Reasoning Method between Polynomial Error Assertions

Abstract

Error coefficients are ubiquitous in systems. In particular, errors in reasoning verification must be considered regarding safety-critical systems. We present a reasoning method that can be applied to systems described by the polynomial error assertion (PEA). The implication relationship between PEAs can be converted to an inclusion relationship between zero sets of PEAs; the PEAs are then transformed into first-order polynomial logic. Combined with the quantifier elimination method, based on cylindrical algebraic decomposition, the judgment of the inclusion relationship between zero sets of PEAs is transformed into judgment error parameters and specific error coefficient constraints, which can be obtained by the quantifier elimination method. The proposed reasoning method is validated by proving the related theorems. An example of intercepting target objects is provided, and the correctness of our method is tested through large-scale random cases. Compared with reasoning methods without error semantics, our reasoning method has the advantage of being able to deal with error parameters.

1. Introduction

Formal verification includes two main approaches: model-checking and theorem-proving. Model-checking, proposed by Clarke and Emerson, verifies safety properties by searching the state space [1,2]. In contrast, theorem-proving uses logic and mathematical reasoning to verify the safety properties of a piece of software [3]. These two approaches have complementary advantages [4,5] and are widely used in industries [6,7,8]. Reasoning methods in theorem-proving belong to the field of deductive reasoning, comprising syntax, semantics, and reasoning rules; and numerous research studies have been conducted in this area. Labeled transition systems or their similar structures are widely used in the field of formal verification, which is a common technical method for describing the transition behavior of systems [9]. In particular, the states and transition conditions of systems are defined by two-valued logic propositions. However, two-valued or multi-valued logic is inadequate to describe the state of complex systems [10]. The real polynomial algebraic transition system extends the domain space of multivalued logic to the real number domain, which can more effectively describe complex systems and verify their safety properties [11]. Particularly in the field of hybrid system verification [12], numerous theories based on differential invariants have been proposed [13,14,15].

Semantics, grammar, and reasoning rules have been extensively studied in the field of reasoning methods [16]. However, the system parameters are sometimes not precisely determined in complex systems. In most cases, only the value ranges of these parameters are known [17,18], thereby making the reasoning and verification of these systems more complex. However, few reports on the semantic descriptions of errors have been published. For example, the Gröbner basis is widely used in polynomial-based theorem-proving methods. However, as the Gröbner basis of polynomial equations does not vary continuously along with the parameters, it significantly increases the difficulty of dealing with error parameters in reasoning methods. In engineering, absolute accuracy is neither possible nor necessary. For example, when the temperature reaches 80 °C, the system stops heating; this is called a guard condition. However, precise measurements are not possible because the measurement often contains errors. Owing to the accumulation of multiple error variables, the system may undergo the wrong transitions. This is unacceptable for safety-critical systems. For example, a guard condition is $\mathrm{f}(x_1,x_2,\dots ,x_{\mathrm{n}})<100$, where $x_1,x_2,\dots ,x_{\mathrm{n}}$ are the values measured by instruments and f is a function of $x_1,x_2,\dots ,x_{\mathrm{n}}$. Because $x_1,x_2,\dots ,x_{\mathrm{n}}$ are all measured values, the calculations cannot be completely accurate. In this way, errors may be further accumulated in the calculation of the function value $\mathrm{f}(x_1,x_2,\dots ,x_{\mathrm{n}})$. In other words, the calculation result may conclude that the guard condition $\mathrm{f}(x_1,x_2,\dots ,x_{\mathrm{n}})<100$ is satisfied, when, in fact, it is perhaps not correct. Especially in the case of the disturbance-sensitive function, minor parameter changes can lead to completely different results. However, several studies on reasoning methods involve error parameters. The authors previously proposed a reasoning method for linear error assertion (LEA) [19]. In this method, combined with the convex properties of LEA, the conclusion that vertexes of the precursor assertion are contained in the zero set of the successor assertion can be used to determine whether there is an implication relationship between precursor assertion and successor assertion. However, zero sets of nonlinear assertions may not be a convex set, indicating that the method reported in [19] is ineffective in dealing with nonlinear error assertion.

Error semantics based on interval numbers can be transformed into an inequality relationship. This implies that some theorems of inequality-proving may be promising for nonlinear error assertions. For example, $\overline{a}=[a^{-},a^{+}]$ can be transformed into: $a^{-}\le \overline{a}\le a^{+}$. Quantifier elimination methods used in reasoning methods between polynomial error assertions (PEAs) are introduced in this study. The inclusion relationships of the zero sets of the PEAs are transformed into the quantifier elimination problems of semi-algebraic first-order logic. Our reasoning method can be used to verify systems described by PEAs.

2. Preliminary

2.1. Error Intervals

Errors are common and inevitable. This section presents the error semantics represented by the intervals and their operation rules. Errors were quantitatively characterized using interval numbers. The interval numbers generalize real numbers and have been successfully applied in numerous areas [20,21]. The definition and operation rules of the interval numbers are introduced below.

Let $\overline{a}=[a^{-},a^{+}]$, $\overline{b}=[b^{-},b^{+}]$, $c$ be a constant.

