proving acceptability properties of relaxed nondeterministic approximate programs
DESCRIPTION
Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs. Michael Carbin Deokhwan Kim, Sasa Misailovic , and Martin C. Rinard. Approximate Computing. Media Processing, Machine Learning, Search. Solution Space: Accuracy versus Cost. 100%. Highly Accurate, - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/1.jpg)
Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs
Michael Carbin
Deokhwan Kim, Sasa Misailovic, and Martin C. Rinard
![Page 2: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/2.jpg)
Approximate Computing
Media Processing, Machine Learning, Search
![Page 3: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/3.jpg)
Solution Space: Accuracy versus Cost
Accuracy
Time/Resources/Cost
0%
100%
Highly Accurate,Expensive
Less accurate,Inexpensive
![Page 4: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/4.jpg)
Standard Program
Accuracy
Time/Resources/Cost
0%
100%
One point in tradeoff space
![Page 5: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/5.jpg)
How Do I Access Other Points in Tradeoff Space?
![Page 6: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/6.jpg)
Approximate Program Transformations
• Task Skipping (Rinard ICS ‘06)
• Loop Perforation (Misailovic, Hoffmann, Sidiroglou, Rinard MIT-TR ’09; ICSE’10; SAS’11; FSE’11).
• Dynamic Knobs (Hoffmann, Sidiroglou, Carbin, Misailovic, Rinard ASPLOS’11)
• Function Substitution (Zhu, Misailovic, Kelner, Rinard POPL ’12)
• Approximate Memories (Lui, Pattabiraman, Moscibroda, Zorn ASPLOS’11; Sampson, Dietl, Fortuna, Gnanapragasam, Ceze, Grossman PLDI ‘11)
• Approximate Memoization (Chaudhuri, Gulwani, Lublinerman, NavidPour FSE ’11)
• Statistical Parallelization (Misailovic , Kim, Rinard MIT-TR ’10,’12)
![Page 7: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/7.jpg)
Relaxed Program
Accuracy
Time/Resources/Cost
0%
100%
Admits executions at multiple points in tradeoff space
Relaxed programs can dynamically and automatically adapt
![Page 8: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/8.jpg)
Loop Perforation
• Profile program, find loops that take most time• Perforate the loops (skip some iterations)
for (i = 0; i < n; i++) { … }
relax s st (s == 1 || s == 2);for (i = 0; i < n; i += s) { … }
Nondeterministically choose loop increment
Execute subset of loop iterations
![Page 9: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/9.jpg)
Common Reaction
• OK, I agree program should run faster• But you can’t do this because you’ll get the
wrong result!
![Page 10: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/10.jpg)
Our Response
• OK, I agree program should run faster• But you can’t do this because you’ll get the
wrong result!• You won’t get the wrong result • You’ll get a different result
![Page 11: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/11.jpg)
We Tried It, And It Works!(ICSE 2010, FSE 2011)
Parsec Benchmark Suite
x264 (H.264 video encoding)bodytrack (human movement tracking)swaptions (swaption pricing)ferret (image search)canneal (digital circuit place and route)blackscholes (European option pricing)streamcluster (online point clustering)
Results
• Performance improvement – Typically over a factor of two– Up to a factor of seven
• Less than 10% change in output
• But no guarantees…
![Page 12: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/12.jpg)
What This Paper Is About
• Expressing relaxed programs
• Specifying acceptability of relaxed programs
• Proving relaxed programs are acceptable
![Page 13: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/13.jpg)
Key Insights
• Relax statement introduces nondeterminism – Subject to a relaxation condition
• Original and relaxed programs share structure– Use relational reasoning– To transfer specification/verification effort from
original program to relaxed program
![Page 14: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/14.jpg)
Methodology for Safe and Acceptable Relaxed Programs
![Page 15: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/15.jpg)
Step #1: Develop a Program
Accuracy
Time/Resources/Cost
0%
100%
![Page 16: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/16.jpg)
Step #2: Define and Verify/Validate Acceptability
Accuracy
Time/Resources/Cost
0%
100%
Define safety and acceptable levels of accuracy
![Page 17: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/17.jpg)
Defining Acceptable
Safety Integrity Accuracy
Key: any implementation that satisfies the stated acceptability properties is acceptable
Acceptability Properties
![Page 18: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/18.jpg)
Acceptability Specification
• assert P: verified assertion
• assume P: assumption– Original program: established through any means – Relaxed program: must be preserved
• relate : relational assertion– Relates values in relaxed program to original
![Page 19: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/19.jpg)
Example Acceptability Properties
relate |z<r> - z<o>| <= .1 * z<o>
relate y<r> == y<o>
assert x != 0 assume x >= 0Safety:
Integrity:
Accuracy:
![Page 20: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/20.jpg)
Step #3: Relax Program
Accuracy
Time/Resources/Cost
0%
100%
Insert relax statements to introduce nondeterministic behaviors at other points
![Page 21: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/21.jpg)
Relax Statement
relax (s) st (s == 1 || s == 2)
Modified Variables Relaxation Predicate
![Page 22: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/22.jpg)
Relaxed Program Semantics
• Shared Structure, Two Semantics– Original semantics
(relax statements have no effect)
– Relaxed semantics (relax statements modify state)
ApproximateNondeterministic
![Page 23: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/23.jpg)
Step #4: Verify that Relaxation Preserves Acceptability
Accuracy
Time/Resources/Cost
0%
100%
Verify that
is a subset of
![Page 24: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/24.jpg)
How do we verify relaxed programs?
