Fast evaluation of some p-adic transcendental functions

HAL Id: hal-03263044

https://hal-cnrs.archives-ouvertes.fr/hal-03263044

Preprint submitted on 16 Jun 2021

HAL is a multi-disciplinary open access archive for the deposit and dissemination of sci- entific research documents, whether they are pub- lished or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L’archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d’enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Fast evaluation of some p-adic transcendental functions

Xavier Caruso, Marc Mezzarobba, Nobuki Takayama, Tristan Vaccon

To cite this version:

Xavier Caruso, Marc Mezzarobba, Nobuki Takayama, Tristan Vaccon. Fast evaluation of some p-adic

transcendental functions. 2021. �hal-03263044�

Working draft, June 16, 2021

XAVIER CARUSO,

Université de Bordeaux, CNRS, INRIA, France

MARC MEZZAROBBA,

LIX, CNRS, École polytechnique, Institut polytechnique de Paris, France

NOBUKI TAKAYAMA,

Kobe University, Japan

TRISTAN VACCON,

Université de Limoges; CNRS, XLIM UMR 7252, France

We design algorithms for computing values of many𝑝-adic elementary and special functions, including loga- rithms, exponentials, polylogarithms, and hypergeometric functions. All our algorithms feature a quasi-linear complexity with respect to the target precision and most of them are based on an adaptation to the𝑝-adic setting of the binary splitting and bit-burst strategies.

CCS Concepts: •Computing methodologies→Algebraic algorithms.

Additional Key Words and Phrases: Algorithms, p-adic numbers, differential equations, binary splitting

1 INTRODUCTION

Special functions of a complex variable play a pivotal role in numerous questions arising from analysis, geometry, combinatorics and number theory. Examples include the link between the Riemann𝜁-function and the distribution of prime numbers, or the Birch and Swinnerton-Dyer conjecture which relates special values of𝐿-functions to arithmetical invariants of elliptic curves.

Being able to evaluate these functions at high precision is invaluable for computing invariants or testing conjectures, and work on fast algorithms for this task over the last decades often makes it possible nowadays to reach accuracies in the millions of digits [e.g., 12].

At the same time, mathematicians have realized that many complex special functions have in- teresting𝑝-adic analogues. A famous example is that of𝑝-adic𝐿-functions, which encode subtle invariants of towers of number fields (viaIwasawa’s theory) and, more generally, of algebraic va- rieties. The algorithmic counterpart of these questions also has attracted some interest. Efficient algorithms have been designed for computing the Morita𝑝-adicΓ-function [22, §6.2] and, more re- cently,𝑝-adic hypergeometric functions [1, 15] and some𝑝-adic𝐿-functions [3]. On a different but closely related note, since the pioneering works of Kedlaya [14], much effort has been devoted to computing the matrix of the Frobenius acting on the cohomology of𝑝-adic algebraic varieties [e.g., 17, 23].

The present paper continues this dynamic and provides new efficient algorithms for evaluating many𝑝-adic elementary and special functions, including polylogarithms, hypergeometric func- tions and, more generally, solutions of “small”𝑝-adic differential equations. In particular, our meth- ods apply to the large class of matrices of the Frobenius acting on the cohomology of a fibration, since they satisfy differential equations of Picard-Fuchs type.

An important feature of our algorithms is that they all run in quasi-linear time in the precision.

This contrasts with most previous work where the complexity was at least quadratic. The main

MM’s work is supported in part by ANR grants ANR-19-CE40-0018 DeRerumNatura and ANR-20-CE48-0014-02 NuSCAP.

XC’s work is supported in part by ANR grant ANR-18-CE40-0026-01 CLap–CLap. TV’s work is supported in part by CNRS- INSMI-PEPS-JCJC-2019 grant Patience.

Authors’ addresses: Xavier Caruso, Université de Bordeaux, CNRS, INRIA, Bordeaux, France, xavier.caruso@normalesup.

org; Marc Mezzarobba, LIX, CNRS, École polytechnique, Institut polytechnique de Paris, 91200, Palaiseau, France, marc@

mezzarobba.net; Nobuki Takayama, Kobe University, Kobe, Japan, [email protected]; Tristan VacconUniversité de Limoges;, CNRS, XLIM UMR 7252, Limoges, France, [email protected].

ingredient for reaching a quasi-optimal complexity is an adaptation to the𝑝-adic setting of the so- calledbit-burstmethod introduced by Chudnovsky and Chudnovsky [8, 9], building on thebinary splittingtechnique [e.g., 16] (see also [2, §178]) and other ideas dating back to Brent’s work on elementary functions [6]. Our algorithms also incorporate later improvements from [24, 19, 18].

We refer to Bernstein’s survey [4, esp. §12] for more history of the development of these techniques and further references.

Our starting point is the existence of recurrence relations on the partial sums of series expan- sions of the functions we are evaluating. Roughly speaking, the binary splitting method consists in expressing the𝑁th partial sum as a product of𝑁 matrices using this recurrence, and forming a balanced product tree to evaluate it (see §4.1). This approach reaches the desired quasi-linear com- plexity when the evaluation point𝑥is a small integer. For more general𝑥, we proceed in several steps: we find a sequence𝑥₁, . . . , 𝑥𝑛=𝑥of intermediate evaluation points whose bit sizes increase at a controlled rate while they get closer and closer in the sense of𝑝-adic distance. Doing this, we can use binary splitting to jump from𝑥𝑖 to𝑥𝑖+1, and eventually reach𝑥in quasi-linear time.

The remainder of the article is organized as follows. After preliminaries on the representation of𝑝-adic numbers in §2, we introduce a𝑝-adic analogue of bit-burst method in the simple case of log(𝑡)in §3. The general case of solutions of linear differential equations is addressed in §4. Finally, in §5, we discuss several applications, including a fast algorithm for evaluating certain logarithmic derivatives related to the Dwork hypergeometric functions.

2 REPRESENTATION OF𝑝-ADIC NUMBERS

Throughout this article, we fix a prime number𝑝 and a finite extension𝐾of the field of𝑝-adic numbersQ_𝑝. We recall that the𝑝-adic valuation onQ_𝑝extends uniquely to𝐾. We denote it by val and assume that it is normalized by val(𝑝)=1. We will use the notation| · |𝑝for the𝑝-adic norm on𝐾, defined by|𝑥|𝑝=𝑝^−val(𝑥); in particular, we have|𝑝|𝑝=𝑝⁻¹.

It will be convenient to present𝐾as an unramified extension ofQ𝑝followed by a totally ram- ified extension given by an Eisenstein polynomial. Let us briefly recall how this works. We fix a uniformizer𝜋of𝐾, that is, an element of minimal positive valuation, and introduce, with𝑘being the residue field of𝐾:

• the ramification index𝑒of𝐾/Q𝑝defined by𝑒= _val(𝜋)¹ ,

• the residual degree𝑓 of𝐾/Q_𝑝defined by𝑓 =[𝑘:F_𝑝].

We choose a monic polynomial𝑈(𝑋) ∈Z[𝑋]of degree𝑓 whose reduction modulo𝑝is irreducible.