For addition:

$$\{\begin{array}{l}c+\overline{a}=[a^{-}+c,a^{+}+c]\\ \overline{a}+\overline{b}=[a^{-}+b^{-},a^{+}+b^{+}]\end{array}$$

(1)

For subtraction:

$$\{\begin{array}{l}\overline{a}-\overline{b}=[a^{-}-b^{+},a^{+}-b^{-}]\\ \overline{a}-c=[a^{-}-c,a^{+}-c]\end{array}$$

(2)

For multiplication:

$$\overline{a}\overline{b}=[\min (a^{-}{b}^{-},a^{-}{b}^{+},a^{+}{b}^{-},a^{+}{b}^{+}),\max (a^{-}{b}^{-},a^{-}{b}^{+},a^{+}{b}^{-},a^{+}{b}^{+})$$

(3)

In particular, when $\overline{a}\ge 0,\overline{b}\ge 0$, then:

$$ab=[a^{-}{b}^{-},a^{+}{b}^{+}]$$

(4)

when $c>0$, then:

$$c\overline{a}=[c{a}^{-},c{a}^{+}]$$

(5)

when $c<0$, then:

$$c\overline{a}=[c{a}^{+},c{a}^{-}]$$

(6)

and when $c=0$, then:

$$c\overline{a}=[0,0]=0$$

(7)

For division, when $c>0$, then:

$$\overline{a}/c=[a^{-}/c,a^{+}/c]$$

(8)

and when $c<0$, then:

$$\overline{a}/c=[a^{+}/c,a^{-}/c]$$

(9)

The error intervals generalize real numbers, where $a^{-}=a^{+}$, $\overline{a}$ is the real number. However, the four arithmetic operations of the interval numbers defined above are irreversible. An example is provided as follows.

If a is a real number, then the equation a + b − b = a must hold. However, if a and b are interval numbers, the previous equation does not necessarily hold.

Let $\overline{a}=[a^{-},a^{+}]$ and $\overline{b}=[b^{-},b^{+}]$.

From the operation rules above, Formula (10) is obtained:

$$\overline{a}+\overline{b}-\overline{b}=[a^{-}+b^{-},a^{+}+b^{+}]-\overline{b}=[a^{-}+b^{-}-b^{+},a^{+}+b^{+}-b^{-}]\ne \overline{a}$$

(10)

Formula (10) implies that the reasoning process is irreversible (that is, the conclusion of the reasoning is only one necessary condition, and not the necessary and sufficient condition for the premise) and does not imply that the four operation rules with interval numbers are incorrect in reasoning methods. The increase in the number of operations, with interval numbers in the reasoning process, may lead to meaningless results. Therefore, it is essential to try other methods in the reasoning process, and this study provides a possible approach.

2.2. Polynomial Error Assertion

In this section, we introduce some of the mathematical concepts that have been established and are involved in our method (Definitions 1, 2, and 3). We also introduce the definitions of PEA and the zero set of PEAs (Definitions 4 and 5) that are contributed by this study.

Definition 1.

A real polynomial is a mathematical expression that comprises several terms. Each term includes one or more variables raised to power and is multiplied by a real coefficient. The general form of a polynomial with m terms is given by Formula (11):

$$f(x_1,x_2,\dots ,x_n)={\displaystyle \sum _{i=0}^m{c}_i{x}_1^{{\alpha }_{i1}}{x}_2^{{\alpha }_{i2}}\dots x_n^{{\alpha }_{in}}}$$

(11)

Let$ℝ[x_1,\dots ,x_n]$be the set of all real polynomials. An example of a real polynomial is as follows:

$$f_1(x_1,x_2,x_3)=3x_{{}_1}^3{x}_2^{}+x_1^2+2x_2^{}$$

(12)

Definition 2

(Real zero set of real polynomials, i.e., zero set of polynomials).Let$f(x_1,\dots ,x_n)\in ℝ[x_1,\dots ,x_n]$. The real zero set of$f(x_1,\dots ,x_2)$is expressed as (13), denoted by$Zero(f)$:

$$Zero(f)=\{(x_1,\dots ,x_n)|f(x_1,\dots ,x_2)=0,and(x_1,\dots ,x_n)\in {ℝ}^n\}$$

(13)

Definition 3

(Real zero set of polynomials group).Let $\phi$be a polynomial group comprising$f_1,f_2,\dots ,f_n$, which is expressed as (14), and:$f_1\in ℝ[x_1,\dots ,x_n],f_2\in ℝ[x_1,\dots ,x_n],\dots ,f_n\in ℝ[x_1,\dots ,x_n]$.

$$\phi =\{\begin{array}{l}{f}_1(x_1,\dots ,x_n)=0\\ f_2(x_1,\dots ,x_n)=0\\ \dots \\ f_n(x_1,\dots ,x_n)=0\end{array}$$

(14)

The real zero set of$\phi$, denoted by$Zero(\phi )$, satisfies Formula (15).

$$Zero(\phi )=Zero(f_1)\cap Zero(f_2)\cap ,\dots ,\cap Zero(f_n)$$

(15)

The definition of the polynomial error assertion is provided below.

Definition 4

(Polynomial error assertion, i.e., PEA).$\overline{\phi }$is a PEA if $\overline{\phi }$and $\overline{f_1},\overline{f_2},\dots ,\overline{f_n}$satisfy Formulas (16)and (17), respectively.

$$\overline{\phi }=\{\begin{array}{l}\overline{f_1}(x_1,\dots ,x_n)=0\\ \overline{f_2}(x_1,\dots ,x_n)=0\\ \dots \\ \overline{f_n}(x_1,\dots ,x_n)=0\end{array}$$

(16)

$$\begin{array}{c}\overline{f_i}(x_1,\dots ,x_n)={\displaystyle \sum _{j=0\dots m}\overline{c_{ij}}{x}_1^{{\alpha }_{ij1}}{x}_2^{{\alpha }_{ij2}}\dots x_n^{{\alpha }_{ijn}}}{,}^{}i=1,2\dots n\\ \overline{c_j}=[c_j^{-},c_j^{+}]\\ j=0,\dots m\end{array}$$

(17)

Definition 5

(Real zero set of PEAs, zero set of PEAs).$\overline{\phi }$is a PEA. The real zero set of$\overline{\phi }$, denoted by $zero(\overline{\phi })$, satisfies Formula (18).

$$zero(\overline{\phi })=zero(\overline{f_1})\cap zero(\overline{f_2})\cap \dots \cap zero(\overline{f_n})$$

(18)

In addition,$zero(\overline{f_1}),zero(\overline{f_2}),\dots ,zero(\overline{f_n})$satisfies Formula (19).

$$zero(\overline{f_i})=\{(x_1,\dots ,x_n)|\forall c_{ij}\in \overline{c_{ij}},and{\displaystyle \sum _{j=0\dots m_i}{c}_{ij}{x}_1^{{\alpha }_{ij1}}{x}_2^{{\alpha }_{ij2}}\dots x_n^{{\alpha }_{ijn}}}=0,and(x_1,\dots ,x_n)\in {ℝ}^n\}$$

(19)

From Definition 5, $zero(\overline{\phi })$ contains all possible solutions of Formula (19) owing to the error coefficients. Therefore, all possible states of the system generated by the error parameters can be defined using $zero(\overline{\phi })$. In engineering, if some system states are not found to be under $zero(\overline{\phi })$, this indicates that there are non-error factors affecting the system. Moreover, determining whether there are some mechanical failures in the system is necessary.

