### Presentations text content in CAUCHY

CAUCHY

Continuity analysis of programs

Slide2Uncertainty and robustness

Trends:

cyber-physical systems, integration of computation and science, …

Uncertainty: stale satellite data, erroneous sensor measurements, …Does your program handle uncertainty robustly? Correctness in settings without uncertainty does not imply correctness in uncertain environments.

Slide3Robustness analysis of programs

Robustness: small perturbations to a program’s operating conditions do not change its behavior significantly.Continuity: Infinitesimal changes to inputs only cause infinitesimal changes to outputs.Discrete continuity: Similar, except for non-infinitesimalchanges to discrete numbers.Derivative has low complexity. Asymptotic stabilityVerify these!

P

Slide4First step: Continuity analysis of programs

Continuity of mathematical functions: definition.Equivalently, infinitesimal changes in inputs only cause infinitesimal changes in outputs.Continuity of programs Associate metric spaces with types, lift it into a metric over states. Same question. Do infinitesimal changes in program inputs only cause infinitesimal changes to outputs?This paper: structural analysis of continuity.

P

Slide5Example: an implementation of

Dijkstra’s algorithm

Small change to real array: each element changes at most by a small amount.Small change to graph with real edge weight: each edge weight changes at most by a small amount.Is this program continuous?

procedure

Dijkstra

(

G: graph

,

src

: node):

for

each node v in G: { d[v] := Infinity }

d[src

] := 0;

Worklist

:= set of all nodes in G;

while

Worklist

is not empty {

Remove node

w

from

Worklist

s.t

. d[w] is minimal;

for

each neighbor v of

w

: {

z := d[w] + G[

w,v

];

if (z < d[v]) { d[v] := z;

prev[v

] :=

w

; } } }

Slide6Example:

Dijkstra’s algorithm

Small change to real array: each element changes at most by a small amount.Small change to graph with real edge weight: each edge weight changes at most by a small amount.Is this program continuous?

procedure Dijkstra (G: graph, src: node):for each node v in G: { d[v] := Infinity } d[src] := 0; Worklist := set of all nodes in G;while Worklist is not empty { Remove node w from Worklist s.t. d[w] is minimal; for each neighbor v of w: { z := d[w] + G[w,v]; if (z < d[v]) { d[v] := z; prev[v] := w; } } }

Depends on what is observable.

At point of output,

d

is a continuous function of G, but

prev

is not.

Slide7Sorting algorithms

are continuous

… but only if output = array of keys.Minimum spanning tree algorithms are continuous… but only if the output is the weight of the tree.Integer knapsack is continuous in values of items but not in their weights.Fractional knapsack is continuous in values and weights.

Continuity at work!

2.0

3.0

4.0

3.0

2.0

3.0

3.0

4.0

2.0

3.0

4.0

2.99

2.0

2.99

3.0

4.0

Slide8Key Idea: Prove branch-equivalence at the

zeroes of b—i.e., conditions under which guard can flip on small changes.Example: d[v] is continuous after if (d[v] < z) d[v] := z. The guard (d[v] < z) flips (under small changes) only when d[v] = z. Then, d[v] has similar values on both branches.Automate using an SMT-solver. (cf. Translation validation)

Challenge #1: Control flow

if

b

P1

P2

1.

P

1

and P

2

are continuous. P is continuous

P

Slide9Challenge #2:

Noninductiveness

while Worklist is not empty { Remove node w from Worklist s.t. d[w] is minimal; for each neighbor v of w: { z := d[w] + G[w,v]; if (z < d[v]) { d[v] := z; prev[v] := w; } } }

Small change to d at iteration-entry can completely change the value of d at the end.Thus, continuity is not inductive.

u

1

d[u

1] = 2.00

u2d[u2] = 2.00

u

3

d[u

2

] = 4.00

Slide10u

2d[u2] = 2.00

u1d[u1] = 2.00

Key idea: Induction over epochs

while

Worklist is not empty { Remove node w from Worklist s.t. d[w] is minimal;

To be reordered, iterations must be approximately tied on selection criterion. Epoch = cluster of such iterations.Prove that iterations within epochs are commutative. Proof can be discharged using an SMT-solver.

u

3

d[u

2] = 4.00

u

1

d[u2] = 2.01

u2d[u1] = 2.00

u

3

d[u

2] = 4.02

Slide11u

2d[u2] = 2.00

u1d[u1] = 2.00

Key idea: Induction over epochs

while

Worklist is not empty { Remove node w from Worklist s.t. d[w] is minimal;

Now do induction over epochs.

u

3

d[u

2] = 4.00

u

1

d[u2] = 2.01

u2d[u1] = 2.00

u

3

d[u

2] = 4.02

Original

Perturbed

Slide12But often, simple induction is enough

for

k := 1 to N for i, j := 1 to N: if G[i, j] > G[i, k] + G [k, j] G[i, j] := G[i, k] + G[k. j];

Floyd-

Warshall

shortest path algorithm

Slide13Challenge #3: Early or late termination

Key Idea: Prove idempotence under conditions when guard can flip.Example: while (z > 0) { x := x + z; z := z * w; } If z = 0, then loop body is idempotent.

while

b

P

Original

Perturbed

Slide14Soundness with respect to definition. (Tricky!) Proof rules discharged using Z3 SMT solver.Able to prove 11 of the 13 continuous algorithms targeted:Sorting (Merge sort, Bubble sort, Insertion sort, Selection sort).Minimum Spanning Tree (Prim’s and Kruskal’s)Shortest Paths (Floyd-Warshall, Bellman-Ford, Dijkstra)Knapsack (Fractional and integer)Epoch induction needed in 5/13 cases. Early termination check needed in 3/13 cases.Current work exploring “real” applications (embedded medical devices and GPS apps).

Results

Slide15Ongoing work: discrete derivatives of programs

Instead of infinitesimal changes to real variables, consider unit changes to finite-precision variables.More natural in the quantitative setting. Changes the game somewhat:E.g., Addition is not continuous. But most of the rules/insights still apply. Goal: Mechanically generate discrete derivatives of programs:E.g., Discrete derivative of Dijkstra’s algorithm in O(n).

P

Slide16The Cauchy challenge

Cauchy

Develop an analytical calculus of computation

Limits of programs

Hybrid representations

Continuity

analysis

Analytic approximations ofprograms

(Discrete) derivatives of programs

Applications in cyber-physical systems, approximate computation. Also, pedagogical value.

Fourier analysis of programs

Slide17Conclusion

Robustness is an important correctness property for programs operating under uncertainty.

Continuity is one, but by no means the only, robustness property.

This paper offers one, but by no means the only, continuity analysis.

First step towards an analytical calculus of computation.

Slide18Slide19

## CAUCHY

Download Presentation - The PPT/PDF document "CAUCHY" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.