\documentclass{article}
%\usepackage{arxiv}
%\usepackage[T1,T2A]{fontenc}

\usepackage[utf8]{inputenc}
\usepackage[english]{babel}
\usepackage{url}
\usepackage{booktabs}
\usepackage{amsfonts}
\usepackage{nicefrac}
\usepackage{microtype}
\usepackage{lipsum}
\usepackage{graphicx}
\usepackage{doi}
\newtheorem{theorem}{Theorem}
\newtheorem{lemma}[theorem]{Lemma}

\usepackage[utf8]{inputenc}
\usepackage{amsmath}
\usepackage{mathtools}

\usepackage{algorithm}
\usepackage{algpseudocode}

\usepackage{babel,csquotes,newcent,textcomp}
\usepackage[backend=biber,sortcites]{biblatex}

\usepackage{capt-of}

\usepackage{lipsum}
\title{Stochastic Newton with Arbitrary Sampling}

\author{ Igor ~Melnikov	\\
	Moscow Institute of Physics and Technology\\
	Dolgoprudny, Russia \\
	\texttt{melnikov.ia@phystech.edu} \\
	%% examples of more authors
	\and
	Rustem Islamov \\
	Institut Polytechnique de Paris\\
	Palaiseau, France \\
	\texttt{rustem.islamov@ip-paris.fr} \\
}

\addbibresource{mybib.bib}
\begin{document}
\nocite{*}
\maketitle

\begin{abstract}
We analyse stochastic Newton-type methods for solving Empirical Risk Minimization problem. We prove fast local convergence rates independent of the condition number. Unlike most other stochastic variants of second order methods, which require the evaluation of a large number of gradients and/or Hessians in each iteration to guarantee convergence, the method do not have this shortcoming. We investigate the performance of the method by applying existing sampling strategies.
\end{abstract}

\section{Introduction}
\begin{equation}\label{eq:problem}
    \min\limits_{x\in \mathbb{R}^d} \left[f\left(x\right):=\cfrac{1}{n}\sum\limits_{i=1}^{n}f_i\left(x\right)\right].
\end{equation}
Here $n$ is the number of data points that is typically extremely large in real problems; $d$ is the number of model parameters. Ususally, $f_i$ denotes the value of a loss function on $i$-th data point $(a_i, b_i)$. One of the examples of the problem that has the form of \eqref{eq:problem} is Logistic Regression problem where
\begin{equation}
    f_i(x) = \log\left(1+\exp(-b_i a_i^\top x )\right),
\end{equation}
where $a_i \in \mathbb{R}^d$ and $b_i \in \{-1,1\}.$

As $n$ is large the problem~\eqref{eq:problem} is typically solved by First-order methods that uses only one data point per iteration. These methods are extensively studied \cite{litlink1} and there are a wide variety of variations of such techniques. In particular, the Stochastic Gradient Descent(SGD) is often used, the distinguishing feature of which is cheap iterations independent of $n$. Nevertheless, SGD with constant-stepsize has a number of disadvantages, the main of which is that it converges only up to the neighbourhood of the solution, not the exact solution. This problem arises since stochastic gradient estimator has non-zero variance. Radius of this convergence area is proportional to the variance of the stochastic gradient. The so-called variance-reduced methods \cite{svrg, saga} are used to solve this problem. They have the same iteration cost as SGD, but now the algorithm converges to the exact solution. However, all first-order methods known to us are characterized by the dependence of the required number of iterations on the condition number\footnote{For a continuously Differentiable function $f$ condition number is defined as $\lim\limits_{\varepsilon \rightarrow 0} \sup\limits_{\left\|\partial x\right\| \leq \varepsilon} \frac{\left\|\partial f\left(x\right)\right\|}{\left\|\partial x\right\|}$,\\ for $L$-smooth and $\mu$-convex function the condition number is $\frac{L}{\mu}$}. This makes impossible using SGD and its variants for ill-conditioned problems.

In classic optimization one of the solutions is to use second-order information about the objective. Classic Newton's method adapts to the curvature of the problem and thereby decrease the dependence on the condition number. The step of Newton's method has the following form

\begin{equation}
    x^{k+1} = x^k - \left(\nabla^2f\left(x^k\right)\right)^{-1}\nabla f\left(x^k\right)
\end{equation}

In the case of ERM we need to compute $n$ Hessians per iteration which is extremely costly in practice. Our desire is to use only a few Hessians in each iteration. One of the most popular directions is so called Subsampled Stochastic Newton's methods \cite{litlink7}. Despite first-order methods, these methods are poorly understood, and the theory usually requires a large batch sizes. To the best of our knowledge there are just a few works that provable work with arbitrary batch sizes \cite{litlink3, litlink5, litlink6}.

In this work we focus on the Algorith 1 of  \cite{litlink4}. They presentes the following algorithm:

\begin{algorithm}\label{eq:algorithm}
\caption{Stochastic Newton (SN)}\label{alg:cap}
\begin{algorithmic}
\State {$\textbf{Initialize:}$ Choose starting iterates $w_1^0, w_2a^0, \dots, w_n^0 \in \mathbb{R}^d$ and minibatch size $\tau \in \{1, 2, \dots, n\}$}
\For {$k = 1, \dots$}
    \State {$x^{k+1} = \left(\sum\limits_{i=1}^n\nabla^2f_i\left(w_i^k\right)\right)^{-1}\sum\limits_{i=1}^n \left(\nabla^2f_i\left(x^k\right)w_i^k - \nabla f_i\left(w_i^k\right)\right)$}
    \State {Choose a subset $k \subseteq \{1,\dots, n\}$ of size $\tau$ uniformly at random}
    \State {
        $w_i^{t+1}=
    \begin{cases}
        w_i^{t} &i \not\in S^t\\
        x^{t + 1} &i \in S^t\\
     \end{cases}$
}
\EndFor
\end{algorithmic}
\end{algorithm}

% \begin{equation*}
% \begin{multlined}
% w^0_i = x^0 \text{, for } i \in \overline{1, n}. \\
% w_i^{t+1}=
%  \begin{cases}
%   w_i^{t} &i \not\in S^t\\
%   x^{t + 1} &i \in S^t\\
%  \end{cases}
%  \end{multlined}
% \end{equation*}
% $S^k$ is uniformly chosen random subset of $\{1, \dots, n\}$ with size $\tau$. \\

% The algorithms looks the following way:

% \begin{equation}
% \begin{multlined}
%     x^{k+1} = \left(\sum\limits_{i=1}^n\nabla^2f_i\left(w_i^k\right)\right)^{-1}\sum\limits_{i=1}^n \left(\nabla^2f_i\left(x^k\right)w_i^k - \nabla f_i\left(w_i^k\right)\right)
% \end{multlined}
% \end{equation}

We investigate how the sampling strategies affect the performance of Algorithm \eqref{eq:algorithm}. In practice, the uniform sampling is not the best choice, and we need to use another strategies how to choose a set $S^t$.

\section{Problem Statement}

Assume we have $n$ training points $\left(a_i, b_i\right)$ for $i \in \overline{1, n}$. We also assume $n$ to be large. Let $f_i\left(x\right)$ be a loss function on $i$-th training point . We analyze second order methods solving Empirical Risk Minimization problem of the form.

One of the examples of the problem that has the form of \eqref{eq:problem} is Logistic Regression problem where
\begin{equation}
    f_i(x) = \log\left(1+\exp(-b_i a_i^\top x )\right),
\end{equation}
where $a_i \in \mathbb{R}^d$ and $b_i \in \{-1,1\}.$

\begin{equation}
    \min\limits_{x\in R} \left[f\left(x\right):=\cfrac{1}{n}\sum\limits_{i=1}^{n}f_i\left(x\right)\right].
\end{equation}

\section{Experiment Plan}

The experiment applies Algorithm 1 to minimize the logistic regression risk function with $l_2$ regularization.

\begin{equation}
    f_i(x) = \log\left(1+\exp(-b_i a_i^\top x )\right) + \frac{\lambda}{2}\|x\|,
\end{equation}

The main experiment is to establish the dependence of convergence accuracy on the size of the batch. The goal is to establish that conditional number does not significantly affect convergence. To do this, it is sufficient to establish that the curves are not very different.

We generate the synthetic data by the make classification function of the scikit-learn library, where n = 500 and d = 5. Each row of the data matrix is normalized such that $\|a_i\| = 1$. We run experiments for $\lambda = \{10^{-1}, 10^{-3}, 10^{-4}\}$, which leads to conditional number differ more than in 10 times.
Initial point $x^0$ is taken as the result of GD in 30 iteration.

\section{Preliminary report}
Convergence has been established. For lambdas 0.001 and 0.0001 the difference in accuracy at 100th iteration is less than in 1.2 times for all butch sizes. However for lambda 0.1 accuracy is much higher - that is a fact to investigate in more detail.

\begin{figure}
    \includegraphics[width=120mm]{convergence_0-1.png}
    \captionof{figure}{$\lambda = 0.1$}
\end{figure}

\begin{figure}
    \includegraphics[width=120mm]{convergence_0-001.png}
    \captionof{figure}{$\lambda = 0.001$}
\end{figure}

\begin{figure}
    \includegraphics[width=120mm]{convergence_0-0001.png}
    \captionof{figure}{$\lambda = 0.0001$}
\end{figure}

\section{Run Basic Code}
We have implemented algorithm 1.

Competitive models for our algorithm were described in Introduction section with links on description. These models are  Gradient Descent, Stochastic Gradient Descent, variance-reduced methods, classical Newton's method.

A description of the algorithm in the form of pseudocode is given in the introduction.
\section{Theoretical part}

The proof was based on the proof in the article 1.

\begin{theorem} Assume that every $f_i$ is $µ$-strongly convex and has $H$-Lipschitz Hessian and consider
the following Lyapunov function:
\begin{equation}
    W^k \overset{def}{=} \frac{1}{n}\sum\limits_{i=1}^{n}\|w_i^k - x^\star\|.
\end{equation}

Then for the random iterates of NS Algorithm we have the recursion:
\begin{equation}
    \mathbf{E}_k W^{k + 1} \leq \left(1 - \frac{\tau}{n} +
    \frac{\tau}{n}\left(\frac{H}{2\mu}\right)^2W^k\right)W^k.
\end{equation}

Furthermore if $\|w_i^0 - x^\star\| \leq \frac{\mu}{H}$, for $i \in \{1, \dots, n\}$ and $\min_{i \in \{1, \dots, n\}}{p_i} \geq \frac{\tau}{4n}$, then for some $\lambda < 1$
\begin{equation}
    \mathbf{E}_k W^{k + 1} \leq \lambda W^k.
\end{equation}
\end{theorem}

This theorem implies at least linear convergence rate for all $\tau$ in our algorithm.
Let's denote by $p_i$ probability of i be in $S$. $|sum|limits_{i=1}^n p_i = \tau$

\begin{lemma} (taken from article 1.).
Let $f_i$ be $\mu$-strongly convex and have $H$-Lipschitz Hessian for all $i = 1, \dots, n$. Then
the iterates of the Algorithm satisfy:
\begin{equation}
    \|x^k - x^\star\| \leq \frac{H}{2\mu}W^k.
\end{equation}
\end{lemma}

\begin{lemma}
If $\|w_i^0 - x^\star\| \leq \frac{\mu}{H}$, for $i \in \{1, \dots, n\}$, then for all $k$, for $i \in \{1, \dots, n\}$
\begin{equation}
    \|w_i^k - x^\star\|^2 \leq \left(\frac{\mu}{H}\right)^2
\end{equation}
\end{lemma}

\begin{lemma} The random iterates of the Algorithms satisfy the identity
\end{lemma}
Proof:
\begin{equation*}
\begin{split}
    \mathbf{E}_k W^{k + 1} = \frac{1}{n}\sum\limits_{i=1}^{n}\mathbf{E}_k\|w_i^{k + 1} - x^\star\| =
     \frac{1}{n}\sum\limits_{i=1}^{n}p_i\|x^k - x^\star\| + \frac{1}{n}\sum\limits_{i=1}^{n}(1 - p_i)\|w_i^k - x^\star\| = \\
     \frac{\tau}{n}\|x^k - x^\star\| + \frac{1}{n}\sum\limits_{i=1}^{n}(1 - p_i)\|w_i^k - x^\star\| \leq
     \frac{\tau}{n}\left(\frac{H}{2\mu}\right)^2\left(W^k\right)^2 + \frac{1}{n}\sum\limits_{i=1}^{n}(1 - p_i)\|w_i^k - x^\star\| \leq \\
     \frac{1}{4}\frac{\tau}{n}W^k + \frac{1}{n}\sum\limits_{i=1}^{n}(1 - p_i)\|w_i^k - x^\star\| \leq \frac{1}{4}\frac{\tau}{n}W^k + \frac{1}{n}(1 - \min_{i \in \{1, \dots, n\}}{p_i})\sum\limits_{i=1}^{n}\|w_i^k - x^\star\|  = \\ \frac{1}{4}\frac{\tau}{n}W^k + (1 - \min_{i \in \{1, \dots, n\}}{p_i})W^k =  \left(\frac{1}{4}\frac{\tau}{n} + 1 - \min_{i \in \{1, \dots, n\}}{p_i}\right)W^k.
\end{split}
\end{equation*}

\section{Analysing error}

We measure speed up of improved sample strategy. So we measures first $n$ satisfying condition $A_n/A_0 < r$.
Where $r$ is maximum of minimal ratio for each algorithms.

