1 Introduction
1.1 History
1.2 The Lorenz Attractor
1.3 Tucker’s Proof
1.4 Outline of This Article
2 Mathematics
2.1 Type Classes for Mathematics in Isabelle/HOL
2.1.1 Vectors in Euclidean Space
2.1.2 Bounded Continuous Function
2.1.3 Bounded Linear Functions
2.2 Dynamical Systems
2.2.1 The Flow
2.2.2 The Poincaré Map
3 Rigorous Numerics
3.1 Expressions for Vectors
3.2 A Runge–Kutta Method
3.3 Straight Line Programs
3.4 Affine Arithmetic
4 Computational Geometry
4.1 Girard and Le Guernic’s Algorithm
4.2 Computing the Set of Edges.
4.3 Knuth’s CCW System
-
Cyclic Symmetry: \(pqr \implies qrp\)
-
Antisymmetry: \(pqr \implies \lnot prq\)
-
Nondegeneracy: \(pqr \vee prq\)
-
Interiority: \(tpq \wedge tqr \wedge trp \implies pqr\)
-
Transitivity: \(tsp \wedge tsq \wedge tsr \wedge tpq \wedge tqr \implies tpr\)
-
Dual Transitivity:$$\begin{aligned} stp \wedge stq \wedge str \wedge tpq \wedge tqr \implies tpr \end{aligned}$$
4.3.1 Total Order from CCW
4.3.2 Instantiation for Points in the Plane
4.3.3 CCW on a Vector Space
-
Translation: \((p + s)(q + s)(r + s)^> = pqr^>\)
-
Scaling: \(\alpha> 0 \implies 0(\alpha \cdot q)r^> = 0qr^>\)
-
Reflection: \(0(-p)q = 0qp\)
-
Addition: \(0pq \implies 0pr \implies 0p(q + r)\)
5 Program and Data Refinement
5.1 Light-Weight Data Refinement
5.2 Autoref
5.2.1 Nondeterministic Specifications
5.2.2 Refinement Relations
6 Reachability Analysis
6.1 The Framework
-
\(({{\textsf {\textit{approx-slp}}}}\,, {{\textsf {\textit{approx-slp-spec}}}}\,) \in {{\textsf {\textit{slp}}}}\,_{{\textsf {\textit{r}}}}\,\rightarrow _{{\textsf {\textit{r}}}}\,{{\textsf {\textit{encl}}}}\,_{{\textsf {\textit{r}}}}\,\rightarrow _{{\textsf {\textit{r}}}}\,\langle \langle {{\textsf {\textit{encl}}}}\,_{{\textsf {\textit{r}}}}\,\rangle {{\textsf {\textit{option}}}}\,_{{\textsf {\textit{r}}}}\,\rangle {{\textsf {\textit{nres}}}}\,_{{\textsf {\textit{r}}}}\,\)
-
\((\lambda x~y.~{{\textsf {\textit{encl-of-ivl}}}}\,~x~y, \lambda x~y.~[x, y]) \in {{\textsf {\textit{lv-rel}}}}\,\rightarrow _{{\textsf {\textit{r}}}}\,{{\textsf {\textit{lv-rel}}}}\,\rightarrow _{{\textsf {\textit{r}}}}\,{{\textsf {\textit{encl}}}}\,_{{\textsf {\textit{r}}}}\,\)
-
\(({{\textsf {\textit{inf-encl}}}}\,, {{\textsf {\textit{Inf-spec}}}}\,) \in {{\textsf {\textit{encl}}}}\,_{{\textsf {\textit{r}}}}\,\rightarrow _{{\textsf {\textit{r}}}}\,\langle {{\textsf {\textit{lv-rel}}}}\,\rangle {{\textsf {\textit{nres}}}}\,_{{\textsf {\textit{r}}}}\,\)
-
\(({{\textsf {\textit{sup-encl}}}}\,, {{\textsf {\textit{Sup-spec}}}}\,) \in {{\textsf {\textit{encl}}}}\,_{{\textsf {\textit{r}}}}\,\rightarrow _{{\textsf {\textit{r}}}}\,\langle {{\textsf {\textit{lv-rel}}}}\,\rangle {{\textsf {\textit{nres}}}}\,_{{\textsf {\textit{r}}}}\,\)
-
\(({{\textsf {\textit{split-encl}}}}\,, {{\textsf {\textit{split-spec}}}}\,_{\subseteq }) \in {{\textsf {\textit{real}}}}\,_{{\textsf {\textit{r}}}}\,\rightarrow _{{\textsf {\textit{r}}}}\,nat_rel \rightarrow _{{\textsf {\textit{r}}}}\,{{\textsf {\textit{encl}}}}\,_{{\textsf {\textit{r}}}}\,\rightarrow _{{\textsf {\textit{r}}}}\,\langle {{\textsf {\textit{encl}}}}\,_{{\textsf {\textit{r}}}}\,\times _{{\textsf {\textit{r}}}}\,{{\textsf {\textit{encl}}}}\,_{{\textsf {\textit{r}}}}\,\rangle {{\textsf {\textit{nres}}}}\,_{{\textsf {\textit{r}}}}\,\)
