Polygon zkEVM可验证计算简单状态机示例

Next we show the arithmetization process of a more complex but yet simple state machine. Unlike the Fibonacci state machine, our simple state machine transitions from one state to the next in response to certain external instructions. See Figure 1 below, for such a state machine, with registries $\text{A}$ and $\text{B}$, and a state $({\text{A}}^{\text{i}},{\text{B}}^{\text{i}})$ that changes to another state $({\text{A}}^{\text{i+2}},{\text{B}}^{\text{i+2}})$ in accordance to two instructions, ${\text{Instruction}}^{\text{i}}$ and ${\text{Instruction}}^{\text{i+1}}$.

Figure 1: A State Machine Receiving Instructions

In the context of the zkProver, these instructions are written as zk-Assembly (zkASM) codes, and stored in a ROM in JSON-format.

State Machine Instructions

Suppose the above simple state machine receives an input, together with the following execution instruction, ${\text{Instruction}}^{\text{1}}$, written in Assembly.

Table 1: Instruction^1 written in zk-Assembly

$$\begin{array}{lc}& {\text{Instruction}}^{\text{1}}\\ \text{line 1}& \$\{\mathtt{getInput}()\}=>\mathtt{A}\\ \text{line 2}& 3=>\mathtt{B}\\ \text{line 3}& :\mathtt{ADD}\\ \text{line 4}& 0=>\mathtt{A},\mathtt{B}\end{array}$$

In accordance with each line of ${\text{Instruction}}^{\text{1}}$, the state machine executor must;

• $\text{line 1}$: Get a free input value and move it into register $\text{A}$.
• $\text{line 2}$: Move the value $3$ into register $\mathtt{B}$.
• $\text{line 3}$: Compute the sum of registry values $\mathtt{A}$ and $\mathtt{B}$, and save the output into register $\mathtt{A}$.
• $\text{line 4}$: Set the registers $\mathtt{A}$ and $\mathtt{B}$ to the value $0$.

For a free input value of $7$, the corresponding state transitions can be recorded in a table as follows;

Table 2: Record of all State Changes

$$\begin{array}{lcccccc}& {\text{Instruction}}^{\text{1}}& \mathtt{free}& \mathtt{A}& {\mathtt{A}}^{\prime }& \mathtt{B}& {\mathtt{B}}^{\prime }\\ \text{line 1}& \$\{\mathtt{getInput}()\}=>\mathtt{A}& 7& 0& 7& 0& 0\\ \text{line 2}& 3=>\mathtt{B}& 0& 7& 7& 0& 3\\ \text{line 3}& :\mathtt{ADD}& 0& 7& 10& 3& 3\\ \text{line 4}& 0=>\mathtt{A},\mathtt{B}& 0& 10& 0& 3& 0\end{array}$$

Note that ${\mathtt{A}}^{\prime }$ and ${\mathtt{B}}^{\prime }$ denote the next state of the registers $\mathtt{A}$ and $\mathtt{B}$, respectively.

Observe also that, each line of ${\text{Instruction}}^{\text{1}}$ does not always affect all register values. Since every register is initialised to $0$ at the start, the state transitions are such that,

• $\text{line 1}$ only affects two registers; $\mathtt{free}$ and ${\mathtt{A}}^{\prime }$.
• $\text{line 2}$ affects the register ${\mathtt{B}}^{\prime }$ alone. Any other state change is due to the rules and the logic of the state machine (i.e., changes in registers; $\mathtt{free}$ and $\mathtt{A}$).
• $\text{line 3}$ affects the register ${\mathtt{A}}^{\prime }$ alone. Again, the state change in register $\mathtt{B}$ is due to the state machine’s rules and logic.
• $\text{line 4}$ affects only two registers; ${\mathtt{A}}^{\prime }$ and ${\mathtt{B}}^{\prime }$. The state change in register $\mathtt{A}$ is also due to the rules and the logic of the state machine.

Computational Trace

Recall that the intention with developing these state machines is not only to carry out computations, but to also ensure that correctness of these computations is verifiable. In addition, verification must be achievable even by users with modest computer power. That said, keeping record of computations, as seen in Table 2 above, is not preferable for verification purposes, because the registry values can be very large for some state machines. And thus, defeating the ultimate purpose and aim of our rollup.

One therefore needs a way to keep track of all the computations and their correct execution, without requiring excessive memory. This is achieved by utilising the computational trace.

For our verification purposes, the computational trace does not capture the actual state values of each state transition, but uses selectors and setters to keep record of whether registry values have been altered (during each state transition) in a way that tallies with the received instructions.

Like switches that can either be ON or OFF, selectors and setters can also be either $1$ or $0$.