\includegraphics[width=90mm]{speed_lambda.png}

\includegraphics[width=90mm]{speed_batch_size.png}

In the table below you can find average speed up for given batch size ($\lambda$ was taken on as linear grid on interval from 0 to 0.1).

\begin{tabular}{ |c|c|c|c|c| }
 \hline
 Batch size & 1 & 2 & 4 & 8 \\
 \hline
 Speed up & 2.42 & 1.78 & 1.62 & 1.39 \\
 \hline
\end{tabular}

\newpage
\addcontentsline{toc}{section}{Список используемой литературы}

%далее сам список используевой литературы

\printbibliography

\end{document}


\chapter{Alphabet (Sigma) and \acro{other}/\acro{unknown} Characters}

\label{app:other}

Kleene automatically keeps track of the set of symbols that are ``known''
to each network, and this set is known traditionally as the alphabet or \emph{sigma}.
Each Kleene network carries its own private sigma.\footnote{The OpenFst
library does not maintain a private sigma for each network; this
functionality is added at the Java level of Kleene.} In the simple case

\begin{Verbatim}[fontsize=\small]
$v = abc ;
\end{Verbatim}

\noindent
the sigma of network \$v will contain the symbols \emph{a}, \emph{b},
\emph{c} and no other symbols.  The Kleene programmer never has to
declare sigmas manually.

In Kleene regular expressions, the . (dot) special syntactic symbol
semantically represents \emph{any} symbol, and has a non-trivial
semantics.  Intuitively, the notion of \emph{any} symbol properly
includes all known symbols in the sigma, plus the infinite set of
\acro{other}, also known as \acro{unknown}, symbols.  We will use the
term \acro{other} herein.

Kleene transducers must also distinguish between the \emph{identity
mapping} of \acro{other} symbols vs.\@ the \emph{non-identity mapping} of
\acro{other} symbols.  The identity mapping maps any \acro{other} symbol
to itself, while the non-identity mapping maps any \acro{other} symbol to
any \acro{other} symbol \emph{except} itself.  The difference is best
seen in concrete examples.

When . (dot) appears in a regular expression like

\begin{Verbatim}[fontsize=\small]
$w = . ;
\end{Verbatim}

\noindent
it is interpreted to produce the arc label
\acro{other\_id}:\acro{other\_id}, which represents the \emph{identity
mapping} of \acro{other} symbols, i.e.\@ the mapping of any \acro{other}
symbol to itself.  As the sigma of ``known'' symbols in \$w is empty, the
resulting network maps \emph{a} to \emph{a}, \emph{b} to \emph{b},
\emph{c} to \emph{c}, and similarly for all possible symbols---but not
\emph{a} to \emph{b} because this would be a non-identity mapping.

To denote the mapping of any symbol to any symbol, including itself, the
Kleene syntax .:. is used in regular expressions, e.g.

\begin{Verbatim}[fontsize=\small]
$y = .:. ;
\end{Verbatim}

\noindent
The resulting network for \$y contains a start state and a final state,
linked by two arcs labeled \acro{other\_id}:\acro{other\_id} and
\acro{other\_nonid}:\acro{other\_nonid}, respectively.  As the name
implies, \acro{other\_nonid}:\acro{other\_nonid} represents the
non-identity mapping of \acro{other} symbols.  The two arcs therefore
handle the cases of identity mapping and non-identity mapping.

In Kleene networks, the symbol coverage of \acro{other\_id} and
\acro{other\_nonid} are identical; it can be thought of as \acro{other},
i.e.\@ the set of all possible symbols not in the sigma of the network;
the labels \acro{other\_id}:\acro{other\_id} and
\acro{other\_nonid}:\acro{other\_nonid} differ only in their mapping
behavior: identity mapping vs.\@ non-identity mapping.

When two networks are combined, via operations like union, concatenation
and composition, the result is a new network with its own sigma.  Where
one or both networks to be combined ``contain \acro{other}'', the
operation, and the calculation of the new sigma, can be quite
complicated, but the programmer never needs to worry about it.

The notion of \emph{any symbol}, denoted . (for ``map any other symbol to
itself'') or .:. (``map any other symbol to any other symbol, including
itself'') are syntactic notions that appear in regular expressions.  The
notions of identity mapping, non-identity mapping and the labels
\acro{other\_id}:\acro{other\_id} and
\acro{other\_nonid}:\acro{other\_nonid} belong to underlying networks.

The arc labels \acro{other\_id} and \acro{other\_nonid} are special, and
these two special symbols should not appear in regular expressions.


\newpage
\section{Entropy Source: Rationale and Discussion}
\label{sec:entropy-appendix}

    The security of cryptographic systems is based on secret bits and keys.
    To prevent guessing, these bits need to be random, so they come from
    True Random Number Generators (TRNGs).

    As a fundamental security function, the generation of random numbers is
    governed by numerous standards and technical requirements.

\subsection{Standards and Terminology}

    A driving design goal for our architecture was for it to be easy to
    implement, yet compatible with current versions of FIPS 140-3
    \cite{NI19} and NIST SP 800-90B \cite{TuBaKe+18}, significantly
    updated standards that are only coming into use in 2020. Naturally,
    the architecture should also support other RNG frameworks such as
    German AIS 20 / 31 \cite{KiSc01,KiSc11} which is widely used
    in Common Criteria evaluations.

    These standards set many of the technical requirements for the design,
    and we use their terminology if possible. Note that FIPS 140-3 /
    SP 800-90B (our main target) imposes requirements on min-entropy, while
    AIS-31 discusses Shannon entropy as well.

    These standards set many of the technical requirements for the design,
    and we use their terminology if possible.
    The delineation of various components is illustrated in Figure
    \ref{fig:rng_tikz}.

    \subsubsection{Entropy Source (ES)}
    \label{sec:intro-es}
    Physical sources of true randomness are called Entropy Sources (ES)
    \cite{TuBaKe+18}. They are built by sampling and processing data
    from a noise source (Section \ref{sec:noise-sources}). Since these
    are directly based on natural phenomena and are subject to
    environmental conditions (which may be adversarial), they require
    features and sensors that monitor the ``health'' and quality of those
    sources. See Section \ref{sec:security-controls} for a discussion about
    such security controls.

    \subsubsection{Conditioning}
    \label{sec:intro-cond}
    Raw physical randomness (noise) sources are rarely statistically
    perfect and some generate very large amounts of bits, which need to be
    ``debiased'' and reduced to a smaller number of bits. This process is
    called conditioning. A secure hash function is an example of a
    cryptographic conditioner. It is important to note that even though
    hashing may make the output look more random, it does not increase its
    entropy content.

    Non-cryptographic conditioners and extractors such as von Neumann's
    ``debiased coin tossing'' \cite{Ne51} are easier to implement
    efficiently but may reduce entropy content (in individual bits removed)
    more than cryptographic hashes which mix the input entropy very efficiently.
    However, they are not based on computational hardness assumptions and
    are therefore inherently more future proof. See Section
    \ref{sec:noncrypto} for a more detailed discussion.

    \subsubsection{Pseudorandom Number Generator (PRNG)}
    \label{sec:intro-prng}
    Pseudorandom Number Generators (PRNGs) use deterministic mathematical
    formulas to create a large amount of random numbers from a smaller
    amount of ``seed'' randomness. PRNGs are divided into cryptographic and
    non-cryptographic ones.

    Non-cryptographic PRNGs, such as the linear-congruential generators
    found in many programming libraries, may generate statistically
    satisfactory random numbers but must never be used for cryptographic
    keying. This is because they are not designed to resist
    \emph{cryptanalysis}; it is usually possible to take some output and
    mathematically derive the ``seed'' or the internal state  of the PRNG
    from it. This is a security problem since knowledge of the state
    allows the attacker to compute future or past outputs.

    \subsubsection{Deterministic Random Bit Generator (DRBG)}
    \label{sec:intro-drbg}
    Cryptographic PRNGs are also known as Deterministic Random Bit
    Generators (DRBGs), a term used by SP 800-90A \cite{BaKe15}. A strong
    cryptographic algorithm such as AES \cite{NI01} or SHA-2/3
    \cite{NI15,NI15A} is used to produce random bits from a seed. The secret
    seed material is like a cryptographic key; determining the seed
    from the DRBG output is as hard as breaking AES or a strong hash function.
    This also illustrates that the seed/key needs to be long enough and
    come from a trusted Entropy Source. The DRBG should still be frequently
    refreshed (reseeded) for forward and backward security.

\begin{figure}[tb]
    \centering
    \input{../diagrams/rng_tikz.tex}
    \caption{PollEntropy provides an Entropy Source (ES) only, not a stateful
        random number generator. As a result, it can support arbitrary
        security levels. Cryptographic (AES, SHA-2/3) ISA Extension
        instructions can be used to construct high-speed DRBGs that are
        seeded from the entropy source.}
%   \Description{Illustration of PollEntropy at the ISA Boundary.}
    \label{fig:rng_tikz}
\end{figure}

\subsection{Specific Rationale and Considerations}

    \paragraph{(Sect. \ref{sec:es-pollentropy}) PollEntropy:}
    An entropy source does not require a high-bandwidth interface;
    a single DRBG source initialization only requires 512 bits
    (256 bits of entropy) and the DRBG state can be shared by any number of
    callers. Once initiated, a DRBG requires new randomness only for the
    purposes of forward security.

    Without a polling-style mechanism the entropy source could hang for
    thousands of cycles under some circumstances. The \mnemonic{wfi} mechanism
    (at least potentially) allows energy-saving sleep on MCUs and context
    switching on a higher-end CPUs.

    The reason for the particular \verb|OPST| two-bit mechanism is to
    provide redundancy. The ``fault'' bit combinations 11 (and 00) are more
    likely for electrical reasons if feature discovery fails and the entropy
    source is actually not available (this has happened to AMD \cite{Sa19}).

    The 16-bit bandwidth was a compromise motivated by the desire to
    provide redundancy in the return value, some protection against
    potential Power/EM leakage (further alleviated by the 2:1 cryptographic
    conditioning discussed in Section \ref{sec:req-entropy}), and the desire
    to have all of the bits ``in the same place'' on both RV32 and RV64
    architectures for programming convenience.

    \paragraph{(Sect. \ref{sec:req-es}) \S E1, Entropy Requirement:}
    Rather than attempting to mathematically define the properties that the
    entropy source output must satisfy, we define that it should
    pass SP 800-90B evaluation and certification when conditioned
    cryptographically (``perfectly'') in ratio 2:1. This is our ``safety
    margin'' for non-cryptographic conditioners.

    Note that the min-entropy assessment methodology in SP 800-90B
    \cite{TuBaKe+18} also has a safety margin in its confidence intervals,
    and therefore there must be consistently \emph{more than} 8 bits of
    entropy per 16-bit word. In practice, we recommend the
    distribution to be significantly closer to uniform to satisfy
    possible additional use cases and AIS 20 / 31 \cite{KiSc11}
    requirements (if those can't be met with a software conditioner).

