A Coq Formalization of Digital Filters Diane Gallois-Wong, Sylvie - PowerPoint PPT Presentation

A Coq Formalization of Digital Filters Diane Gallois-Wong, Sylvie Boldo and Thibault Hilaire Universit´ e Paris-Sud, LRI (Orsay), Inria Saclay Calculemus - August 15, 2018 Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 1 / 11

ime Signal Processing and Digital Filters Signal : audio, video, various physical measurements Applications: communication, robotics, automotive, aeronautics, etc. Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 2 / 11

Signal Processing and Digital Filters Signal : audio, video, various physical measurements Applications: communication, robotics, automotive, aeronautics, etc. Digital signal : T ime discrete time k ∈ Z − → value u ( k ) ∈ R Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 2 / 11

Signal Processing and Digital Filters Signal : audio, video, various physical measurements Applications: communication, robotics, automotive, aeronautics, etc. Digital signal : T ime discrete time k ∈ Z − → value u ( k ) ∈ R u ( k ) y ( k ) Digital filter H : H input signal output signal Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 2 / 11

LTI Digital Filters u ( k ) y ( k ) Digital filter H : H input signal output signal y ( k ) depends on u ( k ) but also on the past Example: y ( k ) = u ( k ) − 3 y ( k − 1) Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 3 / 11

LTI Digital Filters u ( k ) y ( k ) Digital filter H : H input signal output signal y ( k ) depends on u ( k ) but also on the past Example: y ( k ) = u ( k ) − 3 y ( k − 1) We are interested in Linear Time-Invariant (LTI) filters : Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 3 / 11

LTI Digital Filters u ( k ) y ( k ) Digital filter H : H input signal output signal y ( k ) depends on u ( k ) but also on the past Example: y ( k ) = u ( k ) − 3 y ( k − 1) We are interested in Linear Time-Invariant (LTI) filters : valid operations are addition and scaling Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 3 / 11

LTI Digital Filters u ( k ) y ( k ) Digital filter H : H input signal output signal y ( k ) depends on u ( k ) but also on the past Example: y ( k ) = u ( k ) − 3 y ( k − 1) We are interested in Linear Time-Invariant (LTI) filters : valid operations are addition and scaling if the input is delayed, then the output is delayed as well Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 3 / 11

Theory and Practice: Finite Precision Theory : mathematical definition infinite precision ∀ k ∈ Z . y ( k ) = u ( k ) − 3 y ( k − 1) (real numbers R ) ↓ Practice : implementation foreach k do finite precision y ( k ) ← u ( k ) − 3 ∗ y ( k − 1) (floating- or fixed-point numbers) end → rounding errors ֒ Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 4 / 11

Theory and Practice: Finite Precision Theory : mathematical definition infinite precision ∀ k ∈ Z . y ( k ) = u ( k ) − 3 y ( k − 1) (real numbers R ) ↓ Practice : implementation foreach k do finite precision y ( k ) ← u ( k ) − 3 ∗ y ( k − 1) (floating- or fixed-point numbers) end → rounding errors which propagate and may accumulate: ֒ y ∗ ( k ) ← u ( k ) ⊖ 3 ⊗ y ∗ ( k − 1) Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 4 / 11

Theory and Practice: Finite Precision Theory : mathematical definition infinite precision ∀ k ∈ Z . y ( k ) = u ( k ) − 3 y ( k − 1) (real numbers R ) ↓ Practice : implementation foreach k do finite precision y ( k ) ← u ( k ) − 3 ∗ y ( k − 1) (floating- or fixed-point numbers) end → rounding errors which propagate and may accumulate: ֒ y ∗ ( k ) ← u ( k ) ⊖ 3 ⊗ y ∗ ( k − 1) y ∗ ( k ) ← ֓ y ∗ ( k − 1) ← ֓ y ∗ ( k − 2) ← ֓ ... Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 4 / 11

