Robustness analysis of finite precision implementations

Transcription

1 Eric Goubault and Sylvie Putot Cosynus, LIX, Ecole Polytechnique

2 Motivations (see Eric s talk) Context: automatic validation o numerical programs Iner invariant properties both in loating-point and real number semantics Abstract interpretation based static analysis (aine arithmetic/zonotopes) Bound the implementation errors Implemented in the abstract interpreter FLUCTUAT A diiculty in error analysis: unstable tests When inite precision and real control lows are potentially dierent I discontinuity o treatment between branches, joining error analyses rom each branch is unsound When considering sets o executions, most tests are potentially unstable (just issuing a warning is not practical) We propose here to compute discontinuity errors in unstable tests Bound the dierence between the computation in two branches under conditions o unstable tests (mix constraint solving / aine arithmetic) Makes our error analysis sound in presence o unstable tests Provides a robustness analysis o the implementation

3 A typical example o unstable tests: aine interpolators All tests are unstable, but the implementation is robust, the conditional block does not introduce a discontinuity

4 But discontinuities also actually occur (sqrt approx.)

5 Test interpretation Fluctuat: computes rounding errors and propagates errors and uncertainties Relying on aine orms both or real value and error terms; With two sets o constraints on the noise symbols, resp. corresponding to real and inite control lows Main idea to interpret test, inormally Aine orms are unchanged, translate the test condition as a condition on the noise symbols ε i The test condition is interpreted as a restriction o the set o inputs, that lead to an execution satisying the condition: unctional interpretation Example r e a l x = [ 0, 0 ] ; r e a l y = x ; i ( y >= 0) y = x ; Aine orms beore tests: x = 5 + 5ε, y = 0 + 0ε In the i branch ε 0: condition acts on both x and y

6 Test interpretation and set operations - inormally Example x =[,] + u ; // [ ] i ( x <= ) // [ ] y = x +; // [ ] e l s e // [ ] y = x ; // [ ] // [ ] } start x y = x + x > y = x (x, y ) = ( + ε + u, ); ε Φ X = [, ] (x, y ) = (x, y ) (x ); ε Φ X = [0, ] (x, y ) = (x, x + ); ε Φ X (x, y ) = (x, y ) (x > ); ε Φ X = [, 0] (x, y ) = (x, x ); ε Φ X (x, y ) = (x, y ) (x, y ); ε Φ X = [, ]

7 Abstract domain in Fluctuat Abstract value at each control point c For each variable, aine orms or real value and error: x = (α x 0 + α x i ε r i ) i }{{} real value + mi x ε r i i +( e0 x }{{} + center o the error }{{} propag o uncertainty on value at pt i el x ε e l l }{{} uncertainty on error due to point l Constraints on noise symbols coming rom interpretation o test condition ε r Φ X r or real control low (test on the r x : constraints on the ε r i ) (ε r, ε e ) Φ X or inite precision control low (test on the x = r x + e x : constraints on the ε r i and ε e l ) Unstable test condition = intersection o constraints ε r Φ X r Φ Y : unstable test: or a same execution (same values o the noise symbols ε i ) the control low is dierent restricts the range o the ε i : allows us to bound accurately the discontinuity error )

8 Formally, sound abstraction (with discontinuity errors) Abstract value An abstract value X, or a program with p variables x,..., x p, is a tuple X = (R X, E X, D X, Φ X r, Φ X ) composed o the ollowing aine sets and constraints, or all k =,..., p: R X : ˆr k X = r0,k X + n i= r i,k X ε r i where ε r Φ X r E X : êk X = e0,k X + n i= ex i,k ε r i + m j= ex n+j,k ε e j where (ε r, ε e ) Φ X D X : ˆd X k = d X 0,k + o i= d i,k X ε d i ˆ X k = ˆr X k + ê X k where (ε r, ε e ) Φ X E X is the propagated rounding error, D X the propagated discontinuity error New discontinuity errors computed when joining branches o a possibly unstable test Z = X Y is Z = (R Z, E Z, D Z, Φ X r Φ Y r, Φ X Φ Y ) such that (R Z, Φ Z r Φ Z ) = (R X, Φ X r Φ X ) (R Y, Φ Y r Φ Y ) (E Z, Φ Z ) = (E X, Φ X ) (E Y, Φ Y ) D Z = D X D Y (R X R Y, Φ X Φ Y (R Y R X, Φ Y Φ X

9 Example: sound unstable test analysis x := [,] + u; // [] i (x ) y = x+; // [] else y = x; // [] // [] At cpt : ˆr x [] = + ε r ; ê x [] = u x 5 ˆ x [] ˆr x [] 0-0 ε r

10 Example: sound unstable test analysis x := [,] + u; // [] i (x ) y = x+; // [] else y = x; // [] // [] ˆr x [] = + ε r ; ê x [] = u y Φ [] r : ε r 0 Φ [] r : ε r > 0 ε r Test x, real low: Φ [] r : ˆr x [] = + ε r

