Results 1 
6 of
6
Combining Coq and Gappa for Certifying FloatingPoint Programs
, 2009
"... Formal verification of numerical programs is notoriously difficult. On the one hand, there exist automatic tools specialized in floatingpoint arithmetic, such as Gappa, but they target very restrictive logics. On the other hand, there are interactive theorem provers based on the LCF approach, such ..."
Abstract

Cited by 11 (1 self)
 Add to MetaCart
Formal verification of numerical programs is notoriously difficult. On the one hand, there exist automatic tools specialized in floatingpoint arithmetic, such as Gappa, but they target very restrictive logics. On the other hand, there are interactive theorem provers based on the LCF approach, such as Coq, that handle a generalpurpose logic but that lack proof automation for floatingpoint properties. To alleviate these issues, we have implemented a mechanism for calling Gappa from a Coq interactive proof. This paper presents this combination and shows on several examples how this approach offers a significant speedup in the process of verifying floatingpoint programs.
Further analysis of Kahan’s algorithm for the accurate computation of 2 x 2 determinants
 Mathematics of Computation
"... Abstract. We provide a detailed analysis of Kahan’s algorithm for the accurate computation of the determinant of a 2 × 2 matrix. This algorithm requires the availability of a fused multiplyadd instruction. Assuming radixβ, precisionp floatingpoint arithmetic with β even, p ≥ 2, and barring overf ..."
Abstract

Cited by 5 (3 self)
 Add to MetaCart
Abstract. We provide a detailed analysis of Kahan’s algorithm for the accurate computation of the determinant of a 2 × 2 matrix. This algorithm requires the availability of a fused multiplyadd instruction. Assuming radixβ, precisionp floatingpoint arithmetic with β even, p ≥ 2, and barring overflow or underflow we show that the absolute error of Kahan’s algorithm is bounded by (β +1)/2ulps of the exact result and that the relative error is bounded by 2u with u = 1 2 β1−p the unit roundoff. Furthermore, we provide input values showingthati)whenβ/2 is odd—which holds for 2 and 10, the two radices that matter in practice—the absolute error bound is optimal; ii) the relative error bound is asymptotically optimal, that is, for such input the ratio (relative error)/2u has the form 1 − O(β−p). We also give relative error bounds parametrized by the relative order of magnitude of the two products in the determinant, and we investigate whether the error bounds can be improved when adding constraints: When the products in the determinant have opposite signs, which covers the computation of a sum of squares, or when Kahan’s algorithm is used for computing the discriminant of a quadratic equation. 1.
Formal Verification of Numerical Programs: From C Annotated Programs to Mechanical Proofs
"... Abstract Numerical programs may require a high level of guarantee. This can be achieved by applying formal methods, such as machinechecked proofs. But these tools handle mathematical theorems while we are interested in C code, in which numerical computations are performed using floatingpoint arith ..."
Abstract
 Add to MetaCart
Abstract Numerical programs may require a high level of guarantee. This can be achieved by applying formal methods, such as machinechecked proofs. But these tools handle mathematical theorems while we are interested in C code, in which numerical computations are performed using floatingpoint arithmetic, whereas proof tools typically handle exact real arithmetic. To achieve this high level of confidence on C programs, we use a chain of tools: FramaC, its Jessie plugin, Why and provers among Coq, Gappa, AltErgo, CVC3 and Z3. This approach requires the C program to be annotated: each function must be precisely specified, and we prove the correctness of the program by proving both that it meets its specifications and that no runtime error may occur. The purpose of this paper is to illustrate, on various examples, the features of this approach.
Author manuscript, published in "21st IEEE International Symposium on Computer Arithmetic (2013)" How to Compute the Area of a Triangle: a Formal Revisit Sylvie Boldo
, 2013
"... Abstract—Mathematical values are usually computed using wellknown mathematical formulas without thinking about their accuracy, which may turn awful with particular instances. This is the case for the computation of the area of a triangle. When the triangle is needlelike, the common formula has a v ..."
Abstract
 Add to MetaCart
Abstract—Mathematical values are usually computed using wellknown mathematical formulas without thinking about their accuracy, which may turn awful with particular instances. This is the case for the computation of the area of a triangle. When the triangle is needlelike, the common formula has a very poor accuracy. Kahan proposed in 1986 an algorithm he claimed correct within a few ulps. Goldberg took over this algorithm in 1991 and gave a precise error bound. This article presents a formal proof of this algorithm, an improvement of its error bound and new investigations in case of underflow. Index Terms—floatingpoint arithmetic, formal proof, Coq, triangle, underflow I.