One easily checks that𝑈(𝑋)remains irreducible inQ_𝑝[𝑋]and we can then form the fieldQ_𝑞 = Q_𝑝[𝑋]/𝑈(𝑋). It follows from Hensel’s lemma thatQ_𝑞embeds (non-canonically) into𝐾. Let now 𝑉(𝑌) ∈Q𝑞[𝑌]be the minimal polynomial of𝜋overQ𝑞. One can show that𝑉(𝑌)is an Eisenstein polynomial, and in particular that it lies inZ𝑝[𝑋 , 𝑌]/𝑈(𝑋). Besides, Krasner’s lemma [21, §3.1.5]

indicates that we can assume (up to changing𝜋) that𝑉(𝑌) ∈Z[𝑋 , 𝑌]/𝑈(𝑋). Thus, viewing𝑉 as a bivariate polynomial overZ, we have the presentations:

𝐾≃Q_𝑝[𝑋 , 𝑌]/(𝑈 , 𝑉), O_𝐾 ≃Z_𝑝[𝑋 , 𝑌]/(𝑈 , 𝑉) (1) whereO𝐾 denotes the ring of integers of𝐾(which consists of the elements of nonnegative valua- tion). If𝑎∈𝐾is represented by the polynomialÍ^𝑓−1

𝑖=0 Í𝑒−1

𝑗=0𝑎𝑖 𝑗𝑋^𝑖𝑌^𝑗 (with𝑎𝑖 𝑗 ∈Q𝑝), one has:

val(𝑎)=min

𝑖,𝑗 val(𝑎𝑖 𝑗) +_𝑒^𝑗

, |𝑎|𝑝=max

𝑖,𝑗 |𝑎𝑖 𝑗|𝑝·𝑝^−𝑗/𝑒

. (2)

The presentation of𝐾we have picked allows us to define a canonicalexact subrings𝐾^ex and O_𝐾^exby (compare with Eq. (1))

𝐾^ex ≃Q[𝑋 , 𝑌]/(𝑈 , 𝑉), O_𝐾^ex≃Z[𝑋 , 𝑌]/(𝑈 , 𝑉).

The ring O_𝐾^ex is dense in the ring of integers O_𝐾 of 𝐾, which concretely means that given an element𝑎 ∈𝐾 with nonnegative valuation and an integer𝑛, one can always find𝑏 ∈ O_𝐾^ex such that𝑎 ≡𝑏 (mod𝑝^𝑛). Similarly, the ring𝐾^ex is dense in𝐾. Additionally, one can define aheight functionℎ:O_𝐾^ex→R⁺which measures the bit size of the elements by

ℎÍ𝑓−1 𝑖=0 Í𝑒−1

𝑗=0𝑎𝑖 𝑗𝑋^𝑖𝑌^𝑗

=max

𝑖,𝑗 log 1+ |𝑎_{𝑖 𝑗}|

(3) where the coefficients𝑎𝑖 𝑗 are integers and the notation|𝑎𝑖 𝑗|refers to the usual absolute value. If 𝑥and𝑦are elements ofO_𝐾^exof height bounded by𝐻, one can compute the sum𝑥+𝑦for a cost of 𝑂(𝐻)bit operations. Similarly, one can compute the product𝑥𝑦and reduce it for a total cost of 𝑂˜(𝐻)bit operations (where the hidden constant depends on𝑈 , 𝑉 and hence on𝑒, 𝑓).

Proposition 2.1. Given a choice of defining polynomials𝑈 and𝑉, there exists a constant𝐶 ≥0 such that the functionℎ𝐾 =ℎ+𝐶satisfies

ℎ𝐾(𝑥₁+ · · · +𝑥𝑠) ≤max(ℎ𝐾(𝑥₁), . . . , ℎ_𝐾(𝑥_𝑠)) +log(𝑠), ℎ𝐾(𝑥₁𝑥₂· · ·𝑥𝑠) ≤ℎ𝐾(𝑥₁) + · · · +ℎ𝐾(𝑥𝑠),

for all𝑥₁, . . . , 𝑥𝑠 ∈ O_𝐾^ex.

Proof. The first inequality follows (for any choice of𝐶) from the observation that|𝑎₁+· · ·+𝑎𝑠| ≤ 𝑠 ·max(|𝑎₁|, . . . ,|𝑎𝑠|) when𝑎₁, . . . , 𝑎𝑠 are integers. In order to prove the second inequality, it is enough to check thatℎ𝐾(𝑥𝑦) ≤ℎ𝐾(𝑥) +ℎ𝐾(𝑦),i.e.ℎ(𝑥𝑦) ≤ℎ(𝑥) +ℎ(𝑦) +𝐶for some constant𝐶 ≥0 and all𝑥,𝑦 ∈ O_𝐾^ex. Using bilinearity of the product and the first part of the proposition, one finds that one can take𝐶=log(𝑒 𝑓) +max_{0≤𝑖≤2𝑓−2}

0≤𝑗≤2𝑒−2

ℎ 𝑋^𝑖𝑌^𝑗

.

We fix a functionℎ𝐾 :O_𝐾^ex→R⁺satisfying the requirements of Proposition 2.1. It is advisable to minimize𝐶because its value has a direct impact on the complexity of our algorithms. The proof of Proposition 2.1 shows that the value of𝐶is related to the degrees and heights of the polynomials 𝑈 and𝑉. Since𝑈 is defined as a lift of a polynomial overF_𝑝, one can always assumeℎ(𝑈) ≤log𝑝.

Bounding the height of𝑉 is more complicated but, by Krasner’s lemma, it reduces to bounding the ramification of𝐾, a problem that can be attacked using Newton polygons techniques.

3 ELEMENTARY FUNCTIONS 3.1 Logarithm

Let us start with the most basic transcendental functions, namely the𝑝-adic logarithm and expo- nential [e.g., 21, §4.5].

On the open unit disk centered at 1, the𝑝-adic logarithm is defined by the usual convergent series log(1−𝑡) =−Í∞

𝑖=1𝑡^𝑖/𝑖. Given𝑥 ∈𝐾,|𝑥|𝑝<1, our aim is to compute log(1−𝑥)efficiently at high precision. The algorithm we describe is a straightforward adaptation of one of the classical algorithms for the same task over the reals. That the idea generalizes toQ_𝑝is folklore (it is imple- mented inflintand a special case is mentioned in [4]) but, to our knowledge, no full analysis in the𝑝-adic setting appears in the literature. Since the ideas behind this algorithm will return in the next sections, we discuss it in some detail.

First of all, it is useful to know how accurate the input has to be to determine log(1−𝑥)to an accuracy𝑂(𝜋^𝜎).

Lemma 3.1. Let𝑢, 𝑣 ∈ 𝐾with|𝑢|𝑝 < 1and |𝑣|𝑝 < 1. If one has𝑢 = 𝑣+𝑂(𝜋^𝑚)for an integer 𝑚≥𝑒/(𝑝−1), thenlog(1−𝑢)=log(1−𝑣) +𝑂(𝜋^𝑚).

Proof. Writing𝑢 = 𝑣 +𝜋^𝑚𝑤 with |𝑤|_𝑝 ≤ 1 and expanding𝑢^𝑝 = (𝑣 +𝜋^𝑚𝑤)^𝑝, we deduce that𝑢^𝑝 ≡𝑣^𝑝 (mod𝑝𝜋^𝑚). Repeating the same argument, we find that𝑢^𝑝𝑠 ≡𝑣^𝑝𝑠 (mod𝑝^𝑠𝜋^𝑚)for all𝑠 ≥ 0. Therefore^𝑢_𝑖^𝑖 ≡ ^𝑣_𝑖^𝑖 (mod𝜋^𝑚)for all positive integer𝑖 and the result follows from the

definition of log(1−𝑡).

For the actual computation of log(1−𝑡), we use the“digit-burst” strategy materialized by the following lemma, in which𝐶denotes the constant of Proposition 2.1.

