j x k C for i, j = 1, 2,..., p and x U ε (x 0 );. 2pA 0 B 0 C 1. Then, Newton s process: x n+1 = x n W 1 (x n )f (x n ) converges to x = lim x n. n 1 7

20 Kantorovitch s theorem in several dimensions Let f (x) = 0 be a system with p equations and p variables, with f C (2) (ω) and U ε (x 0 ) = { x x 0 ε} ω. If: 1. the Jacobian matrix W (x) = [ f i x j ] for x = x 0 has an inverse Γ 0 = W 1 with Γ 0 A 0 ; 2. Γ 0 f (x 0 ) B 0 ε 2 ; 3. p k=1 2 f i (x) x j x k C for i, j = 1, 2,..., p and x U ε (x 0 );. 2pA 0 B 0 C 1. Then, Newton s process: x n+1 = x n W 1 (x n )f (x n ) converges to x = lim x n. n real vectors real matrices sequences of vectors functions of several variables partial derivatives 1 7

21 Kantorovitch s theorem in several dimensions Let f (x) = 0 be a system with p equations and p variables, with f C (2) (ω) and U ε (x 0 ) = { x x 0 ε} ω. If: 1. the Jacobian matrix W (x) = [ f i x j ] for x = x 0 has an inverse Γ 0 = W 1 with Γ 0 A 0 ; 2. Γ 0 f (x 0 ) B 0 ε 2 ; 3. p k=1 2 f i (x) x j x k C for i, j = 1, 2,..., p and x U ε (x 0 );. 2pA 0 B 0 C 1. Then, Newton s process: x n+1 = x n W 1 (x n )f (x n ) converges to x = lim x n. n real vectors real matrices sequences of vectors functions of several variables partial derivatives 1 7 1

22 Setting up the formalization We need to talk about real numbers matrices We use COQ standard library Reals SSREFLECT library matrix Mix SSREFLECT and standard COQ!

23 Mix SSREFLECT and COQ in SSREFLECT hierarchy of algebraic structures abstract matrices, but operations when elements are from a ring in COQ s Reals library real numbers defined by axioms ring structure

24 Dealing with real matrices use existing results for SSREFLECT library define new concepts: e.g. the norm of a real matrix, matrix sequences and series prove properties A < 1 S, A n = S n=1 A < 1 det(i p A) 0 instantiate to a given norm: e.g. the maximum norm D e f i n i t i o n norm_m (A : M_(m, n ) ) : R := \ big [Rmax R0 ] _ i \ sum_j ( Rabs (A i j ) )

25 Formal proof in several dimensions axiomatic reals finite types, indexed operations matrix vectors: operations, norm matrix norm sequences functions derivation Taylor s formula Kantorovitch

26 Some COQ code: Theorem kantororp_ exist : xs : vec R p, conv Xn xs norm ( d i f _ v xs X0 ) 2 b0 f xs = vect

27 22 7 2

28 What about computations?

29 What about computations? in COQ axiomatic real numbers are appropriate for proofs, but not for computations use libraries for exact real arithmetic

30 Exact real arithmetic with co-inductive streams Representation compute a real number in [ 1, 1] with arbitrary precision real numbers represented as streams of signed digits in base β e.g. 1 3 = = 3::3:: = :: 7:::: d i s β = d 1 ::d 2 ::d 3 ::... β = β i ; β < d i < β notice d 1 ::s β = d 1+s β β i=1 25 7

31 Exact real arithmetic with co-inductive streams Representation compute a real number in [ 1, 1] with arbitrary precision real numbers represented as streams of signed digits in base β e.g. 1 3 = = 3::3:: = :: 7:::: d i s β = d 1 ::d 2 ::d 3 ::... β = β i ; β < d i < β notice d 1 ::s β = d 1+s β β redundant representation useful for designing algorithms i=1 e.g. 0::3:: ::6:: =? 0::3::3:: ::6::5:: = 1:: 1:: ::3::3:: ::6::7:: = 1::0::

32 Exact real arithmetic with co-inductive streams Implementation s β = d 1 ::d 2 ::d 3 ::... β = d 1 ::s β ; β < d i < β in COQ: co-inductive definitions and co-recursive functions CoInductive Stream (A : Type ) : Type : = Cons : A Stream A Stream A. Notation " x : : s " := Cons x s. CoFixpoint Sopp ( s : Stream d i g i t ) : Stream d i g i t := match s with d 1 : : s ( d 1 ) : : Sopp s end

