the Correctness of math.h Implementations Wonyeol Lee 1,2 Rahul - PowerPoint PPT Presentation

Previous Work • Machine-checkable proofs • Harrison used HOL Light to prove [FMCAD’00 ] : “Intel’s sin has precision loss of < 0.574 ulps ” • “Construction of these proofs often requires considerable persistence .” [FMSD’00] • Automatic techniques • Astree [PLDI’03] , Fluctuat [FMICS’09] , Gappa [TOMS’10] , MathSAT [FMCAD’12 ] , Rosa [POPL’14] , FPTaylor [FM’15 ] , Lee/Sharma/Aiken [PLDI’16], ⋯ • None of them can prove < 1 ulp error bound automatically 32 /146

1 + 𝜗 Property • A standard way to model rounding errors • Theorem For any double 𝑏 and 𝑐 , and ∗ ∈ {+, −,×,/} , 𝑏 ⊛ 𝑐 = 𝑏 ∗ 𝑐 1 + 𝜀 for some 𝜀 < 𝜗 • where 𝜗 = 2 −53 That is, 33 /146

1 + 𝜗 Property • A standard way to model rounding errors • Theorem For any double 𝑏 and 𝑐 , and ∗ ∈ {+, −,×,/} , 𝑏 ⊛ 𝑐 = 𝑏 ∗ 𝑐 1 + 𝜀 for some 𝜀 < 𝜗 • where 𝜗 = 2 −53 34 /146

1 + 𝜗 Property • A standard way to model rounding errors • Theorem For any double 𝑏 and 𝑐 , and ∗ ∈ {+, −,×,/} , 𝑏 ⊛ 𝑐 = 𝑏 ∗ 𝑐 1 + 𝜀 for some 𝜀 < 𝜗 • where 𝜗 = 2 −53 That is, 0 1 𝑏 ⊛ 𝑐 35 /146

1 + 𝜗 Property • A standard way to model rounding errors • Theorem For any double 𝑏 and 𝑐 , and ∗ ∈ {+, −,×,/} , 𝑏 ⊛ 𝑐 = 𝑏 ∗ 𝑐 1 + 𝜀 for some 𝜀 < 𝜗 • where 𝜗 = 2 −53 That is, 0 1 𝑏 ⊛ 𝑐 𝑏 ∗ 𝑐 36 /146

1 + 𝜗 Property • A standard way to model rounding errors • Theorem For any double 𝑏 and 𝑐 , and ∗ ∈ {+, −,×,/} , 𝑏 ⊛ 𝑐 = 𝑏 ∗ 𝑐 1 + 𝜀 for some 𝜀 < 𝜗 • where 𝜗 = 2 −53 That is, 𝑏 ∗ 𝑐 1 + 𝜀 ∶ 𝜀 < 𝜗 0 1 𝑏 ⊛ 𝑐 𝑏 ∗ 𝑐 37 /146

1 + 𝜗 Property • A standard way to model rounding errors • Theorem For any double 𝑏 and 𝑐 , and ∗ ∈ {+, −,×,/} , 𝑏 ⊛ 𝑐 = 𝑏 ∗ 𝑐 1 + 𝜀 for some 𝜀 < 𝜗 • where 𝜗 = 2 −53 That is, 𝑏 ∗ 𝑐 1 + 𝜀 ∶ 𝜀 < 𝜗 0 1 𝑏 ⊛ 𝑐 𝑏 ∗ 𝑐 38 /146

Standard Error Analysis • Example: 𝑔 𝑦 = 1 + 𝑦 over 𝑌 = [−0.1, 0.1] 𝑓 = 1 ⊕ 0.5 ⊗ 𝑦 ⟵ implementation of 𝑔 𝑦 1. Construct abstraction 𝐵 𝜀 of 𝑓 : 𝐵 𝜀 𝑦 = 1 + 0.5 × 𝑦 1 + 𝜀 1 1 + 𝜀 2 • 𝐵 𝜀 is a sound abstraction of 𝑓 (or 𝑓 ⊑ 𝐵 𝜀 ): 𝑓 𝑦 ∈ {𝐵 𝜀 𝑦 ∶ 𝜀 1 , 𝜀 2 < 𝜗} for all 𝑦 ∈ 𝑌 39 /146