Rule for the $\text{inFree}$ selector: Record $\text{inFree}$ as $1$ only if the value of the register $\text{free}$ is non-zero.

Rule for selectors $\{\text{setX}\}$: Each selector $\text{setX}$ is recorded;

• As the value $1$, if the value of the corresponding registry $\text{X}$ was involved in (or contributed to) the computation,
• Otherwise, $\text{selX}$ is recorded as the value $0$.

Rule for setters $\{\text{setY}\}$: Each setter $\text{setY}$ is recorded;

• As the value $1$, if the corresponding registry value $\text{Y}$ was altered by the instruction,
• Or, as the value $0$, otherwise.

The computational trace therefore consists mostly of bits, instead of large registry values.

In the zkEVM context, the computational trace is stored as a lookup table in the ROM of the relevant state machine.

Example (Computational Trace)

Take as an example, ${\text{Instruction}}^{\text{1}}$ above. Set selectors $\text{selA}$, $\text{selB}$ and $\text{inFree}$ for the registers $\text{A}$, $\text{B}$ and $\text{free}$, respectively. And, setters $\text{setA}$ and $\text{setB}$ for the registers ${\mathtt{A}}^{\prime }$ and ${\mathtt{B}}^{\prime }$, respectively.

As discussed above;

• The register values, $\mathtt{free}$ and ${\mathtt{A}}^{\prime }$, were changed in $\text{line 1}$. Therefore, only selector $\text{inFree}$ and setter $\text{setA}$ are recorded as $1$.
• The register values ${\mathtt{B}}^{\prime }$, $\mathtt{free}$ and $\mathtt{A}$ were changed in $\text{line 2}$. But, only setter $\text{setB}$ is recorded as $1$ because it is the only change the instruction effected.
• The register values ${\mathtt{A}}^{\prime }$ and $\mathtt{B}$ were changed in $\text{line 3}$. So, setter $\text{setA}$ is recorded as $1$. But since register values $\text{A}$ and $\text{B}$ were involved in the computation in $\text{line 3}$, they are also recorded as $1$.
• The register values ${\mathtt{A}}^{\prime }$, ${\mathtt{B}}^{\prime }$ and $\mathtt{A}$ were changed in $\text{line 4}$. Consequently, only setters $\text{setA}$ and $\text{setB}$ are recorded as $1$.

The computational trace after executing ${\text{Instruction}}^{\text{1}}$ is as reflected in Table 3 below.

Table 3: Computational Trace for Instruction^1

$$\begin{array}{lccccccccccc}& {\text{Instruction}}^{\text{1}}& \mathtt{free}& \text{setB}& \text{setA}& \text{inFree}& \text{selB}& \text{selA}& \mathtt{A}& {\mathtt{A}}^{\prime }& \mathtt{B}& {\mathtt{B}}^{\prime }\\ \text{line 1}& \$\{\mathtt{getInput}()\}=>\mathtt{A}& 7& 0& 1& 1& 0& 0& 0& 7& 0& 0\\ \text{line 2}& 3=>\mathtt{B}& 0& 1& 0& 0& 0& 0& 7& 7& 0& 3\\ \text{line 3}& :\mathtt{ADD}& 0& 0& 1& 0& 1& 1& 7& 10& 3& 3\\ \text{line 4}& 0=>\mathtt{A},\mathtt{B}& 0& 1& 1& 0& 0& 0& 10& 0& 3& 0\end{array}$$

Arithmetic Constraints

Next we create a proper set of arithmetic constraints required in proving correctness of execution. Similar to the Fibonacci SM, where each state had to conform to polynomial identities and each polynomial identity was nothing but an algebraic relation between two consecutive states, our executor SM also needs such algebraic relations. These algebraic relations are also called arithmetic constraints.

In order to fully express the relations between the next values of registries $\text{A}$ and $\text{B}$ as a linear combination of the current registry values, auxiliary registers and selectors need to be added.

This is shown in Figure 2 below, as an algebraic processor of sorts.

Figure 2: The State Machine as an Algebraic Processor

The notation used in Figure 2 is as follows,

a) ${\mathtt{inFree}}^i\in \{0,1\}$ indicates whether $\mathtt{fre}{\mathtt{e}}^{\mathtt{i}}$ is included in the linear combination or not.

b) ${\mathtt{setX}}^i\in \{0,1\}$ indicates whether the result of the linear combination was moved into ${\mathtt{X}}^{\mathtt{i}+1}$ or not.

c) ${\mathtt{free}}^i$ carries inputs freely chosen in order to execute the program.

d) ${\mathtt{const}}^i$ carries fixed values moved into specified registers as per instructions received.
  \text{ }  

Introducing new auxiliary registers results in the following extended table.