    Note that the usage of a vetted conditioner (such as SHA-2/3) was
    specified for technical reasons related to SP 800-90B itself;
    non-vetted conditioners may offer similar security.

    The 128-bit output block size was selected because that is the output
    size of the CBC-MAC conditioner specified in \cite{TuBaKe+18} and also
    the smallest key size we expect to see in applications.

    \paragraph{(Sect. \ref{sec:req-es}) \S E2, IID Requirement:}
    IID is an optional requirement in SP 800-90B \cite{TuBaKe+18} but it
    is needed to prevent information leakage between different entities that
    possibly share the same entropy source. It also significantly
    simplifies certification and vendor-independent driver development.
    The \mnemonic{pollentropy} instruction itself can be later expanded
    to support non-IID sources (e.g., via a different immediate constant).

    \paragraph{(Sect. \ref{sec:req-es}) \S E3, Secret State Requirement:}
    DRBGs can be used to feed other (virtual) DRBGs but that does not
    increase the absolute amount of entropy in the system.
    The entropy source must be able to support current and future security
    standards and applications. The 256-bit requirement maps to
    ``Category 5'' of NIST Post-Quantum Cryptography (4.A.5
    ``Security Strength Categories'' in \cite{NI16}) and TOP SECRET schemes
    in Suite B and the newer U.S. Government CNSA Suite \cite{NS15}.

    {\em Source anonymization.}
    In some cases, an entropy source (or the circuit that interfaces it)
    may have a uniquely identifiable hardware ``signature.'' This can be
    harmless or even useful in some applications (as random sources may
    exhibit PUF-like features) but highly undesirable in others (anonymized
    virtualized environments and enclaves). A DRBG masks such
    statistical features.

    \paragraph{(Sect. \ref{sec:security-controls}) Security Controls:}
    Our approach is informed by the experience of designing and implementing
    cryptographic protocols. Some of the most devastating practical attacks
    against real-life cryptosystems have used inconsequential-looking
    additional information, such as padding error messages \cite{BaFoKa+12}
    or timing information \cite{MoSuEi+20}. In cryptography, such
    out-of-band information sources  are called ``oracles.''

    This also applies to the raw noise source. The raw source interface has
    been delegated to an optional vendor-specific test interface.
    Importantly the test interface and the main interface should not be
    operational at the same time.

    \begin{quote}
    {\it ``The noise source state shall be protected from adversarial
        knowledge or influence to the greatest extent possible. The methods
        used for this shall be documented, including a description of the
        (conceptual) security boundary’s role in protecting the noise source
        from adversarial observation or influence.''}
    \flushright --Noise Source Requirements, NIST SP 800-90B \cite{TuBaKe+18}.
    \end{quote}

    The role of the RISC-V ISA implementation is to try to ensure that the
    hardware-software interface minimizes avenues for adversarial information
    flow; all status information that is unnecessary in normal operation
    should be eliminated. We specifically urge implementers against creating
    unnecessary information flows (``status oracles'') via the custom bits
    or to allow the instruction to disable or affect the TRNG output in any
    significant way. All information flows and interaction mechanisms must
    be considered from an adversarial viewpoint and implemented only if they
    are truly necessary and their security impact can be fully understood.

    For example, the entropy polling interface may not be ``constant time.''
    The polling mechanism can be modeled as a rejection sampler; such a
    timing oracle can reveal information about the noise source and the
    rejection criteria, but usually not the random output itself.
    If these are correlated, additional countermeasures are necessary.

    \paragraph{(Sect. \ref{sec:security-controls}) \S T1, On-demand testing:}
    Interaction with hardware self-test mechanisms
    from the software side should be minimal; the term ``on-demand'' does not
    mean that the end-user or application program should be able to invoke
    them in the field (the term is a throwback to an age of discrete,
    non-autonomous crypto devices with human operators.)

    \paragraph{(Sect. \ref{sec:security-controls}) \S T2, Continuous checks:}
    Physical attacks can occur while the device is running. The design
    should avoid guiding such active attacks by revealing detailed
    status information. Upon detection of an attack the default action
    should be aimed at damage control -- to prevent weak crypto keys from
    being generated.

    The statistical nature of some tests makes ``type-1'' false
    positives a possibility. There may also be requirements for signaling
    of non-fatal alarms; AIS 31 specifies ``noise alarms'' that can go off
    with non-negligible probability even if the device is functioning
    correctly; these can be signaled with \verb|BIST|.
    There rarely is anything that can or should be done about a non-fatal
    alarm condition in an operator-free, autonomous system.

    The state of statistical runtime health checks (such as counters)
    is potentially correlated with some secret keying material, hence
    the zeroization requirement.

    \paragraph{(Sect. \ref{sec:security-controls}) \S T3, Fatal error states:}
    These tests can complement other integrity and tamper resistance
    mechanisms (See Chapter 18 of \cite{An20} for examples).

    Some hardware random generators are, by their physical construction,
    exposed to relatively non-adversarial environmental and manufacturing
    issues. However, even such  ``innocent'' failure modes may indicate
    a  \emph{fault attack} \cite{KaScVe13} and therefore should be addressed
    as a system integrity failure rather than as a diagnostic issue.

    Security architects will understand to use
    permanent or hard-to-recover ``security-fuse'' lockdowns only if the
    threshold of a test is such that the probability of false-positive is
    negligible over the entire device lifetime.

\subsection{Implementation Strategies}

    When considering implementation options and trade-offs one must look
    at the entire information flow since each step is interconnected.

    \begin{enumerate}
    \item   {\bf A Noise Source} generates private, unpredictable signals
            from stable and well-understood physical random events.
    \item   {\bf Sampling} digitizes the noise signal into a raw stream of
            bits. This raw data also needs to be protected by the design.
    \item   {\bf Continuous health tests} ensure that the noise source
            and its environment meet their operational parameters.
    \item   {\bf Non-cryptographic conditioners} remove much of the bias
            and correlation in input noise: Output entropy $\gg 4$ bits/byte.
    \item   {\bf Cryptographic conditioners} produce nearly full entropy
            output, completely indistinguishable from ideal random.
    \item   {\bf DRBG} takes in $\geq 256$ bits of seed entropy as keying
            material and uses a ``one way'' cryptographic process to rapidly
            generate bits on demand (without revealing the seed/state).
    \end{enumerate}
    Steps 1-4 (possibly 5) are considered to be part of the Entropy
    Source (ES) and provided by the \mnemonic{pollentropy} instruction.
    Adding the software-side cryptographic steps 5-6 and control logic
    complements it into a True Random Number Generator (TRNG).
%   This information flow is illustrated by Figure \ref{fig:rng_tikz}.

    As a general rule, RISC-V specifies the ISA only. We provide some
    additional requirements so that portable, vendor-independent middleware
    and kernel components can be created. The actual hardware
    implementation and certification is left to vendors and circuit designers;
    the discussion in this section is purely informational.

    While we do not require entropy source implementations to be
    certified designs, we do expect that they behave in a compatible manner
    and do not create unnecessary security risks to users. Self-evaluation
    and testing following appropriate security standards is usually needed
    to achieve this. NIST has made its SP 800-90B\cite{TuBaKe+18} min-entropy
    estimation package freely available\footnote{EntropyAssessment:
    \url{https://github.com/usnistgov/SP800-90B_EntropyAssessment}} and
    similar free tools are also available\footnote{(In German)
    AIS 31-Implementierung in JAVA:
    \url{https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Zertifizierung/Interpretationen/AIS_31_testsuit_zip}}
    for AIS 31 \cite{KiSc11}.

\subsubsection{Noise Sources}
\label{sec:noise-sources}

    The theory of random signals and electrical noise became well
    established in the post-World War II period \cite{Ri44,Ri45,DaRo58}.
    We will give some examples of common noise sources that can be
    implemented in the processor itself (using standard cells).

    \paragraph{Ring Oscillators.}
    The most common entropy source type in production use today is
    based on ``free running'' ring oscillators and their timing jitter.
    Here, an odd number of inverters is connected into a loop from which
    noise source bits are sampled in relation to a reference clock
    \cite{BaLuMi+11}. The sampled bit sequence may be expected to be
    relatively uncorrelated (close to IID) if the sample rate is suitably low
    \cite{KiSc11}. However further processing is usually required.

    AMD \cite{AM17}, ARM \cite{AR17}, and IBM \cite{LiBaBo+13} are
    examples of ring oscillator TRNGs intended for high-security
    applications.

    There are related metastability-based generator designs such as
    Transition Effect Ring Oscillator (TERO) \cite{VaDr10}.
    The differential/feedback Intel construction \cite{HaKoMa12} is slightly
    different but also falls into the same general metastable
    oscillator-based category.

    The main benefits of ring oscillators are: (1) They can be implemented
    with standard cell libraries without external components --
    and even on FPGAs \cite{VaFiAu+10}, (2) there is an established theory
    for their behavior \cite{HaLe98,HaLiLe99,BaLuMi+11}, and (3) ample
    precedent exists for testing and certifying them at the highest security
    levels.

    Ring oscillators also have well-known implementation pitfalls.
    Their output is sometimes highly dependent on temperature,
    which must be taken into account in testing and modeling.
    If the ring oscillator construction is parallelized, it is important
    that the number of stages and/or inverters in each chain is coprime to
    avoid entropy reduction due to harmonic ``Huyghens synchronization''
    \cite{Ba86}.
    Such harmonics can also be inserted maliciously in a frequency
    injection attack, which can have devastating results \cite{MaMo09}.
    Countermeasures are related to circuit design; environmental sensors,
    electrical filters, and usage of a differential oscillator may help.

    \paragraph{Shot Noise.}
    A category of random sources consisting of discrete events
    and modeled as a Poisson process is called ``shot noise.''
    There's a long-established precedent of certifying them; the
    AIS 31 document \cite{KiSc11} itself offers reference designs based on
    noisy diodes. Shot noise sources are often more resistant to
    temperature changes than ring oscillators.
    Some of these generators can also be fully implemented with standard
    cells (The Rambus / Inside Secure generic TRNG IP \cite{Ra20} is
    described as a Shot Noise generator).

    \paragraph{Other types of noise.}
    It may be possible to certify more exotic noise sources and designs,
    although their stochastic model needs to be equally well understood
    and their CPU interfaces must be secure.
    See Section \ref{sec:quantum} for a discussion of Quantum entropy
    sources.

\subsubsection{Samplers and GetNoise}

    It is necessary to verify that the noise source and sampler output
    matches with their stochastic models. This is usually
    done in a laboratory setting since NIST SP 800-90B \cite{TuBaKe+18}
    requires that the noise source in protected in production devices.
    We are leaving access as a vendor-specific matter but we urge them to
    protect the raw source and to make it unavailable to casual users.

    \underline{Rationale:}
    Samplers can generate vast amounts of data. NIST SP 800-90B
    \cite{TuBaKe+18} defines a conceptual interface \verb|GetNoise()|
    for the raw output and also anticipates that the actual
    interfaces ``will depend on the entropy source deployed.''

    Building data paths to make the raw noise available through the ISA
    would be problematic as it is unclear how to ``sample''
    possibly up to several gigabits of information per second in a way
    that is appropriately representative of its properties.

    \begin{quote}
    \emph{``The vendor may use special methods (or devices, such as an
    oscilloscope) that require detailed knowledge of the source to
    collect raw data. The testing laboratory is required [...] to
    present a rationale why the data collections methods will not alter
    the statistical properties
    of the noise source or explain how to account for any change
    in the source’s statistical characteristics [...]''}
    \flushright -- FIPS 140 Implementation Guidance, 2020 \cite{NICC20}
    \end{quote}

\subsubsection{Continuous Health Tests}
\label{sec:cont-tests}

    If NIST SP 800-90B certification is required, the hardware
    should implement at least the health tests defined in Section
    4.4 of \cite{TuBaKe+18}: repetition count test and adaptive
    proportion test.

    Health monitoring requires some state information related
    to the noise source to be maintained. The tests should be designed
    in a way that a specific number of samples guarantees a state
    flush (no hung states). We suggest flush size $W \leq 1024$ to
    match with the NIST SP 800-90B required tests (See Section 4.4 in
    \cite{TuBaKe+18}). The state is also fully zeroized in a system reset.

