能否在一行中实现多个selector？

[readygo67]

如下图所示，希望的约束是 s_add (advice[2] - a -b) + s_mul (advice[3] - ab) + s_sub(advice[4]-a+b) = 0.

执行下面代码的test_circuit，报告“thread 'tests::test_circuit' panicked at /xxx/halo2_proofs/src/plonk/circuit.rs:736:13:
attempted to use a simple selector in an addition”

不确定halo2是否支持这种写法。

use std::marker::PhantomData;

use group::ff::Field;
use halo2_proofs::{
    circuit::{AssignedCell, Chip, Layouter, Region, SimpleFloorPlanner, Value},
    plonk::{Advice, Circuit, Column, ConstraintSystem, Error, Fixed, Instance, Selector},
    poly::Rotation,
};

// ANCHOR: instructions
trait Instructions<F: Field>: Chip<F> {
    /// Variable representing a number.
    type Num;

    // /// Loads a number into the circuit as a private input.
    // /// load_private 需要layouter 中的assign_region, assign_table, constrain_instance
    fn load_private(&self, layouter: impl Layouter<F>, a: Value<F>, b:Value<F>) -> Result<(Self::Num, Self::Num), Error>;

    // /// Loads a number into the circuit as a fixed constant.
    // fn load_constant(&self, layouter: impl Layouter<F>, constant: F) -> Result<Self::Num, Error>;

    /// Returns `c = a + b`. 
    /// 非约束版本的数值计算。
    fn execute(
        &self,
        layouter: impl Layouter<F>,
        a: Self::Num,
        b: Self::Num,
    ) -> Result<(Self::Num, Self::Num, Self::Num), Error>;


    ///// Exposes a number as a public input to the circuit.
    // fn expose_public(
    //     &self,
    //     layouter: impl Layouter<F>,
    //     num: Self::Num,
    //     row: usize,
    // ) -> Result<(), Error>;
}
// ANCHOR_END: instructions

// ANCHOR: chip
/// The chip that will implement our instructions! Chips store their own
/// config, as well as type markers if necessary.
struct MultiOperationChip<F: Field>  {
    config: MultiOperationConfig, //MultiOperationConfig 说明需要多少个adive, instance 和Fixed 列
    _marker: PhantomData<F>,
}
// ANCHOR_END: chip

// ANCHOR: chip-config
/// Chip state is stored in a config struct. This is generated by the chip
/// during configuration, and then stored inside the chip.
#[derive(Clone, Debug)]
struct MultiOperationConfig {
    advices: [Column<Advice>; 5],   //a, b, a+b, a-b, a*b
    /// This is the public input (instance) column.
    instance: Column<Instance>,
    selectors: [Selector;3],
}

impl<F: Field> MultiOperationChip<F> {
    //construct 配置chip 的静态配置
    fn construct(config: <Self as Chip<F>>::Config) -> Self {  
        Self {
            config,
            _marker: PhantomData,
        }
    }

    //配置chip 
    fn configure(
        meta: &mut ConstraintSystem<F>,  //meta = arkworks中的cs
        advices: [Column<Advice>; 5],
        instance: Column<Instance>,
        selectors: [Selector;3],
        // constant: Column<Fixed>,
    ) -> <Self as Chip<F>>::Config {
        meta.enable_equality(instance); //启用 instance 和 constant 列以用于约束。
        // meta.enable_constant(constant);
        for column in &advices {
            meta.enable_equality(*column);  //遍历 advice 列表中的每个列，并启用它们以用于约束。
        }
     
        meta.create_gate("add", |meta| {
            // `Rotation` has specific constructors.
            let lhs = meta.query_advice(advices[0], Rotation::cur());
            let rhs = meta.query_advice(advices[1], Rotation::cur());
            let sum = meta.query_advice(advices[2], Rotation::cur());
            let difference = meta.query_advice(advices[3], Rotation::cur());
            let product = meta.query_advice(advices[4], Rotation::cur());
    
            let s_add = meta.query_selector(selectors[0]);
            let s_sub = meta.query_selector(selectors[1]);
            let s_mul = meta.query_selector(selectors[2]);

            vec![s_add * (lhs.clone() + rhs.clone() - sum) + s_sub * (lhs.clone() - rhs.clone() - difference) + s_mul * (lhs * rhs - product)] 
        });