$$\begin{array}{lc}& {\text{Instruction}}^{\text{1}}\\ \text{line 1}& \$\{\mathtt{getInput}()\}=>\mathtt{A}\\ \text{line 2}& 3=>\mathtt{B}\\ \text{line 3}& :\mathtt{ADD}\\ \text{line 4}& 0=>\mathtt{A},\mathtt{B}\end{array}\begin{array}{ccccccc}\text{free}& \text{const}& \text{setB}& \text{setA}& \text{inFree}& \text{selB}& \text{selA}\\ 7& 0& 0& 1& 1& 0& 0\\ 0& 3& 1& 0& 0& 0& 0\\ 0& 0& 0& 1& 0& 1& 1\\ 0& 0& 1& 1& 0& 0& 0\end{array}\begin{array}{cccc}\mathtt{A}& {\mathtt{A}}^{\prime }& \mathtt{B}& {\mathtt{B}}^{\prime }\\ 0& 7& 0& 0\\ 7& 7& 0& 3\\ 7& 10& 3& 3\\ 10& 0& 3& 0\end{array}$$

Henceforth, the relations between the states of the registries can be expressed algebraically as follows:

$$\begin{array}{rl}& {\mathtt{A}}^{i+1}={\mathtt{A}}^i+{\mathtt{setA}}^i\cdot ({\mathtt{selA}}^i\cdot {\mathtt{A}}^i+{\mathtt{selB}}^i\cdot {\mathtt{B}}^{\mathtt{i}}+{\mathtt{inFree}}^i\cdot {\mathtt{free}}^i+{\mathtt{const}}^i-{\mathtt{A}}^i),\\ & {\mathtt{B}}^{i+1}={\mathtt{B}}^i+{\mathtt{setB}}^i\cdot ({\mathtt{selA}}^i\cdot {\mathtt{A}}^i+{\mathtt{selB}}^i\cdot {\mathtt{B}}^i+{\mathtt{inFree}}^i\cdot {\mathtt{free}}^i+{\mathtt{const}}^i-{\mathtt{B}}^i).\end{array}$$

Polynomial Constraints

Let’s represent the states of these registries for four steps as polynomials $\mathtt{A},\mathtt{B}\in {\mathbb{Z}}_p[x]$ evaluated on the subgroup $H=\{\omega ,{\omega }^2,{\omega }^3,{\omega }^4=1\}$, in order to produce a cyclic relation:

$$\begin{array}{rl}& \mathtt{A}(x\omega )=\mathtt{A}(x)+\mathtt{setA}(x)\cdot (\mathtt{selA}(x)\cdot \mathtt{A}(x)+\mathtt{selB}(x)\cdot \mathtt{B}(x)+\mathtt{inFree}(x)\cdot \mathtt{free}(x)+\mathtt{const}(x)-\mathtt{A}(x)),\\ & \mathtt{B}(x\omega )=\mathtt{B}(x)+\mathtt{setB}(x)\cdot (\mathtt{selA}(x)\cdot \mathtt{A}(x)+\mathtt{selB}(x)\cdot \mathtt{B}(x)+\mathtt{inFree}(x)\cdot \mathtt{free}(x)+\mathtt{const}(x)-\mathtt{B}(x)).\end{array}$$

Observe that the program is completely described by the constant (and public) polynomials $\mathtt{selA}(\mathtt{x})$, $\mathtt{selB}(\mathtt{x})$, $\mathtt{setA}(\mathtt{x})$, $\mathtt{setB}(\mathtt{x})$, $\mathtt{inFree}(\mathtt{x})$ and $\mathtt{const}(\mathtt{x})$.

The polynomial $\mathtt{free}(x)$ can be public or committed and by changing this polynomial, we can proof different executions for different initial conditions for the same “program”.

In our previous program, we can provide a result of the execution by giving $A({\omega }^4)$.

Notice that the last instruction resets the states’ values and “glues” the last instruction with the first one, achieving a cycle.

Programs with Conditional Jumps

We are going to add the instruction $\mathtt{JMPZ}$ to our assembly. $\mathtt{JMPZ}$ jumps to a specified position in the program if the preceding state of the register $\mathtt{A}$ is zero.

In the next program, $\mathtt{JMPZ}$ will jump to position $5$ if the previous result of $\mathtt{A}+\mathtt{B}$ (which is actually stored in the register $\mathtt{A}$) is $0$:

$$\begin{array}{cl}\text{Position}& \text{Instruction}\\ 0& \$\{\mathtt{getInput}()\}=>\mathtt{A}\\ 1& -3=>\mathtt{B}\\ 2& :\mathtt{ADD}\\ 3& :\mathtt{JMPZ}(5)\\ 4& :\mathtt{ADD}\\ 5& 0=>\mathtt{A},\mathtt{B}\end{array}$$

Note: We will discuss later on how to introduce negative values into our program.