Lemma 3.2. Given𝑥 ∈𝐾,|𝑥|𝑝<1, there exists a decomposition:

1−𝑥 ≡ (1−𝑥₁) · (1−𝑥₂) · · · (1−𝑥ℓ) (mod𝜋^𝜎) withℓ =⌈log₂^𝜎_𝑒⌉and for all𝑠 ∈ {1, . . . , ℓ},𝑥𝑠 ∈ O_𝐾^exsuch that

val(𝑥𝑠)>0,val(𝑥𝑠) ≥2^𝑠−1−1andℎ𝐾(𝑥𝑠) ≤ (2^𝑠−1)log𝑝+𝐶.

Proof. We recall that𝑥is represented by a polynomial of the formÍ

𝑖Í

𝑗𝑎𝑖 𝑗𝑋^𝑖𝑌^𝑗with𝑎𝑖 𝑗 ∈Z𝑝

and𝑎00 ∈ 𝑝Z_𝑝 (see §2). We define𝑥1 by𝑥1 = Í

𝑖Í

𝑗𝑎_{𝑖 𝑗}^′𝑋^𝑖𝑌^𝑗 where𝑎^′_{𝑖 𝑗} is the unique integer in [0, 𝑝−1]which is congruent to𝑎𝑖 𝑗 modulo𝑝. Using (2) and (3), one has val(𝑥1)>0 andℎ𝐾(𝑥₁) ≤ log𝑝+𝐶.

The quotient(1−𝑥)/(1−𝑥₁)is congruent to 1 modulo𝑝, hence it is represented by a polynomial of the formÍ

𝑖Í

𝑗𝑏𝑖 𝑗𝑋^𝑖𝑌^𝑗 with𝑏₀₀ ≡1 (mod𝑝)and𝑏𝑖 𝑗 ≡0 (mod𝑝)for(𝑖, 𝑗) ≠ (0,0). We set 1−𝑥₂ = Í

𝑖Í

𝑗𝑏_{𝑖 𝑗}^′𝑋^𝑖𝑌^𝑗 where𝑏_{𝑖 𝑗}^′ ∈ [0, 𝑝³−1] is congruent to𝑏𝑖 𝑗 modulo𝑝³. One has 1−𝑥 = (1−𝑥1)·(1−𝑥2)·(1+𝑂(𝑝³))with val(𝑥2) ≥1 andℎ𝐾(𝑥₂) ≤3 log𝑝+𝐶.

Repeating this processℓtimes, we obtain the lemma.

Lemma 3.3. Let𝑢 ∈ O_𝐾^ex with |𝑢|𝑝 < 1. One can computelog(1−𝑢) modulo𝜋^𝜎 For a cost of 𝑂˜ 𝜎·^ℎ_val(𝑢)^𝐾(𝑢)

bit operations.

Proof. We have val ^𝑢_𝑖^𝑖

= 𝑖val(𝑢) −val(𝑖) ≥ 𝑖val(𝑢) −log_𝑝𝑖. Thus log(1−𝑢) ≡ Í𝑁 𝑖=1𝑢^𝑖

𝑖

(mod𝜋^𝜎)if𝑁val(𝑢) −log_𝑝𝑁 ≥ ^𝜎_𝑒. This occurs as soon as𝑁 =𝑂˜ _val(𝑢)^𝜎

. Since the numerator (inO_𝐾^ex) and denominator (inZ) of any sum of the formÍ𝑛

𝑖=1 𝑢^𝑖

𝑖0+𝑖 have height at most𝑛(ℎ_𝐾(𝑢) + log(𝑁+1)) +log𝑛), one can compute theexactvalue of the finite sumÍ𝑁

𝑖=1𝑢^𝑖

𝑖 ∈𝐾^exin𝑂˜(𝑁ℎ𝐾(𝑢)) bit operations using a divide-and-conquer strategy. The lemma follows.

Putting everything together, we get the following theorem.

Theorem 3.4. There exists an algorithm that takes as input an element𝑥 ∈ 𝐾, |𝑥|𝑝 < 1and outputslog(1−𝑥)at precision𝑂(𝜋^𝜎)for a cost of𝑂˜(𝜎)bit operations.

Proof. Without loss of generality, one may assume𝜎 ≥ _𝑝−1^𝑒 . Combining Lemmas 3.1 and 3.2, we find a congruence of the form:

log(1−𝑥) ≡log(1−𝑥₁) + · · · +log(1−𝑥ℓ) (mod𝜋^𝜎)

with val(𝑥𝑠) ≥2^𝑠−1−1+¹_𝑒 andℎ𝐾(𝑥_𝑠) ≤ (2^𝑠−1)log𝑝+𝐶for all𝑠 ∈ {1, . . . , ℓ}. By Lemma 3.3, each summand log(1−𝑥𝑠)can be evaluated for a cost of𝑂˜ 𝜎·^ℎ_val(𝑥^{𝐾(𝑥𝑠)}

𝑠)

⊂𝑂˜(𝜎)bit operations. Sinceℓ

itself stays within𝑂(log𝜎), the theorem is proved.

It is possible to track the dependency in the field𝐾of the complexity through the proof. Doing this, we obtain a total cost of𝑂˜(𝜎· (𝐶+log𝑝))where𝐶is the constant of Proposition 2.1 and the constants hidden in the𝑂˜ are now absolute.

3.2 Exponentiation

The exponential function.The𝑝-adic exponential function is the function defined by exp(𝑡) = Í∞

𝑖=0𝑡^𝑖/𝑖!. Using Legendre’s formula, one shows that its radius of convergence is𝑅_exp=𝑝^{−1/(𝑝−1)} <

1 and that it assumes values in the open unit disk centered at 1.

Let𝑥 ∈ 𝐾 with|𝑥|𝑝 < 𝑅_exp. We aim at computing exp(𝑥)at precision𝑂(𝜋^𝜎) in time𝑂˜(𝜎).

It is possible to use a similar “digit-burst” technique as for the logarithm. Instead, we present a different approach that we will reuse later on: we solve the equation log𝑦 = 𝑥 (of unknown𝑦) using a Newton scheme.

For this, we consider the function𝑓 defined for|𝑦−1|𝑝 <1 by 𝑓(𝑦) =𝑥−log𝑦. The Newton iteration formula associated to𝑓 is

𝑦𝑠+1=𝑦𝑠 − 𝑓(𝑦𝑠)

𝑓^′(𝑦_𝑠) =𝑦𝑠· (1+𝑥−log𝑦𝑠). (4) Any sequence(𝑦𝑠)𝑠≥0satisfying (4) will rapidly converge to exp(𝑥)provided that𝑦₀is close enough to exp(𝑥). Noticing that |𝑓^′(𝑦)|_𝑝 = |𝑓^′′(𝑦)|_𝑝 = 1 as soon as |𝑦−1|𝑝 < 1, we deduce from [7, Cor. 3.2.14] (applied with𝐶 =𝑅⁻¹_exp) that a sufficient condition for convergence is|𝑦₀−exp(𝑥)|𝑝 <

𝑅_exp. Now, observe that:

val ^𝑥_𝑖^𝑖_!

≥𝑖· val(𝑥) −_𝑝−1¹

≥_{𝑒(𝑝−1)}^𝑖

the second inequality following from the fact that val(𝑥) − _𝑝−1¹ is a positive element of _{𝑒(𝑝−1)}¹ Z.