    \underline{Rationale:}
    The two mandatory tests can be built with minimal circuitry.
    Full histograms are not required, only simple counter registers:
    repetition count, window count, and sample count.
    Repetition count is reset every time the output sample value
    changes; if the count reaches a certain cutoff limit, a noise alarm
    (\verb|BIST|) or failure (\verb|DEAD|) is signaled. Window counter is
    used to save every $W$'th output (typically $W \in { 512, 1024 }$.)
    The frequency of this reference sample in the following window is
    counted; cutoff values are defined in the standard. We see that the
    structure of the mandatory tests is such that, if well implemented,
    no information is carried beyond a limit of $W$ samples.

    Section 4.5 of \cite{TuBaKe+18} explicitly permits additional
    developer-defined tests and several more were defined in early
    versions of FIPS 140-1 before being ``crossed out.'' The choice
    of additional tests depends on the nature and implementation of the
    physical source.

    Especially if a non-cryptographic conditioner is used in hardware,
    it is possible that the AIS 31 \cite{KiSc11} online tests are
    implemented by driver software. They can also be implemented in hardware.
    For some security profiles AIS 31 mandates that their tolerances are
    set in a way that the probability of an alarm is at least $10^{-6}$
    yearly under ``normal usage.'' Such requirements are problematic
    in modern applications since their probability is too high for
    critical systems\footnote{Currently (2020) about $10^{10}$ secure
    elements are shipped yearly, many in critical applications and with
    TRNGs, according to \url{https://www.eurosmart.com}.}.
    There rarely is anything that can or should be done about a non-fatal
    alarm condition in an operator-free, autonomous system. However,
    AIS 31 allows the DRBG component to keep running despite a failure in
    its Entropy Source, so we suggest re-entering temporary \verb|BIST|
    state (Section \ref{sec:security-controls}) to signal a non-fatal
    statistical error if such (non-actionable) signaling is necessary.
    Drivers and applications can react to this appropriately (or simply
    log it) but it will not directly affect the availability of the TRNG.
    A permanent error condition should result in \verb|DEAD| state.

\subsubsection{Non-cryptographic Conditioners}
\label{sec:noncrypto}

    As noted in Section \ref{sec:intro-cond}, physical randomness sources
    generally require a post-processing step called \emph{conditioning} to
    meet the desired quality requirements, which  are outlined in Section
    \ref{sec:req-es}.

    The approach taken in this interface is to allow a combination of
    non-cryptographic and cryptographic filtering to take place. The
    first stage (hardware) merely needs to be able to distill the entropy
    comfortably above 4 bits per byte (Sect. \ref{sec:req-entropy},
    Entropy) and to guarantee that the samples are independent
    (Sect. \ref{sec:req-iid}, IID).

    \begin{itemize}
    \item   One may take a set of bits from a noise source and XOR them
            together to produce a less biased (and more independent) bit.
            If the source model is well understood, such a construction
            lends itself well to analysis and entropy estimation \cite{Da02}.
    \item   The von Neumann extractor \cite{Ne51} looks at consecutive
            pairs of bits, rejects 00 and 11, and outputs 0 or 1 for
            01 and 10, respectively. It will reduce the number of bits to
            less than 25\% of original but the output is provably unbiased
            (assuming independence).
    \item   Blum's extractor \cite{Bl86} can be used on sources
            whose behavior resembles $n$-state Markov chains. If its
            assumptions hold, it also removes dependencies, creating an IID
            source.
    \item   Other linear and non-linear correctors such as those
            discussed by Dichtl and Lacharme \cite{La08}.
    \end{itemize}

    Note that the hardware may
    also implement a full cryptographic conditioner to in the entropy
    source, even though the software driver still needs
    a cryptographic conditioner too (Sect. \ref{sec:req-state}).

    \underline{Rationale:}
    The main advantage of non-cryptographic filters is in their
    energy efficiency, relative simplicity, and amenability to mathematical
    analysis. If well designed, they can be evaluated in
    conjunction with a stochastic model of the noise source itself.
    They do not require computational hardness assumptions.

    In some cases, an entropy source (and the circuit that implements it)
    may have a uniquely identifiable hardware ``signature.'' This can be
    harmless or even useful in some applications (as random sources may
    exhibit PUF-like features) but highly undesirable in others (anonymized
    virtualized environments and enclaves).

    Such virtualized environments are probably better off just using
    \verb|/dev/urandom| of the host rather than sharing the host's
    hardware-backed Entropy Source to the guest environment. Also note the
    source entropy requirement (Sect. \ref{sec:req-es}, Secret State)
    when sharing such generators.

\subsubsection{Cryptographic Conditioners}
\label{sec:crypto-cond}

    Cryptographic conditioners are always required on the software side of
    the PollEntropy ISA boundary. They may be also implemented on the
    hardware side if necessary. In any case, the PollEntropy output must
    always be compressed 2:1 (or more) before being used as keying material
    or considered ``full entropy.''

    Examples of cryptographic conditioners include the random pool
    of the Linux operating system, secure hash functions (SHA-2/3,
    SHAKE \cite{NI15,NI15A} ),
    and the AES-based CBC-MAC construction of SP 800-90B \cite{TuBaKe+18}.

    In some constructions, such as the Linux RNG and SHA-3/SHAKE \cite{NI15}
    based generators the cryptographic conditioning and output (DRBG)
    generation is provided by the same component.

    \underline{Rationale:}
    For many low-power targets constructions such as Intel's
    \cite{Me18} and AMD's \cite{AM17} hardware AES CBC-MAC conditioner
    would be too complex and expensive to implement solely to serve
    \mnemonic{pollentropy}. On the other hand, simpler non-cryptographic
    conditioners may be too wasteful on input entropy if very high-quality
    random output is required -- ARM TrustZone TRBG \cite{AR17} outputs
    only 10Kbit/sec at 200 MHz. Hence a resource-saving compromise is
    made between hardware and software generation that allows an
    implementation to use the RISC-V cryptographic ISA.

%   Even if a DRBG seed obtains a sufficient amount of entropy in total,
%   some bits may be more important than others. For example, the IV values
%   of a counter-mode DRBG are less important than the key bits;
%   if an adversary knows the key bits then the IV (counter value) is
%   easy to determine. The inverse is not true. Cryptographic
%   conditioning is required to spread the entropy across all bits.

\subsubsection{The Final Random: DRBGs}
\label{sec:drbgs}

    All random bits reaching end users and applications must come from a
    cryptographic DRBG. These are generally implemented by the driver
    component in software. The RISC-V AES and SHA instruction set extensions
    should be used if available, since they offer additional
    security features such as timing attack resistance.

    Currently recommended DRBGs are defined in NIST SP 800-90A (Rev 1)
    \cite{BaKe15}: \verb|CTR_DRBG|, \verb|Hash_DRBG|, and \verb|HMAC_DRBG|.
    Certification often requires known answer tests (KATs) for the symmetric
    components and the DRBG as a whole. These are significantly easier to
    implement in software than in hardware. In addition to the directly
    certifiable SP 800-90A DRBGs, a Linux-style random pool construction
    based on ChaCha20 \cite{Mu20} can be used, or an appropriate construction
    based on SHAKE256 \cite{NI15}.

    These are just recommendations; programmers can adjust the usage of the
    CPU Entropy Source to meet future requirements.

\subsection{Quantum vs Classical Random}
\label{sec:quantum}

    \begin{quote}
        {\it ``The NCSC believes that classical RNGs will continue to
        meet our needs for government and military applications for the
        foreseeable future.''}
        \flushright -- U.K. QRNG Guidance, March 2020 \cite{NC20}.
    \end{quote}

    A Quantum Random Number Generator (QRNG) is a TRNG whose source of
    randomness can be unambiguously identified to be a \emph{specific}
    quantum phenomenon such as quantum state superposition, quantum state
    entanglement, Heisenberg uncertainty, quantum tunneling, spontaneous
    emission, or radioactive decay \cite{IT19}.

    Direct quantum entropy is theoretically the best possible kind of
    entropy. A typical TRNG based on electronic noise is also largely
    based on quantum phenomena and is equally unpredictable - the difference
    is that the relative amount of quantum and classical physics involved is
    difficult to quantify for a classical TRNG.

    QRNGs are designed in a way that allows the amount of quantum-origin
    entropy to be modeled and estimated. This distinction is important in
    the security model used by QKD (Quantum Key Distribution) security
    mechanisms which can be used to protect the physical layer (such as
    fiber optic cables) against interception by using quantum mechanical
    effects directly.

    This security model means that many of the available
    QRNG devices do not use cryptographic conditioning and may fail
    cryptographic statistical requirements \cite{HuHe20}. Many implementers
    may consider them to be entropy sources instead.

    Relatively little research has gone into QRNG implementation security,
    but many QRNG designs are arguably more susceptible to leakage than
    classical generators (such as ring oscillators) as they tend to employ
    external components and mixed materials.

    \paragraph{Post-Quantum Cryptography.}
    The classical/quantum origin of randomness is not important in NIST
    Post-Quantum Cryptography (PQC) \cite{NI16}. Recall that cryptography
    aims to protect the confidentiality and integrity of data itself
    and does not place any requirements on the physical communication
    channel (like QKD). Classical good-quality TRNGs are perfectly suitable
    for generating the secret keys for PQC protocols that are hard for
    quantum computers to break, but implementable on classical computers.
    What matters in cryptography is that the secret keys have enough true
    randomness (entropy) and that they are generated and stored securely.

    Of course one must avoid DRBGs that are based on problems that are
    easily solvable with quantum computers, such as factoring \cite{Sh94}
    in the case of Blum-Blum-Shub generator \cite{BlBlSh86}. However
    most symmetric algorithms are less affected as the best quantum
    attacks are still exponential to key size \cite{Gr96}.

    As an example, the original Intel RNG \cite{Me18}, whose output
    generation is based on AES-128 can be attacked using Grover's algorithm
    with approximately square-root effort \cite{JaNaRo+20}.
    While even ``64-bit'' quantum security is extremely difficult to
    break, many applications specify a higher security requirement.
    NIST \cite{NI16} defines AES-128 to be ``Category 1'' equivalent
    post-quantum security, while AES-256 is ``Category 5'' (highest).
    We avoid this possible future issue by exposing a more direct access
    to the entropy source, which can derive its security from
    information-theoretic assumptions only.


\chapter{Methodology}
\label{ch:methodology}

The objective of this work is to develop a method that, like CADIS and FW-CADIS,
automatically generates variance reduction parameters for fixed-source,
deep-penetration radiation transport problems. In general, the variance reduction
parameters generated by CADIS and FW-CADIS are not sufficient for
problems that are strongly
anisotropic with respect to the flux. This method will extend existing
methods to generate importance maps--that in turn generate variance reduction
parameters--that are informed by angle to remedy this issue. The first section
in this chapter describes
the mathematical foundation of this new method. A discussion on how
the method's performance will be quantified follows. Finally, a description of
the software being used and how the method is added to this software
concludes this chapter.

\input{./chapters/methodology/theory.tex}
\input{./chapters/methodology/success_metrics.tex}
\input{./chapters/methodology/software.tex}
\input{./chapters/methodology/summary.tex}


\documentclass[12pt]{article}
\usepackage[usenames]{color} %used for font color
\usepackage{amsmath, amssymb, amsthm}
\usepackage{wasysym}
\usepackage[utf8]{inputenc} %useful to type directly diacritic characters
\usepackage{graphicx}
\usepackage{caption}
\usepackage{subcaption}
\usepackage [english]{babel}
\usepackage [autostyle, english = american]{csquotes}
\MakeOuterQuote{"}
\graphicspath{ {./} }
\newcommand{\Z}{\mathbb{Z}}
\newcommand{\N}{\mathbb{N}}
\newcommand{\R}{\mathbb{R}}
\newcommand{\Q}{\mathbb{Q}}
\newcommand{\prob}{\mathbb{P}}
\newcommand{\degrees}{^{\circ}}

\author{Tianshuang (Ethan) Qiu}
\begin{document}
\title{Math 104, HW4}
\maketitle
\newpage

\section{Q1}
\subsection{a}
Let $x$ be an arbitrary point in $E = (0,1)$. Choose $r = \min \{(1-x)/2, x/2\}$.
\newline
Consider $S = \{d(s,x)<r\}$. Since $0<x<1$, $(1-x)/2$ and $x/2$ are both positive. Therefore $r>0$, and since $x-x/2 > 0, x+(1-x)/2<1$, we have $S \subseteq E$
\newline
Therefore $E$ is open.
\newline
Consider the complement of $E: E' = \R \setminus E$
\newline
Let $x'=1, r'>0$. Since $E'$ is the complement of $E$, it is the union of $(-\infty, 0], [1, +\infty)$. If $r \geq 1$, we can see that $S' = \{d(s',x')<r'\}$ contains the point $1/2$ for instance, and $1/2 \notin E'$. Otherwise, let $a = x'-r'$, since $x'=1, 0<r'<1, a \in S, a \notin E$. Therefore its complement is not open.
\newline
Thus we have shown that $(0,1)$ is open and not closed.