In programs with conditional jumps, our previous model will not work, because the flow of the program may vary depending on the values of the input.

As it can be seen next, with conditional jumps, the length of the execution trace is not constant (it depends on the free input):

$$\begin{array}{lccccc}\text{Instruction}& \mathtt{free}& \mathtt{A}& {\mathtt{A}}^{\prime }& \mathtt{B}& {\mathtt{B}}^{\prime }\\ \$\{\mathtt{getInput}()\}=>\mathtt{A}& 7& 0& 7& 0& 0\\ -3=>\mathtt{B}& 0& 7& 7& 0& -3\\ :\mathtt{ADD}& 0& 7& 4& -3& -3\\ :\mathtt{JMPZ}(5)& 0& 4& 4& -3& -3\\ :\mathtt{ADD}& 0& 4& 1& -3& -3\\ 0=>\mathtt{A},\mathtt{B}& 0& 1& 0& -3& 0\end{array}$$

$$\begin{array}{lccccc}\text{Instruction}& \mathtt{free}& \mathtt{A}& {\mathtt{A}}^{\prime }& \mathtt{B}& {\mathtt{B}}^{\prime }\\ \$\{\mathtt{getInput}()\}=>\mathtt{A}& 3& 0& 3& 0& 0\\ -3=>\mathtt{B}& 0& 3& 3& 0& -3\\ :\mathtt{ADD}& 0& 3& 0& -3& -3\\ :\mathtt{JMPZ}(5)& 0& 0& 0& -3& -3\\ 0=>\mathtt{A},\mathtt{B}& 0& 0& 0& -3& 0\end{array}$$

The first execution is done in 6 steps, while the second is in 5 steps.

Managing Conditional Jumps

Now, let us introduce a new model to manage a program that contains conditional jumps.

To do this, we need to add the Program Counter (PC). The $\mathtt{PC}$ is a special registry that contains the position of the instruction in the program being executed.

We use ${\text{op}}^i$ as a shorthand for the linear combination of our state machine to simplify the forthcoming constraints:
$${\mathtt{op}}^i:={\mathtt{selA}}^i\cdot {\mathtt{A}}^i+{\mathtt{selB}}^i\cdot {\mathtt{B}}^{\mathtt{i}}+{\mathtt{inFree}}^i\cdot {\mathtt{free}}^i+{\mathtt{const}}^i.$$

The $\mathtt{JMPZ}$ instruction will jump to the instruction ${\text{addr}}^i$ (specified by the $\mathtt{JMPZ}$ instruction) if ${\text{op}}^i$ is zero. Let us first develop some procedure to check if our operation is or not zero in ${\mathbb{Z}}_p$:

To check that a number in the field ${\mathbb{Z}}_p$ is zero, we use the fact that a number $a$ has a multiplicative inverse $a^{-1}$ if and only if $a\ne 0$.

Using this fact, we use the following definition and constraint to do the $\mathtt{isZero}$ check:

$$\begin{array}{rl}& {\mathtt{isZero}}^i:=1-{\mathtt{op}}^i\cdot ({\mathtt{op}}^i{)}^{-1},\\ & {\mathtt{isZero}}^i\cdot {\mathtt{op}}^i=0.\end{array}$$

We can proof that the previous equations describe the desired check by case examination where $a\ne 0$
and $\alpha ,\beta \in {\mathbb{Z}}_p$:

${\mathtt{op}}^i=0,({\mathtt{op}}^i{)}^{-1}=\alpha ,{\mathtt{isZero}}^i=1$ passes the definition and constraint,

${\mathtt{op}}^i=a,({\mathtt{op}}^i{)}^{-1}=a^{-1},{\mathtt{isZero}}^i=0$ passes the definition and constraint.

${\mathtt{op}}^i=0,({\mathtt{op}}^i{)}^{-1}=\alpha ,{\mathtt{isZero}}^i\ne 1$ does not pass the definition of $\mathtt{isZero}$.

${\mathtt{op}}^i=a,({\mathtt{op}}^i{)}^{-1}=\beta ,{\mathtt{isZero}}^i\ne 0$ does not pass the definition and constraint,
either you consider $\beta =0$, $\beta =a^{-1}$ or $\beta \ne a^{-1}$.