Rounding Errors in Digital Filters Digital filters in embedded systems use fixed-point numbers : consume less energy, less expensive than floating-point numbers. Optimisation: trying to use as few bits as possible → difficult, especially as errors may accumulate unexpectedly ֒ Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 5 / 11

Rounding Errors in Digital Filters Digital filters in embedded systems use fixed-point numbers : consume less energy, less expensive than floating-point numbers. Optimisation: trying to use as few bits as possible → difficult, especially as errors may accumulate unexpectedly ֒ → more efficient algorithms have bigger risk of sizeable final ֒ error or overflow (exceeding the greatest representable value) Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 5 / 11

Rounding Errors in Digital Filters Digital filters in embedded systems use fixed-point numbers : consume less energy, less expensive than floating-point numbers. Optimisation: trying to use as few bits as possible → difficult, especially as errors may accumulate unexpectedly ֒ → more efficient algorithms have bigger risk of sizeable final ֒ error or overflow (exceeding the greatest representable value) How to ensure that rounding errors do not cause critical failures in robotics, automotive, aeronautics etc.? Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 5 / 11

Rounding Errors in Digital Filters Digital filters in embedded systems use fixed-point numbers : consume less energy, less expensive than floating-point numbers. Optimisation: trying to use as few bits as possible → difficult, especially as errors may accumulate unexpectedly ֒ → more efficient algorithms have bigger risk of sizeable final ֒ error or overflow (exceeding the greatest representable value) How to ensure that rounding errors do not cause critical failures in robotics, automotive, aeronautics etc.? Error analysis with pen-and-paper proofs [Hilaire, Lopez 2013] etc. Formal methods [Akbarpour, Tahar 2007] [Siddique, Mahmoud, Tahar 2018] etc. Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 5 / 11

Contribution Formalization in Coq : Definitions: signals and Linear Time-Invariant (LTI) filters Various realizations for filters and equivalences between them Theorem of the Error Filter to study propagation of errors Worst-Case Peak-Gain Theorem to bound the final error These are essential steps toward a fully proven rounding error analysis. Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 6 / 11

Defining Signals Signal : function Z → R that takes the value 0 for all k < 0 Definition causal ( x : Z → R ) := ( forall k : Z , ( k < 0)% Z → x k = 0% R ). Record signal := { signal_val : > Z → R ; signal_prop : causal signal_val } . Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 7 / 11

Defining Signals Signal : function Z → R that takes the value 0 for all k < 0 Definition causal ( x : Z → R ) := ( forall k : Z , ( k < 0)% Z → x k = 0% R ). Record signal := { signal_val : > Z → R ; signal_prop : causal signal_val } . Why Z rather than nat ? Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 7 / 11

Defining Signals Signal : function Z → R that takes the value 0 for all k < 0 Definition causal ( x : Z → R ) := ( forall k : Z , ( k < 0)% Z → x k = 0% R ). Record signal := { signal_val : > Z → R ; signal_prop : causal signal_val } . Why Z rather than nat ? + easier handling of initial conditions y ( k ) = u ( k ) − 3 y ( k − 1) + 5 y ( k − 3) in nat : separate cases for k ∈ { 0 , 1 , 2 } Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 7 / 11

Defining Signals Signal : function Z → R that takes the value 0 for all k < 0 Definition causal ( x : Z → R ) := ( forall k : Z , ( k < 0)% Z → x k = 0% R ). Record signal := { signal_val : > Z → R ; signal_prop : causal signal_val } . Why Z rather than nat ? + easier handling of initial conditions y ( k ) = u ( k ) − 3 y ( k − 1) + 5 y ( k − 3) in nat : separate cases for k ∈ { 0 , 1 , 2 } + better readability of theorems + more intuitive substraction (natural numbers in Coq: 3 − 5 = 0) − less library support (but often easy to adapt from nat to Z ) Diane Gallois-Wong (U-PSud, LRI) A Coq Formalization of Digital Filters Calculemus - August 15, 2018 7 / 11