2.3. Implication Relationships

The implication relationship between assertions is the fundamental rule in the reasoning method based on theorem-proving. We introduce the equivalent expression of the implication relationship between polynomials and zero sets in Theorems 1 and 2, respectively.

Theorem 1.

${\phi }_1$implies ${\phi }_2$(denoted as ${\phi }_1|={\phi }_2$) iff$Zero({\phi }_1)\subseteq Zero({\phi }_2)$, where ${\phi }_1$and${\phi }_2$are the two polynomials.

In Theorem 1, the comprehensible statement of the implication relationship (${\phi }_1|={\phi }_2$) is as follows: if ${\phi }_1$ is true, then ${\phi }_2$ must be true. For example, ${\phi }_1:x-1=0{,}^{}{\phi }_2:x^2-3x+2=0$, then ${\phi }_1|={\phi }_2$ must be true. Apparently, if the formula $x-1=0$ holds, then $x^2-1=0$ must be true. The formula $Zero({\phi }_1)\subseteq Zero({\phi }_2)$ is obtained using Theorem 1. Indeed, $Zero({\phi }_1)\subseteq Zero({\phi }_2)$ must hold because $\left\{1\right\}\subseteq \{1,2\}$.

Theorem 2.

${\overline{\phi }}_1$implies ${\overline{\phi }}_2$(denoted as ${\overline{\phi }}_1|={\overline{\phi }}_2$) iff$Zero({\overline{\phi }}_1)\subseteq Zero({\overline{\phi }}_2)$, where ${\overline{\phi }}_1$and ${\overline{\phi }}_2$are the two PEAs.

The significance of $Zero(\overline{\phi })$ lies in all possible system states produced by error coefficients. Conversely, if the security state zone of the system is defined by $Zero({\overline{\phi }}_2)$, and, at a certain moment, the system state $x=(x_1,x_2,\dots ,x_n)$ satisfies $(x_1,x_2,\dots ,x_n)\notin Zero(\overline{{\phi }_2})$, then state $x$ is unsafe for the system. If the security state zone of the system is defined by $Zero({\overline{\phi }}_2)$, and if $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ is held, it implies that all states in $Zero(\overline{{\phi }_1})$ are safe.

3. Problem Descriptions

Let ${\overline{\phi }}_1$ and ${\overline{\phi }}_2$ be two PEAs; we must determine whether $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ holds. This question has safety significance in safety-critical systems. For example, considering the safety states of the system are designed using $Zero(\overline{{\phi }_2})$ according to the given error coefficients, the mechanical or electrical capability of the system meets the given design requirements and error tolerances. However, this does not mean that all possible error assignments can be met for the system design. For example, when extreme weather conditions occur, one of the error coefficients exceeds the given error range. At this time, it is necessary to identify whether the system can still not exceed the design requirements under the new parameter assignments. When ${\overline{\phi }}_1$ and ${\overline{\phi }}_2$ are both non-linear PEA, the vertex judgment method (VJM) in [19] is invalid. The idea of VJM is that ${\overline{\phi }}_1$ and ${\overline{\phi }}_2$ are linear algebraic assertions. ${\overline{\phi }}_1|={\overline{\phi }}_2$ is true if all vertices ($v_1,v_2,\dots ,v_{2^n}$) ${\overline{\phi }}_1$ satisfy the formula $v_1\in Zero(\overline{{\phi }_2}),v_2\in Zero(\overline{{\phi }_2}),\dots ,v_{2^n}\in Zero(\overline{{\phi }_2})$. However, VJM is based on convex conditions $Zero(\overline{{\phi }_2})$. The convex set has a property that all points inside it (including its boundary) can be generated finitely by its vertices. Moreover, if all the vertices of $Zero(\overline{{\phi }_1})$ are within $Zero(\overline{{\phi }_2})$ (including the boundary), then $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ must hold. Unfortunately, $Zero(\overline{{\phi }_2})$ is not a convex set when ${\overline{\phi }}_2$ is a nonlinear PEA. For example, in Formula (45) in Section 5, $Zero(\overline{{\phi }_2})$ is not a convex set, and $Zero(\overline{{\phi }_2})$ is shown as the red part in Figure 1. Obviously, both A and B are inside $Zero(\overline{{\phi }_2})$, but some points on the line segment of AB are no longer inside $Zero(\overline{{\phi }_2})$.

Therefore, VJM is invalid for PEA. For example, Figure 2a clearly shows that the rectangle ABCD is a convex set, and points A, B, C, and D are the vertices of the rectangle. When vertices A, B, C, and D are all inside the diamond-shaped EFGH, it can be concluded that all the points inside the rectangle ABCD are inside the diamond-shaped EFGH. However, the closed area formed by the line segments EF, FG, GH, HE (the area is shorted for EFGH) in Figure 2b is also a convex set, as seen in the red area in Figure 1. Although vertices A, B, C, and D of the rectangle ABCD are all inside the non-convex EFGH (including the boundary), the red part in the rectangle ABCD remains outside EFGH.

The following section introduces a method of identifying the relationship between non-linear PEAs and the mathematical definitions involved.

4. Reasoning Method between PEAs

4.1. Two Mathematical Definitions

The constant coefficients—the semi-algebraic system (CSS) [22] and first-order polynomial logic formulas [14]—are introduced in Definitions 6 and 7, respectively. After Definition 6, the method of transforming PEA into a CSS is provided.