We can mix the two equations into just one constraint:
$${\mathtt{isZero}}^i\cdot {\mathtt{op}}^i=0,{\mathtt{isZero}}^i=1-{\mathtt{op}}^i\cdot ({\mathtt{op}}^i{)}^{-1}\to (1-{\mathtt{op}}^i\cdot ({\mathtt{op}}^i{)}^{-1})\cdot {\mathtt{op}}^i=0.$$

Let us introduce the following machinery to our setup in order to introduce jumps:

We add a selector ${\text{jmpz}}^i\in \{0,1\}$ to our state machine to code the $\mathtt{JMPZ}$ instruction and express the behaviour of the PC. Then, the set of constraints is the following:

$$\begin{array}{rl}& {\mathtt{op}}^i:={\mathtt{selA}}^i\cdot {\mathtt{A}}^i+{\mathtt{selB}}^i\cdot {\mathtt{B}}^{\mathtt{i}}+{\mathtt{inFree}}^i\cdot {\mathtt{free}}^i+{\mathtt{const}}^i,\\ & {\mathtt{PC}}^{i+1}={\mathtt{PC}}^i+1+{\mathtt{jmpz}}^i\cdot (1-{\mathtt{op}}^i\cdot ({\mathtt{op}}^i{)}^{-1})\cdot ({\mathtt{addr}}^i-{\mathtt{PC}}^i-1),\\ & (1-{\mathtt{op}}^i\cdot ({\mathtt{op}}^i{)}^{-1})\cdot {\mathtt{op}}^i=0.\end{array}$$

Observe that:

1. If ${\mathtt{op}}^i\ne 0$, then $(1-{\mathtt{op}}^i\cdot ({\mathtt{op}}^i{)}^{-1})=0$ and hence ${\mathtt{PC}}^{i+1}={\mathtt{PC}}^i+1$;
2. If ${\mathtt{op}}^i=0$, then $(1-{\mathtt{op}}^i\cdot ({\mathtt{op}}^i{)}^{-1})=1$ and hence ${\mathtt{PC}}^{i+1}={\mathtt{PC}}^i+1+{\mathtt{addr}}^i-{\mathtt{PC}}^i-1={\mathtt{addr}}^i$.

This is exactly the wanted behaviour.

Next, we show the execution traces for the free inputs 7 and 3 respectively:

$$\begin{array}{l}\text{Instruction}\\ \$\{\mathtt{getInput}()\}=>\mathtt{A}\\ -3=>\mathtt{B}\\ :\mathtt{ADD}\\ :\mathtt{JMPZ}(5)\\ :\mathtt{ADD}\\ 0=>\mathtt{A},\mathtt{B},\mathtt{PC}\end{array}\begin{array}{ccccccccccc}\text{free}& \text{const}& \text{addr}& \text{jmpz}& \text{setB}& \text{setA}& \text{inFree}& \text{selB}& \text{selA}& \text{op}& \text{invOp}\\ 7& 0& 0& 0& 0& 1& 1& 0& 0& 7& 7^{-1}\\ 0& -3& 0& 0& 1& 0& 0& 0& 0& -3& (-3{)}^{-1}\\ 0& 0& 0& 0& 0& 1& 0& 1& 1& 4& 4^{-1}\\ 0& 0& 5& 1& 0& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 1& 0& 1& 1& 1& 1\\ 0& 0& 0& 1& 1& 1& 0& 0& 0& 0& 0\end{array}\begin{array}{cccccc}\mathtt{PC}& \mathtt{P}{\mathtt{C}}^{\prime }& \mathtt{A}& {\mathtt{A}}^{\prime }& \mathtt{B}& {\mathtt{B}}^{\prime }\\ 0& 1& 0& 7& 0& 0\\ 1& 2& 7& 7& 0& -3\\ 2& 3& 7& 4& -3& -3\\ 3& 4& 4& 4& -3& -3\\ 4& 5& 4& 1& -3& -3\\ 5& 0& 1& 0& -3& 0\end{array}$$

$$\begin{array}{l}\text{Instruction}\\ \$\{\mathtt{getInput}()\}=>\mathtt{A}\\ -3=>\mathtt{B}\\ :\mathtt{ADD}\\ :\mathtt{JMPZ}(5)\\ 0=>\mathtt{A},\mathtt{B}\end{array}\begin{array}{ccccccccccc}\text{free}& \text{const}& \text{addr}& \text{jmpz}& \text{setB}& \text{setA}& \text{inFree}& \text{selB}& \text{selA}& \text{op}& \text{invOp}\\ 3& 0& 0& 0& 0& 1& 1& 0& 0& 3& 3^{-1}\\ 0& -3& 0& 0& 1& 0& 0& 0& 0& -3& (-3{)}^{-1}\\ 0& 0& 0& 0& 0& 1& 0& 1& 1& 0& \alpha \\ 0& 0& 5& 1& 0& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 1& 1& 1& 0& 0& 0& 0& 0\end{array}\begin{array}{cccccc}\mathtt{PC}& \mathtt{P}{\mathtt{C}}^{\prime }& \mathtt{A}& {\mathtt{A}}^{\prime }& \mathtt{B}& {\mathtt{B}}^{\prime }\\ 0& 1& 0& 3& 0& 0\\ 1& 2& 3& 3& 0& -3\\ 2& 3& 3& 0& -3& -3\\ 3& 5& 3& 0& -3& -3\\ 5& 0& 0& 0& -3& 0\end{array}$$

Note that we use $\mathtt{invOp}$ for the column containing the inverses of $\mathtt{op}$.

