How to Compute the Area of a Triangle: a Formal Revisit

Transcription

1 21st IEEE International Symposium on Computer Arithmetic How to Compute the Area of a Triangle: a Formal Revisit Sylvie Boldo Inria Saclay Île-de-France, LRI, Université Paris-Sud April 9th, 2013

2 Motivations Given 3 FP numbers a, b, and c that are the side lengths of a triangle, we want to compute the area of this triangle. b c The common formula is attributed to Heron of Alexandria: = s (s a) (s b) (s c) where s = a + b + c 2 a

3 Motivations This is known to be inaccurate using FP arithmetic in the case of needle-like triangles: b c for a = , b = , and c = , Heron s formula gives 17.6 and Kahan s a for a = , b = , and c = , Heron s formula FAILS and Kahan s gives Kahan suggested sorting a, b, c and using: = 1 4 (a + (b + c)) (c (a b)) (c + (a b)) (a + (b c))

4 Literature [Kahan, Miscalculating Area and Angles of a Needle-like Triangle, 1986?] Area is accurate to within a few units in their last digits. Proof A few facts (values are non-negative, exact subtractions) [Goldberg, What every computer scientist should know about floating-point arithmetic, 1991] The rounding error of area is at most 11 ε, provided ε < and subtraction and square roots are accurate. No proof.

5 Motivations Can we formally (im)-prove the error bound? (a proof that is mechanically verified by a proof assistant) What can be said about underflows? What can be said about overflows? Can we have an understandable proved program? We will use the Coq proof assistant and the Flocq library (multi-radix, multi-format and multi-precision library). For the formal proof of the C program, we will use the following chain: Frama-C/Jessie/Why3 (see later).

6 Notations Side lengths: a, b and c They are sorted and represent a (possibly degenerate) triangle: 0 c b a b + c radix β, precision p, machine epsilon ε = β1 p 2. minimal exponent E i (the smallest positive (subnormal) FP number is β E i ) rounding to nearest, ties to even,, : rounded addition, subtraction and multiplication C(e) the exact value of a FP expression e (i.e. obtained without rounding) err(x, y, e) means that the relative error is less than e: x y e y

7 Kahan s algorithm = 1 4 (a + (b + c)) (a + (b c)) (c + (a b)) (c (a b))

8 Kahan s algorithm = 1 4 (a + (b + c)) (a + (b c)) (c + (a b)) (c (a b)) t 1 = a (b c) t 2 = a (b c) t 3 = c (a b) t 4 = c (a b) M = t 1 t 2 t 3 t 4 ( ) 1 = ( M) 4

9 Kahan s algorithm = 1 4 (a + (b + c)) (a + (b c)) (c + (a b)) (c (a b)) t 1 = a (b c) t 2 = a (b c) t 3 = c (a b) t 4 = c (a b) M = ((t 1 t 2 ) t 3 ) t 4 ( ) 1 = ( M) 4

10 Plan 1 Motivations 2 Error Bound Provided neither Underflow, nor Overflow Occur 3 Underflow Handling 4 Program Proof 5 Conclusion

11 Assumptions Set of hypotheses with unbounded exponent range: the exponent range is unbounded, 1 4 fits in the format, ε 1 100, 0 c b a b + c.

12 Proof sketch all t i are non-negative, so the square root is innocuous a b = a b, using Sterbenz theorem basic forward error analysis on the others FP additions, subtractions, and multiplications This lemma about the square root: Theorem (err sqrt flx) Given x, y, e, if 0 y, and e 0.5 and err(x, y, e), then err( ( x), y, ε + (1 + ε) 5 8 e).

13 Practical use of un-instantiated variables Thanks to Coq inference mechanism, I did not write explicitly the rounding error of M in the expected form: ε + (1 + ε) (ε + (1 + ε) (ε + (1 + ε) (2 ε + ε ε+ (2 ε + ε ε) + (2 ε + ε ε) (2 ε + ε ε)) + ε + (ε+ (1 + ε) (2 ε + ε ε + (2 ε + ε ε) + (2 ε + ε ε) (2 ε + ε ε))) ε) + ε + (ε + (1 + ε) (ε + (1 + ε) (2 ε + ε ε + (2 ε + ε ε) + (2 ε + ε ε) (2 ε + ε ε)) +ε + (ε + (1 + ε) (2 ε + ε ε + (2 ε + ε ε)+ (2 ε + ε ε) (2 ε + ε ε))) ε)) ε)