Hence, one can start the Newton iteration with𝑦0 = Í𝑒−1 𝑖=0 𝑥^𝑖

𝑖! mod𝜋^𝑚 where𝑚is any integer strictly greater that_𝑝−1^𝑒 . The cost of the computation of𝑦0is independent of the target precision 𝜎. Finally, [7, Cor. 3.2.14] tells us that𝑦𝑠 ≡exp(𝑥) (mod𝜋^𝜎)provided that 2^𝑠 val 𝑦₀−exp(𝑥)

−

𝑝−11

≥ ^𝜎_𝑒, which holds for 2^𝑠 ≥ (𝑝−1)𝜎. One can take𝑠 =𝑂(log𝜎), proving that the total cost of the algorithm is𝑂˜(𝜎).

Powering.Given𝛿 ∈Z𝑝and𝑥in the open unit disk of𝐾, one can give a meaning to the expression (1+𝑥)^𝛿by setting:

(1+𝑥)^𝛿 = Õ∞

𝑖=0

𝛿(𝛿−1) · · · (𝛿−𝑖+1)

𝑖! 𝑥^𝑖. (5)

A first idea to compute this value in quasi-optimal complexity is to write(1+𝑥)^𝛿 =exp 𝛿·log(1+ 𝑥)

. However, it does not quite work because the latter equality only makes sense when𝛿·log(1+𝑥) falls inside the disk of convergence of the exponential. Instead, we observe that𝑦=(1+𝑥)^𝛿always satisfies the equation

log𝑦=𝛿·log(1+𝑥)

and solve it using a Newton scheme as we did in §3.2: we start by computing a first rough approx- imation𝑦₀of(1+𝑥)^𝛿and then iterate the Newton operator (4). As before, the precision we need on𝑦0is𝑂(𝑝^1/(𝑝−1)), so that we can take the series (5) truncated after𝑚=⌈𝑒/(𝑝−1)⌉terms for𝑦0. The total complexity of the computation of(1+𝑥)^𝛿is at most𝑂˜(𝜎).

The same strategy applies to theArtin-Hasse exponentialAH(𝑡)=exp(𝑡+𝑝⁻¹𝑡^𝑝+ · · · +𝑝^−𝑛𝑡^𝑝𝑛+

· · · ), a useful renormalization of the𝑝-adic exponential with a larger radius of convergence [21,

§7.2].

4 SOLUTION OF DIFFERENTIAL EQUATIONS

Our goal is now to generalize the previous results to the evaluation of a large class of solutions of differential equations. We consider a linear differential equation of the form

𝑎𝑟(𝑡)𝑦^(𝑟)(𝑡) + · · · +𝑎₁(𝑡)𝑦^′(𝑡) +𝑎₀(𝑡)𝑦(𝑡)=0 (6)

where the𝑎𝑖 are polynomials of degree at most𝑑, with coefficients in O_𝐾^ex of height at mostℓ.

Substituting𝑦(𝑡)=Í

𝑛≥0𝑦𝑛𝑡^𝑛into (6) shows that the coefficient sequence(𝑦𝑛)of a formal power series solution𝑦must satisfy

𝑏₀(𝑛)𝑦𝑛+𝑏₁(𝑛)𝑦_𝑛−1+ · · · +𝑏𝑠(𝑛)𝑦𝑛−𝑠 =0, (7) 𝑏𝑗(𝑛)=

Õ𝑟 𝑖=0

𝑎𝑖,𝑖−𝑟+𝑗(𝑛−𝑗) (𝑛−𝑗−1) · · · (𝑛−𝑗−𝑖+1), (8) where𝑠 =𝑟 +𝑑and𝑎𝑖,𝑗is the coefficient of𝑡^𝑗in𝑎𝑖(𝑡)(0 if𝑗 <0). In particular, one has

𝑏₀(𝑛)=𝑎𝑟(0)𝑛(𝑛−1) · · · (𝑛−𝑟+1). (9) The recurrence (7) holds for all𝑛∈Zif the sequence(𝑦_𝑛)is extended by𝑦𝑛=0 for𝑛<0.

4.1 Partial sums at ordinary points

The recurrence (7) can be used to evaluate partial sums of the series𝑦(𝑡) efficiently by binary splitting. We recall and analyze an algorithm for this task, essentially the “optimized” version from [19] of a method first detailed in [8, §5–6].

We assume in this subsection that𝑎𝑟(0) ≠0. Then, the space of formal power series solutions of (6) has dimension𝑟 and admits a basis(𝑓₀, . . . , 𝑓𝑟−1)such that𝑓𝑗(𝑡)=𝑡^𝑗+𝑂(𝑡^𝑟). We denote by Φ₀(𝑡)= _𝑖!¹𝑓_𝑗^(𝑖)(𝑡)

the associated fundamental matrix. There exists𝜌>0 such that the𝑓𝑗converge on the open disk of radius𝜌 centered at 0. For future use, we also defineΦ_𝜉(𝑡)= _𝑖!¹𝑔_𝑗^(𝑖)(𝜉+𝑡)

at an arbitrary𝜉with𝑎𝑟(𝜉)≠0, where𝑔𝑗 now is the solution such that𝑔𝑗(𝜉+𝑡)=𝑡^𝑗+𝑂(𝑡^𝑟).

We are given an integer𝑁and an element𝑥 ∈𝐾^ex, written in the form𝑥 =𝑢/𝑣with𝑢∈ O_𝐾^exand 𝑣 ∈Z, and our task is to compute the𝑁-th partial sum ofΦ₀(𝑥). The general idea of the algorithm is to encode the simultaneous computation of the entries ofΦ₀(𝑥)in a product of matrices that is computed in rational arithmetic by forming a balanced product tree. For space reasons, we limit ourselves here to a technical description of the procedure and refer to [18] for more context.

Given a ring𝑅, an indeterminate𝑍, and𝑘 ∈Z_≥0, define the jet space𝐽_𝑍^𝑘(𝑅)=𝑅J𝑍K/𝑍^𝑘. Observe that computing each column ofΦ₀(𝑥) reduces to evaluating one of the 𝑓𝑗 at𝑥 +Δ ∈ 𝐽Δ^𝑟(𝐾^ex).

(Jet spaces in a second indeterminate Λwill be used in §4.3.) LetM be the set of tuples𝑇 = (C_𝑇,d𝑇,u𝑇,v𝑇,R𝑇)withC𝑇 ∈ (O_𝐾^ex)^𝑠×𝑠,d𝑇 ∈ O_𝐾^ex,u𝑇 ∈ 𝐽Δ^𝑟(O_𝐾^ex),v𝑇 ∈Z, andR𝑇 ∈𝐽Δ^𝑟(O_𝐾^ex)^𝑠. We equipMwith the product defined by

𝑇𝑇^′=(C𝑇C𝑇^′,d𝑇d𝑇^′,u𝑇u𝑇^′,v𝑇v𝑇^′,R𝑇C𝑇^′u𝑇^′+d𝑇v𝑇R𝑇^′) (10) whereR𝑇,R𝑇^′are viewed as row vectors. The product is associative. In fact, multiplying elements ofMamounts to multiplying(𝑠+1) × (𝑠+1)matrices of the form

M𝑇 =

C𝑇u𝑇 0 R𝑇 d𝑇v𝑇

,

but the representation (10) makes fast computations with these special matrices easier to state and analyze.

For𝑛∈N, let𝐵(𝑛)be the element ofMdefined by

C𝐵(𝑛) =©­

­­­

«

0 𝑏₀(𝑛) . . .

𝑏0(𝑛)

−𝑏𝑠(𝑛) · · · −𝑏₁(𝑛) ª®®®

®¬ ,

R𝐵(𝑛)=(0, . . . ,0, 𝑣𝑏0(𝑛)), d𝐵(𝑛)=𝑏₀(𝑛),

u𝐵(𝑛)=𝑢+𝑣Δ, v𝐵(𝑛)=𝑣.