Definition 6 (CSS).

Formula (20) represents the general form of a CSS:

$$\{\begin{array}{l}{p}_1(x_1,\dots ,x_n)=0,\dots ,p_s(x_1,\dots ,x_n)=0,\\ g_1(x_1,\dots ,x_n)\ge 0,\dots ,g_r(x_1,\dots ,x_n)\ge 0,\\ g_{r+1}(x_1,\dots ,x_n)>0,\dots ,g_t(x_1,\dots ,x_n)>0,\\ h_1(x_1,\dots ,x_n)\ne 0,\dots ,h_m(x_1,\dots ,x_n)\ne 0,\end{array}$$

(20)

Among them,$p_1,\dots ,p_s,g_1,\dots ,g_t,h_1,\dots ,h_m$are all real coefficient polynomials. CSS has a wide range of applications in terms of geometry, topology, and differential dynamics.

The given PEA can be transformed into a CSS. The general conversion method is as follows.

A PEA comprises multiple error polynomials.$\overline{f}(x_1,\dots ,x_n)$is the error polynomial in the general form, as in Formula (17). The equivalent CSS is then shown in Formula (21):

$$\{\begin{array}{l}{\displaystyle \sum _{j=0\dots m}\overline{c_j}{x}_1^{{\alpha }_{j1}}{x}_2^{{\alpha }_{j2}}\dots x_n^{{\alpha }_{jn}}=}0,\\ c_1^{+}\ge c_1,\dots ,c_j^{+}\ge c_j,\\ c_1\ge c_1^{-},\dots ,c_j\ge c_j^{-},\end{array}$$

(21)

Thus, a PEA can be transformed into an equivalent CSS.

Definition 7.

A first-order polynomial logic comprises the following four parts:

(1) 

Terms of polynomial, which comprise these variables ($x_1,\dots ,x_n$or$x,y,z\dots$) in$ℝ$;

(2) 

Relational symbols:$=,\ne ,<,\le ,>,\ge \dots$;

(3) 

Boolean connectives:$\wedge ,\vee ,\neg ,\to ,\leftrightarrow$;

(4) 

Quantifiers:$\forall ,\exists$.

For example, Formula (22) is a first-order polynomial logic:

$$\forall x\forall y((x^2+y^2<4)\wedge (x^2+y^2>1))$$

(22)

Accordingly, a CSS can be equivalently transformed into a first-order polynomial logic, as shown in Formula (23):

$$\{\begin{array}{l}{x}^2+y^2<4\\ x^2+y^2>1\\ x>0\end{array}\iff (x^2+y^2<4)\wedge (x^2+y^2>1)\wedge (x>0)$$

(23)

4.2. Quantifier Elimination

This section briefly introduces the quantifier elimination method, based on cylindrical algebraic decomposition (CAD). Tarski modified the reasoning process based on first-order logic to judge the inclusion relationship of specific sets. However, Tarski’s algorithm has a high time complexity for the problem of quantifier elimination [23]. The CAD algorithm was first proposed by Collins [24] and has been further improved by many researchers. At present, it is widely used in quantifier elimination problems. Xia et al. first implemented the CAD algorithm on Maple [25]. The CAD algorithm can equivalently convert first-order polynomial logic with quantifiers into a formula without quantifiers. The algorithm first selects an appropriate projection operator (Proj), which projects a first-order logic formula with r variables to a first-order logic formula with only r − 1 variables. Then, it iteratively applies the projection operator Proj, thereby obtaining several first-order logic formulas with r − 1, r − 2, …, 1 variables. Subsequently, the real root isolation algorithm is applied to these first-order logic formulas, such that the ${ℝ}^r$ space is divided into several cells. All the points in a certain cell have the same sign on each subformula in this first-order polynomial logic. Hence, an arbitrary point in each cell can be selected to verify each formula in first-order polynomial logic, thereby providing an equivalent quantifier-free formula. The quantifier elimination method has been applied to many contexts [26,27,28]. Certain scholars have made some progress in the poly-complexity quantifier elimination method in the field of symbolic computation [29]. In this study, $Q\mathrm{E}()$ denotes the quantifier elimination method.

For example, $f$ is a first-order polynomial logic, such as in Formula (24). After eliminating the quantifier for $f$ (denoted as $Q\mathrm{E}(f)$), the equivalent non-quantifier formula of $f$ is as Formula (25):

$$f=\exists y((x^2+y^2<1)\wedge (-2<x^3+y<2))$$

(24)

$$f\stackrel{Q\mathrm{E}(f)}{\iff }-1<x<1$$

(25)

4.3. Reasoning Method between PEAs

This section introduces some theorems proposed in this study (Lemma 1, Theorem 3, and Definitions 8 and 9), and the steps of the reasoning method between PEAs.

Lemma 1.

$\overline{f_1}$ and $\overline{f_2}$ are two error polynomials, expressed in Formula (26), and are arranged in the same alphabetical order. If $\overline{c_{1j}}\subseteq \overline{c_{2j}},j=0,1,\dots ,m$ and ${\alpha }_{1j1}={\alpha }_{2j1},{\alpha }_{1j2}={\alpha }_{2j2},\dots ,{\alpha }_{1jm}={\alpha }_{2jm}$ are true, then $Zero(\overline{f_1})\subseteq Zero(\overline{f_2})$ must hold.

$$\{\begin{array}{l}\overline{f_1}(x_1,\dots ,x_n)={\displaystyle \sum _{j=0\dots m}\overline{c_{1j}}{x}_1^{{\alpha }_{1j1}}{x}_2^{{\alpha }_{1j2}}\dots x_n^{{\alpha }_{1jn}}}\\ \overline{f_2}(x_1,\dots ,x_n)={\displaystyle \sum _{j=0\dots m}\overline{c_{2j}}{x}_1^{{\alpha }_{2j1}}{x}_2^{{\alpha }_{2j2}}\dots x_n^{{\alpha }_{2jn}}}\end{array}$$

(26)

Proof. 