Standard Error Analysis • Example: 𝑔 𝑦 = 1 + 𝑦 over 𝑌 = [−0.1, 0.1] 𝑓 = 1 ⊕ 0.5 ⊗ 𝑦 ⟵ implementation of 𝑔 𝑦 1. Construct abstraction 𝐵 𝜀 of 𝑓 : 𝐵 𝜀 𝑦 = 1 + 0.5 × 𝑦 1 + 𝜀 1 1 + 𝜀 2 ⊕ ⊗ = • 𝐵 𝜀 is a sound abstraction of 𝑓 (or 𝑓 ⊑ 𝐵 𝜀 ): 𝑓 𝑦 ∈ {𝐵 𝜀 𝑦 ∶ 𝜀 1 , 𝜀 2 < 𝜗} for all 𝑦 ∈ 𝑌 42 /146

Standard Error Analysis • Example: 𝑔 𝑦 = 1 + 𝑦 over 𝑌 = [−0.1, 0.1] 𝑓 = 1 ⊕ 0.5 ⊗ 𝑦 ⟵ implementation of 𝑔 𝑦 1. Construct abstraction 𝐵 𝜀 of 𝑓 : 𝐵 𝜀 𝑦 = 1 + 0.5 × 𝑦 1 + 𝜀 1 1 + 𝜀 2 = • 𝐵 𝜀 is a sound abstraction of 𝑓 (or 𝑓 ⊑ 𝐵 𝜀 ): 𝑓 𝑦 ∈ {𝐵 𝜀 𝑦 ∶ 𝜀 1 , 𝜀 2 < 𝜗} for all 𝑦 ∈ 𝑌 43 /146

Standard Error Analysis • Example: 𝑔 𝑦 = 1 + 𝑦 over 𝑌 = [−0.1, 0.1] 𝑓 = 1 ⊕ 0.5 ⊗ 𝑦 ⟵ implementation of 𝑔 𝑦 2. Compute a bound on relative error of 𝑓 : 𝑔(𝑦)−𝐵 𝜀 𝑦 Θ 𝑠𝑓𝑚 = max 𝑔(𝑦) 𝑦∈ −0.1,0.1 , 𝜀 1 ,𝜀 2 ∈ −𝜗,𝜗 1+𝑦− 1+ 0.5 × 𝑦 1+𝜀 1 1+𝜀 2 = max 1+𝑦 𝑦∈ −0.1,0.1 , 𝜀 1 ,𝜀 2 ∈ −𝜗,𝜗 3. Compute a bound on ulp error of 𝑓 : Θ 𝑣𝑚𝑞 = Θ 𝑠𝑓𝑚 /𝜗 46 /146

Standard Error Analysis • Example: 𝑔 𝑦 = 1 + 𝑦 over 𝑌 = [−0.1, 0.1] 𝑓 = 1 ⊕ 0.5 ⊗ 𝑦 ⟵ implementation of 𝑔 𝑦 2. Compute a bound on relative error of 𝑓 : 𝑔(𝑦)−𝐵 𝜀 𝑦 Θ 𝑠𝑓𝑚 = max 𝑔(𝑦) 𝑦∈ −0.1,0.1 , 𝜀 1 ,𝜀 2 ∈ −𝜗,𝜗 1+𝑦− 1+ 0.5 × 𝑦 1+𝜀 1 1+𝜀 2 = max 1+𝑦 𝑦∈ −0.1,0.1 , 𝜀 1 ,𝜀 2 ∈ −𝜗,𝜗 3. Compute a bound on ulp error of 𝑓 : Θ 𝑣𝑚𝑞 = Θ 𝑠𝑓𝑚 /𝜗 47 /146

Standard Error Analysis • Example: 𝑔 𝑦 = 1 + 𝑦 over 𝑌 = [−0.1, 0.1] 𝑓 = 1 ⊕ 0.5 ⊗ 𝑦 ⟵ implementation of 𝑔 𝑦 2. Compute a bound on relative error of 𝑓 : 𝑔(𝑦)−𝐵 𝜀 𝑦 Θ 𝑠𝑓𝑚 = max 𝑔(𝑦) 𝑦∈ −0.1,0.1 , 𝜀 1 ,𝜀 2 ∈ −𝜗,𝜗 1+𝑦− 1+ 0.5 × 𝑦 1+𝜀 1 1+𝜀 2 = max 1+𝑦 𝑦∈ −0.1,0.1 , 𝜀 1 ,𝜀 2 ∈ −𝜗,𝜗 3. Compute a bound on ulp error of 𝑓 : Θ 𝑣𝑚𝑞 = Θ 𝑠𝑓𝑚 /𝜗 Theorem ErrUlp 𝑏, 𝑐 ≤ ErrRel 𝑏, 𝑐 /𝜗 48 /146