Also define𝑃(𝑛₀, 𝑛₁)=𝐵(𝑛₁−1) · · ·𝐵(𝑛₀+1)𝐵(𝑛₀).

Algorithm 1PartialSum (𝑎𝑖) ∈ O_𝐾^ex[𝑡]^𝑟, 𝑢∈ O_𝐾^ex, 𝑣 ∈Z, 𝑁 ∈Z_≥𝑟, 𝜎 ∈Z_≥0

(1) Compute the polynomials𝑏𝑗 defined by (7), (8).

(2) ComputeΠ = 𝑃(𝑟 , 𝑁)using recursively the formula𝑃(𝑛₀, 𝑛₁) =𝑃(𝑚, 𝑛₁)𝑃(𝑛₀, 𝑚)with𝑚 ≈ (𝑛₀+𝑛₁)/2.

(3) Extract the last𝑟 columns ofC^Πas a matrix𝑈 ∈ (O_𝐾^ex)^𝑠×𝑟. (4) Compute and return the matrix

˜

Φ=[𝑣^−𝑗d⁻¹Π v⁻¹Π ((𝑢+𝑣Δ)^𝑗(RΠ)𝑠−𝑗)_𝑖]_{0≤𝑖,𝑗<𝑟} mod𝜋^𝜎 ∈𝐾^𝑟×𝑟

where(R^Π)𝑠−𝑗is the entry ofR^Πof index𝑠−𝑗, counting from zero, and𝜉𝑖 for𝜉∈ 𝐽Δ^𝑟(𝐾)is the coefficient ofΔ^𝑖 in𝜉.

Proposition 4.1. Write𝑓𝑗(𝑡)=Í

𝑛≥0𝑓𝑗,𝑛𝑡^𝑛and let𝑓𝑗(𝑡)_<𝑁 =Í𝑁−1

𝑛=0 𝑓𝑗,𝑛𝑡^𝑛. Algorithm 1 returns 1

𝑖!

d^𝑖

d𝑡^𝑖(𝑓𝑗(𝑡)<𝑁)

𝑡=𝑥

mod𝜋^𝜎

0≤𝑖,𝑗<𝑟

.

Proof. The recurrence relation (7) translates into

𝑏0(𝑛) (𝑦𝑛−𝑠+1, . . . , 𝑦𝑛)^T=C𝐵(𝑛)(𝑦𝑛−𝑠, . . . , 𝑦𝑛−1)^T.

Letting𝑌𝑛 = (𝑦𝑛−𝑠𝜉^𝑛−1, . . . , 𝑦_𝑛−1𝜉^𝑛−1, 𝑦(𝜉)<𝑛)^Twhere𝜉 =𝑥+Δ ∈ 𝐽Δ^𝑟(𝐾)and𝑦(𝑡)<𝑁 denotes the partial sumÍ𝑁−1

𝑛=0 𝑦𝑛𝑡^𝑛, one has

𝑌𝑛 =

©­­­

­­­­

«

0 𝜉 0

. . . ... 𝜉 ... 𝑐𝑠(𝑛)𝜉 · · · 𝑐₁(𝑛)𝜉 0

0 · · · 0 1 1

ª®®®

®®®®

¬

𝑌𝑛−1, 𝑐𝑖(𝑛)=−𝑏𝑖(𝑛) 𝑏₀(𝑛),

that is,𝑌𝑛=(v𝐵(𝑛)d𝐵(𝑛))⁻¹M𝐵(𝑛)𝑌𝑛−1, whenever𝑏0(𝑛)≠0. Taking into account (9), it follows that (𝑦_{𝑁−𝑠+1}, . . . , 𝑦𝑁)^T=d⁻¹Π C^Π(0, . . . ,0, 𝑦₀, . . . , 𝑦𝑟−1)^T,

and𝑌𝑁 =(vΠd^Π)⁻¹M^Π𝑌𝑟−1. When𝑦is set to the element𝑓𝑗of the distinguished basis defined above, the corresponding initial vector is𝑌𝑟 =( [𝑑+𝑗zeros], 𝑢^𝑟−1/𝑣^𝑟−1,[𝑟−𝑗−1 zeros], 𝑢^𝑗/𝑣^𝑗))^T. This leads

to the formulas used at step 4.

We turn to the complexity analysis. When𝐴is anO_𝐾^ex-algebra equipped with a distinguished O_𝐾^ex-basis(𝑒𝑖), such as𝐴=O_𝐾^ex[𝑛], we extendℎ𝐾 to𝐴by settingℎ𝐾(Í

𝑖𝜆𝑖𝑒𝑖)=max𝑖ℎ𝐾(𝜆𝑖).

Lemma 4.2. For 𝑗 = 0, . . . , 𝑟, the coefficient𝑏𝑗 of the recurrence relation(7) satisfiesℎ𝐾(𝑏𝑗) ≤ ℓ+ (𝑠+1)log𝑠.

Proof. The coefficients of the polynomials(𝑛−𝑗) · · · (𝑛−𝑗−𝑖+1)appearing in (8) are all bounded by(1+𝑗) · · · (1+𝑗+𝑖−1) ≤𝑠! since𝑖+𝑗 ≤𝑠in all the terms. Coming back to the definition ofℎ𝐾, we getℎ𝐾(𝑏𝑗) ≤log(𝑠!) +max0≤𝑖≤𝑟ℎ𝐾(𝑎𝑖,𝑖−𝑟+𝑗) ≤𝑠log𝑠+𝑠+ℓ.

Lemma 4.3. Let𝐻 be such thatℎ𝐾(𝑢), ℎ𝐾(𝑣) ≤ 𝐻. Let0 ≤𝑛0 <𝑛1andΠ =𝑃(𝑛0, 𝑛1). We have the bounds

ℎ𝐾(uΠ), ℎ𝐾(vΠ) ≤ (𝑛₁−𝑛₀) (𝐻+log(𝑠)),

ℎ𝐾(CΠ), ℎ𝐾(dΠ) ≤ (𝑛₁−𝑛₀) (ℓ+ (𝑠+2) (log𝑠+log𝑛₁) +1),

ℎ𝐾(RΠ) ≤ (𝑛₁−𝑛0) (ℓ+𝐻+ (𝑠+3) (log𝑠+log𝑛1) +1).

Proof. We start by bounding the height of the elements of𝐵(𝑛)for𝑛≤𝑛₁. We have by assump- tionℎ𝐾(u_𝐵(𝑛)), ℎ𝐾(v_𝐵(𝑛)) ≤𝐻. Lemma 4.2 impliesℎ𝐾(𝑏𝑗(𝑛)) ≤𝛽(𝑛):=ℓ+ (𝑠+1)log𝑠+𝑑log𝑛+1 for all 𝑗 and𝑛. We hence haveℎ𝐾(C𝐵(𝑛)), ℎ𝐾(d𝐵(𝑛)) ≤ 𝛽(𝑛) andℎ𝐾(R𝐵(𝑛)) ≤ 𝛽(𝑛) +𝐻. For 𝑇 ,𝑇^′∈ M, Proposition 2.1 yields

ℎ𝐾(C𝑇𝑇^′) ≤ℎ𝐾(C𝑇) +ℎ𝐾(C𝑇^′) +log(𝑠), ℎ𝐾(d𝑇𝑇^′) ≤ℎ𝐾(d𝑇) +ℎ𝐾(d𝑇^′),

ℎ𝐾(v_𝑇𝑇^′) ≤ℎ𝐾(v_𝑇) +ℎ𝐾(v_𝑇^′),

ℎ𝐾(u𝑇𝑇^′) ≤ℎ𝐾(u𝑇) +ℎ𝐾(u𝑇^′) +log(𝑟).