11 Example: sound unstable test analysis x := [,] + u; // [] i (x ) y = x+; // [] else y = x; // [] // [] ˆr x [] = + ε r ; ê x [] = u Real at []: ( [] = + εr, Φ [] Real at []: ( [] = + εr, Φ [] y Φ [] r : ε r 0 Φ [] r : ε r > 0 ε r

12 Example: sound unstable test analysis x := [,] + u; // [] i (x ) y = x+; // [] else y = x; // [] // [] ˆr x [] = + ε r ; ê x [] = u Real at []: ( [] = + εr, Φ [] Real at []: ( [] = + εr, Φ [] Test x, loat low: : ˆr x [] + ê x [] = + ε r + u Φ [] y 5 [] [] 0 - u 0 Φ [] r : ε r 0 Φ [] r : ε r > 0 Φ [] : ε r u Φ [] : ε r > u ε r

13 Example: sound unstable test analysis x := [,] + u; // [] i (x ) y = x+; // [] else y = x; // [] // [] Real at []: ( [] = + εr, Φ [] Real at []: ( [] = + εr, Φ [] y 5 ˆ y [] ˆ y [] [] 0 - u 0 [] Φ [] r : ε r 0 Φ [] r : ε r > 0 Φ [] : ε r u Φ [] : ε r > u ε r Error at []: ê y [] = êx [] + δε e Error at []: ê y [] = êx []

14 Example: sound unstable test analysis x := [,] + u; // [] i (x ) y = x+; // [] else y = x; // [] // [] Real at []: ( [] = + εr, Φ [] Real at []: ( [] = + εr, Φ [] y 5 ˆ y [] ˆ y [] [] 0 - u 0 [] Φ [] r : ε r 0 Φ [] r : ε r > 0 Φ [] : ε r u Φ [] : ε r > u ε r Error at []: ê y [] = u + δεe Error at []: ê y [] = u Φ [] r Φ [] : u < ε r 0 Unstable test, irst possibility: Φ [] r Φ [] : u < ε r 0

15 Example: sound unstable test analysis x := [,] + u; // [] i (x ) y = x+; // [] else y = x; // [] // [] Real at []: ( [] = + εr, Φ [] Real at []: ( [] = + εr, Φ [] y 5 ˆ y [] ˆ y [] [] 0 - u 0 [] Φ [] r : ε r 0 Φ [] r : ε r > 0 Φ [] : ε r u Φ [] : ε r > u ε r Error at []: ê y [] = u + δεe Error at []: ê y [] = u Unstable test, second possibility: Φ [] r Φ [] =

16 Example: sound unstable test analysis x := [,] + u; // [] i (x ) y = x+; // [] else y = x; // [] // [] Real at []: ( [] = + εr, Φ [] Real at []: ( [] = + εr, Φ [] y 5 ˆ y [] ˆ y [] 0 - u 0 [] [] Φ [] r : ε r 0 Φ [] r : ε r > 0 Φ [] : ε r u Φ [] : ε r > u ε r Error at []: ê y [] = u + δεe Error at []: ê y [] = u Φ [] r Φ [] : u < ε r 0 Error at [] :ê y [] êy [] ( ˆ y [] [], Φ [] Φ [] = ê y [] }{{} êy [] + ( [] [] +êy [] [] [], Φ[] Φ []

17 Example: sound unstable test analysis x := [,] + u; // [] i (x ) y = x+; // [] else y = x; // [] // [] Real at []: ( [] = + εr, Φ [] Real at []: ( [] = + εr, Φ [] y 5 ˆ y [] ˆ y [] [] 0 - u 0 [] Φ [] r : ε r 0 Φ [] r : ε r > 0 Φ [] : ε r u Φ [] : ε r > u ε r Error at []: ê y [] = u + δεe Error at []: ê y [] = u Φ [] r Φ [] : u < ε r 0 Error at [] :ê y [] êy [] + ( [] }{{} [], Φ[] Φ [] = u + δε e χ [ u,0] (ε }{{} ê y [] ˆd y []

18 Example: sound unstable test analysis x := [,] + u; // [] i (x ) y = x+; // [] else y = x; // [] // [] y 5 ˆ y [] ˆ y [] 0 - u 0 [] [] ε r Error at [] :ê y [] êy [] + ( [] }{{} [], Φ[] Φ [] = u + δε e + χ }{{}}{{} [ u,0] (ε }{{} ê y [] ˆd y ê y [] ˆd y [] [] Real value [] = + εr [, ] Float value ˆ y [] = [] + êy [] = + εr + u + δε e [ + u δ, + u + δ]

19 Householder algorithm or square root

20 Conclusion Error bounds now sound even with unstable tests Candidate input values or unstable tests given by Φ X Φ Y r Robustness analysis and discontinuity error bounds applicable to general uncertainties (not only inite precision) A.I. techniques allow to extend error analyses compared to more classical interval-like techniques Natural potential on these robustness aspects or more interaction with constraint-based approaches to the veriication o inite-precision implementations such as, e. g. O. Ponsini, C. Michel, M. Rueher: Reining Abstract Interpretation Based Value Analysis with Constraint Programming Techniques. CP 0