Standard Error Analysis • Example: 𝑔 𝑦 = 1 + 𝑦 over 𝑌 = [−0.1, 0.1] 𝑓 = 1 ⊕ 0.5 ⊗ 𝑦 ⟵ implementation of 𝑔 𝑦 2. Compute a bound on relative error of 𝑓 : 𝑔(𝑦)−𝐵 𝜀 𝑦 Θ 𝑠𝑓𝑚 = max 𝑔(𝑦) 𝑦∈ −0.1,0.1 , 𝜀 1 ,𝜀 2 ∈ −𝜗,𝜗 1+𝑦− 1+ 0.5 × 𝑦 1+𝜀 1 1+𝜀 2 = max 1+𝑦 𝑦∈ −0.1,0.1 , 𝜀 1 ,𝜀 2 ∈ −𝜗,𝜗 3. Compute a bound on ulp error of 𝑓 : Θ 𝑣𝑚𝑞 = Θ 𝑠𝑓𝑚 /𝜗 Theorem ErrUlp 𝑏, 𝑐 ≤ ErrRel 𝑏, 𝑐 /𝜗 49 /146

Standard Error Analysis: Limitation 50 /146

Standard Error Analysis: Limitation Intel’s log 10 14 ⋮ ulp error based on standard input value error analysis error bounds from [PLDI’16] 51 /146

Standard Error Analysis: Limitation Intel’s log 10 14 ⋮ ulp error 3 ulps based on standard input value error analysis error bounds from [PLDI’16] 1 ulp 52 /146

Standard Error Analysis: Limitation Intel’s log 10 14 ⋮ ulp error 4095 4096 , 1 3 ulps based on standard input value error analysis error bounds from [PLDI’16] 1 ulp 53 /146

Why the Loose Error Bound? • Floating-point operations are sometimes exact if 0.125𝑦 ≥ 2 −1022 0.125 ⊗ 𝑦 = 0.125 × 𝑦 𝑦 ⊖ 1 0 = 𝑦 − 1 if 0.5 ≤ 𝑦 ≤ 2 • Standard error analysis constructs imprecise abstractions if 0.125𝑦 ≥ 2 −1022 0.125 ⊗ 𝑦 ⊑ 0.125 × 𝑦 0.125 ⊗ 𝑦 ⊑ 0.125 × 𝑦 (1 + 𝜀) 𝑦 ⊖ 1 0 ⊑ 𝑦 − 1 if 0.5 ≤ 𝑦 ≤ 2 𝑦 ⊖ 1 0 ⊑ 𝑦 − 1 (1 + 𝜀′) 54 /146

Analysis of log 4095 • For 𝑦 ∈ 4096 , 1 , log computes 2 ⊗ 𝑦 ⊖ 255 ⊗ 1 255 128 ⊗ 1 𝑠 𝑦 = 2 ⊕ 2 ⊖ 1 ≈ 𝑦 − 1 128 • and returns 𝑠 𝑦 − 1 2 𝑠 𝑦 2 + ⋯ + 1 7 𝑠 𝑦 7 • Roughly speaking, (precision loss of log ) ≥ (precision loss of 𝑠 𝑦 ) 61 /146

Standard Analysis of log 2 ⊗ 𝑦 ⊖ 255 ⊗ 1 255 128 ⊗ 1 4095 𝑠 𝑦 = 2 ⊕ 2 ⊖ 1 4096 ≤ 𝑦 < 1 128 • Abstraction of 𝑠 𝑦 : 1 + 𝜀 0 − 255 × 1 𝐵 𝜀 𝑦 = 2 × 𝑦 1 + 𝜀 1 1 + 𝜀 2 + ⋯ 128 2 = 𝑦 − 1 + 𝑦 − 255 256 𝜀 1 + ⋯ 00000000000000 • Bound on relative error of 𝑠 𝑦 : 𝑦 − 255 𝐵 𝜀 𝑦 − (𝑦 − 1) 256 max ≥ max 𝜗 . . 𝑦 − 1 𝑦 − 1 4095 4095 4096≤𝑦<1, 𝜀 𝑗 <𝜗 4096≤𝑦<1 66 /146