Note also that the $\mathtt{PC}$ turns to be an important registry when jumps are included in the set of possible instructions because jumps can modify the sequence of instructions that is executed also known as “the trace”.

Now, our polynomials are definitely not preprocessed, this is because the values of the table will not only depend on the program, but also on the free input values. Hence, we need to ensure that we are verifying the correct program.

Proving the Execution of the “Correct Program”

Up to now, we can prove that each instruction is correctly executed, but, how do we prove that we are executing the correct set of instructions, that is to say, that we are executing the “correct program”?
The solution seems obvious: Check that every executed instruction is some instruction in the program,
but how do we do this in a succinct manner?

To do so, we have to provide a codification for each instruction and then we will check that the codification of the execution’s instructions is included in the codification of the program’s instructions.

Let’s begin showing how to encode the constant values of our instructions. As a particular example, consider that we want to use signed integers of 4 bits (in the real machine, we will use an analogous 32 bits codification).
The four bit codification is shown next:

$$\begin{array}{ccccccccccccc}-8& -7& -6& ...& -2& -1& 0& 1& 2& ...& 6& 7& 8\\ 1000& 1001& 1010& ...& 1110& 1111& 0000& 0001& 0010& ...& 0110& 0111& 1000\end{array}$$

Notice that with this arithmetic $8=-8$, which is a weird case that we discard, using only values from -7 to 7.
Then, we encode these values in elements of the field ${\mathbb{Z}}_p$:

$$\begin{array}{ccccccccccc}-7& -6& ...& -2& -1& 0& 1& 2& ...& 6& 7\\ p-7& p-6& ...& p-2& p-1& 0& 1& 2& ...& 6& 7\end{array}$$

So, we have to enforce that $\mathsf{const}(x)\in \{p-7,p-6,...,p-2,p-1,0,1,2,...,6,7\}$.

We enforce the previous condition with the following equivalent inclusion:

$$\mathsf{const}(x)+7\in \{0,1,2,...,14\}$$

Hence, we will use $\mathsf{const}(x)+7$ in base $2$ instead of $\mathsf{const}(x)$ to encode our instruction, just to avoid the sum.

Let’s now explain how to encode every distinct instruction to be executed by the program:

$$\begin{array}{c}\mathbf{Instruction}\\ \$\{\mathtt{getInput}()\}=>\mathtt{A}\\ -3=>\mathtt{B}\\ :\mathtt{ADD}\\ :\mathtt{JMPZ}(5)\\ :\mathtt{ADD}\\ 0=>\mathtt{A},\mathtt{B},\mathtt{PC}\end{array}\begin{array}{ccccccccc}\text{const+7}& \text{addr}& \text{jmpz}& \text{setB}& \text{setA}& \text{inFree}& \text{selB}& \text{selA}& \text{instruction}\\ 7& 0& 0& 0& 1& 1& 0& 0& \mathrm{0111.0000.001100}\\ 4& 0& 0& 1& 0& 0& 0& 0& \mathrm{0100.0000.010000}\\ 7& 0& 0& 0& 1& 0& 1& 1& \mathrm{0111.0000.001011}\\ 7& 5& 1& 0& 0& 0& 0& 0& \mathrm{0111.0101.100000}\\ 7& 0& 0& 0& 1& 0& 1& 1& \mathrm{0111.0000.001011}\\ 7& 0& 1& 1& 1& 0& 0& 0& \mathrm{0111.0000.111000}\end{array}$$

Observe that we have codified the instruction using the following rule:
$${\text{instruction}}^i:=2^{10}\cdot ({\text{const}}^i+7)+2^6\cdot {\text{addr}}^i+2^5\cdot {\text{jmpz}}^i+2^4\cdot {\text{setB}}^i+2^3\cdot {\text{setA}}^i+2^2\cdot {\text{inFree}}^i+2\cdot {\text{selB}}^i+{\text{selA}}^i.$$

That is, we are codifying it as the concatenated base $2$ integer of all the values (in the order of appearance on the table).

Note that additionally, we will need to check that the selectors are binary and that $\text{addr}$ is composed of $4$ bits, i.e., ${\text{addr}}^i\in \{0,1,\dots ,15\}$

Also observe that, when ${\text{const}}^i+7=7$, this means that ${\text{const}}^i=0$, so the constant is not used in those cases.