\subsection{b}
Let $x=1, r>0, E=[0,1]$. Consider $S = \{d(s,x)<r\}$. Since $r>0, \exists s \in S s.t. s>x$. However since the interval only goes from 0 to 1, $s \notin E$. Therefore this interval is not open.
\newline
Consider $E' = \R \setminus E$.
\newline
Since $E'$ is the complement of $E$, it is the union of $(-\infty, 0), (1, +\infty)$. If $x$ is in the former, then pick $r' = -x/2$. Since $x<0, -x > 0$, and $x+(-x/2)<0$, so $S = \{d(s',x')<r'\} \subseteq E$.
\newline
If it is in the latter, pick $r' = (x-1)/2$. Since $x>1$, and $x-(x-1)/2>1$, so $S = \{d(s',x')<r'\} \subseteq E$. Therefore its complement is open.
\newline
Thus we have shown that $[0,1]$ is closed and not open.

\subsection{c}
Consider $x = 1$, let $r > 0$, we can consider this set to be a non-increasing series from 1 to 0. Let $S = \{d(s,x)<r\}$, now since $r > 0, \exists s' \in S s.t. 1/2<s'<1$, since this series is non-increasing, $s' \notin E$. Therefore the set is not open.
\newline
Consider the complement $E'$. Consider $x'$. If $x'>1 or x'<0$, we can choose $r'$ exactly the same as part (b) of this question. We can see that the set with radius $r'$ is a subset of $E'$.
\newline
If $0<x'<1$, we need to show that we can pick an $r'$ small enough to have not let the "other" set in.
\newline
Since $x' \notin E$, and $0<x'<1$, then it must be "sanwiched" between two elements of $E$. Let the two around $x'$ be $1/(n+1)<x'<1/n$. Now we can apply the denseness of rationals theorem to show that $\exists q_1, q_2 s.t. 1/(n+1)<q_1<x', x'<q_2<1/n$. Now let $r' = \min \{ q_1, q_2 \}$. We can see that all of the elements in this radius are in the set $E'$. Therefore its complement is open.
\newline
Thus we have shown that this set is closed and not open.

\subsection{d}
Let $x \in \Q, r>0$, and $S = \{d(s,x)<r\}$. By the denseness of irrationals we know that $\exists a \notin \Q s.t. x < a < x+r$. Therefore $\Q$ is not open.
\newline
We can repeat the same argument but with irrationals. Let $y$ be irrational$, r>0$, and $S = \{d(s,y)<r\}$. By the denseness of ratioanls we know that $\exists b \in \Q s.t. y < b < y+r$. Therefore $\Q$'s complement is not open.
\newline
Therefore $\Q$ is neither open nor closed.

\subsection{e}
Let this set be $E$. Let $e \in E$ be an arbitrary point, and we choose $r = 1-d(e,(0,0))$. So we have our set $S = \{d(e,s)<r\}$.
By the triangle inequality we have $d(s, (0,0)) < 1 - r +r = 1$, so $s \in E \forall s \in S$. Therefore the set is open.
\newline
Let $E$'s complement be called $E'$, and let $x \in E'$ be a point such that $d(x, (0,0)) = 1$. Let $r' > 0$, then consider the set $S' = \{d(x,s')<r'\}$. $\exists t \in S s.t. d(t, (0,0))<1$. Then $t \in E$. Therefore its complement is not open.
\newline
Therefore this set is open and not closed.
\newpage

\section{Q2}
\subsection{a}
Let $a \in U$ be an arbitrary point. Since $U$ is a union of a collection of open sets, then it must belong to at least one element of this collection. Let that element be $U_0$.
\newline
Since $U_0$ is open, $\exists r>0 s.t. S=\{s \in S | d(a,s)<r\} \subseteq U_0$. Therefore we have found an $r$ that works for an arbitrary point in $U$. Thus $U$ is open. Q.E.D.

\subsection{b}
Consider $V_0 = U_1 \cap U_2$.
\newline
From the intersection, we conclude that for all $v \in V_0, v \in U_1, v \in U_2$. Now consider an arbitrary point $w \in V$. Since it is in open sets $U_1, U_2$, $\exists r_1, r_2 s.t. \{d(w,v)<r_1\} \subset U_1, \{d(w,v)<r_2\} \subset U_2$
\newline
Now let $r = \min \{r_1, r_2\}$. Since r is the smaller of the two, $A = \{d(w, a)<r \} \subset V_0, \subset V_1$. Therefore $A \subset V_0$. Thus we have shown that $V_0$ is open.
\newline
We can then repeat this process finitely many times, taking the minimum of the radius each time. Finally we have that $V$ is open. Q.E.D.

\subsection{c}
Consider $W = \cap ^\infty _{n=0} (1/n, -1/n)$. Since $1/n \to 0$ and $-1/n \to 0$, $W = \{0\}$. This set has only 1 element and is therefore closed. Q.E.D.
\newpage

\section{Q3}
Let $\epsilon > 0$, since $s_n \to s$, we have $\exists N s.t. \forall n>N, d(s_n,s)<\epsilon$. Now let $r = \epsilon$, we can see that $\exists n s.t. d(s_n, s)<r$.
\newline
Consider the complement of $E: F$. Consider the point $s$, since $s \notin E$, we have $s \in F$. Let $r' > 0$, define $Q = d(s,q)<r'$. Since we have shown above that $\exists n s.t. d(s_n, s)<r$ for $r>0$, we know that $Q$ will always overlap with $E$. Therefore we cannot find a radius small enough, and $F$ is not open. Thus $E$ is not closed. Q.E.D.
\newpage

\section{Q4}
Since $E$ is not closed, its complement $F$ is not open. Let $s$ be a boundary point in $F$: $s \in F s.t. \{p|d(s,p)<r \} \not\subset F \forall r > 0$
\newline
Now let $e$ be an arbitrary point in $E$. Consider the sequence $s_n \in \{s \mid a\in E, d(a,s)<\frac{1}{n}\}$. We are attempting to draw "smaller and smaller" circles. Since we have shown above that $\exists p \in E s.t. d(s,p)<r \forall r>0$, so we know that we can always pick an $s_n$ that is closer to $f$. Now, since $1/n \to 0$, we know that $d(s_n, s)\to 0$, and therefore $s_n \to s, s \notin E$. Q.E.D.
\newpage

\section{Q5}
Assume that there exists a sequence $s_n$ that converges to $s \notin F$.
\newline
First, $s$ must be in $E$. Since $F \subseteq E, \forall f \in F, f \in E$. Furthermore, $E$ is sequentially compact, so every subsequence converges to an element in $E$. Therefore $s_n$ cannot converge to an element outside of $F$, so for the sake of contradiction we assume that it converges to $s \in E$.
\newline
Let $\epsilon > 0$, then by our assumption there exists $N$ such that $\forall n>N, d(s_n, s)<\epsilon$. Now since $F$ is closed, we know that its complement is open. Let $F' = S \setminus F$. Since $F$ is open, for any point $a \in F, \exists r>0 s.t. \{b \mid d(a,b)<r\} \subseteq F'$.
\newline
Now we let the region surrounding our convergent point $s$ have value $r = k$, and we choose $\epsilon = k/2$. Since $r>0, k/2>0$. Now for all $d(p,s)<k$, $p \in F'$. This is a contradiction since if our sequence converges to $s$, it must be able to get arbitrarily close, but we have just created a space where $s_n$ cannot approach $s$. \lightning
\newline
Therefore our assumption is incorrect and $s_n \to s$ must have $s \in F$.
\newpage

\section{Q6}
By the definition of $\lim \sup$ we have $$\lim _{N \to \infty}\{\sup \{\frac{a_{n+1}}{a_n}\mid n>N\}< C$$
\newline
Assume that the statement is not correct, so we have: for all $N \in \N, a_n \geq c^{n-N}a_N$
\newline
Let $k \in \N$, between $n \leq k \leq N$, there must be at least 1 value such that $(a_{k+1}/a_k) \geq C$ because otherwise, $a_n < c^{n-N}a_N$, and we have assumed that to be false. Now since we can show that there is at least 1 instance where $(a_{k+1}/a_k) \geq C$ for all possible intervals of $n,N \in N$, the limit superior cannot be less than $C$. \lightning
\newline
We have found a contradiction, therefore our assumption is not correct and there must exist some $N \in \N$ that satisfies $a_n < c^{n-N}a_N \forall n>N$. Q.E.D.
\newpage

\section{Q7}
\subsection{a}
Lemma: $\lim \sup a+b \leq \lim \sup a + \lim \sup b$
\newline
Since $k^2 \neq 0 \forall k>0$, $a_k \neq 0$. Consider $a_{k+1}/a_k$ :
$$\frac{(k+1)^2}{3^{k+1}}\times \frac{3^k}{k^2} = \frac{(k+1)^2}{3k^2}$$
$(k+1)^2 < 2k^2$ for all $k>3$, we have
$$\lim \sup \frac{(k+1)^2}{3k^2} < \lim \sup \frac{2k^2}{3k^2} = \frac{2}{3}$$
Therefore the ratio of the limit superior is less than 1, the sequence converges absolutely. Q.E.D.

\subsection{b}
$a_k = k^2/3^k$, define $b_k = 3^k/3^k$. Since $k^2<3^k$ for all $k>2$, we have $a_k<b_k \forall k>2$.
\newline
Now consider the nth root: taking the nth root does not change the order when both numbers are positive, so we have $\lim \sup a_k^{1/k} < \lim \sup b_k^{1/k} = 1$ since $b_k$ is constant.
\newline
Thus we have $\lim \sup a_n < 1$. The sequence converges by root test. Q.E.D.

\subsection{c}
Consider $c_k = 2^k/3^k$. $2^k \geq k^2 \forall k\geq 2$. Furthermore, our sequence $a_k = k^2/3^k$ is positive. So we have $|a_k|\leq c_k$. $c_k$ converges by geometric series with $r = 2/3<1$. Therefore $a_k$ converges by limit comparison test.

\end{document}


\section{Noise effects}
To conclude our analysis, in the end we studied the behaviours of the sub-pixel filters varying the noise in the image. As we mentioned in Section \ref{sec:laser-peaks}, the presence of electrical noise in the frames \cite{1334612}, can affect heavily the quality of the peak detection, thus it is a good practice to apply some filters that reduce the weight of this noise during the laser location phase \cite{Naidu1991}. For example, industry experts know that such operations are necessary if you use the \textit{center of mass}: the presence of spikes influences the evaluation of the weighted average. An example of this, is shown in Figure \ref{fig:noise-es}. \\
  \begin{figure}[t!]
    \centering
    \includegraphics[width=\textwidth]{./images/analysis/noise/electrical.jpg}
    \caption{Effects of noise in peak detection. On the left there is a noise free Gaussian, and the \acs{COM} correctly detect the peak. On the right, the noise moves the location (-.) with respect to the correct one (- -).}
    \label{fig:noise-es}
  \end{figure}

As far as we are concerned, we have noticed these problems during the test shown in Section \ref{sec:exp2}. Before reaching the discussed results, we tried to apply different image preprocessing algorithms to increase the precision of the peak localizion. So we saw that when we changed the preprocessing, the final results changed too. In Figure \ref{fig:prep-dima} we reported the model trends for each sub-pixel filter used, varying the image preprocessing algorithms. As we can see, not all algorithms improve the results, on the contrary, sometimes they get worse the final error. In addition, we can see that the trend is different between mobile average and derivatives filters. These observations suggested us that not all filters have the same behaviour. Anyway, these results were obtained from a single system, thus we decided to perform some theoretical tests, in order to control the sources of noise. \\

In the second set of tests, we introduced some noise to the Gaussian, varying its \acs{SNR}. In this way we were able to see how much strong are the sub-pixel algorithms with respect to the noise, and thus to the variations in image conditions. To do that, we varied the \acs{SNR} in the range $\left( 0, 30 \right)$ with step $1$, and repeated the test five times per \acs{SNR} step. The averages of the results are shown in Figures \ref{fig:prep1} and \ref{fig:prep2}. We had to split the trends in two graphics to see better what happens.