Standard Analysis of log 2 ⊗ 𝑦 ⊖ 255 ⊗ 1 128 ⊗ 1 255 4095 𝑠 𝑦 = 2 ⊕ 2 ⊖ 1 4096 ≤ 𝑦 < 1 128 • Abstraction of 𝑠 𝑦 : 1 + 𝜀 0 − 255 × 1 𝐵 𝜀 𝑦 = 2 × 𝑦 1 + 𝜀 1 1 + 𝜀 2 + ⋯ 128 2 = 𝑦 − 1 + 𝑦 − 255 256 𝜀 1 + ⋯ 00000000000000 • Bound on relative error of 𝑠 𝑦 : unbounded 𝑦 − 255 𝐵 𝜀 𝑦 − (𝑦 − 1) 256 max ≥ max 𝜗 . . 𝑦 − 1 𝑦 − 1 4095 4095 4096≤𝑦<1, 𝜀 𝑗 <𝜗 4096≤𝑦<1 72 /146

Standard Analysis of log 2 ⊗ 𝑦 ⊖ 255 ⊗ 1 255 128 ⊗ 1 4095 𝑠 𝑦 = 2 ⊕ 2 ⊖ 1 4096 ≤ 𝑦 < 1 128 • Abstraction of 𝑠 𝑦 : 1 + 𝜀 0 − 255 × 1 𝐵 𝜀 𝑦 = 2 × 𝑦 1 + 𝜀 1 1 + 𝜀 2 + ⋯ 128 2 = 𝑦 − 1 + 𝑦 − 255 256 𝜀 1 + ⋯ 00000000000000 10 14 ulps for log near 𝑦 = 1 [PLDI’16] • Bound on relative error of 𝑠 𝑦 : unbounded 𝑦 − 255 𝐵 𝜀 𝑦 − (𝑦 − 1) 256 max ≥ max 𝜗 . . 𝑦 − 1 𝑦 − 1 4095 4095 4096≤𝑦<1, 𝜀 𝑗 <𝜗 4096≤𝑦<1 73 /146

Precise Analysis of log 2 ⊗ 𝑦 ⊖ 255 ⊗ 1 255 128 ⊗ 1 4095 𝑠 𝑦 = 2 ⊕ 2 ⊖ 1 4096 ≤ 𝑦 < 1 128 𝐵′ 𝜀 𝑦 − (𝑦 − 1) 𝑦 − 1 max = max 𝑦 − 1 𝜗 . . 𝑦 − 1 4095 4095 4096≤𝑦<1, 𝜀′ <𝜗 4096≤𝑦<1 0000000000000 = 𝜗 74 /146

Precise Analysis of log exact 2 ⊗ 𝑦 ⊖ 255 ⊗ 1 255 128 ⊗ 1 4095 𝑠 𝑦 = 2 ⊕ 2 ⊖ 1 4096 ≤ 𝑦 < 1 128 75 /146

Precise Analysis of log exact 2 ⊗ 𝑦 ⊖ 255 ⊗ 1 255 128 ⊗ 1 4095 𝑠 𝑦 = 2 ⊕ 2 ⊖ 1 4096 ≤ 𝑦 < 1 128 • More precise abstraction of 𝑠 𝑦 : 𝐵′ 𝜀 𝑦 = 𝑦 − 1 + 𝑦 − 1 𝜀′ 79 /146

Precise Analysis of log exact 2 ⊗ 𝑦 ⊖ 255 ⊗ 1 255 128 ⊗ 1 4095 𝑠 𝑦 = 2 ⊕ 2 ⊖ 1 4096 ≤ 𝑦 < 1 128 • More precise abstraction of 𝑠 𝑦 : 𝐵′ 𝜀 𝑦 = 𝑦 − 1 + 𝑦 − 1 𝜀′ • Tighter bound on relative error of 𝑠 𝑦 : 𝐵′ 𝜀 𝑦 − (𝑦 − 1) 𝑦 − 1 max = max 𝑦 − 1 𝜗 . . 𝑦 − 1 4095 4095 4096≤𝑦<1, 𝜀′ <𝜗 4096≤𝑦<1 0000000000000 = 𝜗 80 /146

