Abstract. Sollya has become a mature tool for the development of numerical software. With about 175 built-in algorithms and a broad extensibility, it offers a complete tool-chain for fixed-and floating-point software and hardware design. Its features include on-the-fly faithful rounding, specialized approximation algorithms and extensive support for floating-point code generation.

High confidence in floating-point programs requires proving numerical properties of final and intermediate values.One may need to guarantee that a value stays within some range, or that the error relative to some ideal value is well bounded. Such work may require several lines of proof for each line of code, and will usually be broken by the smallest change to the code (e.g. for maintenance or optimization purpose). Certifying these programs by hand is therefore very tedious and error-prone. This article discusses the use of the Gappa proof assistant in this context. Gappa has two main advantages over previous approaches: Its input format is very close to the actual C code to validate, and it automates error evaluation and propagation using interval arithmetic. Besides, it can be used to incrementally prove complex mathematical properties pertaining to the C code. Yet it does not require any specific knowledge about automatic theorem proving, and thus is accessible to a wide community. Moreover, Gappa may generate a formal proof of the results that can be checked independently by a lower-level proof assistant like Coq, hence providing an even higher confidence in the certification of the numerical code. The article demonstrates the use of this tool on a real-size example, an elementary function with correctly rounded output.

The implementation of a correctly rounded or interval elementary function needs to be proven carefully in the very last details. The proof requires a tight bound on the overall error of the implementation with respect to the mathematical function. Such work is function specific, concerns tens of lines of code for each function, and will usually be broken by the smallest change to the code (e.g. for maintenance or optimization purpose). Therefore, it is very tedious and error-prone if done by hand. This article discusses the use of the Gappa proof assistant in this context. Gappa has two main advantages over previous approaches: Its input format is very close to the actual C code to validate, and it automates error evaluation and propagation using interval arithmetic. Besides, it can be used to incrementally prove complex mathematical properties pertaining to the C code. Yet it does not require any specific knowledge about automatic theorem proving, and thus is accessible to a wider community. Moreover, Gappa may generate a formal proof of the results that can be checked independently by a lowerlevel proof assistant like Coq, hence providing an even higher confidence in the certification of the numerical code.

This article is a case study in the implementation of a portable, proven and efficient correctly rounded elementary function in double-precision. We describe the methodology used to achieve these goals in the crlibm library. There are two novel aspects to this approach. The first is the proof framework, and in general the techniques used to balance performance and provability. The second is the introduction of processor-specific optimizations to get performance equivalent to the best current mathematical libraries, while trying to minimize the proof work. The implementation of the natural logarithm is detailed to illustrate these questions.Keywords: floating-point, elementary functions, logarithm, correct rounding Résumé Cet article montre comment implémenter une fonctionélémentaire efficace avec arrondi correct prouvé en double-précision. La méthodologie employée dans ce but par la bibliothèque crlibm présente deux aspects novateurs. Le premier concerne la preuve de l'arrondi correct, et plus généralement les techniques employées pour gérer les compromis entre performance et facilité de preuve. Le second est l'utilisation d'optimisations utilisant des caractéristiques les plus avancées des processeurs, ce qui permet d'obtenir une performanceéquivalente aux meilleures implémentations existantes. L'implémentation du logarithme népérien est décrite en détailà titre d'illustration. Mots-clés: virgule flottante, fonctionsélémentaires, logarithme, arrondi correctFast and correctly rounded logarithms in double-precision 1

The high-quality floating-point implementation of useful functions f : R → R, such as exp, sin, erf requires bounding the error ε = p−f f of an approximation p with regard to the function f . This involves bounding the infinite norm ε ∞ of the error function. Its value must not be underestimated when implementations must be safe. Previous approaches for computing infinite norm are shown to be either unsafe, not sufficiently tight or too tedious in manual work. We present a safe and self-validating algorithm for automatically upper-and lower-bounding infinite norms of error functions. The algorithm is based on enhanced interval arithmetic. It can overcome high cancellation and high condition number around points where the error function is defined only by continuous extension. The given algorithm is implemented in a software tool. It can generate a proof of correctness for each instance on which it is run. Keywords: Certified infinite norm, interval arithmetic, elementary functionsRésumé Pour garantir la qualité de l'implémentation en arithmétique flottante de fonctions usuelles f : R → R telles que exp, sin, erf, il faut borner l'erreur ε = p−f f commise entre f et une approximation p. Cela implique de borner la norme infinie ε ∞ de la fonction d'erreur. Si on veut que l'implémentation soit sure, on ne doit en aucun cas renvoyer une borne inférieureà la valeur exacte. Nous montrons que les approches précédentes visantà calculer la norme infinie ne sont pas satisfaisantes : soit elles ne sont pas sures, soit pas assez précises, soit elles nécessitent un travail manuel trop fastidieux. Nous présentons un algorithme sûr, qui fournit une preuve de sa propre correction, et qui minore et majore automatiquement la norme infinie de fonctions d'erreur. Cet algorithme est fondé sur une version améliorée d'arithmétique d'intervalle. Il peut contourner les difficultés duesà une grande cancellation et un mauvais conditionnement autour de points où la fonction d'erreur n'est définie que par continuité. L'algorithme proposé aété implémenté dans un outil logiciel. Il peut générer une preuve de correction pour toute instance sur laquelle il est exécuté.

In this paper, we present an efficient algorithm to compute the faithful rounding of the l 2-norm of a floatingpoint vector. This means that the result is accurate to within one bit of the underlying floating-point type. This algorithm does not generate overflows or underflows spuriously, but does so when the final result indeed calls for such a numerical exception to be raised. Moreover, the algorithm is well suited for parallel implementation and vectorization. The implementation runs up to 3 times faster than the netlib version on current processors.

Abstract-The worst-case peak gain (WCPG) of an LTI filter is an important measure for the implementation of signal processing algorithms. It is used in the error propagation analysis for filters, thus a reliable evaluation with controlled precision is required. The WCPG is computed as an infinite sum and has matrix powers in each summand. We propose a direct formula for the lower bound on truncation order of the infinite sum in dependency of desired truncation error. Several multiprecision methods for complex matrix operations are developed and their error analysis performed. We present a multiprecision complex matrix inversion algorithm using Newton-type iteration, along with its error analysis and proof of convergence. A multiprecision matrix powering method is presented. All methods yield a rigorous solution with an absolute error bounded by an a priori given value. The results are illustrated with numerical examples.

Abstract-A typical floating-point environment includes support for a small set of about 30 mathematical functions such as exponential, logarithms and trigonometric functions. These functions are provided by mathematical software libraries (libm), typically in IEEE754 single, double and quad precision.This article suggests to replace this libm paradigm by a more general approach: the on-demand generation of numerical function code, on arbitrary domains and with arbitrary accuracies.First, such code generation opens up the libm function space available to programmers. It may capture a much wider set of functions, and may capture even standard functions on nonstandard domains and accuracy/performance points.Second, writing libm code requires fine-tuned instruction selection and scheduling for performance, and sophisticated floatingpoint techniques for accuracy. Automating this task through code generation improves confidence in the code while enabling better design space exploration, and therefore better time to market, even for the libm functions.This article discusses, with examples, the new challenges of this paradigm shift, and presents the current state of open-source function code generators.