Real Behavior of Floating Point Numbers SMT 2017 | Bruno Marre, - PowerPoint PPT Presentation

Real Behavior of Floating Point Numbers SMT 2017 | Bruno Marre, Bobot François, Zakaria Chihani 23 July 2017

COLIBRI (Bruno Marre) Started in 2000 for test case generation Used only as a library in PathCrawler and Gatel CP solver uses Eclipse Prolog Proprietary with the help of IRSN No test case that use NaN or infinities Only fp.eq , no =, only RNE, +0 = − 0, only 32/64 bit integer modulo, real CEA | 23 July 2017 | p. 2

COLIBRI (Bruno Marre) Started in 2000 for test case generation Used only as a library in PathCrawler and Gatel CP solver uses Eclipse Prolog Proprietary freeware for academic with the help of IRSN No test case that use NaN or infinities Only fp.eq , no =, only RNE, +0 = − 0, only 32/64 bit integer modulo, real CEA | 23 July 2017 | p. 2

Architecture Labelling Propagation Splitting unsat sat CEA | 23 July 2017 | p. 3

Architecture Labelling Propagation Splitting unsat sat CEA | 23 July 2017 | p. 3

Floating Points ✔ Clear Semantic: x � y = o( x + y ) CEA | 23 July 2017 | p. 4

Floating Points ✔ Clear Semantic: x � y = o( x + y ) ✘ Few algebraic properties: not associative, x � y = x � y = 0 CEA | 23 July 2017 | p. 4

Floating Points ✔ Clear Semantic: x � y = o( x + y ) ✘ Few algebraic properties: not associative, x � y = x � y = 0 10 � �� � ✘ Counter-intuitive: 0 . 1 � · · · � 0 . 1 � = 0 . 1 � 10 . = 1 . CEA | 23 July 2017 | p. 4

Floating Points ✔ Clear Semantic: x � y = o( x + y ) ✘ Few algebraic properties: not associative, x � y = x � y = 0 10 � �� � ✘ Counter-intuitive: 0 . 1 � · · · � 0 . 1 � = 0 . 1 � 10 . = 1 . ✘ State of the art: current bit-blasting doesn’t scale CEA | 23 July 2017 | p. 4

Floating Points ✔ Clear Semantic: x � y = o( x + y ) ✘ Few algebraic properties: not associative, x � y = x � y = 0 10 � �� � ✘ Counter-intuitive: 0 . 1 � · · · � 0 . 1 � = 0 . 1 � 10 . = 1 . ✘ State of the art: current bit-blasting doesn’t scale ✘ Pervasives in programs CEA | 23 July 2017 | p. 4

Domain Specific Approach of CP X i ∈ [1; 10] = ⇒ X 0 � X 1 � X 2 � X 3 � X 4 � X 5 � X 6 � X 7 ∈ [8; 80] Z3 : 3s COLIBRI: < 0.1s (+0.25s) CEA | 23 July 2017 | p. 5

Domain Specific Approach of CP X i ∈ [1; 10] = ⇒ X 0 � X 1 � X 2 � X 3 � X 4 � X 5 � X 6 � X 7 ∈ [8; 80] Z3 : 3s COLIBRI: < 0.1s (+0.25s) ⇒ X 0 � X 1 � X 2 � X 3 � X 4 � X 5 � X 6 � X 7 ∈ [1; 10 8 ] X i ∈ [1; 10] = Z3 : 31min COLIBRI: < 0.1s (+0.25s) CEA | 23 July 2017 | p. 5

COLIBRI: Floating Point Precise domain propagation: x � y = 0 . 05 = ⇒ x , y ∈ [ − 0 . 1259 .. ; 0 . 175 .... ] CEA | 23 July 2017 | p. 6

COLIBRI: Floating Point Precise domain propagation: x � y = 0 . 05 = ⇒ x , y ∈ [ − 0 . 1259 .. ; 0 . 175 .... ] 0 . 05: 0 x 3 fa 999999999999 a CEA | 23 July 2017 | p. 6

COLIBRI: Floating Point Precise domain propagation: x � y = 0 . 05 = ⇒ x , y ∈ [ − 0 . 1259 .. ; 0 . 175 .... ] 0 . 05: 0 x 3 fa 999999999999 a Distance graph on floating-point numbers CEA | 23 July 2017 | p. 6