Precise Analysis of log exact 2 ⊗ 𝑦 ⊖ 255 ⊗ 1 255 128 ⊗ 1 4095 𝑠 𝑦 = 2 ⊕ 2 ⊖ 1 4096 ≤ 𝑦 < 1 128 • More precise abstraction of 𝑠 𝑦 : 𝐵′ 𝜀 𝑦 = 𝑦 − 1 + 𝑦 − 1 𝜀′ • Tighter bound on relative error of 𝑠 𝑦 : 𝐵′ 𝜀 𝑦 − (𝑦 − 1) 𝑦 − 1 max = max 𝑦 − 1 𝜗 . . 𝑦 − 1 4095 4095 4096≤𝑦<1, 𝜀′ <𝜗 4096≤𝑦<1 0000000000000 = 𝜗 We prove a bound of 0.583 ulps for log 81 /146

Precise Analysis of log exact 2 ⊗ 𝑦 ⊖ 255 ⊗ 1 255 128 ⊗ 1 4095 𝑠 𝑦 = 2 ⊕ 2 ⊖ 1 4096 ≤ 𝑦 < 1 128 • More precise abstraction of 𝑠 𝑦 : To prove the 1 ulp error bound, 𝐵′ 𝜀 𝑦 = 𝑦 − 1 + 𝑦 − 1 𝜀′ • Need to construct more precise abstractions • Tighter bound on relative error of 𝑠 𝑦 : Need to use floating-point exactness results 𝐵′ 𝜀 𝑦 − (𝑦 − 1) 𝑦 − 1 max = max 𝑦 − 1 𝜗 . . 𝑦 − 1 4095 4095 4096≤𝑦<1, 𝜀′ <𝜗 4096≤𝑦<1 0000000000000 = 𝜗 We prove a bound of 0.583 ulps for log 82 /146

Precise Analysis of log exact 2 ⊗ 𝑦 ⊖ 255 ⊗ 1 255 128 ⊗ 1 4095 𝑠 𝑦 = 2 ⊕ 2 ⊖ 1 4096 ≤ 𝑦 < 1 128 • More precise abstraction of 𝑠 𝑦 : To prove the 1 ulp error bound, 𝐵′ 𝜀 𝑦 = 𝑦 − 1 + 𝑦 − 1 𝜀′ • Need to construct more precise abstractions • Tighter bound on relative error of 𝑠 𝑦 : • Need to use floating-point exactness results 𝐵′ 𝜀 𝑦 − (𝑦 − 1) 𝑦 − 1 max = max 𝑦 − 1 𝜗 . . 𝑦 − 1 4095 4095 4096≤𝑦<1, 𝜀′ <𝜗 4096≤𝑦<1 0000000000000 = 𝜗 We prove a bound of 0.583 ulps for log 83 /146

Sterbenz’s Theorem • Theorem [Sterbenz, 1973] 1 2 𝑏 ≤ 𝑐 ≤ 2𝑏 ⟹ 𝑏 ⊖ 𝑐 = 𝑏 − 𝑐 • Example: 84 /146

Sterbenz’s Theorem • Theorem [Sterbenz, 1973] 1 2 𝑏 ≤ 𝑐 ≤ 2𝑏 ⟹ 𝑏 ⊖ 𝑐 = 𝑏 − 𝑐 4095 • Example: log for 𝑦 ∈ 4096 , 1 85 /146

Sterbenz’s Theorem • Theorem [Sterbenz, 1973] 1 2 𝑏 ≤ 𝑐 ≤ 2𝑏 ⟹ 𝑏 ⊖ 𝑐 = 𝑏 − 𝑐 4095 • Example: log for 𝑦 ∈ 4096 , 1 𝜌 𝜌 • Example: sin for 𝑦 ∈ 2𝜌 − 64 , 2𝜌 + 64 1. Compute 𝑧 = 𝑦 ⊖ 2𝜌 3! 𝑧 3 + ⋯ + 1 1 9! 𝑧 9 2. Return 𝑧 − ≈ 𝑡𝑗𝑜 𝑧 86 /146

Sterbenz’s Theorem • Theorem [Sterbenz, 1973] 1 2 𝑏 ≤ 𝑐 ≤ 2𝑏 ⟹ 𝑏 ⊖ 𝑐 = 𝑏 − 𝑐 4095 • Example: log for 𝑦 ∈ 4096 , 1 𝜌 𝜌 • Example: sin for 𝑦 ∈ 2𝜌 − 64 , 2𝜌 + 64 1. Compute 𝑧 = 𝑦 ⊖ 2𝜌 3! 𝑧 3 + ⋯ + 1 1 9! 𝑧 9 2. Return 𝑧 − ≈ 𝑡𝑗𝑜 𝑧 87 /146