The first thing that caught our attention was the fact that, for high values of \acs{SNR}, the initial hypothesis that $\hat{\delta} \in \left( -\frac{1}{2}, \frac{1}{2} \right)$ with respect to the pixel, is false. The only model that always guarantees the hypothesis, is the \textit{FIR}. Unfortunately, we are not able to model this result mathematically. As we said in the previous chapters, the algorithm used to detects the peak, finds the pixel with the greater value along a row, and then applies on it the sub-pixel filters. If we think of a moment, this is a reasonable hypothesis: so we considered the possibility to go out from the pixel as an error due to the noise in the image.

The second important thing to underline, is the effect of the size of the window. As we have said several times, the window has to be comparable with the width of the Gaussian, however, in presence of noise, the bigger the window is, the bigger is the weight of the noise in the measure. We can see this for both \textit{center of mass} and \textit{B\&R}. Furthermore, in the same point we can notice that the \textit{FIR} filter, that is more robust than the others in presence of noise, becomes the worst. \\

Thus, we can conclude that, from a global point of view, the \textit{FIR} filter is the more robust in presence of noise, and it is the more stable, because of its small variance along noise variation. However, for low noise images \textit{center of mass} and \textit{B\&R} models, allow to reach better results. The \textit{B\&R} is the less stable filter, but as shown in Figure \ref{fig:prep-dima}, it is the less sensible (with the \textit{FIR} filter) to image preprocessing. Finally, as far as the window size is concerned, the rule on Gaussian dimension continues to apply. So, there isn't a filter better than the others: their behaviours strictly depends from the scenario we are working on, and from the preprocess applied to the image. Since these considerations are empirical, we suggest to perform some tests in real conditions before choosing what algorithm use in your application.
  \begin{figure}[b!]
    \centering
    \includegraphics[width=0.95\textwidth]{./images/analysis/noise/preprocessing_dima.png}
    \caption{Variation in the model output changing the image preprocessing.}
    \label{fig:prep-dima}
  \end{figure}
\vfill
  \begin{figure}
    \centering
    \includegraphics[width=\textwidth]{./images/analysis/noise/prep1.png}
    \caption{Filters' trends for \acs{SNR} in range $\left( 0, 10 \right)$}
    \label{fig:prep1}
  \end{figure}
\vfill
  \begin{figure}[t!]
    \centering
    \includegraphics[width=\textwidth]{./images/analysis/noise/prep2.png}
    \caption{Filters' trends for \acs{SNR} in range $\left( 10, 30 \right)$}
    \label{fig:prep2}
  \end{figure}


\documentclass[twoside]{MATH77}
\usepackage{multicol}
\usepackage[fleqn,reqno,centertags]{amsmath}
\begin{document}
\hyphenation{SINTOP}
\begmath 13.2 Numerical Evaluation of Integrals Over Several Dimensions

\silentfootnote{$^\copyright$1997 Calif. Inst. of Technology, \thisyear \ Math \`a la Carte, Inc.}

\subsection{Purpose}

This collection of subprograms estimates the value of the integral $I_n$,
where%
\begin{gather*}
\{I_0\}_f=\emptyset \vspace{2pt} \\
I_k=\int \rule[-15pt]{0pt}{34pt}_{\displaystyle
\hspace{-9pt}a_k(x_{k+1},...,x_n,
\{I_{k^{\prime}}\}_{a_k})}^%
{\displaystyle \hspace{-2pt}b_k(x_{k+1},...,x_n,\{I_{k^{\prime}}\}_{b_k})}
\hspace{-1.3in}f_k(x_k,...,x_n,\{I_{k-1}\}_{f_k})\,dx_k,\ \
1\leq k\leq n-1\\
I_n=\int_{\displaystyle a_n}^{\displaystyle b_n}f_n(x_n,
\{I_{n-1}\}_{f_n})\,dx_n,
\end{gather*}
$a_n$ and $b_n$ are constants, $a_1$, ..., $a_{n-1}$, $b_1$, ..., $b_{n-1}$
and $f_1$, ..., $f_n$ are functions provided by the user. The notation
$\{I_{k-1}\}_g$ means a set of zero or more integrals of dimension less
than $k$, used in the calculation of $g$, and $k^{\prime }$ is less than
the dimensionality of the integral enclosing $I_k(k^{\prime }$ may be
greater than $k)$. Usually, $f_k$ is $I_{k-1}$ for $k>1$, and
$\{I_{k^{\prime}}\}_{a_k}$ and $\{I_{k^{\prime}}\}_{b_k}$ are empty.

Using $n=2$ for illustration, this formulation of the multiple integration
problem includes the simple case of%
\begin{equation*}
I_2=\int_{\displaystyle a_2}^{\displaystyle b_2}\int_{\displaystyle %
a_1(x_2)}^{\displaystyle b_1(x_2)}f_1(x_1,x_2)\,dx_1\,dx_2,
\end{equation*}
but it also allows for improved computational efficiency if the integrand
can be factored as%
\begin{equation*}
I_2=\int_{\displaystyle a_2}^{\displaystyle b_2}f_2(x_2)\int_{\displaystyle %
a_1(x_2)}^{\displaystyle b_1(x_2)}f_1(x_1,x_2)\,dx_1\,dx_2,
\end{equation*}
and in addition it allows for the more general case of%
\begin{equation*}
I_2=\int_{\displaystyle a_2}^{\displaystyle %
b_2}f_2(x_2,I_1^{(a)}(x_2),I_1^{(b)}(x_2),...)\,dx_1\,dx_2,
\end{equation*}
where $I_1^{(a)}(x_2)$, $I_1^{(b)}(x_2)$, ... are integrals over one
dimension. This includes the case in which, for example, $I_1^{(a)}(x_2)$ is
a limit for $I_1^{(b)}(x_2).$

\subsection{Usage}

Described below under B.1 through B.5 are:

\begin{tabular*}{3.3in}{@{}l@{~~}l}
B.1 & \hspace{-20pt} Program Prototype, Single Precision\dotfill
\pageref{PPSP}\\
\quad B.1.a & The Calling Routine\dotfill \pageref{Calling}\\
\quad B.1.b & Argument Definitions\dotfill \pageref{ArgDef}\\
\quad B.1.c & The User-supplied Subroutine SINTF to\rule{.34in}{0pt}\\
 & Calculate Limits and Integrands\dotfill \pageref{SINTF}\\
\quad B.1.d & Argument Definitions for SINTF\dotfill \pageref{ArgSINTF}\\
\quad B.1.e & Actions to be Accomplished by SINTF\dotfill \pageref{ActSINTF}\\
\quad B.1.f & Passing Extra Information into SINTF\dotfill \pageref{ExtSINTF}\\
\end{tabular*}

\begin{tabular*}{3.3in}{@{}l@{~~}l}
B.2 & \hspace{-20pt} Program Prototype, Single Precision,\\
 & \hspace{-20pt} Reverse Communication\dotfill \pageref{PPRC}\\
\quad B.2.a & The Calling Routine\dotfill \pageref{CallingRC}\\
\quad B.2.b & Argument Definitions\dotfill \pageref{ArgDefRC}\\
B.3 & \hspace{-20pt} Methods to Request Unusual Usage
Through\rule{.3in}{0pt}\\
 & \hspace{-20pt} the Arguments IOPT and WORK\dotfill \pageref{UnusualUse}\\
B.4 & \hspace{-20pt} Changing the Selection of Some Options\\
 & \hspace{-20pt} During the Computation\dotfill \pageref{ChangeSel}\\
B.5 & \hspace{-20pt} Modifications for Double Precision
Usage\dotfill \pageref{DPuse}\\
\end{tabular*}

\subsubsection{Program Prototype, Single Precision.\label{PPSP}}

\paragraph{The Calling Routine\label{Calling}}

\begin{description}
\item[INTEGER]  \ {\bf NDIMI, NWORK, IOPT}$(\geq k)$\newline
[$k$ depends on options used ($\geq 2$).]

\item[REAL]  \ {\bf ANSWER, WORK}(NWORK)
\end{description}

Assign values to NDIMI and NWORK.

Assign values to IOPT() and elements of WORK() referenced by options (see
Section B.3). For simplest usage, set

\hspace{.2in}IOPT$(2)=0$

\begin{center}
\fbox{\begin{tabular}{@{\bf }c}
CALL SINTM (NDIMI, ANSWER,\\
WORK, NWORK, IOPT)\\
\end{tabular}}
\end{center}

If the computation is successful (see the description of values of IOPT(1)
below) the result is in ANSWER and the estimate of the error in the result
is in WORK(1).

\paragraph{Argument Definitions\label{ArgDef}}

\begin{description}
\item[NDIMI] \  [in] Number of dimensions of integration, $n$ in Section A.

\item[ANSWER] \  [out] Estimate of the integral.

\item[WORK()] \  [inout] On completion, WORK(1) contains an estimate of the
upper bound of the magnitude of the difference between ANSWER and the true
value of the integral. During the integration, WORK(1:NDIMI)
contains the abscissas $x_1$ through $x_{NDIMI}$, WORK(NDIMI+1:2$\times $NDIMI)
contains the lower limits $a_1$ through $a_{NDIMI}$,
and WORK(2$\times $NDIMI+1:3$\times $NDIMI) contains the
upper limits $b_1$ through $b_{NDIMI}$.
WORK(NDIMI+1:NWORK) may be referenced by the option vector IOPT() as
described below and in Section B.3, and to pass parameters to SINTF as
described in Section B.1.f.

\item[NWORK] \  [in] Specifies the amount of space allocated for the array
WORK(). NWORK must be $\geq 220\times \text{NDIMI} - 217.$

\pagebreak
\centerline{{\bf Table of Options for SINTM}\hspace{.5in}}
\ {\bf Option}\newline
{\bf Number\hspace{.3in}Brief Description}\vspace{-3pt}
\begin{itemize}
\item[0]  No more options.

\item[1]  No effect. Reserved for future use. Do not use option~1.

\item[2]  Select level of diagnostic output.

\item[3]  Specify error tolerances.

\item[4]  Specify an a posteriori estimate of the absolute error in the
calculated value of the integrand.

\item[5]  Specify an a priori estimate of the relative error expected in the
calculated values of integrands.

\item[6]  Use reverse communication.

\item[7]  Specify minimum index of quadrature formula.

\item[8]  No effect. The parameter may provide information to SINTF.

\item[9]  Specify maximum number of integrand evaluations allowed.

\item[10]  Return number of integrand evaluations used.

\item[11]  Specify location of singularity or discontinuity in integrand.

\item[12]  Specify absolute errors in the limits.

\item[13]  Specify location in IOPT of notification of nonstandard dimension
changes.
\end{itemize}\vspace{-3pt}

\rule{2.9 in}{1 pt}\vspace{3pt}

\item[IOPT()] \  [inout] Used to return status information to the user, to
allow the selection of options, and to pass parameters to SINTF as described
in Section B.1.f. IOPT(1) returns a status indicator with the possible
values:

\begin{description}
\item[\rm $-$NDIMI] \  Normal termination with either the absolute or relative
error tolerance criteria satisfied (see option~3 below and in Section
B.3).

\item[\rm $-$NDIMI$-1$] \  Normal termination with neither the absolute nor
relative error tolerance criteria satisfied, but the tolerance relative to
the locally achievable precision is satisfied. This is the normal status
value when no tolerances are specified. (See option~3 below and in
Section B.3).

\item[\rm $-$NDIMI$-2$] \  Normal termination with none of the error tolerance
criteria satisfied. (See option~3 below and in Section B.3).

\item[\rm $-$NDIMI$-3$] \  Error termination, NWORK is too small.