33 Exact real arithmetic with co-inductive streams Certification d 1 ::s β = d 1 + s β β link the exact reals with axiomatic reals Variable β : N. CoInductive represents : Stream d i g i t R Prop : = rep : s r k, β < k < β 1 r 1 represents s r represents (k :: s) k+r β. Notation " s r " : = represents s r. certify implementations via this relation Theorem Sopp_correct : s r, s r ( Sopp s ) ( r )

34 Implementation of Newton s method x n+1 = x n f (xn) f (x n) Newton on streams Sx 0 := s 0 Sx n+1 := Sx n g(sx n ) Newton on axiomatic reals Rx 0 := r 0 Rx n+1 := Rx n f (Rxn) f (Rx n) Theorem Snewt_correct : (... ) s 0 r 0 g ( x ) f (x)f (x) ( Sxn g s 0 n ) ( Rxn f f r 0 n ). we can express properties on elements of Newton s sequence

35 Implementation of Newton s method x n+1 = x n f (xn) f (x n) Newton on streams Sx 0 := s 0 Sx n+1 := Sx n g(sx n ) Newton on axiomatic reals Rx 0 := r 0 Rx n+1 := Rx n f (Rxn) f (Rx n) Theorem Snewt_correct : (... ) s 0 r 0 g ( x ) f (x)f (x) ( Sxn g s 0 n ) ( Rxn f f r 0 n ). we can express properties on elements of Newton s sequence but, we cannot reason about the root of the function we want to compute the root in arbitrary precision

36 Newton for streams Goal define a co-recursive algorithm to compute the root x of the function f produce the first digit use a guarded co-recursive call

37 Newton for streams Goal define a co-recursive algorithm to compute the root x of the function f Idea produce the first digit use a guarded co-recursive call start with f and x 0 speed of convergence n s.t. x n = d 1+x n β x = d 1+x β

38 Newton for streams Goal define a co-recursive algorithm to compute the root x of the function f Idea produce the first digit use a guarded co-recursive call start with f and x 0 speed of convergence n s.t. x n = d 1+x n β f (x ) = 0 f ( d 1+x β ) = 0 define f 1 (x) := f ( d 1+x β ) f 1(x ) = 0 x = d 1+x β repeat process to get the first digit of x ; start with f 1 and x n

39 Newton for streams Goal define a co-recursive algorithm to compute the root x of the function f Idea produce the first digit use a guarded co-recursive call start with f and x 0 speed of convergence n s.t. x n = d 1+x n β f (x ) = 0 f ( d 1+x β ) = 0 define f 1 (x) := f ( d 1+x β ) f 1(x ) = 0 x = d 1+x β repeat process to get the first digit of x ; start with f 1 and x n g = f f g 1 (x) := f 1(x) f 1 (x) = f ( d 1 +x β ) 1 β f ( d 1 +x β ) β ) = β g( d 1+x

40 Newton for streams Idea to produce a first digit of x determine x n = d 1+x n β s.t. x = d 1+x β do a co-recursive call with function g 1 (x) = β g( d 1+x β ) and x n Algorithm CoFixpoint exact_newton g s 0 n := match ( make_digit ( Sxn g s 0 n ) ) with d 1 : : s n d 1 : : exact_newton (fun s (β g(d 1 :: s))) s n n end

41 Newton for streams Idea to produce a first digit of x determine x n = d 1+x n β s.t. x = d 1+x β do a co-recursive call with function g 1 (x) = β g( d 1+x β ) and x n Algorithm CoFixpoint exact_newton g s 0 n := match ( make_digit ( Sxn g s 0 n ) ) with d 1 : : s n d 1 : : exact_newton (fun s (β g(d 1 :: s))) s n n end. Theorem exact_ newton_ correct : (... ) ( exact_newton g s 0 n ) x. ensure the same hypotheses for x n and g 1 as for x 0 and g 3 7 3

42 35 7 3

43 Computation with rounding computations on machines are inexact modify Newton s method the method to include rounding x 0 x n+1 = x n f (x n) f (x n ) ( t 0 = x 0 t n+1 = rnd n+1 t n f (t ) n) f (t n )