Sterbenz’s Theorem • Theorem [Sterbenz, 1973] 1 2 𝑏 ≤ 𝑐 ≤ 2𝑏 ⟹ 𝑏 ⊖ 𝑐 = 𝑏 − 𝑐 4095 • Example: log for 𝑦 ∈ 4096 , 1 𝜌 𝜌 • Example: sin for 𝑦 ∈ 2𝜌 − 64 , 2𝜌 + 64 exact 1. Compute 𝑧 = 𝑦 ⊖ 2𝜌 3! 𝑧 3 + ⋯ + 1 1 9! 𝑧 9 2. Return 𝑧 − ≈ 𝑡𝑗𝑜 𝑧 88 /146

Sterbenz’s Theorem • Theorem [Sterbenz, 1973] 1 2 𝑏 ≤ 𝑐 ≤ 2𝑏 ⟹ 𝑏 ⊖ 𝑐 = 𝑏 − 𝑐 4095 • Example: log for 𝑦 ∈ 4096 , 1 𝜌 𝜌 • Example: sin for 𝑦 ∈ 2𝜌 − 64 , 2𝜌 + 64 precision loss exact 1. Compute 𝑧 = 𝑦 ⊖ 2𝜌 of sin is small 3! 𝑧 3 + ⋯ + 1 1 9! 𝑧 9 2. Return 𝑧 − ≈ 𝑡𝑗𝑜 𝑧 89 /146

Sterbenz’s Theorem • How to apply the theorem automatically? 𝑓 ⊖ 𝑓 ′ ⊑ ? 𝑓 ⊖ 𝑓 ′ • Construct: 𝑓 ⊑ 𝐵 𝜀 , 𝑓′ ⊑ 𝐵 ′ 𝜀 𝐵′ 𝜀 𝑦 − 1 • Check: ≥ 0 and min 2 𝐵 𝜀 𝑦 𝑦, 𝜀 • max 𝐵′ 𝜀 𝑦 − 2𝐵 𝜀 𝑦 ≤ 0 𝑦, 𝜀 1 2 𝐵 𝜀 𝑦 ≤ 𝐵 ′ ⟹ 𝜀 𝑦 ≤ 2𝐵 𝜀 𝑦 for all 𝑦 ∈ 𝑌 , all 𝜀 𝑗 < 𝜗 • Precondition of theorem: 1 2 𝑓 𝑦 ≤ 𝑓 ′ 𝑦 ≤ 2𝑓 𝑦 ⟹ for all 𝑦 ∈ 𝑌 90 /146

Sterbenz’s Theorem • How to apply the theorem automatically? 𝑓 ⊖ 𝑓 ′ ⊑ ? 𝑓 ⊖ 𝑓 ′ • Construct: 𝑓 ⊑ 𝐵 𝜀 , 𝑓′ ⊑ 𝐵 ′ 𝜀 𝐵′ 𝜀 𝑦 − 1 • Check: ≥ 0 and min 2 𝐵 𝜀 𝑦 true 𝑦, 𝜀 • max 𝐵′ 𝜀 𝑦 − 2𝐵 𝜀 𝑦 ≤ 0 𝑦, 𝜀 1 2 𝐵 𝜀 𝑦 ≤ 𝐵 ′ ⟹ 𝜀 𝑦 ≤ 2𝐵 𝜀 𝑦 for all 𝑦 ∈ 𝑌 , all 𝜀 𝑗 < 𝜗 • Precondition of theorem: 1 2 𝑓 𝑦 ≤ 𝑓 ′ 𝑦 ≤ 2𝑓 𝑦 ⟹ for all 𝑦 ∈ 𝑌 96 /146

