Applying Formal Methods in Scientific Computing: Enhancing Reliability and Accuracy

1. Using Mathematics in Scientific ComputingMcMaster University CAS 727 Design of Numerical Software Mohammed Alshayeb 2/2011

2. Outlines • Introduction to Mathematical techniques • Formal Methods • Limits of Formal Methods

3. Intro. to Mathematical Techniques • Traditional design validation = Simulation • Choose test cases wisely, measure coverage • But still principally depend on selection of cases • Formal Methods = Proof of Correctness • Methods with well-defined syntactical and semantical levels. • Both levels are based on mathematical theories (logic, algebra, set theory, etc.) • It is used in areas where errors can cause loss of life or significant financial damage. It is used much in floating point arithmetic.

4. Intro. to Mathematical Techniques • Real-world numerical catastrophes • Intel FDIV Bug Error in Pentium hardwire floating point divide circuit. Intel recall in December 1994 & 1997 cost $300 million. • Patriot missile accident. 26 people were killed because of inaccurate calculation of the time. • Ariane 5 rocket.Ariane 5 rocket exploded 40 seconds after being launched by European Space Agency.

5. Intro. to Mathematical Techniques Verification Coverage Formal Methods real life Formal Methods – ideal case simulation Spot coverage Full coverage Full coverage of some areas

6. Intro. To Mathematical Techniques • Use of Formal Methods by Projects

7. Intro. To Mathematical Techniques • Use of Formal Methods by type of Application

8. Intro. To Mathematical Techniques • Did the use of formal methods have an effect on time, cost, and quality? Time Cost Quality No effect Improvement worsening

9. Formal Methods • Using Formal Methods • The conventional way of indicating a precondition and a postcondition for a statement S is • {P} S {Q} where P is the precondition, and Q is the postcondition “ Hoare triple” • e.g. { x = 0 } x:= x + 1 { x > 0 } is validiff execution of x := x+1 in any state which x is 0 terminates in a state in which x > 0 • Definition of assignment: {E[x := R] } x := E {R}, where R is postcondition, E is expression.

10. Formal Methods • The use of formal methods

11. Formal Methods • To apply Formal Methods in Scientific Computing, the domain of a relation must be valid, with respect to the design of logic. • E[ x := R ] ∧ domain( R ) • Domain(R) = { x|  (y | : (x,y)  R) } • e.g. x { x |  (y | : -2^16 < x + y < 2 ^ 16)}  ( y | : -2^16 < x + y < 2^16)

12. Formal Method • For any operation in floating point, the result must be valid for the floating point specification. • Floating Point x= (−1)^s ×2^e × m, when rounding x’ a rounding error happens, it must be |x – x’/x| <= 2^-p • Floating-point computations depend on the architecture

13. Limit of Formal Methods • Use formal methods as supplements to quality assurance methods not a replacement for them • Formal methods can increase confidence in a product’s reliability if they are applied skillfully • Useful for consistency checks, but formal methods cannot guarantee the completeness of a specifications. • Formal methods must be fully integrated with domain knowledge to achieve positive results.

14. Questions!! End

15. References • Hardware-independent proofs of numerical programs, Sylvie Boldo,Thi Minh TuyenNguyen. 2010 • Formal Methods Applied to a Floating-Point Number System, Geoff Barrett, 1989, IEEE • Formal Methods: Practice and Experience, Jim Woodcock, University of York • Stochastic Formal Methods: An application to accuracy of numeric software. • Limits of Formal Methods, Ralf Kneuper