Now, to prove the program, every instruction will be uniquely identified by its code and position in the program (we also use 4 bits in this example for the position).

We define the $\mathtt{ROM}$ of the program as the sum between every instruction and the position in which it is defined:
$${\text{ROM}}^i:=2^{14}\cdot {\text{position}}^i+{\text{instruction}}^i.$$

Observe that the $\mathtt{ROM}$ uniquely identifies the program we want to verify and it is independent of the different possible executions.

The resulting $\mathtt{ROM}$ of our program is the following:

$$\begin{array}{cc}\text{position}& \mathbf{Instruction}\\ 0& \$\{\mathtt{getInput}()\}=>\mathtt{A}\\ 1& -3=>\mathtt{B}\\ 2& :\mathtt{ADD}\\ 3& :\mathtt{JMPZ}(5)\\ 4& :\mathtt{ADD}\\ 5& 0=>\mathtt{A},\mathtt{B},\mathtt{PC}\end{array}\begin{array}{c}\text{ROM}\\ \mathrm{0000.0111.0000.001100}\\ \mathrm{0001.0100.0000.010000}\\ \mathrm{0010.0111.0000.001011}\\ \mathrm{0011.0111.0101.100000}\\ \mathrm{0100.0111.0000.001011}\\ \mathrm{0101.0111.0000.111000}\end{array}$$

We will encode the program trace using the PC:

$$\begin{array}{c}\mathtt{PC}\\ 0\\ 1\\ 2\\ 3\\ 4\\ 5\end{array}\begin{array}{cc}\mathtt{position}& \mathbf{Instruction}\\ 0& \$\{\mathtt{getInput}()\}=>\mathtt{A}\\ 1& -3=>\mathtt{B}\\ 2& :\mathtt{ADD}\\ 3& :\mathtt{JMPZ}(5)\\ 4& :\mathtt{ADD}\\ 5& 0=>\mathtt{A},\mathtt{B},\mathtt{PC}\end{array}\begin{array}{cccccccc}\text{const+7}& \text{addr}& \text{jmpz}& \text{setB}& \text{setA}& \text{inFree}& \text{selB}& \text{selA}\\ 7& 0& 0& 0& 1& 1& 0& 0\\ 4& 0& 0& 1& 0& 0& 0& 0\\ 7& 0& 0& 0& 1& 0& 1& 1\\ 7& 5& 1& 0& 0& 0& 0& 0\\ 7& 0& 0& 0& 1& 0& 1& 1\\ 7& 0& 1& 1& 1& 0& 0& 0\end{array}\begin{array}{c}\mathtt{insTrace}\\ \mathrm{0000.0111.0000.001100}\\ \mathrm{0001.0100.0000.010000}\\ \mathrm{0010.0111.0000.001011}\\ \mathrm{0011.0111.0101.100000}\\ \mathrm{0100.0111.0000.001011}\\ \mathrm{0101.0111.0000.111000}\end{array}$$

$$\begin{array}{c}\mathtt{PC}\\ 0\\ 1\\ 2\\ 3\\ 5\end{array}\begin{array}{cc}\mathtt{position}& \mathbf{Instruction}\\ 0& \$\{\mathtt{getInput}()\}=>\mathtt{A}\\ 1& -3=>\mathtt{B}\\ 2& :\mathtt{ADD}\\ 3& :\mathtt{JMPZ}(5)\\ 4& 0=>\mathtt{A},\mathtt{B},\mathtt{PC}\end{array}\begin{array}{cccccccc}\text{const+7}& \text{addr}& \text{jmpz}& \text{setB}& \text{setA}& \text{inFree}& \text{selB}& \text{selA}\\ 7& 0& 0& 0& 1& 1& 0& 0\\ 4& 0& 0& 1& 0& 0& 0& 0\\ 7& 0& 0& 0& 1& 0& 1& 1\\ 7& 5& 1& 0& 0& 0& 0& 0\\ 7& 0& 1& 1& 1& 0& 0& 0\end{array}\begin{array}{c}\mathtt{insTrace}\\ \mathrm{0000.0111.0000.001100}\\ \mathrm{0001.0100.0000.010000}\\ \mathrm{0010.0111.0000.001011}\\ \mathrm{0011.0111.0101.100000}\\ \mathrm{0101.0111.0000.111000}\end{array}$$

Recall that our main question was: How do we actually check correctness in an efficient manner?

We can achieve it with the Plookup protocol. So, to check that the correct program is being executed, we simply have to use Plookup to determine if:

$$\mathsf{insTrace}(\mathsf{x})\subset \mathsf{ROM}(\mathsf{x})$$

In words, the trace being executed is an execution of the actual program if the instruction trace is contained in the ROM of the program.