14 Final rounding error with an unbounded exponent range Theorem (err flx) We have err(, C( ), 61 8 ε + 36ε2 ). Instead of 11 ε, we have a formal proof of ε (+Nε 2 ). If we assume radix 2, then multiplying by 1 4 is exact: Theorem (err flx radix2) With β = 2, we have err(, C( ), 53 8 ε + 29ε2 ). Instead of 11 ε, we have a formal proof of ε (+Nε 2 ).

15 Plan 1 Motivations 2 Error Bound Provided neither Underflow, nor Overflow Occur 3 Underflow Handling 4 Program Proof 5 Conclusion

16 Assumptions Set of hypotheses with underflow gradual underflow with E i as minimal exponent, E i 3 p, no upper bound on the exponent, 1 4 fits in the format, ε 1 100, 0 c b a b + c.

17 Proof sketch as before, all t i are non-negative, so the square root is innocuous as before, a b = a b, using Sterbenz theorem if the result of an addition is a subnormal FP, then it is exact for the square root, there is no problem, as a square root cannot be subnormal (except zero) for multiplication, we have to assume the result is not subnormal: Theorem (err mult flt) Given x 1, y 1, e 1, x 2, y 2, e 2, if x 1 and x 2 fit in the format, if err(x 1, y 1, e 1 ), and err(x 2, y 2, e 2 ), and if β E i +p 1 < x 1 x 2, then err(x 1 x 2, y 1 y 2, ε + (1 + ε) (e 1 + e 2 + e 1 e 2 )).

18 Detect subnormals We need to prove no subnormal is created. detect afterwards if a subnormal appeared in the computation If the result is big enough, it will mean no underflow happened anywhere in the computation. order the t i s by magnitude. Theorem We have 0 t 4 t 3 t 2 t 1. use the following fact to not loose subnormality: Theorem (subnormal aux) Given x and y, we assume that x is a FP and that β E i +p 1 < x y. We also assume that, if x 1, then y 1. Then β E i +p 1 < x.

19 Final rounding error with underflow Theorem (err flt) Ei We assume that 1 +p 1 4 β 2 <. We have err(, C( ), 61 8 ε + 36ε2 ). Theorem (err flt radix2) We assume that β = 2, and that 2 Ei +p 1 err(, C( ), 53 8 ε + 29ε2 ). 2 2 <. We have same error bounds as before, assuming is not too small.

20 What about Overflow? Overflow is only taken into account at the program level. we will prove no overflow occur We assume a < using Gappa, we prove no overflow occur in the 14 operations

21 Plan 1 Motivations 2 Error Bound Provided neither Underflow, nor Overflow Occur 3 Underflow Handling 4 Program Proof 5 Conclusion

22 Methodology C Program

23 Methodology Human Annotated C Program (specification, invariant)

24 Methodology Human Annotated C Program (specification, invariant) Frama-C Jessie Theorem statements

25 Methodology Human Annotated C Program (specification, invariant) Frama-C Jessie Automatic provers (Gappa) Theorem statements Coq Human

26 Methodology Human Annotated C Program (specification, invariant) Frama-C Jessie Theorem statements Automatic provers (Gappa) Coq Human

27 Methodology Human Annotated C Program (specification, invariant) Frama-C Jessie Theorem statements Automatic provers (Gappa) Coq Human

28 Methodology Human Annotated C Program (specification, invariant) Frama-C Jessie Theorem statements Automatic provers (Gappa) Coq Human

29 Methodology Human Annotated C Program (specification, invariant) Frama-C Jessie Theorem statements Automatic provers (Gappa) Coq Human

30 Methodology Human Annotated C Program (specification, invariant) Frama-C Jessie Theorem statements Automatic provers (Gappa) Coq Human

31 Methodology Human Annotated C Program (specification, invariant) Frama-C Jessie Theorem statements Automatic provers (Gappa) Coq Human

32 Methodology Human Annotated C Program (specification, invariant) Frama-C Jessie Theorem statements Automatic provers (Gappa) Coq Human

