## Formal verification of IA-64 division algorithms (2000)

Venue: | Proceedings, Theorem Proving in Higher Order Logics (TPHOLs), LNCS 1869 |

Citations: | 18 - 4 self |

### BibTeX

@INPROCEEDINGS{Harrison00formalverification,

author = {John Harrison},

title = {Formal verification of IA-64 division algorithms},

booktitle = {Proceedings, Theorem Proving in Higher Order Logics (TPHOLs), LNCS 1869},

year = {2000},

pages = {234--251},

publisher = {Springer}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract. The IA-64 architecture defers floating point and integer division to software. To ensure correctness and maximum efficiency, Intel provides a number of recommended algorithms which can be called as subroutines or inlined by compilers and assembly language programmers. All these algorithms have been subjected to formal verification using the HOL Light theorem prover. As well as improving our level of confidence in the algorithms, the formal verification process has led to a better understanding of the underlying theory, allowing some significant efficiency improvements. 1

### Citations

512 |
Introduction to HOL: A theorem proving environment for higher order logic
- Gordon, Melham
- 1993
(Show Context)
Citation Context ...llow reasonably fast software implementations. 1.3 Formal floating point theory The formal verifications are conducted using the freely available 2 HOL Light prover [7]. HOL Light is a version of HOL =-=[5]-=-, itself a descendent of Edinburgh LCF [6] which first defined the ‘LCF approach’ that these systems take to formal proof. LCF provers explicitly generate proofs in terms of extremely low-level primit... |

90 |
Edinburgh LCF: A Mechanised Logic
- Gordon, Milner, et al.
- 1979
(Show Context)
Citation Context ...ons. 1.3 Formal floating point theory The formal verifications are conducted using the freely available 2 HOL Light prover [7]. HOL Light is a version of HOL [5], itself a descendent of Edinburgh LCF =-=[6]-=- which first defined the ‘LCF approach’ that these systems take to formal proof. LCF provers explicitly generate proofs in terms of extremely low-level primitive inferences, in order to provide a high... |

90 | Theorem Proving with the Real Numbers
- Harrison
- 1998
(Show Context)
Citation Context ... be partially automated. In general, however, the user must describe the proof at a moderate level of detail. The verifications described here draw extensively on a formalized theory of real analysis =-=[8]-=- and floating point arithmetic [9]. These sources should be consulted for more details, but we now summarize some of the main formal concepts used in the present paper. HOL notation is generally close... |

70 |
IA-64 and Elementary Functions: Speed and Precision
- Markstein
- 2000
(Show Context)
Citation Context ... implementation of integer division on IA-64 and proofs of correctness, see [1]. Much more detail about the IA-64 implementation of division, square root and other mathematical functions are given in =-=[12]-=-. The closest related work to that described here is the formal verification of division algorithms reported in [13] and [15]. Although these are respectively for microcode and hardware RTL, and the p... |

69 | HOL Light: A tutorial introduction
- Harrison
- 1996
(Show Context)
Citation Context ...hitecture needs to be designed to allow reasonably fast software implementations. 1.3 Formal floating point theory The formal verifications are conducted using the freely available 2 HOL Light prover =-=[7]-=-. HOL Light is a version of HOL [5], itself a descendent of Edinburgh LCF [6] which first defined the ‘LCF approach’ that these systems take to formal proof. LCF provers explicitly generate proofs in ... |

58 |
The IA-64 architecture at work
- Dulong
- 1998
(Show Context)
Citation Context ...raditional architectures, IA-64 incorporates a unique combination of features, including an instruction format encoding parallelism explicitly, instruction predication, and speculative/advanced loads =-=[4]-=-. Nevertheless, it also offers full upwards-compatibility with IA-32 (x86) code. 1.1 The IA-64 floating point architecture The IA-64 floating point architecture has been carefully designed to allow hi... |

49 |
The Functional Approach to Programming
- Mauny, Cousineau
- 2003
(Show Context)
Citation Context ...sually stored permanently, but the strict reduction to primitive inferences in maintained by the abstract type system of the interaction and implementation language, which for HOL Light is CAML Light =-=[16, 3]-=-. This language serves as a programming medium allowing higher-level derived rules (e.g. to automate linear arithmetic, first order logic or reasoning in other special domains) to be programmed as red... |