Identities to Prove an Execution Trace

As a summary, we have seen that the following set of identities are used to define our program:

$$\begin{array}{rl}& \mathsf{A}(x\omega )=\mathsf{A}(x)+\mathsf{setA}(x)\cdot (\mathsf{op}(x)-\mathsf{A}(x)),\\ & \mathsf{B}(x\omega )=\mathsf{B}(x)+\mathsf{setB}(x)\cdot (\mathsf{op}(x)-\mathsf{B}(x)),\\ & \mathsf{PC}(x\omega )=\mathsf{PC}(x)+1+\mathsf{jmpz}(x)\cdot (1-\mathsf{op}(x)\cdot \mathsf{invOp}(x))\cdot (\mathsf{addr}(x)-\mathsf{PC}(x)-1),\\ & (1-\mathsf{op}(x)\cdot \mathsf{invOp}(x))\cdot \mathsf{op}(x)=0.\end{array}$$

With the following definition:
$$\mathsf{op}(x):=\mathsf{selA}(x)\cdot \mathsf{A}(x)+\mathsf{selB}(x)\cdot \mathsf{B}(x)+\mathsf{inFree}(x)\cdot \mathsf{free}(x)+\mathsf{const}(x).$$

Moreover, we should add the following Plookup checks:

$$\begin{array}{rl}& \text{const}(x)+7\subset \{0,1,\dots ,14\},\\ & \mathsf{addr}(x)\subset \{0,1,\dots ,15\},\\ & \mathsf{position}(x)\subset \{0,1,\dots ,15\},\\ & \mathsf{PC}(x)\subset \{0,1,\dots ,15\},\\ & \text{insTrace}(x)\subset \text{ROM}(x).\end{array}$$

With the following definitions:

$$\begin{array}{rl}& \text{instruction}(x):=2^{10}\cdot (\text{const}(x)+7)+2^6\cdot \text{addr}(x)+2^5\cdot \text{jmpz}(x)+2^4\cdot \text{setB}(x)+\\ & 2^3\cdot \text{setA}(x)+2^2\cdot \text{inFree}(x)+2\cdot \text{selB}(x)+\text{selA}(x),\\ & \text{ROM}(x):=2^{14}\cdot \text{position}(x)+\text{instruction}(x),\\ & \text{insTrace}(x):=2^{14}\cdot \text{PC}(x)+\text{instruction}(x).\end{array}$$

Finally, it should be checked that the whole set of selectors are, in fact, binary:

$$\begin{array}{rl}& \mathsf{selA}(x)\cdot (\mathsf{selA}(x)-1)=0,\mathsf{setA}(x)\cdot (\mathsf{setA}(x)-1)=0,\\ & \mathsf{selB}(x)\cdot (\mathsf{selB}(x)-1)=0,\mathsf{setB}(x)\cdot (\mathsf{setB}(x)-1)=0,\\ & \mathsf{inFree}(x)\cdot (\mathsf{inFree}(x)-1)=0,\mathsf{jmpz}(x)\cdot (\mathsf{jmpz}(x)-1)=0.\end{array}$$

Regarding the polynomials, in this state machine:

1. We have to commit $\text{inFree}(x),\text{selA}(x),\text{selB}(x),\text{setA}(x),\text{setB}(x)$ $\text{A}(x),\text{B}(x),\text{const}(x),$ $\text{jmpz}(x),$ $\text{invOp}(x)$, $\text{addr}(x)$, $\text{free}(x)$, $\text{position}(x)$ and $\text{PC}(x)$.

2. While the only constant (preprocessed) polynomial is $\text{ROM}(x)$.

参考资料

[1] Polygon zkEVM Simple State Machine

附录：Polygon Hermez 2.0 zkEVM系列博客

• ZK-Rollups工作原理
• Polygon zkEVM——Hermez 2.0简介
• Polygon zkEVM网络节点
• Polygon zkEVM 基本概念
• Polygon zkEVM Prover
• Polygon zkEVM工具——PIL和CIRCOM
• Polygon zkEVM节点代码解析
• Polygon zkEVM的pil-stark Fibonacci状态机初体验
• Polygon zkEVM的pil-stark Fibonacci状态机代码解析
• Polygon zkEVM PIL编译器——pilcom 代码解析
• Polygon zkEVM Arithmetic状态机
• Polygon zkEVM中的常量多项式
• Polygon zkEVM Binary状态机
• Polygon zkEVM Memory状态机
• Polygon zkEVM Memory Align状态机
• Polygon zkEVM zkASM编译器——zkasmcom
• Polygon zkEVM哈希状态机——Keccak-256和Poseidon
• Polygon zkEVM zkASM语法