Let $\overline{c_{1j}}=[c_{1j}^{-},c_{1j}^{+}],\overline{c_{2j}}=[c_{2j}^{-},c_{2j}^{+}]$. From $\overline{c_{1j}}\subseteq \overline{c_{2j}}$, the Formula (27) is obtained:

$$\overline{c_{2j}}=\overline{c_{1j}}\cup [c_{2j}^{-},c_{1j}^{-}]\cup [c_{1j}^{+},c_{1j}^{+}]$$

(27)

According to Definition 5, Formula (28) can be obtained:

$$\begin{array}{l}Zero(\overline{f_2})=\{(x_1,\dots ,x_n)|\forall c_{2j}\in \overline{c_{2j}},and{\displaystyle \sum _{j=0\dots m}{c}_{2j}{x}_1^{{\alpha }_{2j1}}{x}_2^{{\alpha }_{2j2}}\dots x_n^{{\alpha }_{2jn}}}=0\}\\ =\{(x_1,\dots ,x_n)|\forall c_{2j}\in (\overline{c_{1j}}\cup [c_{2j}^{-},c_{1j}^{-}]\cup [c_{1j}^{+},c_{1j}^{+}]),and{\displaystyle \sum _{j=0\dots m}{c}_{2j}{x}_1^{{\alpha }_{2j1}}{x}_2^{{\alpha }_{2j2}}\dots x_n^{{\alpha }_{2jn}}}=0\}\\ =Zero(\overline{f_1})\cup \{(x_1,\dots ,x_n)|\forall c_{2j}\in ([c_{2j}^{-},c_{1j}^{-}]\cup [c_{1j}^{+},c_{1j}^{+}]),and{\displaystyle \sum _{j=0\dots m}{c}_{2j}{x}_1^{{\alpha }_{2j1}}{x}_2^{{\alpha }_{2j2}}\dots x_n^{{\alpha }_{2jn}}}=0\}\\ \end{array}$$

(28)

Therefore, the formula $Zero(\overline{f_1})\subseteq Zero(\overline{f_2})$ holds. □

For example, because $[1,2]\subseteq [1,3]$, Formula (29) must hold.

$$Zero([1,2]\cdot x^2-5x-1=0)\subseteq Zero([1,3]\cdot x^2-5x-1=0)$$

(29)

Some symbols used in Theorem 3, and the reasoning method in this article, are provided in Definitions 7 and 8.

Definition 8.

Let $\phi$be the CSS equivalent to $\overline{\phi }$, where $\overline{\phi }$is a PEA.

For example, $\overline{\phi }:y^2-[c_1^{-},c_1^{+}]x^2+x+[c_2^{-},c_2^{+}]=0$. The equivalent CSS of $\overline{\phi }$ is represented by Formula (30):

$$\phi =\{\begin{array}{l}{y}^2-c_1{x}^2+x+c_2=0\\ c_1^{-}\le c_1\le c_1^{+}\\ c_2^{-}\le c_2\le c_2^{+}\end{array}$$

(30)

Definition 9.

${\phi }_s$is a real polynomial equation system that replaces all error coefficients in $\overline{\phi }$with symbols.

For example, $\overline{\phi }:y^2-[c_1^{-},c_1^{+}]x^2+x+[c_2^{-},c_2^{+}]=0$. Formula (31) demonstrates the symbolized Formula ${\phi }_s$:

$${\phi }_s:y^2-c_1{x}^2+x+c_2=0$$

(31)

Theorem 4.

${\overline{\phi }}_1$and ${\overline{\phi }}_2$are two PEAs, and the error coefficients in ${\overline{\phi }}_1$and ${\overline{\phi }}_2$are provided. The equivalent CSS corresponding to ${\overline{\phi }}_2$is ${\phi }_2$, presented in Definition 8. The symbolized formula of ${\overline{\phi }}_1$is ${\phi }_{1s}$, as expressed in Definition 9.

Assuming that all the error coefficients of${\overline{\phi }}_1$are $c_{11}=[c_{11}^{-},c_{11}^{+}],c_{12}=[c_{12}^{-},c_{12}^{+}],\dots ,c_{1n}=[c_{1n}^{-},c_{1n}^{+}]$and all error coefficients of${\overline{\phi }}_2$are$c_{21}=[c_{21}^{-},c_{21}^{+}],c_{22}=[c_{22}^{-},c_{22}^{+}],\dots ,c_{2m}=[c_{2m}^{-},c_{2m}^{+}]$.

Then, if Formula (32) holds,$Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$must be true:

$$\begin{array}{l}\{c_{11},\dots ,c_{1n}|(c_{11}^{-}\le c_{11}\le c_{11}^{+})\wedge \dots \wedge (c_{1n}^{-}\le c_{1n}\le c_{1n}^{+})\}\subseteq \\ \{c_{11},\dots ,c_{1n}|Q\mathrm{E}(\forall x_1,\dots ,\forall x_n,\exists c_{21}\in [c_{21}^{-},c_{21}^{+}],\dots ,\exists c_{2m}\in [c_{2m}^{-},c_{2m}^{+}],{\phi }_{1s}|=\overline{{\phi }_2})\}\end{array}$$

(32)

Proof. 

Let $\overline{{\phi }_{1s}}=({\phi }_{1s}\wedge \forall (c_{11},\dots ,c_{1n})\in \{c_{11},\dots ,c_{1n}|Q\mathrm{E}(\forall x_1,\dots ,\forall x_n,\exists c_{21}\in [c_{21}^{-},c_{21}^{+}],\dots ,\exists c_{2m}\in [c_{2m}^{-},c_{2m}^{+}],{\phi }_{1s}|=\overline{{\phi }_2})\}$.