33 Methodology Human Annotated C Program (specification, invariant) Frama-C Jessie Theorem statements Automatic provers (Gappa) Coq Human Proved Theorems

34 Methodology Human Annotated C Program (specification, invariant) Frama-C Jessie Theorem statements Automatic provers (Gappa) Coq Human The program is correct with respect to its specifications Proved Theorems

35 Triangle C program /*@ requires 0 <= ensures \ result ==\ round_double (\ NearestEven,\ sqrt ( x double s q r t ( double x ) ; /*@ logic real S( real a, real b, real c) \ let s = (a+b+c \ sqrt (s*(s-a )*(s-b )*(s-c */ /*@ requires 0 <= c <= b <= a && a <= b + c && a <= 0 x1p255 ensures 0x1p -513 < \ == > \ abs (\ result <= (53./8*0 x1p *0 x1p -106)* S(a,b, */ double t r i a n g l e ( double a, double b, double c ) { r e t u r n (0 x1p 2 s q r t ( ( a+(b+c ) ) ( a+(b c ) ) ( c+(a b ) ) ( c (a b ) ) ) ) ; }

36 Triangle C program /*@ requires 0 <= ensures \ result ==\ round_double (\ NearestEven,\ sqrt ( x double s q r t ( double x ) ; Square root definition /*@ logic real S( real a, real b, real c) \ let s = (a+b+c \ sqrt (s*(s-a )*(s-b )*(s-c */ /*@ requires 0 <= c <= b <= a && a <= b + c && a <= 0 x1p255 ensures 0x1p -513 < \ == > \ abs (\ result <= (53./8*0 x1p *0 x1p -106)* S(a,b, */ double t r i a n g l e ( double a, double b, double c ) { r e t u r n (0 x1p 2 s q r t ( ( a+(b+c ) ) ( a+(b c ) ) ( c+(a b ) ) ( c (a b ) ) ) ) ; }

37 Triangle C program /*@ requires 0 <= ensures \ result ==\ round_double (\ NearestEven,\ sqrt ( x double s q r t ( double x ) ; /*@ logic real S( real a, real b, real c) \ let s = (a+b+c \ sqrt (s*(s-a )*(s-b )*(s-c */ Heron s formula (no rounding) /*@ requires 0 <= c <= b <= a && a <= b + c && a <= 0 x1p255 ensures 0x1p -513 < \ == > \ abs (\ result <= (53./8*0 x1p *0 x1p -106)* S(a,b, */ double t r i a n g l e ( double a, double b, double c ) { r e t u r n (0 x1p 2 s q r t ( ( a+(b+c ) ) ( a+(b c ) ) ( c+(a b ) ) ( c (a b ) ) ) ) ; }

38 Triangle C program /*@ requires 0 <= ensures \ result ==\ round_double (\ NearestEven,\ sqrt ( x double s q r t ( double x ) ; /*@ logic real S( real a, real b, real c) \ let s = (a+b+c \ sqrt (s*(s-a )*(s-b )*(s-c */ /*@ requires 0 <= c <= b <= a && a <= b + c && a <= 0 x1p255 ensures 0x1p -513 < \ == > \ abs (\ result <= (53./8*0 x1p *0 x1p -106)* S(a,b, */ Kahan s algorithm with properly ordered t i s double t r i a n g l e ( double a, double b, double c ) { r e t u r n (0 x1p 2 s q r t ( ( a+(b+c ) ) ( a+(b c ) ) ( c+(a b ) ) ( c (a b ) ) ) ) ; }

39 Triangle C program /*@ requires 0 <= ensures \ result ==\ round_double (\ NearestEven,\ sqrt ( x double s q r t ( double x ) ; /*@ logic real S( real a, real b, real c) \ let s = (a+b+c \ sqrt (s*(s-a )*(s-b )*(s-c */ ordered side lengths /*@ requires 0 <= c <= b <= a && a <= b + c && a <= 0 x1p255 ensures 0x1p -513 < \ == > \ abs (\ result <= (53./8*0 x1p *0 x1p -106)* S(a,b, */ double t r i a n g l e ( double a, double b, double c ) { r e t u r n (0 x1p 2 s q r t ( ( a+(b+c ) ) ( a+(b c ) ) ( c+(a b ) ) ( c (a b ) ) ) ) ; }