(Verification Strategies)
![Page 25: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/25.jpg)
Program Logic (Hoare Logic)
{x = 1} x = x + 1 {x = 2}
If we know P is true of the program, then after execution of s, Q is also true
}{}{ Q s P
![Page 26: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/26.jpg)
Strategy #1: Verify Relaxed Program Outright
• Note: relaxation doesn’t modify y• If S(y) is true in the original program, then it’s
also true in relaxed
<...>{ P(x, y) && Q(y) }relax (x) st (true);{ Q(y) }<...>{ R(x, y) && S(y)}assert R(x, y) && S(y);
Lose P because x is modified
Prove both R and S
![Page 27: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/27.jpg)
Relational Program Logic
{x<r> == x<o> && y<r> == y<o>} relax (x) st (true);{y<r> == y<o>}
relrel Q sP
![Page 28: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/28.jpg)
Strategy #2: Relational Reasoning
<...>{x<r> == x<o> && y<r> == y<o>}relax (x) st (true);{ y<r> == y<o> }<...>{R(x<r>, y<r>) && y<r> == y<o> }assert R(x, y) && S(y) ;
x different but y the same
Only prove R
If S(y<o>) is trueand y<r> == y<o>
then S(y<r>) is true
Relational reasoning is the bridge
![Page 29: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/29.jpg)
Guarantee: Relative Progress
If original program satisfies all assertions, then the relaxed program satisfies all assertions
Established through any means: verification, testing, code review
![Page 30: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/30.jpg)
Formalization
![Page 31: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/31.jpg)
Language
![Page 32: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/32.jpg)
Inference Rules
![Page 33: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/33.jpg)
Coq Formalization
![Page 34: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/34.jpg)
A Lot of Coq
Formalization is sound.Relative progress guaranteed
![Page 35: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/35.jpg)
Case Studies
• Dynamic Knobs– Dynamically choose different implementations
• Statistical Parallelization– Reduce synchronization of parallelized algorithm
• Approximate Memory– Relax memory integrity of a stored matrix
In the paper!
![Page 36: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/36.jpg)
Future Work (In Progress/Submission)
• Termination– Relaxation may interfere– Relative termination perhaps powerful
• Scalability– Larger language; verified with static analysis
• Synthesizing Relaxations– Derive relaxations from acceptability properties
![Page 37: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/37.jpg)
Related Work
• Executable Specifications– Specification Statement (Morgan TOPLAS ‘88)
• Relational Reasoning/Program Logics– Translation Validation (Pnueli TACAS ’98) – Relational Hoare Logic (Benton POPL ’04)– Developed for verifying traditional compiler optimizations
– i.e., semantic equivalence• Safe Approximate Computations– Critical Region Identification (Carbin ISSTA ‘10)– EnerJ: Approximate Data Types (Sampson PLDI ’11)
![Page 38: Proving Acceptability Properties of Relaxed Nondeterministic Approximate Programs](https://reader033.vdocuments.mx/reader033/viewer/2022051402/5681634b550346895dd3dd5e/html5/thumbnails/38.jpg)
Takeaway
• Relaxation is a powerful technique– Increased performance– Reduced power– Dynamic adaptation
• Relational reasoning is the key to verifying acceptability of relaxed programs