45 |
754 for binary floating point arithmetic
- Standard
- 1985
(Show Context)
Citation Context ...ands:fms computes xy − z whilefnma computes z − xy. The IA-64 architecture supports several different floating point formats compatible with the IEEE 754 Standard for Binary Floating-Point Arithmetic =-=[10]-=-. For the four most important formats, we give the conventional name, the precision, and the minimum 1 Seehttp://developer.intel.com/design/ia64/downloads/adag.htm.sand maximum exponents. Thus, number... |

31 | A machine-checked theory of floating point arithmetic
- Harrison
(Show Context)
Citation Context ...l, however, the user must describe the proof at a moderate level of detail. The verifications described here draw extensively on a formalized theory of real analysis [8] and floating point arithmetic =-=[9]-=-. These sources should be consulted for more details, but we now summarize some of the main formal concepts used in the present paper. HOL notation is generally close to traditional logical and mathem... |

30 | A mechanically checked proof of the correctness of the kernel of the AMD5k86 floating-point division algorithm
- Moore, Lynch, et al.
- 1998
(Show Context)
Citation Context ...plementation of division, square root and other mathematical functions are given in [12]. The closest related work to that described here is the formal verification of division algorithms reported in =-=[13]-=- and [15]. Although these are respectively for microcode and hardware RTL, and the present work is for software, this difference is not as significant as it may seem, since all these implementations s... |

30 |
Formally verifying ieee compliance of floating-point hardware
- O’Leary, Zhao, et al.
- 1999
(Show Context)
Citation Context ...ogrammer, based on a high-level specification that the underlying operations are IEEE-correct. Other work on formal verification of division hardware using a combined theorem prover and model checker =-=[14]-=- is also closely related, but in this work the verification is taken down to a lower level (the implementation in terms of logic gates), and closely integrated with the overall design flow, helping to... |

21 |
Computation of elementary functions on the IBM RISC system/6000 processor
- Markstein
- 1990
(Show Context)
Citation Context ...rrectly via ordinary software. Remarkably, however, fairly short straight-line sequences offma operations (or negated variants), suffice to do so. This approach to division was pioneered by Markstein =-=[11]-=- on the IBM RS/6000 3 family. It seems that the ability to perform both a multiply and an add or subtract without an intermediate rounding is essential to this, but besides its utility here, the fma h... |

19 | Proving the IEEE correctness of iterative floating-point square root, divide, and remainder algorithms
- Cornea-Hasegan
- 1998
(Show Context)
Citation Context ...ng is assured. One approach to proving this for a given algorithm is to ask: how close can a/b be to a floating point number or midpoint? A little work allows us to provide an answer to that question =-=[2]-=-, which we can formalize as the following HOL theorem: ⊢ a ∈ iformat(E,p,N) ∧ b ∈ iformat(E,p,N) ∧ c ∈ iformat(E,p+1,N+1) ∧ &2 pow (p - 1) / &2 pow N <= abs(a) ∧ ¬(b = &0) =⇒ (a / b = c) ∨ abs(a / b -... |

10 |
Le langage Caml. Intereditions
- Leroy, Weis
- 1993
(Show Context)
Citation Context ...sually stored permanently, but the strict reduction to primitive inferences in maintained by the abstract type system of the interaction and implementation language, which for HOL Light is CAML Light =-=[16, 3]-=-. This language serves as a programming medium allowing higher-level derived rules (e.g. to automate linear arithmetic, first order logic or reasoning in other special domains) to be programmed as red... |

5 |
A mechanically checked proof of IEEE compliance of a register-transfer-level specification of the AMD-k7 floating-point multiplication, division, and square root instructions
- Rusinoff
- 1998
(Show Context)
Citation Context ...ion of division, square root and other mathematical functions are given in [12]. The closest related work to that described here is the formal verification of division algorithms reported in [13] and =-=[15]-=-. Although these are respectively for microcode and hardware RTL, and the present work is for software, this difference is not as significant as it may seem, since all these implementations seem to be... |

2 |
Integer divide and remainder operations in the intel ia-64 architecture
- Cornea, Iordache, et al.
- 2000
(Show Context)
Citation Context ...veral integer divide algorithms, which use a specialized floating-point division algorithm as a core. For an overview of the implementation of integer division on IA-64 and proofs of correctness, see =-=[1]-=-. Much more detail about the IA-64 implementation of division, square root and other mathematical functions are given in [12]. The closest related work to that described here is the formal verificatio... |