        MultiOperationConfig {
            advices,
            instance,
            selectors,
        }
    }
}
// ANCHOR_END: chip-config

// ANCHOR: chip-impl
impl<F: Field> Chip<F> for MultiOperationChip<F> {
    type Config = MultiOperationConfig;
    type Loaded = (); //综合时需要,可以理解为chip的初始状态

    fn config(&self) -> &Self::Config {
        &self.config
    }

    fn loaded(&self) -> &Self::Loaded {
        &()  //返回对空元组的不可变引用。
    }
}
// ANCHOR_END: chip-impl

// ANCHOR: instructions-impl
/// A variable representing a number.
#[derive(Clone)]
struct Number<F: Field>(AssignedCell<F, F>);  

// MultiOperationChip 实现 NumericInstructions
impl<F: Field> Instructions<F> for MultiOperationChip<F> {
    type Num = Number<F>;  //Number<F>是

    fn load_private(
        &self,
        mut layouter: impl Layouter<F>,
        a: Value<F>,
        b: Value<F>,
    ) -> Result<(Self::Num, Self::Num), Error> {
        let config = self.config();

        //load_private 调用layouter中的assign_region, assign_region调用 
        layouter.assign_region(
            || "load private",
            |mut region|{
               let a_cell =  region
                    .assign_advice(|| "input a ", config.advices[0], 0, || a).map(Number)?;
               let b_cell =  region
                    .assign_advice(|| "input b",  config.advices[1], 0, || b).map(Number)?;
                Ok((a_cell, b_cell))
            },
        )
    }


    fn execute(
        &self,
        mut layouter: impl Layouter<F>,
        a: Self::Num,
        b: Self::Num,
    ) -> Result<(Self::Num, Self::Num, Self::Num), Error> {
        let config = self.config();

        layouter.assign_region(
            || "execute",
            |mut region: Region<'_, F>| {
                config.selectors[0].enable(&mut region, 0)?; //
                config.selectors[1].enable(&mut region, 0)?; //
                config.selectors[2].enable(&mut region, 0)?; //

                let a = a.0.copy_advice(|| "a", &mut region, config.advices[0], 0).map(Number)?;  //config.advice[0]列的第[0]行的值 = a.0
                let b = b.0.copy_advice(|| "b", &mut region, config.advices[1], 0).map(Number)?;  //config.advice[1]列的第[0]行的值 = a.0

                let sum_value = a.0.value().copied() + b.0.value().copied();
                let difference_value = a.0.value().copied() - b.0.value().copied();
                let product_value = a.0.value().copied() * b.0.value().copied();

                let sum = region
                    .assign_advice(|| "a + b", config.advices[2], 0, || sum_value)
                    .map(Number)?;
                
            
                let difference = region
                    .assign_advice(|| "a - b", config.advices[3], 0, || difference_value)
                    .map(Number)?;

     
                let product = region
                    .assign_advice(|| "a * b", config.advices[4], 0, || product_value)
                    .map(Number)?;