The first inequality implies

ℎ𝐾(C𝑇1···𝑇𝑚) ≤ℎ𝐾(C𝑇1) + · · · +ℎ𝐾(C𝑇𝑚) +𝑚log(𝑠)

whenceℎ𝐾(CΠ) ≤ (𝑛₁−𝑛₀) (𝛽(𝑛₁) +log(𝑠)). The height bounds ondΠ,uΠ, andvΠ follow in the same way.

In the case ofR^Π, Proposition 2.1 implies

ℎ𝐾(R𝑇𝑇^′) ≤max(ℎ𝐾(R𝑇C𝑇^′u𝑇^′), ℎ𝐾(d𝑇v𝑇R𝑇^′)).

With𝑇 =𝐵(𝑛)and𝑇^′=𝑃(𝑛−𝑚, 𝑛−1), one has

ℎ𝐾(R_𝑇C𝑇^′u𝑇^′) ≤ℎ𝐾(R_𝑇) +ℎ𝐾(C_𝑇^′) +ℎ𝐾(u_𝑇^′) +log(𝑠) +log(𝑟)

≤𝛽(𝑛) +𝐻+ (𝑚−1) (𝛽(𝑛) +log(𝑠) +𝐻+log(𝑟))

≤𝑚(𝛽(𝑛) +𝐻+2 log(𝑠)),

ℎ𝐾(d_𝑇v𝑇R𝑇^′) ≤ℎ𝐾(d_𝑇) +ℎ𝐾(v_𝑇) +ℎ𝐾(R_𝑇^′) +log(𝑟)

≤𝛽(𝑛) +𝐻+ℎ𝐾(R𝑇^′) +log(𝑟).

Thusℎ𝐾(R_𝑇𝑇^′) ≤ max(ℎ𝐾(R_𝑇^′) +𝛾(𝑛), 𝑚𝛾(𝑛))where𝛾(𝑛) = 𝛽(𝑛) +𝐻 +2 log(𝑠). By induction on𝑚, one getsℎ𝐾(RΠ) ≤ (𝑛₁−𝑛0)𝛾(𝑛₁). The claim follows.

Proposition 4.4. For𝑢,𝑣of height≤𝐻 and𝜎=𝑂˜(𝑁), Algorithm 1 runs in𝑂˜ 𝑠^𝜔𝑁(ℓ+𝐻+𝑠) bit operations, where𝜔is the exponent of matrix multiplication.

Proof. The bulk of the cost comes from step 2. Step 2 decomposes into the computation of the tuples𝐵(𝑛)for𝑛 = 𝑟 , . . . , 𝑁, and the construction of a product tree from these tuples. The evaluation of𝑏𝑗 at𝑛can be performed in𝑂˜(ℎ𝐾(𝑏𝑗) +𝑟log𝑛) =𝑂˜(ℓ +𝑠 +log𝑛)operations in a divide-and-conquer fashion [11, 5], leading to a total cost of𝑂˜(𝑠(ℓ +𝑠 +log𝑛) +𝐻) for the construction of each𝐵(𝑛).

Consider two subproductsΠ₀=𝑃(𝑛₀, 𝑛₁)andΠ₁=𝑃(𝑛₁, 𝑛₂)with 0≤𝑛₁−𝑛₀, 𝑛₂−𝑛₁≤𝑚. Using the bounds from Lemma 4.3 and standard bounds on the complexity of arithmetic inZ[𝑋], one sees that computingu^Π1Π₀andv^Π1Π₀fromΠ₀,Π₁takes𝑂˜(𝑚𝑟(𝐻+log𝑠))=𝑂˜(𝑚𝑠𝐻)operations.

Similarly, the computation ofC^Π1Π₀ andd^Π1Π₀ requires a total of𝑂˜(𝑚(𝑠^𝜔+1ℓlog𝑁))operations.

Finally, one can computed^Π1v^Π1R^Π0in𝑂˜(𝑚𝑠𝑟· (ℓ+𝐻 +𝑠log𝑁))operations, andR^Π1C^Π0u^Π0in 𝑂˜(𝑚(𝑠^𝜔+𝑠𝑟) · (ℓ+𝐻+𝑠log𝑁))operations by reinterpreting the product𝐽Δ^𝑟(O_𝐾^ex)^𝑠× (O_𝐾^ex)^𝑠×𝑠 → 𝐽Δ^𝑟(O_𝐾^ex)^𝑠 as a matrix-matrix product(O_𝐾^ex)^𝑟×𝑠× (O_𝐾^ex)^𝑠×𝑠 → (O_𝐾^ex)^𝑟×𝑠.

Consequently, the cost of computing𝑃(𝑟 , 𝑁)from the𝐵(𝑛)is𝑂˜(𝑠^𝜔𝑁(ℓ+𝐻+𝑠))and dominates that of constructing the𝐵(𝑛). Step 1 takes𝑂˜(𝑟𝑠(ℓ+𝑠))operations. Step 4 takes𝑂˜(𝑟²(ℓ+𝐻+𝑠+𝜎))

operations.

When|𝑥| < 𝜌, the series𝑦(𝑥)converges geometrically, so 𝑁 =𝑂(𝜎)terms suffice to attain the precision𝑂(𝜋^𝜎). When additionally𝑥 is the image in𝐾 of an algebraic number of small bit size, one can take𝐻 =𝑂(1)in Proposition 4.4, and Algorithm 1 is enough to evaluate𝑦(𝑥)to the precision𝑂(𝜋^𝜎)in time𝑂˜(𝜎).

4.2 The “digit-burst” method

In general, though, computing𝑦(𝑥)for𝑥 ∈𝐾to a precision𝑂(𝜋^𝜎)requires approximating𝑥itself by an element of𝐾^ex of height about𝜎, making the complexity bound roughly quadratic in𝜎.

Chudnovsky and Chudnovsky [8] get around this issue by using the analytic continuation formula Φ₀(𝑥₀+𝑥₁+ · · · +𝑥𝑚)=Φ_𝑥

0+···+𝑥𝑚−1(𝑥𝑚) · · ·Φ_𝑥

0(𝑥₁)Φ₀(𝑥₀)

along a path formed by approximations𝑥0+ · · · +𝑥𝑚of𝑥with an exponentially increasing number of correct digits, balancing the speed of convergence of the series with the height of the terms like in Theorem 3.4. Interestingly, the idea still applies in the𝑝-adic case, even though the “analytic continuation” process does not allow one to escape from the disk of convergence ofΦ₀(𝑡).

We want to evaluateΦ₀at a point𝑥with|𝑥|𝑝<𝜌. For simplicity, we limit ourselves to𝑥∈ O_𝐾^ex but the general case can be handled in a similar fashion. We first need some a priori bounds on the speed of convergence of series solutions of (6). Given𝜌 >0, we denote byA𝜌the subring of𝐾J𝑡K consisting of series𝑓(𝑡)=Í

𝑛≥0𝑎𝑛𝑡^𝑛for which the sequence(|𝑎𝑛|𝑝𝜌^𝑛)𝑛≥0is bounded from above.

The ringA𝜌is equipped with theGauss normk · k𝜌 defined bykÍ

𝑛≥0𝑎𝑛𝑡^𝑛k𝜌 =sup_𝑛≥0|𝑎𝑛|𝑝𝜌^𝑛. It satisfies the ultrametric triangle inequalityk𝑓+𝑔k𝜌≤max(k𝑓k𝜌,k𝑔k𝜌)and it is multiplicative (i.e.

k𝑓 𝑔k𝜌 =k𝑓k𝜌k𝑔k𝜌). Geometrically, series belonging toA𝜌converge on theopendisk of center 0 and radius𝜌and the Gauss norm corresponds to the sup norm on this disk taken over an algebraic closure.