Because the quantifier elimination method ($Q\mathrm{E}()$) based on CAD can generate an equivalent quantifier-free logic constraint, Formula (33) can be obtained:

$$\overline{{\phi }_{1s}}|=\overline{{\phi }_2}$$

(33)

According to Theorem 2, Formula (34) holds:

$$Zero(\overline{{\phi }_{1s}})\subseteq Zero(\overline{{\phi }_2})$$

(34)

Conversely, according to Lemma 1 and Formula (32), we obtain Formula (35):

$$Zero(\overline{{\phi }_1})=Zero({\phi }_{1s}\wedge (c_{11}^{-}\le c_{11}\le c_{11}^{+})\wedge \dots \wedge (c_{1n}^{-}\le c_{1n}\le c_{1n}^{+}))\subseteq Zero(\overline{{\phi }_{1s}})$$

(35)

From Formulas (34) and (35), $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ holds. □

Based on Theorem 3, we can obtain the reasoning method for PEAs. Steps 1–4 can determine whether $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ is true. Some of the symbols used in the following steps are represented as follows:

${\overline{\phi }}_1$ and ${\overline{\phi }}_2$ are two PEAs. All the error coefficients of ${\overline{\phi }}_1$ and ${\overline{\phi }}_2$ are $c_{11}=[c_{11}^{-},c_{11}^{+}],c_{12}=[c_{12}^{-},c_{12}^{+}],\dots ,c_{1n}=[c_{1n}^{-},c_{1n}^{+}]$ and $c_{21}=[c_{21}^{-},c_{21}^{+}],c_{22}=[c_{22}^{-},c_{22}^{+}],\dots ,c_{2m}=[c_{2m}^{-},c_{2m}^{+}]$, respectively. The steps to verify whether $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ holds are as follows:

• Convert ${\overline{\phi }}_1$, ${\overline{\phi }}_2$ into the symbolized formula ${\phi }_{1s}$, ${\phi }_{2s}$ according to Definition 9.
• Combine ${\phi }_{1s}$, ${\phi }_{2s}$, and the error coefficients of ${\overline{\phi }}_2$ to form a first-order polynomial logic, as expressed in Formula (36):

  $${\phi }_{1s}\wedge {\phi }_{2s}\wedge (c_{21}^{-}\le c_{21}\le c_{21}^{+})\wedge \dots \wedge (c_{2m}^{-}\le c_{2m}\le c_{2m}^{+})$$

  (36)
• Convert $(c_{21}^{-}\le c_{21}\le c_{21}^{+})\wedge \dots \wedge (c_{2m}^{-}\le c_{2m}\le c_{2m}^{+})$ from Formula (36) into the representation with the existential quantifier $\exists$. Consequently, eliminate the quantifier for the formula $Q\mathrm{E}(\forall x_1,\dots ,\forall x_n,\exists c_{21}\in [c_{21}^{-},c_{21}^{+}],\dots ,\exists c_{2m}\in [c_{2m}^{-},c_{2m}^{+}],({\phi }_{1s}|={\phi }_{2s})$ to obtain a first-order constraint containing only $c_{11},\dots ,c_{1n}$. The result is represented by Formula (37):

  $$f_1(c_{11},\dots ,c_{1n})\vee \dots \vee f_L(c_{11},\dots ,c_{1n})$$

  (37)
• Finally, we determine whether Formula (38) holds. If (38) holds, then $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ holds:

  $$\{c_{11},\dots ,c_{1n}|(c_{11}^{-}\le c_{11}\le c_{11}^{+})\wedge \dots \wedge (c_{1n}^{-}\le c_{1n}\le c_{1n}^{+})\}\subseteq \{c_{11},\dots ,c_{1n}|f_1(c_{11},\dots ,c_{1n})\vee \dots \vee f_L(c_{11},\dots ,c_{1n})\}$$

  (38)

When there are multiple variables in Formula (37), the interval operation rules introduced in Section 2 may be needed to judge Formula (38).

A simple example is presented below to introduce the reasoning method between PEAs.

4.4. Simple Example

${\overline{\phi }}_1$ and ${\overline{\phi }}_2$ are two PEAs as Formula (39). Now, we must judge whether $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ holds:

$${\overline{\phi }}_1=\{\begin{array}{l}{x}^2+y^2=[1,4]\\ x=[0,+\infty ]\\ y=[0,+\infty ]\end{array},{\overline{\phi }}_2=\{\begin{array}{l}{(x-1)}^2+y^2=[0,6]\\ x=[0,+\infty ]\\ y=[0,+\infty ]\end{array}$$

(39)

Based on the steps described in Section 4.3, the specific steps for the example are as follows:

• The symbolized ${\overline{\phi }}_1$ and ${\overline{\phi }}_2$ are shown in Formula (40):

  $${\phi }_{1s}=\{\begin{array}{l}{x}^2+y^2=a\\ x\ge 0\\ y\ge 0\end{array},{\phi }_{2s}=\{\begin{array}{l}{(x-1)}^2+y^2=b\\ x\ge 0\\ y\ge 0\end{array}$$

  (40)
• According to Step 2 in Section 4.3, Formula (41) can be obtained:

  $$\begin{array}{l}{\phi }_{1s}\wedge {\phi }_{2s}\wedge (c_{21}^{-}\le c_{21}\le c_{21}^{+})\wedge \dots \wedge (c_{2m}^{-}\le c_{2m}\le c_{2m}^{+})=\\ (x^2+y^2=a)\wedge (x\ge 0)\wedge (y\ge 0)\wedge ({(x-1)}^2+y^2=b)\wedge 0\le b\le 6\end{array}$$

  (41)
• Using the call quantifier elimination algorithm, Formula (42) can be obtained:

  $$\begin{array}{l}\mathrm{Q}E(\forall x_1,\dots ,\forall x_n,\exists c_{21}\in [c_{21}^{-},c_{21}^{+}],\dots ,\exists c_{2m}\in [c_{2m}^{-},c_{2m}^{+}],{\phi }_{1s}|={\phi }_{2s})=\\ \mathrm{Q}E(\forall x_1,\dots ,\forall x_n,\exists b\in [0,6],((x^2+y^2=a)\wedge (x\ge 0)\wedge (y\ge 0))|=(({(x-1)}^2+y^2=b))\wedge (x\ge 0)\wedge (y\ge 0))=\\ \mathrm{a}\le 5\end{array}$$

  (42)
• Finally, $[1,4]\subseteq \mathrm{a}\le 5$, i.e., $1\le a\le 4\subseteq \mathrm{a}\le 5$ is found to be true. Therefore, $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ is true.