\item[\rm $-$NDIMI$-4$] \  Bad value for an element of IOPT().

\item[\rm $-$NDIMI$-5$] \  Too many function values needed (see option~9 below and
in Section B.3).

\item[\rm $-$NDIMI$-$k$-5$] \  Error termination. The $k^{th}$ integrand
apparently contains a non-integrable singularity. The approximate abscissa
of the singularity in the $k^{th}$ dimension is in ANSWER, and the abscissas
of exterior dimensions are in WORK$(k$+1:NDIMI). WORK(1)
contains a large number.

\item[\rm $-$NDIMI$-$NDIMI$-$k$-5$] \  When applying the usage that allows
changing the dimensionality of the next integral to be computed in a
nonstandard way (Section B.1.e), the specified dimensionality $k$ of an
inner integral is not less than the dimensionality of the outer integral.
\end{description}

The remainder of IOPT() may be used to select options and to pass parameters
to SINTF. If no options are selected, set IOPT$(2)=0.$
\end{description}

See Section B.3 for a detailed description of options and the table
on the left for an overview.

\paragraph{The User-Supplied Subroutine SINTF to Calculate Integrands and
Limits\label{SINTF}}

SINTM requires that the user provide values of the integrand and values of
the lower and upper limits, and allows the user to make functional
transformations of inner integrals before they are used as integrands of
outer integrals. In the case of simple usage these values are provided by a
user-supplied subroutine of the form:

{\tt \begin{tabbing}
SUBROUTINE SINTF(ANSWER, WORK, IFLAG)\\
REAL \ ANSWER, WORK(*)\\
INTEGER \ IFLAG\\
\rm .\ .\ .
\end{tabbing}}

\paragraph{Argument Definitions for SINTF\label{ArgSINTF}}

\begin{description}
\item[ANSWER] \  [inout] Usage depends on IFLAG.

\item[WORK({\rm 1:NDIMI})]  \ [inout] Storage for the currently needed
values of $x_1$,\ ..., $x_{NDIMI}$. When IFLAG $\neq 0$, $x_1$ is not
needed and WORK(1) has a different usage described below.

\item[WORK({\rm NDIMI+1:2$\times $NDIMI})]  \ [inout] Storage for
lower integration limits, $a_1$, ..., $a_{NDIMI}.$

\item[WORK({\rm 2$\times $NDIMI+1:3$\times $NDIMI)}]  \ [inout]
Storage for upper integration limits, $b_1$, ..., $b_{NDIMI}.$

\item[WORK({\rm $220\times \text{NDIMI}-216:\text{NWORK}$})] \ [inout]
May be used to pass extra information into SINTF, See Section~B.1.f.

\item[IFLAG] \ [inout] On input, IFLAG indicates the action to be taken by
SINTF.  The value of IFLAG may be changed by SINTF.  IFLAG may be used to
pass extra information into SINTF, See Section~B.1.f.

\end{description}

Most mathematical software that requires user defined function
information allows the user to pass in the name of a subprogram for
evaluating the function.  The approach used here has the advantage of not
requiring the user to declare his subprogram in an external statement
(It's not unusual for this to be forgotten.), and of giving a meaningful
diagnostic when no such routine is provided.  If one is solving different
problems with different programs, one can use different file names for the
different function subprograms, all of which would use the same entry
name.  The linker must then be told which of these function subprograms
should be used in forming the executable file.  If one wants to solve
several different problems in the same program, one should code the
separate cases in one subprogram and select the one desired by passing a
``case'' variable into the routine.  This can either be done as part of
IFLAG as mentioned above, or can be done through the use of named
common.  One can also use reverse communication and call subprograms with
different names for the different cases.

\paragraph{Actions to be Accomplished by SINTF\label{ActSINTF}}

{\bf IFLAG} = 0\ \ The Inner Integrand\newline
When IFLAG\ $= 0$, SINTF must compute the inner integrand, $f_1$, as a
function of $x_1$, ..., $x_{NDIMI}$, and return the result in ANSWER.

{\bf IFLAG} $< 0$\ \ After Computing $I_{-IFLAG}$\newline
When IFLAG $< 0$, say IFLAG\ $= -i$, the current value of the integral
$I_i$ is provided in ANSWER, and the estimated error $E_i$ in this value
is provided in WORK(1). Frequently, one will have $f_{i+1} = I_i$, and
$a_i$ and $b_i$ will not depend on integrals, in which case
$\varepsilon_{i+1} = E_i = $ WORK(1), and SINTF can simply RETURN, taking
no action.

In more complicated cases, SINTF must compute the integrand $f_{i+1}$ as a
function of $x_{i+1}$, ..., $x_{NDIMI}$, $I_i$, and perhaps other
integrals as described in the next paragraph. The value of $f_{i+1}$ must
be in ANSWER on return, and the error $\varepsilon _{i+1}$ in $f_{i+1}$
must be in WORK(1).

If $f_{i+1}$ depends on integral(s) not yet computed then SINTF must
remember $I_i$ and $E_i$ for subsequent use, and set IFLAG to the number of
dimensions of the next integral to be evaluated; IFLAG must be less than the
number of dimensions of the enclosing integral. If option~13 is selected
then K13 is used for this communication instead of IFLAG. IFLAG is the first
element of the IOPT vector passed to SINTM (see Section B.1.f). It is the
responsibility of SINTF to remember the state of computation of the several
integrals upon which $f_{i+1}$ depends. That is, to know when to change
IFLAG (or K13), when not to change it, and when to evaluate $f_{i+1}.$

To estimate errors and control the selection of evaluation points during
calculation of $I_{i+1}$, SINTM needs an estimate of the error in
$f_{i+1}$. In the simple case when $f_{i+1}=I_i$, and $a_i$ and $b_i$ do
not depend on integrals, one has $\varepsilon _{i+1}=E_i=$ WORK(1) and no
special action is required. In general, however, one must compute%
\begin{equation*}
\text{WORK(1) }=\sum_{\{\,j\mid I_i^{(j)}\in \{I_i\}_f\,\}}|\partial
f_{i+1}/\partial I_i^{(j)}|\ E_i^{(j)}
\end{equation*}
Where $E_i^{(j)}$ is the error in $I_i^{(j)}$. If some arguments of
$f_{i+1}$, say $y_j$, cannot be precisely calculated and represented, then
one must add $\Sigma \ |\partial f_{i+1}/\partial y_j|\ E(y_j)$, where
E($y_j)$ is the error in the calculation of $y_j$, onto the above sum.

{\bf IFLAG} $> 0$\ \ Before Computing $I_{IFLAG}$\newline
When IFLAG $>0$, say IFLAG $=i$, SINTF must compute $a_i$ and $b_i$ as
functions of $x_{i+1}$, ..., $x_{NDIMI}$, storing $a_i$ in WORK(NDIMI +
IFLAG) and $b_i$ in WORK(2$\times $NDIMI + IFLAG). SINTF will be called
only once with IFLAG = NDIMI, since the outer limits $a_{NDIMI}$ and
$b_{NDIMI}$ must be constants, and thus need to be set only once. These
may be stored into WORK() either by the user's main program before the
initial call to SINTM or else by SINTF when it is called with IFLAG =
NDIMI. Similarly, if the limits $a_k$ and $b_k$ of $I_k$ are constant,
they may be stored into WORK() by the user's main program before the
initial call to SINTM, or on any call to SINTF for which IFLAG $\geq k.$

Suppose a limit $a_i$ or $b_i$ depends on variables of integration $\{x_m |\
i < k \leq m \leq $ NDIMI$\}$. Then $a_i$ or $b_i$ may be calculated any
time that $i \leq $ IFLAG\ $< k$, but for maximum efficiency should be
calculated when IFLAG\ $= k-1$. Similarly a subexpression of $f_i$ that
depends on $\{x_m |\ i < k \leq m \leq $ NDIMI$\}$ should be calculated when
IFLAG $= k$, and used when IFLAG $= -i.$

For $1 \leq i <$ NDIMI the integral $I_i$, having the limits $a_i $ and $b_i$,
may subsequently be used as an argument in computing $f_{i+1}$.  Let $q$ be
the maximum of $|\partial f_{i+1}/\partial I_i|$ over all integrals on which
$f_{i+1}$ depends. If $q \neq 1$, then during an entry at which $a_i$ and
$b_i$ are being computed, SINTF must also compute $q$, or an upper bound for
$q$, and store this value in WORK(1).  This value is used internally to decide
how much accuracy is needed for the coming integration.  Note that if
$f_{i+1}$ is of the form $q(x_{i+1},\ \ldots,\ x_{NDIMI}) I_i$, then the $q$
computed here can be saved and reused for computing the values of ANSWER and
WORK(1) when IFLAG = $-(i+1)$.

If it is known that the integrand, $f_i$, has a single singularity
affecting integration from $a_i$ to $b_i$, SINTF should transmit
information on the type and location of this singularity to SINTM
during each entry that computes $a_i$ and $b_i$. To do this, SINTF
should store the location (on the $x_i$ axis) of the singularity into
WORK($|$K11$|$), where K11 is transmitted to SINTM, either by a call
to SINTOP with Option~11, or by storing K11 into IFLAG.  If the
singularity is at one of the limits, then $\text{NDIMI}< |\text{K11}|
\leq 3\times \text{NDIMI}$ is allowed.  Otherwise, one should have
$|\text{K11}| > 220\times \text{NDIMI}-217$. The sign of K11 affects
the internal transformations made to cope with the singularity as
described in Section~B.3 of Chapter~13.1.  If singularities are
present in more than one dimension of the multiple integration, one
must use a different value of $|$K11$|$ for each different
singularity location.

SINTM provides for the case that $f_{i+1}$ might depend on several
integrals, some of which have fewer than $i$ dimensions. When it is
necessary to evaluate an integral of dimension less than $i$, set IFLAG (or
K13 if option~13 has been selected) to the number of dimensions of the
integral to be evaluated, and set the appropriate limits into WORK() as
described above.

To illustrate nonstandard changes in dimensionality, suppose that the
integrand of a three dimensional integral depends on a function of several
one- and two-dimensional integrals, and suppose one chooses to evaluate the
one-dimensional integrals first. When SINTM first requests SINTF to provide
the limits of the inner (two-dimensional) integral (IFLAG $= 2)$, change
IFLAG to~1. Upon completion of each but the last of the one dimensional
integrals (IFLAG $= -1)$, set IFLAG to~1. Upon completion of the last of the
one-dimensional integrals, and upon completion of all but the last
two-dimensional integral, set IFLAG to~2. SINTF must keep track of it's
state using SAVE variables. That is, SINTF is responsible for knowing which
integrand to evaluate when IFLAG $= 0$, which transformation to apply when
IFLAG $< 0$, and which limits to supply when IFLAG $> 0$. For this
example, an error will be signaled with IOPT$(1)=-14=-\text{NDIMI}-
\text{NDIMI}-3-5$ if one sets IFLAG~$\geq $~3.

If either of the limits $a_i$ or $b_i$ are imprecisely known or imprecisely
representable $(e.g.$, they depend on integrals, or there is significant
cancellation in their evaluation), then for maximum reliability the errors
in the limits should be made known to SINTM by invoking SINTOP and selecting
option~12. See Section~B.3.

\paragraph{Passing Extra Information into SINTF\label{ExtSINTF}}

The argument WORK of SINTF is the vector WORK passed from the user's calling
routine to SINTM.  WORK() may be used to provide information for options as
described in Section B.3, and to pass floating point information from the
user's calling routine into SINTF.

The argument IFLAG of SINTF is the first element of the IOPT() vector
passed from the user's calling routine to SINTM. Elements of IOPT()
(after the first) that are not used for options as described in
Section B.3 may be used to pass integer valued information into
SINTF. In addition, the parameter of option~8 described in Section
B.3 may be examined by SINTF. If IFLAG is used in this way, it must
be declared

{\bf INTEGER} \ {\bf IFLAG}(*)

and IFLAG(1) must be examined to determine the action.