Proposition 4.5. For 𝑓₀, 𝑓₁, . . . , 𝑓_𝑟−1 ∈ A𝜌 and for any series𝑦 ∈ 𝐾J𝑡Kwith𝑦^(𝑟)+𝑓_𝑟−1𝑦^(𝑟−1)+

· · · +𝑓₁𝑦^′+𝑓₀𝑦=0, one has:

𝑦∈ A𝜌_˜ with 𝜌˜=𝑅_exp·min 𝜌, min

0≤𝑖<𝑟k𝑓𝑖k

1 𝜌𝑖−𝑟

,

k𝑦k𝜌_˜ ≤𝑀˜ with 𝑀˜ = max

0≤𝑖<𝑟

𝑦^(𝑖)(0)

𝑝, where we recall that𝑅_exp=𝑝^{−1/(𝑝−1)}.

Sketch of the proof. Write𝑦 = Í

𝑛≥0𝑦𝑛𝑡^𝑛. The coefficients𝑦𝑛 satisfy a recurrence of the form (8), except that the length of the recurrence in now unbounded because the 𝑓𝑖 are series instead of polynomials. Using this recurrence, one checks by induction on𝑛that|𝑛!𝑦𝑛|𝑝 ≤ 𝑀˜ · (𝜌˜/𝑅_exp)^𝑛. Using|𝑛!|𝑝 ≥𝑅_exp^−𝑛, we obtain|𝑦𝑛|𝑝 ≤𝑀˜𝜌˜^𝑛and the proposition follows.

Define slice(𝑥, 𝜎0, 𝜎₁)as the result of replacing by zero the coefficients of𝑝^𝑘in the𝑝-adic expan- sion of the coordinates of𝑥except for𝜎₀6𝑘<𝜎₁, that is, using the notation of §2:

slice Í

𝑖,𝑗𝑢𝑖,𝑗𝑋^𝑖𝑌^𝑗, 𝜎₀, 𝜎₁

=Í

𝑖,𝑗((𝑢𝑖,𝑗mod𝑝^𝜎1)

− (𝑢𝑖,𝑗mod𝑝^𝜎0))𝑋^𝑖𝑌^𝑗.

(11)

Algorithm 2 implements the computation ofΦ₀(𝑥).

Lemma 4.6. If𝑎 ∈ O_𝐾^ex[𝑡] is a polynomial of degree at most𝑟 withℎ𝐾(𝑎) ≤ ℓand𝜉 ∈ O_𝐾^ex has heightℎ𝐾(𝜉) ≤𝐻, then𝑎˜=𝑎(𝜉+𝑡)has heightℎ𝐾(𝑎) ≤˜ ℓ+ (𝑟+1)𝐻+log𝑟.

Proof. With𝑎 =Í

𝑖𝑐𝑖𝑡^𝑖, one has ˜𝑎 =Í

𝑗Í

𝑖 𝑖 𝑗

𝑐𝑖𝜉^𝑖−𝑗𝑡^𝑗. Since log ^𝑖_𝑗

≤𝑖 ≤𝑟, the claim follows

by Proposition 2.1.

Algorithm 2DigitBurstSolve(𝒂 ∈ (O_𝐾^ex)^𝑟[𝑡], 𝜌, 𝑀, 𝑥∈ O_𝐾^ex, 𝜎) (1) Let ˜𝜌 =𝑅exp·min

𝜌,min0≤𝑖<𝑟

_k𝑎

𝑖k𝜌 k𝑎_𝑟k_𝜌

1/(𝑖−𝑟) .

(2) Let𝑐=⌈max(val(𝑥),−1+log_𝑝𝜌)⌉˜ ,𝜎^′=𝜎−min(0,⌊log_𝑝𝑀⌋).

(3) Set𝑌 =Id∈ (O_𝐾^ex)^𝑟×𝑟,𝒂₋₁=𝒂, and𝑥₋₁=0.

(4) For𝑚=0,1, . . .while𝑐2^𝑚 6𝜎:

(a) Set𝒂_𝑚(𝑋)=𝒂_𝑚−1(𝑥𝑚−1+𝑋).

(b) Set𝑥𝑚=slice(𝑥, 𝑐⌊2^𝑚−1⌋, 𝑐2^𝑚).

(c) If𝑚=0 then set𝑁0=(𝜎^′+log_𝑝𝑀) /log_𝑝(𝜌/|𝑥|_𝑝), otherwise set𝑁𝑚 =𝜎^′/log_𝑝(𝜌/|𝑥˜ 𝑚|𝑝)

(d) Set𝑌 =Φ˜𝑌 where ˜Φ=PartialSum(𝒂_𝑚, 𝑥𝑚,1,⌈𝑁𝑚⌉, 𝜎^′).

(5) Return𝑌.

Proposition 4.7. Given𝒂 = (𝑎_𝑖) ∈ (O_𝐾^ex)^𝑟[𝑡],𝑥 ∈ O_𝐾^ex withℎ𝐾(𝑥) ≤ 𝜎 and𝜌, 𝑀 ∈ R_>0 such that:

(1) the leading coefficient𝑎𝑟 of𝒂 is invertible in A𝜌 (equivalently, all roots of𝑎𝑟 in an algebraic closure have norm at least𝜌),

(2) the entries ofΦ₀(𝑡)lie inA𝜌and have Gauss norm≤𝑀, Algorithm 2 computesΦ₀(𝑥)mod𝜋^𝜎 in𝑂˜(𝑠^𝜔𝜎(ℓ+𝑠))operations.

Proof. Consider iteration𝑚of the loop. We have by constructionℎ𝐾(𝑥_𝑚) ≤𝑐2^𝑚 andℎ𝐾(𝑥₀+

· · · +𝑥_𝑚−1) ≤𝑐2^𝑚−1. By Lemma 4.6, this impliesℎ𝐾(𝒂_𝑚) ≤𝑐(𝑟+1)2^𝑚−1+ℓ+log𝑟. Using fast Taylor shift algorithms [25], one can compute the vector𝒂_𝑚from𝒂_𝑚−1in𝑂˜(𝑐𝑟³ℎ𝐾(𝑥𝑚) +𝑐𝑟²ℎ𝐾(𝒂_𝑚−1))= 𝑂˜(𝑐𝑟³2^𝑚)=𝑂˜(𝑠³𝜎)operations. Since, by (2) and (11),|𝑥𝑚|𝑝≤𝑝^−𝑐2𝑚, one gets𝑁𝑚 =𝑂(𝑐⁻¹2^−𝑚𝜎).

By Proposition 4.4, the cost of the call to PartialSum is

𝑂˜(𝑠^𝜔𝑁𝑚(ℎ𝐾(𝒂_𝑚) +ℎ𝐾(𝑥𝑚) +𝑠)=𝑂˜(𝑠^𝜔𝜎(ℓ+𝑠)).

As the number of iterations is𝑂(log𝜎), the total cost of the algorithm is𝑂˜(𝑠^𝜔𝜎(ℓ+𝑠)).