Distance graph on floating-point numbers x IEEE-format, num( x ) 0 . 0 num( x ) − num( fp . mul _ 2 x ) = 2 52 CEA | 23 July 2017 | p. 7

Distance graph on floating-point numbers x IEEE-format, num( x ) 0 . 0 +1 p − 1074 1 +1 p − 1073 2 1 . 0 0x3ff0000000000000 2 . 0 0x4000000000000000 num( x ) − num( fp . mul _ 2 x ) = 2 52 CEA | 23 July 2017 | p. 7

Distance graph on floating-point numbers x IEEE-format, num( x ) − 2 . 0 − 0x4000000000000000 − 1 . 0 − 0x3ff0000000000000 − 1 p − 1073 − 2 − 1 p − 1074 − 1 0 . 0 +1 p − 1074 1 +1 p − 1073 2 1 . 0 0x3ff0000000000000 2 . 0 0x4000000000000000 num( x ) − num( fp . mul _ 2 x ) = 2 52 CEA | 23 July 2017 | p. 7

Distance graph on floating-point numbers x IEEE-format, num( x ) − 2 . 0 − 0x4000000000000000 − 1 . 0 − 0x3ff0000000000000 − 1 p − 1073 − 2 − 1 p − 1074 − 1 − 0 . − 0 0 . 0 +1 p − 1074 1 +1 p − 1073 2 1 . 0 0x3ff0000000000000 2 . 0 0x4000000000000000 num( x ) − num( fp . mul _ 2 x ) = 2 52 CEA | 23 July 2017 | p. 7

Distance graph on floating-point numbers x ∈ [1; 10], fp . mul RNE x 2 = y { 2 52 } y x w ∈ [1; 10], fp . add RNE w 3 = z [num(13) − num(10); num(4) − num(1)] w z CEA | 23 July 2017 | p. 8

COLIBRI: Floating Point Precise domain propagation: x � y = 0 . 05 = ⇒ x , y ∈ [ − 0 . 1259 .. ; 0 . 175 .... ] 0 . 05: 0 x 3 fa 999999999999 a Distance graph on floating-point numbers Monotonic functions: ⇒ o( x ) ≤ o( f − 1 (o( y ))) o( f ( x )) < o( y ) = CEA | 23 July 2017 | p. 9

COLIBRI: Floating Point Precise domain propagation: x � y = 0 . 05 = ⇒ x , y ∈ [ − 0 . 1259 .. ; 0 . 175 .... ] 0 . 05: 0 x 3 fa 999999999999 a Distance graph on floating-point numbers Monotonic functions: ⇒ o( x ) ≤ o( f − 1 (o( y ))) o( f ( x )) < o( y ) = Instantiated for many functions CEA | 23 July 2017 | p. 9

COLIBRI: Floating Point Precise domain propagation: x � y = 0 . 05 = ⇒ x , y ∈ [ − 0 . 1259 .. ; 0 . 175 .... ] 0 . 05: 0 x 3 fa 999999999999 a Distance graph on floating-point numbers Monotonic functions: ⇒ o( x ) ≤ o( f − 1 (o( y ))) o( f ( x )) < o( y ) = Instantiated for many functions Linearization of constraints for simplex CEA | 23 July 2017 | p. 9

Interesting and Simple Real Examples 1 / ∗ @ requires 0 ≤ x ≤ 1000; requires 0 ≤ y ≤ 1000; ensures 0 ≤ \result ≤ 1; @ ∗ / 3 double x_normalisation( double x, double y){ 5 return x/sqrt(x ∗ x + y ∗ y); 7 } CEA | 23 July 2017 | p. 10

COLIBRI: Example of Reasoning � x 2 � y 2 ≥ x ? 0 ≤ x , y ≤ 1000 = ⇒ CEA | 23 July 2017 | p. 11

COLIBRI: Example of Reasoning � x 2 � y 2 ≥ x ? 0 ≤ x , y ≤ 1000 = ⇒ �� � o o( x 2 ) + o( y 2 ) < x o( x 2 ) + o( y 2 ) ≤ o( x 2 ) o( x 2 ) + o( y 2 ) = o( x 2 ) �� � o( x 2 ) o < x x < x if o( x 2 ) is normalized o( x 2 ) is denormalized x the minimum of the remaining values is a solution CEA | 23 July 2017 | p. 11