The Maple2020 codes and the result of Step 3 are as follows:

with (RegularChains):

with (SemiAlgebraicSetTools):

R: = PolynomialRing([x, y, a, b]);

f: = &A [x, y], &E [b], (((y^2 + x^2 = a) &and (0 <= x)) &and (0 <= y)) &implies ((((x − 1)^2 + y^2 <= b) &and (0 <= b)) &and (b <= 6));

out: = QuantifierElimination(f, ‘output’ = ‘rootof’);

out: = a <= 5

Figure 3, Figure 4, Figure 5 and Figure 6, generated from Python codes, show the conclusion more clearly. The red part of Figure 3 is the area of $Zero({\overline{\phi }}_1)$. The blue part of Figure 4 is the area of $Zero({\overline{\phi }}_2)$.

Does $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ hold? We can mix Figure 3 and Figure 4 to observe. Figure 5 is obtained by mixing Figure 3 and Figure 4. As shown in Figure 5, the red part ($Zero({\overline{\phi }}_1)$) is all inside $Zero({\overline{\phi }}_2)$. Furthermore, we are also interested in the boundary situation when a = 5 (variable “a” comes from Formula (40)). According to the calculation result from the Maple codes above in Section 4.4, we can conclude that when a <= 5, $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ holds. Figure 6 shows the situation when a = 5.

In Figure 6, $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ barely holds with the boundary condition (a = 5). This shows that, in this case, the results (a <= 5) obtained by our method are complete.

5. Example of Target Interception

5.1. Interception Verification

This section provides an example of the reasoning method between PEAs in the industry and the codes in Maple.

A self-powered flying target descends from a height of 10 km. Assuming that the expected landing point is the origin of the coordinates, the target flight path is always on a plane. The target starts to land at a horizontal distance (s) of 80 km from the point of origin, and a height (h) of 10 km in the vertical direction. After radar monitoring and system simulation, the landing trajectory of the target conforms to a PEA, which is represented by ${\overline{\phi }}_1$ in Formula (43):

$${\overline{\phi }}_1=\{\begin{array}{l}y=\frac{10h}{s^3}{x}^3-\frac{15h}{s^4}{x}^4+\overline{a}\cdot \frac{6h}{s^5}{x}^5\\ \overline{a}=[0.99,1.01]\end{array}$$

(43)

From Formula (43), $Zero(\overline{{\phi }_1})$ is obtained as shown in Formula (44):

$$Zero(\overline{{\phi }_1})=\{(x,y)|\forall a\in [0.99,1.01],\frac{10h}{s^3}{x}^3-\frac{15h}{s^4}{x}^4+\overline{a}\cdot \frac{6h}{s^5}{x}^5-y=0,45\le x\le 80\}$$

(44)

At this point, it is necessary to attempt to intercept the target at 45 km from the point of origin in the horizontal direction. This distance (45 km from the origin) is to ensure safety. This is because being too close to the ground or point of origin may make the interception process meaningless, even if it is successfully intercepted. If the target is a missile with certain lethality, enough safe distance is necessary. Therefore, a group of intercepting objects is launched from the ground, which is designed to satisfy ${\overline{\phi }}_2$ (a PEA with three degrees), as shown in Formula (45):

$${\overline{\phi }}_2=\{\begin{array}{l}y=\frac{3h}{s^2}{x}^2-\overline{b}\cdot \frac{2h}{s^3}{x}^3+0.3\\ \overline{b}=[0.95,1.05]\\ 45\le x\le 80\end{array}$$

(45)

From Formula (45), $Zero(\overline{{\phi }_2})$ can be obtained as Formula (46):

$$Zero(\overline{{\phi }_2})=\{(x,y)|\forall b\in [0.95,1.05],\frac{3h}{s^2}{x}^2-\overline{b}\cdot \frac{2h}{s^3}{x}^3+0.3-y=0,45\le x\le 80\}$$

(46)

Thereafter, we must determine whether the flying object can be intercepted under sufficiently dense launching of the interceptors. When the set of trajectories of the group of interceptors includes all possible trajectories of the target, the target can be intercepted.

That is, $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ holds.

The specific steps and their results are provided below, according to the method discussed in Section 4.3.

• Convert ${\overline{\phi }}_1$, ${\overline{\phi }}_2$ in Formulas (43) and (45), respectively, into the symbolized ${\phi }_{1s}$, ${\phi }_{2s}$ as shown in Formula (47).

  $${\phi }_{1s}=\{\begin{array}{l}y=\frac{10h}{s^3}{x}^3\frac{15h}{s^4}{x}^4+a\cdot \frac{6h}{s^5}{x}^5\\ 45\le x\le 80\end{array},{\phi }_{2s}=\{\begin{array}{l}y=\frac{3h}{s^2}{x}^2-b\cdot \frac{2h}{s^3}{x}^3+0.3\\ 45\le x\le 80\end{array}$$

  (47)
• By combining ${\phi }_{1s}$, ${\phi }_{2s}$, and the error coefficients of ${\overline{\phi }}_2$, Formula (48) can be obtained.

  $$\begin{array}{l}{\phi }_{1s}\wedge {\phi }_{2s}\wedge (c_{21}^{-}\le c_{21}\le c_{21}^{+})\wedge \dots \wedge (c_{2m}^{-}\le c_{2m}\le c_{2m}^{+})=\\ (y=\frac{10h}{s^3}{x}^3-\frac{15h}{s^4}{x}^4+a\frac{6h}{s^5}{x}^5)\wedge (45\le x\le 80)\wedge (y=\frac{3h}{s^2}{x}^2-b\cdot \frac{2h}{s^3}{x}^3+0.3)\wedge (0.95\le b\le 1.05)\end{array}$$