Sterbenz’s Theorem • How to apply the theorem automatically? can apply 𝑓 ⊖ 𝑓 ′ ⊑ ? 𝑓 ⊖ 𝑓 ′ the theorem • Construct: 𝑓 ⊑ 𝐵 𝜀 , 𝑓′ ⊑ 𝐵 ′ 𝜀 𝐵′ 𝜀 𝑦 − 1 • Check: ≥ 0 and min 2 𝐵 𝜀 𝑦 true 𝑦, 𝜀 • max 𝐵′ 𝜀 𝑦 − 2𝐵 𝜀 𝑦 ≤ 0 𝑦, 𝜀 1 2 𝐵 𝜀 𝑦 ≤ 𝐵 ′ ⟹ 𝜀 𝑦 ≤ 2𝐵 𝜀 𝑦 for all 𝑦 ∈ 𝑌 , all 𝜀 𝑗 < 𝜗 • Precondition of theorem: 1 2 𝑓 𝑦 ≤ 𝑓 ′ 𝑦 ≤ 2𝑓 𝑦 ⟹ for all 𝑦 ∈ 𝑌 99 /146

Sterbenz’s Theorem • How to apply the theorem automatically? can apply 𝑓 ⊖ 𝑓 ′ ⊑ 𝐵 𝜀 𝑦 − 𝐵 ′ ? 𝑓 ⊖ 𝑓 ′ 𝜀 𝑦 the theorem • Construct: 𝑓 ⊑ 𝐵 𝜀 , 𝑓′ ⊑ 𝐵 ′ 𝜀 𝐵′ 𝜀 𝑦 − 1 • Check: ≥ 0 and min 2 𝐵 𝜀 𝑦 true 𝑦, 𝜀 • max 𝐵′ 𝜀 𝑦 − 2𝐵 𝜀 𝑦 ≤ 0 𝑦, 𝜀 1 2 𝐵 𝜀 𝑦 ≤ 𝐵 ′ ⟹ 𝜀 𝑦 ≤ 2𝐵 𝜀 𝑦 for all 𝑦 ∈ 𝑌 , all 𝜀 𝑗 < 𝜗 • Precondition of theorem: 1 2 𝑓 𝑦 ≤ 𝑓 ′ 𝑦 ≤ 2𝑓 𝑦 ⟹ for all 𝑦 ∈ 𝑌 100 /146

the Correctness of math.h Implementations Wonyeol Lee 1,2 Rahul - PowerPoint PPT Presentation

On Automatically Proving the Correctness of math.h Implementations Wonyeol Lee 1,2 Rahul Sharma 3 Alex Aiken 1 1 Stanford University 2 KAIST 3 Microsoft Research POPL 2018 1 /146 Our Goal mathematical specification Industry

Proving Program Correctness The Axiomatic Approach What is Correctness? Correctness:

08Program Verification II CS 5209: Foundation in Logic and AI Martin Henz and Aquinas Hobor

Program Correctness Assert formal correctness statements about

Reducing Total Correctness to Partial Correctness by a Transformation of the Language Semantics a

Proving Correctness of Graph Programs Relative to Recursively Nested Conditions Nils Erik Flick

Recalling Our Intro to the Course 1 The Program Correctness Problem ? Conventional models of

Correctness of Program Transformations as a Termination Problem Conrad Rau, David Sabel and

Proving Correctness of a KRK Chess Endgame Strategy by SAT-based Constraint Solving Marko

Correctness of parallel programs Shaz Qadeer Research in

Program correctness and verification Programs should be: clear; efficient; robust; reliable;

Machine-checked correctness and complexity of a Union-Find implementation Arthur Charguraud

Recursion: Introduction and Correctness Lecture B Jones MWF 9-9:50am PCNYN 109 Lecture D

pytest Big Idea: You can write a function to test the correctness of another function! This is

Week 4 Video 7 Memory Algorithms Is future correctness enough? Up until this point weve

Proving Preservation of Partial Correctness with ACL2: A Mechanical Compiler Source Level

Causal Atomicity: Correctness conditions for weak memory Heike Wehrheim Joint work with Simon

Practical Proof Systems for SAT and QBF Marijn J.H. Heule Dagstuhl Seminar on SAT and

Foundational Proof Certificates Making proof universal and permanent Dale Miller INRIA-Saclay

Delegation with (nearly) optimal time/space overhead Justin Holmgren Ron Rothblum MIT MIT

A Self-Verifying Theorem Prover Jared Davis (advertisement by J Strother Moore)

CUTKB at NTCIR-14 QALab-PoliInfo Task Toshiki Tomihira and Yohei Seki University of Tsukuba,

Decidability of distributed complexity of locally checkable problems on paths Alkida Balliu,

Local Algorithms: Past, Present, Future Jukka Suomela Helsinki Institute for Information

Degrees of Lookahead in Context-free Infinite Games Joint work with Wladimir Fridman and Christof