-
\(({{\textsf {\textit{inter-encl-plane}}}}\,, {{\textsf {\textit{inter-spec}}}}\,_2) \in {{\textsf {\textit{encl}}}}\,_{{\textsf {\textit{r}}}}\,\rightarrow _{{\textsf {\textit{r}}}}\,\langle {{\textsf {\textit{lv-rel}}}}\,\rangle {{\textsf {\textit{plane}}}}\,_{{\textsf {\textit{r}}}}\,\rightarrow _{{\textsf {\textit{r}}}}\,\langle {{\textsf {\textit{encl}}}}\,_{{\textsf {\textit{r}}}}\,\rangle {{\textsf {\textit{nres}}}}\,_{{\textsf {\textit{r}}}}\,\)
6.2 The Specification
6.3 Single Step
6.4 Continuous Reachability
6.5 Resolve Intersection
6.6 Intermediate Poincaré Maps
6.7 Derivatives
6.8 Correctness Theorem
7 Application to Lorenz Attractor
7.1 The Input Data and its Interpretation
7.2 Checking the Input Data
7.2.1 Representation of Cones
7.2.2 Checking a Single Result Element
7.2.3 Checking All Results
-
Threads: 22
-
Elapsed Time: 6 h 33 min 9 s
-
CPU Time: 131 h 52 min 40 s
-
Parallelization Factor: 20.13
-
Garbage Collection Time: 42 min 36 s
8 Conclusion
8.1 Future Work
smalldiv.cc
and coeffs.cc
help devising the normal form, but neither their specification nor their implementation is particularly challenging; they essentially only evaluate a large number of fixed arithmetic expressions.expansion.cc
) that the expansion estimates given by \(\mathcal {E}\) are sufficiently large to guarantee the locally eventually onto property. We validated this with a non-verified computation for the expansion estimates prescribed by our \({{\textsf {\textit{input-data}}}}\,\). Further mathematical foundations are required in order to conclude from the computed forward invariant conefield \(\mathfrak {C}\) and the expansion bounds that there exists a stable foliation, and that this foliation can be used to reduce the two-dimensional dynamics on \({\varSigma }\) to a one-dimensional map. This requires in particular the formalization of differentiable manifolds, and theorems like the existence of differentiable invariant sections for fiber contractions [41].8.2 Size of Code
Sections | Language | Lines of code/proof | |
---|---|---|---|
RODES | C\({++}\) | 3800 | |
Profil/BIAS | C\({++}\) | 8852 | |
generated ODE solver | SML | 13200 | |
Flow, Poincaré map | Isabelle/HOL theory | 12000–16500 | |
Affine Arithmetic | 8500 | ||
Intersection | 5000 | ||
Refinement/Enclosures | 5000 | ||
Reachability Analysis | 10000 | ||
Lorenz Attractor | 3000 |
8.3 Trust Base
eval
in Isabelle/HOL. This is common practice to speed up rewriting. Isabelle/HOL equations are mapped to function definitions in Standard ML. These are compiled and evaluated in PolyML.5 We also use the common extension (HOL-Library.Code_Target_Numeral
in Isabelle2017) of the code generator that maps Isabelle/HOL integers to the integer type IntInf.int
of PolyML, which can be based on either PolyML’s own implementation of arbitrary precision integers or GMP [8].eval
speeds up evaluation by translating terms to the implementation language of the proof checker (PolyML). In view of this, it is more similar to Coq’s native_compute
[2], which evaluates terms after translation to Coq’s implementation language OCaml, than to Coq’s virtual machine [9].