40 Triangle C program /*@ requires 0 <= ensures \ result ==\ round_double (\ NearestEven,\ sqrt ( x double s q r t ( double x ) ; /*@ logic real S( real a, real b, real c) \ let s = (a+b+c \ sqrt (s*(s-a )*(s-b )*(s-c */ overflow condition /*@ requires 0 <= c <= b <= a && a <= b + c && a <= 0 x1p255 ensures 0x1p -513 < \ == > \ abs (\ result <= (53./8*0 x1p *0 x1p -106)* S(a,b, */ double t r i a n g l e ( double a, double b, double c ) { r e t u r n (0 x1p 2 s q r t ( ( a+(b+c ) ) ( a+(b c ) ) ( c+(a b ) ) ( c (a b ) ) ) ) ; }

41 Triangle C program /*@ requires 0 <= ensures \ result ==\ round_double (\ NearestEven,\ sqrt ( x double s q r t ( double x ) ; /*@ logic real S( real a, real b, real c) \ let s = (a+b+c \ sqrt (s*(s-a )*(s-b )*(s-c */ /*@ requires 0 <= c <= b <= a && a <= b + c && a <= 0 x1p255 ensures 0x1p -513 < \ result If no == > \ abs (\ result <= (53./8*0 x1p *0 x1p -106)* S(a,b, */ double t r i a n g l e ( double a, double b, double c ) { r e t u r n (0 x1p 2 s q r t ( ( a+(b+c ) ) ( a+(b c ) ) ( c+(a b ) ) ( c (a b ) ) ) ) ; }

42 Triangle C program /*@ requires 0 <= ensures \ result ==\ round_double (\ NearestEven,\ sqrt ( x double s q r t ( double x ) ; /*@ logic real S( real a, real b, real c) \ let s = (a+b+c \ sqrt (s*(s-a )*(s-b )*(s-c */ /*@ requires 0 <= c <= b <= a && a <= b + c && a <= 0 x1p255 ensures 0x1p -513 < \ == > \ abs (\ result <= (53./8*0 x1p *0 x1p -106)* S(a,b, */ Error bound double t r i a n g l e ( double a, double b, double c ) { r e t u r n (0 x1p 2 s q r t ( ( a+(b+c ) ) ( a+(b c ) ) ( c+(a b ) ) ( c (a b ) ) ) ) ; }

43 Triangle C program /*@ requires 0 <= ensures \ result ==\ round_double (\ NearestEven,\ sqrt ( x double s q r t ( double x ) ; /*@ logic real S( real a, real b, real c) \ let s = (a+b+c \ sqrt (s*(s-a )*(s-b )*(s-c */ /*@ requires 0 <= c <= b <= a && a <= b + c && a <= 0 x1p255 ensures 0x1p -513 < \ == > \ abs (\ result <= (53./8*0 x1p *0 x1p -106)* S(a,b, */ Function call double t r i a n g l e ( double a, double b, double c ) { r e t u r n (0 x1p 2 s q r t ( ( a+(b+c ) ) ( a+(b c ) ) ( c+(a b ) ) ( c (a b ) ) ) ) ; }

44 Program proof

45 Plan 1 Motivations 2 Error Bound Provided neither Underflow, nor Overflow Occur 3 Underflow Handling 4 Program Proof 5 Conclusion

46 Conclusion tighter error bound mechanically verified tighter error bound rather easy formal proof (shows the library is comprehensive) unexpectedly tedious to handle higher-order terms in the error bounds: ε, 0 < ε < 1 100, ε 9 +9ε 8 +36ε 7 +84ε ε ε 4 +84ε 3 +36ε 2 +9ε 37ε 2 +9ε As usual, underflow handling is tricky. Here we detect afterwards by ordering the multiplications.

47 Perspectives We assumed either (β = 2 and p 7) or (β = 10 and p 3). These assumptions can be removed by increasing the error bound. Tighter error bound: 1 2 instead of 5 8 in the sqrt error lemma (+ second-order terms). t 4 is exact For β = 2 and an unbounded exponent range, err(, C( ), 5 ε + 36ε 2 ). Tighter error bound in progress: 4.75 ε if tightening the t 2 error bound same bound with underflow

48 Thank you for your attention!

49 Thank you for your attention!