Assisted verification of elementary functions using Gappa

Abstract

The implementation of a correctly rounded or interval elementary function needs to be proven carefully in the very last details. The proof requires a tight bound on the overall error of the implementation with respect to the mathematical function. Such work is function specific, concerns tens of lines of code for each function, and will usually be broken by the smallest change to the code (e.g. for maintenance or optimization purpose). Therefore, it is very tedious and error-prone if done by hand. This article discusses the use of the Gappa proof assistant in this context. Gappa has two main advantages over previous approaches: Its input format is very close to the actual C code to validate, and it automates error evaluation and propagation using interval arithmetic. Besides, it can be used to incrementally prove complex mathematical properties pertaining to the C code. Yet it does not require any specific knowledge about automatic theorem proving, and thus is accessible to a wider community. Moreover, Gappa may generate a formal proof of the results that can be checked independently by a lowerlevel proof assistant like Coq, hence providing an even higher confidence in the certification of the numerical code.

Mapping for Maximum Performance on FPGA DSP Blocks

“…Gappa [2] is a tool intended for verification and formal proof generation on numerical expressions, supporting both fixedpoint and floating-point arithmetic. It can generate tight bounds on computational errors at intermediate and output nodes, and can be used for output range determination for given input ranges.…”

“…We show that generic RTL mapped in this manner achieves identical performance to code that instantiates the DSP48E1 primitives directly. We have also integrated the open-source tool Gappa [2] to allow us to investigate resulting truncation errors and optimise allocation of signals to the different DSP block inputs. The proposed mapping approach can be incorporated into a high-level synthesis flow to allow arithmetic-intensive inner loops to be mapped for maximum throughput.…”

Combining Coq and Gappa for Certifying Floating-Point Programs

“…8 is a tool dedicated to proving arithmetic properties on numerical programs [18,19]. Given a logical proposition expressing bounds on mathematical real-valued expressions, Gappa checks that it holds.…”

When FPGAs are better at floating-point than microprocessors

“…For instance, there is some hope to be able to infer the required size of a large accumulator automatically, or at least with machine assistance. The Gappa proof assistant has already been used to help validate complex datapaths for elementary function implementations [5]. The goal of (FPG) 2 A is to build upon such tools.…”