Certifying the Floating-Point Implementation of an Elementary Function Using Gappa

Abstract

High confidence in floating-point programs requires proving numerical properties of final and intermediate values.One may need to guarantee that a value stays within some range, or that the error relative to some ideal value is well bounded. Such work may require several lines of proof for each line of code, and will usually be broken by the smallest change to the code (e.g. for maintenance or optimization purpose). Certifying these programs by hand is therefore very tedious and error-prone. This article discusses the use of the Gappa proof assistant in this context. Gappa has two main advantages over previous approaches: Its input format is very close to the actual C code to validate, and it automates error evaluation and propagation using interval arithmetic. Besides, it can be used to incrementally prove complex mathematical properties pertaining to the C code. Yet it does not require any specific knowledge about automatic theorem proving, and thus is accessible to a wide community. Moreover, Gappa may generate a formal proof of the results that can be checked independently by a lower-level proof assistant like Coq, hence providing an even higher confidence in the certification of the numerical code. The article demonstrates the use of this tool on a real-size example, an elementary function with correctly rounded output.

Code Generators for Mathematical Functions

“…However, the most accurate implementations are found in open-source efforts, with several correctly rounded functions provided by libraries such as IBM LibUltim [15] (now in the glibc) and more recently CRLibm [16].…”

“…Gappa [16] is a formal proof assistant that is able to manage the accumulation of floating-point errors in most of libm codes. Compared to [16], in the present work the Gappa proof scripts are not written by hand, but generated along with the C code.…”

“…Compared to [16], in the present work the Gappa proof scripts are not written by hand, but generated along with the C code. Interestingly, Gappa is itself a generator (it generates Coq or HOL formal proofs).…”

Built-in Treatment of an Axiomatic Floating-Point Theory for SMT Solvers

“…, I n are intervals with numerical bounds. Actually, Gappa handles more predicates than just membership in an interval [6], but for the sake of simplicity, they will not be mentioned here.…”

“…It automatizes the proofs in a highly efficient way, as long as the verification conditions only deal with arithmetic constructs [6]. Unfortunately, some program constructs tend to leak into the verification conditions and obfuscate the arithmetic constructs Gappa relies on.…”