Rigorous Estimation of Floating-Point Round-Off Errors with Symbolic Taylor Expansions

Abstract

Rigorous estimation of maximum floating-point round-off errors is an important capability central to many formal verification tools. Unfortunately, available techniques for this task often provide very pessimistic overestimates, causing unnecessary verification failure. We have developed a new approach called Symbolic Taylor Expansions that avoids these problems, and implemented a new tool called FPTaylor embodying this approach. Key to our approach is the use of rigorous global optimization, instead of the more familiar interval arithmetic, affine arithmetic, and/or SMT solvers. FPTaylor emits per-instance analysis certificates in the form of HOL Light proofs that can be machine checked. In this article, we present the basic ideas behind Symbolic Taylor Expansions in detail. We also survey as well as thoroughly evaluate six tool families, namely, Gappa (two tool options studied), Fluctuat, PRECiSA, Real2Float, Rosa, and FPTaylor (two tool options studied) on 24 examples, running on the same machine, and taking care to find the best options for running each of these tools. This study demonstrates that FPTaylor estimates round-off errors within much tighter bounds compared to other tools on a significant number of case studies. We also release FPTaylor along with our benchmarks, thus contributing to future studies and tool development in this area.

On automatically proving the correctness of math.h implementations

“…Here the variable δ i P r´∆ i , ∆ i s, where ∆ i P R ě0 is a constant. This abstraction is similar to the one described in [Solovyev et al 2015].…”

“…Hence, our implementation computes sound lower/upper bounds of these optimization objectives via Eq. (13)-(16), and uses these instead of the exact minimization/maximization results as in [Lee et al 2016;Solovyev et al 2015].…”

“…Using the new operation, b is defined as the application of linearizep¨q to the real-valued multiplication of two abstractions. Note that this abstraction is more precise than the ones considered in prior work that either bound all the quadratic error terms by one ulp [Lee et al 2016] or bound the coefficients of the quadratic terms by constants obtained via interval analysis [Solovyev et al 2015]. These constants can lead to imprecise ulp error bounds when apxq « 0 and we give an example at the end of this section.…”

“…We remark that the previous work on similar abstractions, [Goubault and Putot 2005;Solovyev et al 2015], does not use the compressp¨q operation. Let us revisit the rules in Figure 3.…”

“…We conclude this section by demonstrating that the abstraction used in [Solovyev et al 2015] is not sufficient to prove tight ulp error bounds. For example, consider Intel's sin implementation of the sine function over the input interval X " r2´2 52 , π 64 s. Since sin computes x´1 6 x 3`¨¨¨f or an input x P X , applying the p1`ϵq-property produces an abstraction of sin that contains the error term´1 6 x 3 δ 1 δ 2 δ 3 , where |δ i | ă ϵ (i " 1, 2, 3).…”