                Ok((sum,difference, product))
            },
        )
    }


}
// ANCHOR_END: instructions-impl

// ANCHOR: circuit
/// The full circuit implementation.
///
/// In this struct we store the private input variables. We use `Option<F>` because
/// they won't have any value during key generation. During proving, if any of these
/// were `None` we would get an error.
#[derive(Default)]
struct MultiOperationCircuit<F: Field> {
    a: Value<F>,
    b: Value<F>,
}

impl<F: Field> Circuit<F> for MultiOperationCircuit<F> {
    type Config = MultiOperationConfig;
    type FloorPlanner = SimpleFloorPlanner;

    fn without_witnesses(&self) -> Self {
        Self::default()
    }
    fn configure(meta: &mut ConstraintSystem<F>) -> Self::Config {
        // We create the two advice columns that MultiOperationChip uses for I/O.
        let advices = [meta.advice_column(), meta.advice_column(), meta.advice_column(), meta.advice_column(), meta.advice_column()];

        // We also need an instance column to store public inputs.
        let instance = meta.instance_column();

        // Create a fixed column to load constants,分配一个cosntant 列
        // let constant = meta.fixed_column();
        let selectors = [meta.selector(), meta.selector(), meta.selector()];

        MultiOperationChip::configure(meta, advices, instance, selectors)
    }
    
    fn synthesize(
        &self,
        config: Self::Config,
        mut layouter: impl Layouter<F>,
    ) -> Result<(), Error> {
        // 构建一个chip
        let chip = MultiOperationChip::<F>::construct(config);

        // Load our private values into the circuit.
        let (a, b) = chip.load_private(layouter.namespace(|| "load a and b"), self.a, self.b)?;
        // let b = chip.load_private(layouter.namespace(|| "load b"), self.b)?;
    
        let (a, b, c) = chip.execute(layouter.namespace(|| format!("execute")), a, b)?;
    
        Ok(())
    }
}
// ANCHOR_END: circuit

fn main(){}

#[cfg(test)]
mod tests {

    use super::*;
    use halo2_proofs::{dev::MockProver, pasta::Fp};
    #[test]
    fn test_circuit() {
        let k=3;
        // Prepare the private and public inputs to the circuit!
        let a = 70; 
        let b = 60;

        let a = Fp::from(a);
        let b = Fp::from(b);


        // Instantiate the circuit with the private inputs.
        let circuit = MultiOperationCircuit {
            a: Value::known(a),  //对Value的赋值语句
            b: Value::known(b),
        };

        // Arrange the public input. We expose the multiplication result in row 0
        // of the instance column, so we position it there in our public inputs.
        let public_inputs = vec![];

        // Given the correct public input, our circuit will verify.
        let prover = MockProver::run(k as u32, &circuit, vec![public_inputs.clone()]).unwrap();
        prover.assert_satisfied();
  

        // If we try some other public input, the proof will fail!
        // public_inputs[0] += Fp::one();
        // let prover = MockProver::run(k, &circuit, vec![public_inputs]).unwrap();
        // assert!(prover.verify().is_err());
    }
}

[qizhou]

默认的simple selector不能跟其他的selector混用（会影响优化）。可以把simple selector换成complex selector如下：

        // Create a fixed column to load constants,分配一个cosntant 列
        // let constant = meta.fixed_column();
        let selectors = [meta.complex_selector(), meta.complex_selector(), meta.complex_selector()];

程序就可以跑通了。

但是，在这个例子里面，我们建议不要使用连加作为约束，因为会出现多个selector为1，并且每个selector相乘的多项式数值不为0，导致每个selector的多项式的无法分别单独约束。

vec![s_add * (lhs.clone() + rhs.clone() - sum) + s_sub * (lhs.clone() - rhs.clone() - difference) + s_mul * (lhs * rhs - product)] 

比如，这里面可以让s_add = s_sub = 1，同时sum = lhs * 2, difference = 0，一样是可以通过约束检查，但是并没有实现lhs + rhs = sum 和 lhs - rhs = diff的约束。

最好的方式是把他们分开如下：

vec![s_add * (lhs.clone() + rhs.clone() - sum), s_sub * (lhs.clone() - rhs.clone() - difference), s_mul * (lhs * rhs - product)]

至于为什么会最终得到一个多项式，使得以上3个多项式同时满足，就需要了解PLONK/SNARK的原理了。