Regarding correctness, it follows from Proposition 4.5 applied with𝑓𝑖(𝑡)= ^𝑎𝑖

𝑎𝑟(𝑡−𝑥₀− · · · −𝑥_𝑚−1) and our choices of𝜌,𝑀 and ˜𝜌that the matrix ˜Φcomputed at step 4d is equal toΦ_𝑥

0+···+𝑥𝑚−1(𝑥𝑚) modulo𝜋^𝜎′. Besides, the norm of its coefficients is bounded by𝑀when𝑚=0 and by 1 otherwise.

The product of all these matrices is then congruent toΦ_𝑥

0+···+𝑥_𝑚(0)=Φ_𝑥(0)modulo𝜋^𝜎. 4.3 Regular singularities

For many interesting examples, the assumption𝑎𝑟(0) ≠0 is not satisfied. In this case, there may not exist a full basis of formal power series solutions. Series solutions that do exist still satisfy the recurrence (7) (whose order drops since𝑏₀vanishes identically), but a solution𝑦(𝑡) ∈𝐾J𝑡Kis not necessarily characterized by its coefficients𝑦₀, . . . , 𝑦_𝑟−1, and may not converge anywhere.

We focus here on the important special case where 0 is aregular singular point, which means, by definition, that the leading coefficient𝑄₀ = 𝑏𝑗0 of (7), called the indicial polynomial, has de- gree𝑟. It is a classical fact [e.g., 20, §16] that one can then construct𝑟linearly independent formal logarithmic series solutions

𝑓𝑗(𝑡)=𝑡^𝛿𝑗 Õ∞ 𝜈=0

𝜅Õ𝑗−1 𝑘=0

𝑓𝑗,𝜈,𝑘𝑡^𝜈 log^𝑘𝑡

𝑘! , 𝑓𝑗,𝜈,𝑘 ∈𝐾(𝛿𝑗), (12)

where the𝛿𝑗are roots of𝑄₀in an algebraic closure of𝐾. Letting𝐸be the set of(𝛿, 𝑘)such that𝛿is a root of𝑄₀of multiplicity𝜇(𝛿)>𝑘, the𝑓𝑗can be chosen in such a way that, for each𝑗, exactly one

Algorithm 3RegSingPartialSum (𝑎𝑖), 𝑢∈ O_𝐾^ex, 𝑣 ∈Z, 𝑁 , 𝜎 (1) Compute the polynomials𝑏𝑗 defined by (7), (8).

Let𝑗₀=min{𝑗 :𝑏𝑗 ≠0},𝑠^′=𝑠−𝑗₀and𝑄𝑗 =𝑏𝑗0+𝑗 for 0≤𝑗≤𝑠^′. (2) Write𝑄₀(𝑛) = 𝜁Î

𝑞∈QÎ

𝜈∈N𝑞𝑞(𝑛+𝜈)^{𝑚𝑞,𝜈} where𝜁 ∈ 𝐾^ex, Q ⊂ 𝐾^ex[𝑛] is a set of monic, irreducible, non-constant polynomials,N𝑞⊂Z_≥0, and any two distinct𝑞(𝑛+𝜈)are coprime.

(3) Initialize ˜Φto an𝑟 ×0 matrix over𝐾^ex. (4) For𝑞 ∈ Q:

(a) Let𝛾be the image of𝑋 in𝐾^ex[𝑋]/𝑞(𝑋). Compute𝜏 ∈Zsuch that𝜏𝛾is integral overO_𝐾^ex. Let𝛼=𝜏𝛾.

(b) Let𝜅=Í

𝜈∈N𝑞𝑚𝑞,𝜈.

InitializeΨto an(𝑠^′+1) ×0 matrix overL𝛼,𝜅.

(c) For each pair(𝜈0, 𝜈1)of consecutive elements ofN𝑞∪ {𝑁}:

(i) Right-shift all entries ofΨby𝑚𝑞,𝜈0, prepending zeros.

(ii) For𝑘 = 0, . . . , 𝑚𝑞,𝜈0−1, append toΨa column of the form([𝑠^′−1 zeros], 𝐿_𝛼,𝜅^𝑘 ,0)^T and attach to it the index𝜈₀.

(iii) ComputeΠ=𝑃˜(𝜈₀, 𝜈₁)by binary splitting.

(iv) SetΨ=Π•Ψ.

(d) Compute the setEof roots of𝑞inZ_𝑝. Fail if|E |<deg𝑞.

(e) For each𝑐 in the last row ofΨ and each𝛾^∗ ∈ E, append to ˜Φthe column vector of coefficients of𝑐(𝑢/𝑣, 𝜏𝛾^∗, 𝛾^∗+𝜈) mod 𝜋^𝜎, cf. (14), where𝜈is the index attached to the column ofΨ.

(5) Return ˜Φ.

of the coefficients𝑓𝑗,𝜈,𝑘 for which(𝛿𝑗+𝜈, 𝑘) ∈𝐸is nonzero, and one can take𝜅𝑗 ≤Í

𝛿𝑖−𝛿𝑗∈Z𝜇(𝛿𝑖).

Moreover, by [19, Prop. 3], the relation (7) holds for the series (12) when𝑓𝑗,𝜈is interpreted as the vector(𝑓_{𝑗,𝜈,𝑘})_{0≤𝑘<𝜅𝑗} and𝑛is set to𝛿𝑗+𝜈+ΛwhereΛis the operator mapping(𝑐_𝑘)_𝑘to(𝑐_𝑘+1)_𝑘. In other words, with𝑄𝑗 =𝑏𝑗0+𝑗 and𝑠^′=𝑠−𝑗₀, one has, for all𝑗 ∈ {1, . . . , 𝑟}and𝜈∈Z,

𝑄0(𝛿𝑗 +𝜈+Λ) (𝑓_{𝑗,𝜈,𝑘})_𝑘+ · · · +𝑄𝑠^′(𝛿𝑗+𝜈+Λ) (𝑓𝑗,𝜈−𝑠^′,𝑘)_𝑘 =0. (13) Making the bridge between these formal solutions and actual analytic solutions is the subject of the Dwork-Robba theory of𝑝-adic exponents [e.g., 13, §13]. While the general case seems difficult to attack, when the exponents𝛿𝑗 all lie inZ𝑝, the formal expression (12) does define an analytic function on each ball of the form{𝑥₀(1+𝜉):|𝜉|𝑝 <1}with|𝑥₀|𝑝 <𝜌for a suitable𝜌 >0, and binary splitting methods adapt, making it possible to evaluate the fundamental matrixΦ₀(𝑡)= ¹

𝑖!𝑓_𝑗^(𝑖)(𝑡) on any such ball in essentially linear time. We must limit ourselves here to a succinct description of the algorithm, leaving for future work a complete proof and complexity analysis (which however proceed along the same lines as in §4.1, see [18] for some details in the complex setting).

The procedure is summarized in Algorithm 3. Its input is similar to that of Algorithm 1, with the understanding that the number of terms𝑁 to be computed now applies separately to each set of solutions 𝑓𝑗 whose exponents𝛿𝑗 differ by integers. (We assume for simplicity that 𝑁 ≥ max({𝛿𝑖−𝛿_𝑗}∩Z).) The differences with Algorithm 1 come from the need to deal with exponents𝛿𝑗

lying inZ_𝑝and with logarithmic terms.

Exponents inZ_𝑝 cause no serious trouble. The only subtlety is that, in order to keep the bit size of the coefficients of (13) small, we represent the𝛿𝑗 as elements of formal integral extensions ofO_𝐾^ex. This is the role of step 4a. Computations performed in this representation are shared be- tween solutions 𝑓𝑗 that are Galois conjugates of each other, which roughly offsets the overhead of arithmetic in extension rings. When no two exponents𝛿𝑗 differ by an element ofZ, all𝜅𝑗 are