Formal Verification of Floating-Point programs Sylvie Boldo and - - PowerPoint PPT Presentation

▶
formal verification of floating point programs
SMART_READER_LITE
LIVE PREVIEW

Formal Verification of Floating-Point programs Sylvie Boldo and - - PowerPoint PPT Presentation

Oct 13, 2023 20 likes •412 views

Formal Verification of Floating-Point programs Sylvie Boldo and Jean-Christophe Filli atre Montpellier June, 26th 2007 INRIA Futurs CNRS, LRI Existing tools Model and specification of FP numbers Examples Conclusion Motivations

slide-1
SLIDE 1

Formal Verification of Floating-Point programs

Sylvie Boldo and Jean-Christophe Filliˆ atre

Montpellier – June, 26th 2007 INRIA Futurs CNRS, LRI

slide-2
SLIDE 2

Existing tools Model and specification of FP numbers Examples Conclusion

Motivations

Goal: reliability in numerical software

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-3
SLIDE 3

Existing tools Model and specification of FP numbers Examples Conclusion

Motivations

Goal: reliability in numerical software Tool: formal proofs

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-4
SLIDE 4

Existing tools Model and specification of FP numbers Examples Conclusion

Motivations

Goal: reliability in numerical software Tool: formal proofs Drawback: we were not checking the real program

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-5
SLIDE 5

Existing tools Model and specification of FP numbers Examples Conclusion

Motivations

Goal: reliability in numerical software Tool: formal proofs Drawback: we were not checking the real program ⇒ put together existing tools ⇒ check what is really written by programmers

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-6
SLIDE 6

Existing tools Model and specification of FP numbers Examples Conclusion

Outline

Existing tools Caduceus Formalization of floats Model and specification of FP numbers Examples Conclusion

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-7
SLIDE 7

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

What is Caduceus?

The method is to annotate the C program

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-8
SLIDE 8

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

What is Caduceus?

The method is to annotate the C program We add pre-conditions and post-conditions to functions We add variants, invariants, assertions

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-9
SLIDE 9

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

What is Caduceus?

The method is to annotate the C program We add pre-conditions and post-conditions to functions We add variants, invariants, assertions The tool generates proof obligations (such as Coq theorems) associated to the user annotations The proof of the verification conditions ensures that the program meets its specification

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-10
SLIDE 10

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Caduceus

Java Java C

slide-11
SLIDE 11

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Caduceus

Java Java C Krakatoa Krakatoa Caduceus Caduceus

slide-12
SLIDE 12

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Caduceus

Java Java C Krakatoa Krakatoa Caduceus Caduceus Why Why

slide-13
SLIDE 13

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Caduceus

Java Java C Krakatoa Krakatoa Caduceus Caduceus Why Why Coq Coq PVS PVS HOL HOL Mizar Mizar Proof obligations Proof obligations

slide-14
SLIDE 14

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Caduceus

Java Java C Krakatoa Krakatoa Caduceus Caduceus Why Why Coq Coq PVS PVS HOL HOL Mizar Mizar Proof obligations Proof obligations Simplify Simplify haRVey haRVey CVC CVC

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-15
SLIDE 15

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Example: search in an array

int index ( int t [ ] , int n , int v ) { int i = 0; while ( i < n) { i f ( t [ i ] == v ) break ; i ++; } return i ; }

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-16
SLIDE 16

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Example: search in an array

/*@ requires \valid_range(t,0,n-1) @ ensures @ (0 <= \result < n => t[\result] == v) && @ (\result == n => @ \forall int i; 0 <= i < n => t[i] != v) */ int index ( int t [ ] , int n , int v ) { int i = 0; /*@ invariant 0 <= i && @ \forall int k; 0 <= k < i => t[k] != v @ variant n - i */ while ( i < n) { i f ( t [ i ] == v ) break ; i ++; } return i ; }

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-17
SLIDE 17

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Existing tools Caduceus Formalization of floats Model and specification of FP numbers Examples Conclusion

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-18
SLIDE 18

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Coq formalization (by Daumas, Rideau, Th´ ery)

Float = pair of signed integers (mantissa, exponent)

(n, e) ∈ Z2

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-19
SLIDE 19

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Coq formalization (by Daumas, Rideau, Th´ ery)

Float = pair of signed integers (mantissa, exponent) associated to a real value

(n, e) ∈ Z2 ֒ → n × βe ∈ R

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-20
SLIDE 20

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Coq formalization (by Daumas, Rideau, Th´ ery)

Float = pair of signed integers (mantissa, exponent) associated to a real value

(n, e) ∈ Z2 ֒ → n × βe ∈ R

1.000102 E 4 → (1000102, −1)2 ֒ → 17 IEEE-754 significant of 754R real value ⇒ normal floats, subnormal floats, cohorts, overflow

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-21
SLIDE 21

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Partial Conclusion

◮ We have all the needed tools

◮ program → formal theorem (obligations) ◮ formal float, formal rounding. . . Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-22
SLIDE 22

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Partial Conclusion

◮ We have all the needed tools

◮ program → formal theorem (obligations) ◮ formal float, formal rounding. . .

◮ We have to merge them to get a tool:

program → formal theorem on FP arithmetic

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-23
SLIDE 23

Existing tools Model and specification of FP numbers Examples Conclusion Caduceus Formalization of floats

Partial Conclusion

◮ We have all the needed tools

◮ program → formal theorem (obligations) ◮ formal float, formal rounding. . .

