Logosphere A Digital Library of Formal Proof Carsten Schürmann Processor Verification • INTEL (HOL/HOL light). [John Harrison] • $500mio Pentium bug. • AMD (ACL2, Nqthm). [Matt Kaufmann] • Siemens, Microsoft (ASM). [Yuri Gurevich] Newton-Raphson iteration or power series expansion, and it Yet since the error bounds are necessarily pessimistic, as- culminates in a final fma that rounds a ‘result before the fi- suming worst-case rounding errors reinforcing each other nal rounding’ . In general, may be irrational, whereas on all the previous operations, it seems quite likely that the the final is of the form for some floating-point algorithm is in fact correct. How can we bridge the gap? numbers , and and is therefore always rational. This One solution is to utilize more refined theorems [32], shows that in general we cannot expect . However but this is complicated and may still fail to justify several we do require that they always round in the same way. How algorithms that are intuitively believed to work correctly. might this be proved? An ingenious alternative [11] is to observe that there are On general grounds we note that cannot be exactly relatively few cases like whose square roots the midpoint between two floating-point numbers, because come close enough to render the simple theorem inappli- in a floating-point format with bits of precision, a mid- cable, and these can be isolated by fairly straightforward point value has significant digits and therefore its number-theoretic methods. We can therefore: square more than . This is a useful observation. We’ll never be in the tricky case where theNreewatroen-tRwapohseoqn uitearlaltiyoncolropsoewer series expanIssionl,aatned itthe sYpeet csinacle cthaeseerrsor bounds are nectehssaatrilyhapvesesimsiqstuica, raes- floating-point numbers (resolved bcyulmtihneates‘rinoaufinndal ftomaethvaet nro’unds a ‘result berfoooretsthewfii-thin stuhmeincgriwtoicrsat-lcadsiesrtoaunncdiengoefrraorms riedinpfoorciinntg. each other rule.) So in round-to-nearest, anndal roundcinogu’ ld.oInngleynerroalu, ndmay be irrational, whereas on all the previous operations, it seems quite likely that the the final is of the form for some floCatoinng-cplouindte froalmgortithhem issiimn fpaclet cothrrecot.rHemow cthanawt ethbreidagelgthoergiatph?m in different ways if there were a midpnuominbetrsbe,twaenedn tahnedmis,thfeorerfore always rational. This One solution is to utilize more refined theorems [32], will give correct results except possibly for . only then could the closest floating-shpoowisntthant uinmgebneerrasl wtoe ctahnneomt expect . However but this is complicated and may still fail to justify several we do require that they always round in the same way. How algorithms that are intuitively believed to work correctly. differ. For example in the followinmgigdhtiathgisrbaemprowvehde? re large Explicitly shAonwingthenatiousthaleteranalgtivoer[ith11]mis tios ocboserrectrve thatfothrerethaere lines indicate floating-point numbers aOnndgesnmeraallglerorunodns ewse rneopte-that cannot be exactly relatively few cases like whose square roots the midpoint between two floating-point numbers, because (ecofmfeecctliovseleynobuyghrtuonrennidnegr tihteosinmpthleotsheorienmpuintasp)p.li- resent midpoints, would round ‘indoa wflona’tinwg-hpoilinet formawt owuithld bits of precision, a mid- cable, and these can be isolated by fairly straightforward round ‘up’: FormalpoinVt erificationvalue hasat Intel significant digits andBtyhesreofomreeitsstraignhutmfboerrw-thaerodretmic amtehtheomds.aWtiecsca[n1t1he]reffoorem: alized in Newton-Raphson iteration or power series expansion, and it Yet since the esrqrour aboruendms aorerenectehsasanrily p.essTimhisitsic,iass-a useful observation. We’ll culminates in a final fma that rounds a ‘result before the fi- suming worst-case rounding errors reinforcing each other HOL without particular difficulty, one can show that the dif- nal rounding’ . In general, may be irrational, whereas on all the previnoeusvoepJreorbhatneioHninas,rritithssoenemtrsicqukitye lcikaeslyethwaththeere there are two equally close Isolate the special cases that have square the final is of the form for some floating-point algorithm is inflfIanoctetalctoCirnorergpc-to.prHaotoioiwnn,ctaJnFn1wu-1em3brbidegresthe(graeps?olved by thefic‘ruoultndcatoseesvefno’ r squarerorootsowtisthhinatvheecsriitgicnalidfiisctanncde sof a,mcidopnosinitd. ered numbers , and and is therefore always rational. This One solution 2is11to1 NutEiliz2e5tmh oArveenreufiened theorems [32], rule.) So in round-to-nearest, and could only round shows that in general we cannot expect . However but this is complicatedHillsbanordomOayR, stillUSAfail to justify several as -bit integers, suchCotnhcalutdoenfreomofthtehseimfpolelltoheworienmgthdaitothpehaalgnotriinthem