A mechanically checked proof of the correctness of the kernel of the AMD5k86 floating-point division algorithm (1998)

by J Strother Moore, Tom Lynch, Matt Kaufmann
Venue:IEEE Transactions on Computers