Deductive Verification of Floating-Point Java Programs in KeY

Abstract

Deductive verification has been successful in verifying interesting properties of real-world programs. One notable gap is the limited support for floating-point reasoning. This is unfortunate, as floating-point arithmetic is particularly unintuitive to reason about due to rounding as well as the presence of the special values infinity and ‘Not a Number’ (NaN). In this paper, we present the first floating-point support in a deductive verification tool for the Java programming language. Our support in the KeY verifier handles arithmetic via floating-point decision procedures inside SMT solvers and transcendental functions via axiomatization. We evaluate this integration on new benchmarks, and show that this approach is powerful enough to prove the absence of floating-point special values—often a prerequisite for further reasoning about numerical computations—as well as certain functional properties for realistic benchmarks.

The Integration of Testing and Program Verification

“…Challenge 10 (Language Features). In order to make deductive verification usable in an industrial setting, the verifiers need to extend their support for different language features, such as exception support (see [33] for initial ideas in this direction), floating point numbers (currently partially supported by some tools, such as KeY [2], Frama-C [29] and Why3 [15]), strings, input/output, reflection, streams, and logging mechanisms. Part of this is an engineering effort, but to support verification of for example reflection and streams, also new verification techniques need to be developed.…”