we do require that they always round in the same way. How algorithms jthoaihtnnarhde@iiifnftcuehitrievpenslyt.wbienlaiteyveseld.iftcotohwmeorrkecworreerctelya. midpoint between them, for might this be proved? An ingenious alternative [11] is to observe that there are equations has a solutiwoilnl givefcoorrrseoctmreseulitns etxecgeeptrpossibly for , where. On general gWhat’rounds we note that cannot besexactly Intelrelatively few coanselsyl iktehupen could t hwehto?ocselosqsuearsetroflootsating-point numbers to them the midpointAbetlwtehenotwuo gflohating-paoinntanulmybezrsi,nbegcause tAhbsictsroamcet ccloosenenddouiigfthfietor.rnenFdoer ctrheocextlsyamimomnpbapllelliptehonsesioainbreltemotinhpirneuatisp.afpoTllhil-illsoyinwvolivnesgfordmiinaggmraathimes- wroheureghlalrygethe factoExrpblicitlyy whshiocwh ththate thgeualgraonrithtemedisrceolrrectativfoe retrh-e in a floating-point format with bits of precision, a mid- cable, and thelseinceans biendisoiclaatemtdeatbicflyalofmaaiortdliyenlssgotrf-atpihgeohstyifsnotretwmnaarnuddmitsbineternsdedabnedhavsiomr anadller ones rep- point value has significant digits aAnsddethsiegrnesfobreecoimtse morencuommbpleerx-,thfoeromreatlicvemrifiecthatoiodns. Welcinaknintghethre ftworoe:: ror is excessive: (effectively by running it on those inputs). squarewmooreuthland . bTehis ics oa umsefpul loteibccshenraiqvuatetiesonadr.e,Wbeetc’ohlml iengriencreaissinglyaimpmorretausntecninhtthme sidimpoipnltse,r suwfofiucldieronutnd ‘down’ while would never be in the tricky case where there arheatrwdwoaerequinadlulystrcyl.oMseany different Imseotlhaotdestahree usspeedc,iraalngc-ases that havAectusqaluraerqeuirements condition. One cinag fnrom eproapossiitilonyal tasuteoloegy ctrhhoeockatisntwg uitiphrtitnowtuheneuocdsreiut‘oiucflapldd’i:sstanucefofif acmeidptooint.show By some straightforward mathematics [11] formalized in floating-point numbers (resolved by thinete‘rraocutinvedhtigoheerv-oernd’er theorem provers. Our own work is rule.) SoHOLin round-to-ne ar es t, an d co u ld o nl y ro un d [Harrison’03] mainly concerned with the formalCvoernificcluadtioenfroofmflotahtiengs-imple theorem that the algorithm HOL without particular difficulty, one can show that the dif- in diffetrehntawtayfs iof trherae wneyre ammidipdoinpptoboientwimneaethntetmhaetmica,:lfofurnctions. As this paper aims to illus- Mathematical specification will give correct results except possibly for . only then could the closest floating-pointrtanteu,msubcherasptpolictahteiomns require a rather general mathemat- ficult cases for square roots have significands , considered ical framework and the ability to automate special-purpose differ. For example in the following diagram where large Explicitly show that the algorithm is correct for the as -bit integers, such that one of the following diophantine lines indiFloatingcate floating-point num bPersointanpdrosomf aallge orroarithmeticitnhmess rienpa- reliable way. Our w.ork uses the Mathematical model We consider the equations separately for each chosen public-domain interactive theorem prover HOL(Lefigfehct,tiavnedly by running it on those inputs). equations has a solution for some integer , where resent midpoints, would round ‘dowwne’cwlahimilethat thwisoaunld similar ‘LCF-style’ theorem provers round ‘up’: . For example, we might be interested in whether are a good choice for such applicBaytiosnosm. e straighAtfolrtwhaordumgahthemaatnicasl[y11z]ifnorgmalActuitzhedialsinsystemcondition combinatorially is roughly the factor by which the guaranteed relative er- HOL without particular difficulty, one can show that the dif- ror is excessive: In that case and coficuullt dcasnes’fotrwlsqioueaurelodronobtsehoacvpoe spmigonpilfisicciaantdetseds,,ciodtnhseiedreseredoisfa much simpler sufficient has a solution. If so, the possible value(s) 1 Formal Verificationas -bit integercs,osnucdhitthiaot non.e Oof ntThheeeffcoalcaltosnwthieantag(sid)igolepythtiansngetaienmetahthaemtaititcawl prooouflrdighst uisffice to show . Here is the formal theorem in HOL in aalso dmifficoultr[e13], ganed (nii)ecorrraecltness of formaol mfodels are added to the set of difficult cases. It’s quite easy equations has athsoaluttifoonr afonrysomeiidnpteogeirnt : , where Although analyzing this condition Acsomobsitnpartoogrriaamllmy ers knowistorothuegirhRoundclyostth, ewfriatcintgorpbroy- wh icdhtheoethsenogtunaer caensamesstaereidlyriemlaptlyivceoerr re-cwatness of tyhe actifual system [15], were called on to denigrate the idea of formal verifi- would fboe crompl:icated, there is a muchgrsaimmsptlheart sfunffictcioiennctorrectlryorinisaellxciercsusimvset:ances — or to program HOL to enumerate all the solutions of such dio- sometimes even saying precisely what that means — is dif- cation in the 70s. However, these objections seem to have