◮ We have to merge them to get a tool:

program → formal theorem on FP arithmetic

◮ We have to decide how to specify a FP program!

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-24
SLIDE 24

Existing tools Model and specification of FP numbers Examples Conclusion

Existing tools Caduceus Formalization of floats Model and specification of FP numbers Examples Conclusion

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-25
SLIDE 25

Existing tools Model and specification of FP numbers Examples Conclusion

Caduceus’s model of FP numbers

A “program” float is a triple:

◮ the floating-point number, as computed by the program,

x → xf floating-point part

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-26
SLIDE 26

Existing tools Model and specification of FP numbers Examples Conclusion

Caduceus’s model of FP numbers

A “program” float is a triple:

◮ the floating-point number, as computed by the program,

x → xf floating-point part

◮ the value if all previous computations were exact,

x → xe exact part

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-27
SLIDE 27

Existing tools Model and specification of FP numbers Examples Conclusion

Caduceus’s model of FP numbers

A “program” float is a triple:

◮ the floating-point number, as computed by the program,

x → xf floating-point part

◮ the value if all previous computations were exact,

x → xe exact part

◮ the ideally computed value

x → xm model part

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-28
SLIDE 28

Existing tools Model and specification of FP numbers Examples Conclusion

Caduceus’s model of FP numbers (II)

Program features

◮ types for single and double precision floats ◮ roundings that may be switched ◮ basic operations ◮ . . .

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-29
SLIDE 29

Existing tools Model and specification of FP numbers Examples Conclusion

Caduceus’s model of FP numbers (II)

Program features

◮ types for single and double precision floats ◮ roundings that may be switched ◮ basic operations ◮ . . .

Specification features

◮ computations are exact inside annotations ◮ access to the exact and model parts ◮ round error and total error macros

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-30
SLIDE 30

Existing tools Model and specification of FP numbers Examples Conclusion

Existing tools Caduceus Formalization of floats Model and specification of FP numbers Examples Conclusion

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-31
SLIDE 31

Existing tools Model and specification of FP numbers Examples Conclusion

Example 1: exact subtraction

f l o a t Sterbenz ( f l o a t x , f l o a t y ){ return x−y ; }

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-32
SLIDE 32

Existing tools Model and specification of FP numbers Examples Conclusion

Example 1: exact subtraction

/*@ requires y/2 <= x <= 2*y @ ensures \result == x-y @*/ f l o a t Sterbenz ( f l o a t x , f l o a t y ){ return x−y ; }

(44 lines of Coq)

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-33
SLIDE 33

Existing tools Model and specification of FP numbers Examples Conclusion

Example 2: Malcolm’s Algorithm

double malcolm () { double A, B; A=2; while (A != (A+1)) A∗=2; B=1; while ((A+B)−A != B) B++; return B; }

(747 lines of Coq)

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-34
SLIDE 34

Existing tools Model and specification of FP numbers Examples Conclusion

Example 2: Malcolm’s Algorithm

/*@ ensures \result == 2 */ double malcolm () { double A, B; A=2; /*@ assert A==2 */ /*@ invariant A == 2 ^^ my_log(A) @ && 1 <= my_log(A) <= 53 @ variant (53-my_log(A)) */ while (A != (A+1)) A∗=2; /*@ assert A == 2 ^^ (53) */ B=1; /*@ assert B==1 */ /*@ invariant B == IRNDD(B) && 1 <= B <= 2 @ variant (2-IRNDD(B)) */ while ((A+B)−A != B) B++; return B; }

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-35
SLIDE 35

Existing tools Model and specification of FP numbers Examples Conclusion

Example 3: stupid exponential computation

double my exp ( double x ) { double y=1+x∗(1+x /2); return y ; }

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-36
SLIDE 36

Existing tools Model and specification of FP numbers Examples Conclusion

Example 3: stupid exponential computation

/*@ requires |x| <= 2 ^^ (-3) @ ensures \model(\result)==exp(\model(x)) @ && (\round_error(x)==0 @ => \round_error(\result) @ <= 2 ^^ (-52)) @ && \total_error(\result) @ <= \total_error(x) @ + 2 ^^ (-51) */ double my exp ( double x ) { double y=1+x∗(1+x /2); /*@ \set_model y exp(\model(x)) */ return y ; }

(unproved)

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-37
SLIDE 37

Existing tools Model and specification of FP numbers Examples Conclusion

Existing tools Caduceus Formalization of floats Model and specification of FP numbers Examples Conclusion

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-38
SLIDE 38

Existing tools Model and specification of FP numbers Examples Conclusion

Conclusion

Advantages ⊕ a way to specify and formally prove a FP program ⊕ includes all other aspects of program verification ⊕ with or without Overflow ⊕ intuitive specification

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs

slide-39
SLIDE 39

Existing tools Model and specification of FP numbers Examples Conclusion

Conclusion

Advantages ⊕ a way to specify and formally prove a FP program ⊕ includes all other aspects of program verification ⊕ with or without Overflow ⊕ intuitive specification Drawbacks ⊖ no NaNs, no ±∞ ⊖ no exception, no flag ⊖ no way to detect compiler optimizations ⊖ fails on Intel architectures (no way to predict if 53 or 80 bits are used)

Sylvie Boldo & Jean-Christophe Filliˆ atre Formal Verification of Floating-Point programs