\subsubsection{Program Prototype, Single Precision, Reverse Communication.
\label{PPRC}}

\paragraph{The Calling Routine\label{CallingRC}}

\begin{description}
\item[INTEGER] \  {\bf NDIMI, NWORK, IOPT}$(\geq 3)$

\item[REAL] \  {\bf ANSWER, WORK}(NWORK)
\end{description}

Assign values to NDIMI, NWORK and IOPT() and elements of WORK() referenced
by options. Constant limits may be stored in the appropriate positions in
WORK() as described in Section~B.1.b. Option~6 must be selected (see
Section~B.3). For simple usage
\begin{tabbing}
\hspace{.2in}\=IOPT$(2) = 6$\\
\>IOPT$(3) = 0$
\end{tabbing}
\begin{center}
\fbox{\begin{tabular}{@{\bf }c}
CALL SINTM (NDIMI, ANSWER,\\
WORK, NWORK, IOPT) \\
\end{tabular}}
\end{center}
\hspace{.2in}DO
$$
\fbox{{\bf CALL SINTMA (ANSWER, WORK, IOPT)}}
$$
\begin{tabbing}
\hspace{.2in}\=\ \ \ \ \=IF (IOPT(1) .GT.\ 0) THEN\\

\>\>\ \ \ \ \=$\{$Calculate the limits as described in\\
\>\>\>\ \ \ \ \=Section B.1.d when IFLAG $>0.\}$\\

\>\>ELSE IF (IOPT(1) .LT. 0) THEN\\

\>\>\>IF (IOPT(1) + NDIMI .LE. 0) EXIT\\

\>\>\>$\{$Transform the integral as described in\\
\>\>\>\>Section B.1.d when IFLAG $<0.\}$\\

\>\>ELSE\\

\>\>\>ANSWER = value of innermost integrand,\\
\>\>\>\ \ \ \ $f_1$, at (WORK(1), ..., WORK\ (NDIMI)).\\

\>\>END IF\\

\>END DO\\

\>$\{$Integration is complete$.\}$
\end{tabbing}

Multi-dimensional quadrature can use significant amounts of computer time.\
The usage described above can be modified to reduce the execution time
slightly at a cost of the user's code becoming more complicated. To do
this, replace the single line

\hspace{.2in}ANSWER $= ...$\newline
by
\begin{tabbing}
\hspace{.2in}\=IOPT$(1) = 0$\\

\>DO WHILE (IOPT(1) .EQ.\ 0)\\

\>\ \ \ \ \=ANSWER = Value of the innermost\\
\>\>\ \ \ \ \=integrand, $f_1$, at (WORK(1), ...,\\
\>\>\>WORK(NDIMI))
\end{tabbing}
$$
\quad \quad \fbox{{\bf CALL SINTA (ANSWER, WORK, IOPT)}}
$$
\begin{tabbing}
\hspace{.2in}\=END DO\\

\>IF (IOPT(1) .GT.\ 0) THEN\\

\>\ \ \ \ \=$\{$Values of IOPT(1) produced by SINTMA and\\
\>\>\ \ \ \ \=SINTA have different meanings. Calculate\\
\>\>\>IOPT(1) as described in Section B.1.b.$\}$\\

\>\>IOPT$(1) = -$(IOPT(1) + NDIMI)\\

\>\>EXIT\ \  \=(from DO --- END DO in which this\\
\>\>\>\ code is embedded)\\

\>END IF
\end{tabbing}

This modification reduces by one the number of subroutine calls for every
evaluation of the innermost integrand.

\paragraph{Argument Definitions\label{ArgDefRC}}

\begin{description}
\item[NDIMI, WORK(), NWORK, IOPT()]  \ Used as described in Section
B.1.b, except if $-$NDIMI $<$ IOPT(1) $\leq $ NDIMI, IOPT(1) is used as
described for IFLAG in Section B.1.e.

\item[ANSWER]  \ [inout] On completion, ANSWER contains an estimate of the
integral. During integration, ANSWER provides a value of the integrand to
SINTMA.
\end{description}

\subsubsection{Methods to Request Unusual Usage Through the Arguments IOPT
and WORK\label{UnusualUse}}

All options other than option~13 have the same qualitative effect as when
calculating an integral over one dimension, as described in Section B.3
of Chapter~13.1, but some options have separate effects in separate
dimensions.  Direct calls to SINTOP should be made as described in
Section~B.4 of Chapter~13.1. Options different from those in 13.1 are:

\begin{itemize}
\item[2]  (Argument K2) K2 is an NDIMI decimal digit integer, where the
low order digit selects the level of diagnostic output during integration
over $x_1$, the next digit selects the level of diagnostic output during
integration over $x_2$, etc. The meaning of each digit is the same as the
meaning of K2 described in Section~B.3 of Chapter~13.1.

\item[9]  (Argument K9) K9 specifies only the maximum number of evaluations
of the inner integrand $(f_1).$

\item[11] (Argument K11) WORK($|$K11$|$) specifies the location of a
singularity or discontinuity in the outer dimension.  Singularities or
discontinuities in inner dimensions may be specified as described in
Section~B.1.e.  In either case, a different value of K11 must be used for
each different abscissa of a singularity or discontinuity.  However if
several dimensions happen to have singularities or discontinuities at the
same abscissa, the same value of K11 can be used for all of them.  The
sign of K11 affects the internal transformations made to cope with the
singularity as described in Section~B.3 of Chapter~13.1.

\item[12] (Argument K12) The errors in the lower and upper limits are
stored in WORK(K12) and WORK(K12+1) respectively prior to a
call to SINTOP.  The error in the lower limit $a_i$ is defined by $ \Sigma
\ |\partial a_i/\partial x_j|\ \epsilon \ x_j+\Sigma \ |\partial
a_i/\partial y_j|\ E(y_j)+\Sigma \|\partial a_i/\partial I_j|\ E_j$, where
$ x_j$ are variables of integration of outer integrals, $\epsilon $ is the
round-off level for the appropriate precision, $y_j$ are arguments of
$a_i$ that are neither variables of integration of outer integrals nor
integrals, E($y_j)$ is the error in $y_j$, $I_j$ are integrals that are
arguments of $ a_i$, and $E_j$ is the error in $I_j$.  The error in the
integral due to error in the limit is the error in the limit times the
integrand evaluated near the limit.  The error in the upper limit is
calculated similarly.  If this option is not selected, or K12 $=0$, then
the limits will be assumed to be exact.

\item[13]  (Argument K13) In the IOPT vector passed to SINTM, K13 may be
used to notify SINTM of nonstandard changes in the dimensionality of
integration. If option~13 is not selected, IOPT(1) may be used for this
purpose. But notice that reporting singularities might also use IOPT(1).
\end{itemize}

\subsubsection{Changing the Selection of Some Options During the Computation
\label{ChangeSel}}

The method of changing the selection of options 1, 2, 6, 7, 9, 12 and~13
during the integration is described in Chapter~13.1, Section~B.4.

\subsubsection{Modifications for Double Precision Usage\label{DPuse}}

For double precision usage, change all REAL type statements to DOUBLE
PRECISION and change the prefix of all subroutine names from SINT to DINT.

\subsection{Examples and Remarks}

See DRSINTMF and ODSINTMF, or DRSINTMR and ODSINTMR for an example of the
use of SINTM to compute%
\begin{equation*}
\int_0^\pi \int_0^y\frac{x\cos y}{x^2+y^2}\,dx\,dy=0.
\end{equation*}
The difference between DRSINTMF and DRSINTMR is that DRSINTMF uses forward
communication, while DRSINTMR uses reverse communication.

DRSINTMF and DRSINTMR demonstrate the use of functional transformation of
the inner integrand to reduce the cost of calculating the integral. The
factor $\cos y$ in the integrand does not depend on the inner variable of
integration. In this context, $f_1 = x\ / (x^2 + y^2)$, and $f_2 = I_1 \cos
\ y$. Special care is taken when $y$ is near zero, as the denominator of
$f_1 $ might underflow.

The above integral is really the product of two one-dimensional integrals
(let $z = x/y)$. This situation is not uncommon. Since the cost of
estimating multi-dimensional integrals by nested estimation over one
dimension is exponential in the number of dimensions, the possibility of
this situation should always be considered.

\subsection{Functional Description}

The integral over several dimensions is computed by repeated integration
over one dimension, as shown in Section~A. The integral over one dimension
is estimated using the subprograms described in Chapter~13.1. See Section~D
of Chapter~13.1 for a functional description.

Extensive test results are given in \cite{Krogh:1978:PTR}.  Since there
are no other multi-dimensional quadrature subprograms extant that provide
the functionality of SINTM and DINTM, it is not practical to carry out
extensive comparative tests.  Since SINT1 and DINT1 are, however, more
reliable and require fewer function values than other one-dimensional
quadrature routines, it is to be expected that SINTM and DINTM are more
reliable and require fewer function values than other subprograms that
evaluate multi-dimensional integrals by repeated integration over one
dimension.

\bibliography{math77}
\bibliographystyle{math77}

\subsection{Error Procedures and Restrictions}

Error messages are printed using the extended error message processor
described in Chapter~19.3. If an error does not result in a ``stop,'' error
signals are returned to the user by values of the status flag in IOPT(1).\
Printing, when enabled by Option~2, is executed in subroutines SINTO for
single precision and DINTO for double precision. Both of these programs also
use the message processor described in Chapter~19.3. One can change the
action on errors and parameters affecting the output of messages, by calling
the message/error routine MESS before calling this routine.

\subsection{Supporting Information}

The source language for these subroutines is ANSI Fortran 77.

Common blocks referenced: SINTC and SINTEC in the single precision
versions, and DINTC and DINTEC in the double precision versions.
SINTC and DINTC are written using several COMMON statements, for
maintenance purposes. This usage conforms to the ANSI Fortran-77
standard, but at least one compiler interprets it improperly. If you
experience inscrutable errors, try re-writing the COMMON statements
for SINTC (or DINTC) into a single statement.

\begin{tabular}{@{\bf}l@{\hspace{5pt}}l}
\bf Entry & \hspace{.35in} {\bf Required Files}\vspace{2pt} \\
DINTM & \parbox[t]{2.7in}{\hyphenpenalty10000 \raggedright
AMACH, DCOPY, DINTA, DINTDL, DINTDU, DINTF, DINTM, DINTMA, DINTNS,
DINTO, DINTOP, DINTSM, DMESS, MESS\rule[-5pt]{0pt}{8pt}}\\
DINTMA & \parbox[t]{2.7in}{\hyphenpenalty10000 \raggedright
AMACH, DCOPY, DINTA, DINTDL, DINTDU, DINTF, DINTMA, DINTNS, DINTO,
DINTSM, DMESS, MESS\rule[-5pt]{0pt}{8pt}}\\
SINTM & \parbox[t]{2.7in}{\hyphenpenalty10000 \raggedright
AMACH, MESS, SCOPY, SINTA, SINTDL, SINTDU, SINTF, SINTM, SINTMA,
SINTNS, SINTO, SINTOP, SINTSM, SMESS\rule[-5pt]{0pt}{8pt}}\\
SINTMA & \parbox[t]{2.7in}{\hyphenpenalty10000 \raggedright
AMACH, MESS, SCOPY, SINTA, SINTDL, SINTDU, SINTF, SINTMA, SINTNS,
SINTO, SINTSM, SMESS}\\
\end{tabular}

Designed by Fred T.\ Krogh and W.\ Van Snyder, JPL, 1977. Programmed by W.\
Van Snyder, 1977. Revised by W. Van Snyder, 1986, 1988.

Error/Message handling revised by F. T. Krogh, March~1992.

Two demonstration drivers are shown below, with the output they produced
when run on an IBM PC/AT with an 80287 floating point coprocessor. The first
demonstrates forward communication usage; the second demonstrates reverse
communication usage.

\begcodenp
\lstset{language=[77]Fortran,showstringspaces=false}
\lstset{xleftmargin=.8in}

\centerline{\bf \large DRSINTMF}\vspace{10pt}
\lstinputlisting{\codeloc{sintmf}}

\vspace{20pt}\centerline{\bf \large ODSINTMF}\vspace{-5pt}
\lstset{language={}}
\lstinputlisting{\outputloc{sintmf}}
\bigskip\

\centerline{\bf \large DRSINTMR}\vspace{10pt}
\lstinputlisting{\codeloc{sintmr}}

\vspace{30pt}\centerline{\bf \large ODSINTMR}\vspace{-5pt}
\lstset{language={}}
\lstinputlisting{\outputloc{sintmr}}
\end{document}