  (48)
• The universal quantifier $\forall$ acts on x and y, and the existence quantifier $\exists$ acts on b in Formula (48). Subsequently, we call the quantifier elimination algorithm to obtain Formula (49):

  $$\begin{array}{l}\mathrm{Q}E(\forall x_1,\dots ,\forall x_n,\exists c_{21}\in [c_{21}^{-},c_{21}^{+}],\dots ,\exists c_{2m}\in [c_{2m}^{-},c_{2m}^{+}],{\phi }_{1s}|={\phi }_{2s})=\\ \mathrm{Q}E(\forall (x,y),\exists b\in [0.95,1.05],(y=\frac{10h}{s^3}{x}^3-\frac{15h}{s^4}{x}^4+a\cdot \frac{6h}{s^5}{x}^5)\wedge (45\le x\le 80)\wedge (y=\frac{3h}{s^2}{x}^2-b\cdot \frac{2h}{s^3}{x}^3+0.3))=\\ \approx 0.9883\le a\le 1.01129\end{array}$$

  (49)
• Because $\overline{a}=[0.99,1.01]\subseteq [0.9883,1.01129]$, we can conclude that $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ is true. That is, $\overline{{\phi }_1}|=\overline{{\phi }_2}$ holds.

In Step 3, the quantifier elimination algorithm (QE) is available in Maple2020. However, it can only handle first-order polynomial logic with integer coefficients. Hence, Formula (49) must be multiplied by an appropriate integer before calling the quantifier elimination method to obtain Formula (49) without floating-point numbers. Subsequently, the conclusion of Step 4 must divide this integer (the integer is 6000 in this case), which is not repeated here. The Maple codes of Step 3 are as follows:

with (RegularChains):

with (SemiAlgebraicSetTools):

R: = PolynomialRing ([x, y, a, b]):

f: = &A [x, y], &E [b], ‘&and’(a*x^5 – 1,200,000*x^4 + 64,000,000*x^3 – 327,680,000,000*y = 0, 45 < x, x < 80) &implies ‘&and’(−b*x^3 + 12,000*x^2 – 2,560,000*y + 768,000 = 0, 95 <= b, b <= 105):

out: = QuantifierElimination(f, ‘output’ = ‘rootof’);

out: = (5930 <= a) &and (a <= RootOf(_Z^4 – 1,428,000*_Z^3 + 620,670,000,000*_Z^2 – 7,420,070,585,984,000*_Z + 22,489,217,064,000,000,000, index = real [1])).

5.2. Simulation and Testing

The interval number in $\overline{{\phi }_2}$ is $\overline{b}=[0.95,1.05]$. In addition, n numbers are selected randomly in intervals $[0.95,1.05]$ to form n test cases ($cas{e}_1,cas{e}_1,\dots ,cas{e}_n$). These n random parameters are substituted into Formula (45) to form n polynomial equation systems, the curves of which are represented by the red parts in Figure 7 and Figure 8. Similarly, repeat the procedure for $\overline{{\phi }_1}$. The n numbers are selected randomly in the interval $\overline{a}=[0.99,1.01]$ to form n test cases ($cas{e}_1^{’},cas{e}_2^{’},\dots ,cas{e}_n^{’}$). These n cases are then substituted into Formula (43). Subsequently, the n curves are drawn, as indicated by the black parts in Figure 7 and Figure 8.

Figure 7 show that, when $45\le x\le 80$, the black area ($Zero(\overline{{\phi }_1})$) is inside the red area ($Zero(\overline{{\phi }_2})$). This shows that these interceptors can hit the target in the range of 45 km to 80 km from the point of origin in the horizontal direction, as long as these interceptors that satisfy the formula $\overline{{\phi }_2}$ can be launched sufficiently densely.

Furthermore, according to the result from Maple in step 4 in Section 5.1, we can conclude that when $0.9883\le a\le 1.0112$, $Zero(\overline{{\phi }_1})\subseteq Zero(\overline{{\phi }_2})$ holds. The black part of Figure 8 is the situation with $\overline{a}=[0.999,1.001]$ as $Zero(\overline{{\phi }_1})$. The situation with $0.9883\le a\le 1.0112$ is shown in Figure 9.

In Figure 9, in the range of 45–80 km in the horizontal direction, the black part almost ran out of the red area. This suggests that the result ($0.9883\le a\le 1.0112$) obtained by our method are also complete, as in the example in Section 4.4.

5.3. Comparison

Most reasoning methods based on theorem proofs do not contain error semantics. For polynomial systems with error coefficients, reasoning methods with error semantics have advantages over most methods without error semantics. The literature [19] is valuable for linear error assertions, but it is invalid for nonlinear PEAs. The method reported in [14] is effective for polynomial systems with a single error variable. However, there are few reports on reasoning methods with multiple error variables on PEAs. Conversely, some scholars have studied fuzzy reasoning to deal with errors [30]. This type of method provides the fuzzy degree of correctness or similar conclusions, which is different from the reasoning method proposed in this article. The proposed reasoning method can provide a deterministic answer (without a fuzzy degree) to establish whether the conclusion is correct or incorrect.

6. Conclusions

The reasoning method between PEAs, with two theorems involved, and their proofs, are proposed in this study. In addition, for non-linear assertions without polynomials, Taylor expansion can be used to expand them into polynomials for approximation. However, the quantifier elimination algorithm based on cylindrical algebraic decomposition (in the field of symbolic computation) is used in our reasoning method. Although the time complexity of our reasoning method will significantly increase with the increase in the number of variables, our reasoning method can provide a reliable and accurate answer without a fuzzy degree for the reasoning between PEAs, which is necessary in safety-critical systems. The reasoning problem of error polynomials with many variables is expected to be approximated by combining numerical calculation methods. This is also the direction of our study in the future.