44 Certified rounding prove that t n x use local stability: x 0 U x 0, x n (x 0 ) x x n (x 0 ): x 0, x 1, x 2, x 3,... x x n (x 1 ): x n ( x 1 ): x n ( x 2 ): x n ( x 2 ): x 1, x 2, x 3... x x 1, x 2, x 3... x x 2, x 3... x x 2, x 3... x

45 Certified rounding prove that t n x use local stability: x 0 U x 0, x n (x 0 ) x x n (x 0 ): x 0, x 1, x 2, x 3,... x x 0 = t 0 x n (x 1 ): x 1, x 2, x 3... x x n ( x 1 ): x 1, x 2, x 3... x x 1 = t 1 x n ( x 2 ): x 2, x 3... x x n ( x 2 ): x 2, x 3... x x 2 = t

46 Newton with rounding Let f :]a, b[ R and x 0 satisfying the conditions in Kantorovitch s theorem and let rnd : N R R. If 1. n x, x ]a, b[ rnd n (x) ]a, b[ µ 0 < 1 3. [x 0 3B 0, x 0 + 3B 0 ] ]a, b[. n x, x rnd n (x) 1 3 n R 0, where R 0 = 1 µ2 0 8µ 0 B 0 then, for the perturbed Newton s sequence t 0 = x 0 and t n+1 = rnd n+1 (t n f (t n )f (t n )) a. the sequence {t n } n N converges and lim n t n = x where x is the root of the function f given by Kantorovitch s theorem b. n, x t n 1 2 n 1 B

47 39 7 3

48 Formalization of a numerical method 1. formalize the necessary mathematical theories 2. prove the theorems 3. handle computations. handle optimizations 0 7

49 Another formal study Interval arithmetic tool used to handle inaccuracies in computations. π =.27 [ 3.15, 3.1] [1.1, 1.2] = [.73,.27] 1 7

50 Another formal study Interval arithmetic tool used to handle inaccuracies in computations. π =.27 [ 3.15, 3.1] [1.1, 1.2] = [.73,.27] solve systems of linear interval equations { [1, 2]x 1 + [2, ]x 2 = [ 1, 1] [2, ]x 1 + [1, 2]x 2 = [1, 2] 1 7

51 Solving systems of linear interval equations Two steps: 1. checking regularity of the associated interval matrix 2. computing bounds of the solution set exact solution bounds for the solution set 2 7

52 Solving systems of linear interval equations Two steps: 1. checking regularity of the associated interval matrix 2. computing bounds of the solution set exact solution bounds for the solution set 2 7

53 Regular interval matrices A = ( [2, ] [ 1, 1] [ 1, 1] [2, ] ) A is regular iff à A, det à 0 ( Ã11 à à = 12 à 21 à 22 det à 0 ), à 11 [2, ], à 12 [ 1, 1] à 21 [ 1, 1], à 22 [2, ] 3 7

54 Criteria for regularity of interval matrices Criterion A is regular if and only if x R n, 0 A x x = 0. Criterion A is regular if and only if x R n, A c x A x x = 0. Criterion (using positive definiteness) If the matrix (A T c A c T A A I) is positive definite for some consistent matrix norm, then A is regular. Criterion (using the midpoint inverse) If the following inequality holds ρ( I RA c + R A ) < 1 for an arbitrary matrix R, then A is regular. Criterion (using eigenvalues) If the inequality λ max ( T A A) < λ min (A T c A c ) holds, then A is regular. 7

55 Organization of the formal proof axiomatic reals finite types, indexed operations matrix real intervals real matrix: norm, eigenvalues interval matrices criteria of regularity for interval matrices 5 7

56 Work for eigenvalues spectral radius: ρ(a) = max{ λ(a) } Theorem (Perron Frobenius) If A R n n is nonnegative then the spectral radius ρ(a) is an eigenvalue of A, and there is a real, nonnegative vector x 0 with Ax = ρ(a)x. 6 7

57 Conclusion Contributions: formalization of mathematical concepts two formal studies: Newton s method regularity of interval matrices Perspectives: for interval analysis: study computation study for floating point numbers 7 7