COLIBRI: Example of Reasoning � x 2 � y 2 ≥ x ? 0 ≤ x , y ≤ 1000 = ⇒ �� � o o( x 2 ) + o( y 2 ) < x o( x 2 ) + o( y 2 ) ≤ o( x 2 ) o( x 2 ) + o( y 2 ) = o( x 2 ) �� � o( x 2 ) o < x x < x if o( x 2 ) is normalized o( x 2 ) is denormalized x the minimum of the remaining values is a solution There is a counter-example! CEA | 23 July 2017 | p. 11

Interesting and Simple Real Examples: Corrected / ∗ @ requires 0.0001 ≤ x ≤ 1000; requires 0.0001 ≤ y ≤ 1000; 2 ensures 0 ≤ \result ≤ 1; @ ∗ / 4 double x_normalisation( double x, double y){ return x/sqrt(x ∗ x + y ∗ y); 6 8 } CEA | 23 July 2017 | p. 12

Other Examples: From SPARK User Rule procedure User_Rule_7 (X, Y, Z, A : Float; Res : out Boolean) 2 is begin 4 pragma Assume (Z ≥ 0.0); pragma Assume (X ≥ Y); 6 pragma Assume (Y ≥ Z); pragma Assume (X > Z); 8 pragma Assume (A ≥ 1.0); Res := (X − Y) / (X − Z) ≤ A; 10 pragma Assert (Res); −− valid end User_Rule_7; 12 CEA | 23 July 2017 | p. 13

Other Examples: From SPARK User Rule A ≤ X � Y X � Z ≤ B with ... � X 2 � Y 2 ≤ X with ... X √ X 2 � Y 2 ≤ 1 with ... CEA | 23 July 2017 | p. 14

Linearization [Belaid2012] For t a normal positive number with double precision: o( t ) CEA | 23 July 2017 | p. 15

Linearization [Belaid2012] For t a normal positive number with double precision: 1 1 (1 − 2 52 − 1) · t ≤ o( t ) ≤ (1 + 2 52 + 1) · t . CEA | 23 July 2017 | p. 15

Linearization [Belaid2012] For t a normal positive number with double precision: 1 1 (1 − 2 52 − 1) · t ≤ o( t ) ≤ (1 + 2 52 + 1) · t . (0 . ≤ f x ≤ f 10 . 0) ∧ (0 . ≤ f y ≤ f 10 . 0) ⇒ (( x � y ) � x ) � y ≤ f 0 . 0001 CEA | 23 July 2017 | p. 15

Linearization [Belaid2012] For t a normal positive number with double precision: 1 1 (1 − 2 52 − 1) · t ≤ o( t ) ≤ (1 + 2 52 + 1) · t . (0 . ≤ f x ≤ f 10 . 0) ∧ (0 . ≤ f y ≤ f 10 . 0) ⇒ o(o(o( x + y ) − x ) − y ) ≤ f 0 . 0001 CEA | 23 July 2017 | p. 15

Bitvector and Integer Arithmetic (CPAIOR17) High-level view of bitvectors New propagations for integers ↔ bitvectors CEA | 23 July 2017 | p. 16

Interreductions Int/BV ∆ ➀ D ➁ ➃ ➄ D D ∆ ∆ ➅ FP Real ➂ CEA | 23 July 2017 | p. 17

Casts x , y ∈ [1; 1000], fp . to _ sbv _ x = w , fp . to _ sbv _ y = z [0; ... ] y x w z CEA | 23 July 2017 | p. 18

Casts x , y ∈ [1; 1000], fp . to _ sbv _ x = w , fp . to _ sbv _ y = z [0; ... ] y x [0; ... ] w z CEA | 23 July 2017 | p. 18

Griggio and Schanda 60 50 40 time(s) 30 20 10 0 0 20 40 60 80 100 120 140 160 180 200 proved COLIBRI no simplex no delta MathSAT ACDCL Z3 CEA | 23 July 2017 | p. 19

Future Work Look at the unsolved benchmarks CEA | 23 July 2017 | p. 20

Future Work Look at the unsolved benchmarks More confidence in the propagation and rewrite rules CEA | 23 July 2017 | p. 20

Future Work Look at the unsolved benchmarks More confidence in the propagation and rewrite rules Uninterpreted functions and quantifiers CEA | 23 July 2017 | p. 20