Verifying a Synthesized Implementation of IEEE-754 Floating-Point ...

4 B. Akbarpour et al.and − ln(2)/64 ≤ r ≤ ln(2)/64. This n is found by roundingx(32/ln(2)) to the nearest integer. Now we decompose n into itsquotient and remainder when divided by 32, i.e. n = 32m + jwith 0 ≤ j ≤ 31. Hencee x = e (32m+j)(ln(2)/32)+r = e ln(2)m e ln(2)j/32 e r = 2 m 2 j/32 e rValues of 2 j/32 for 0 ≤ j ≤ 31 are pre-stored constants, andmultiplication by 2 m is fast. Hence we just need to calculate e rfor r ∈[−ln(2)/64, ln(2)/64]. This is done by a lower-orderpolynomial approximation p(r) ≈ e r − 1, where:p(r) = r + 83886762 24 r 2 + 111848762 26 r 3The actual reconstruction of e x , for reasons of accuracy, isdone by:e x = 2 m (2 j/32 + 2 j/32 p(r))In fact, in order to achieve good accuracy, the abovemathematical description is complicated slightly. The value ris broken down into r 1 + r 2 , where r 2 ≪ r 1 . Similarly thepre-stored constants 2 j/32 are all stored as two separate arraysS lead and S trail with 2 j/32 ≈ S lead (j) + S trail (j) and S trail (j) ≪S lead (j). This would avoid rounding errors as well as take care ofthe ordering of operations, hence making the actual code look abit more complicated than the above mathematical description.4. MODELING AND VERIFICATIONMETHODOLOGYThe verification process for the table-driven floating-pointexponential function will be performed on many levels.Harrison [7] formalized and verified using the HOL Lighttheorem prover that a behavioral specification of the IEEE-754 table-driven floating-point exponential function impliesits abstract mathematical counterpart. He also performed anerror analysis between these two levels. For this, he firstdeveloped theories in HOL on construction of real numbers [16],and formalization of IEEE-754 standard-based floating-pointarithmetic [7,17]. Then he used valuation functions to find thereal value of the floating-point exponential function output,and defined the error as the difference between this valueand the corresponding output of the ideal real exponentialfunction. Then he established fundamental lemmas on erroranalysis of floating-point rounding and arithmetic operationsagainst their abstract mathematical counterparts. Finally basedon these lemmas, he proved that the floating-point exponentialfunction algorithm has the correct overflow behavior and, inthe absence of overflow, the error in the result is less than 0.54units in the last place compared with the exact mathematicalexponential function. He confirmed and strengthened the mainresults of the previously published error analysis in [8], thoughhe uncovered a minor error in the hand proof and located afew subtle corners in the proof that a less careful worker mighteasily have overlooked. The error in postulated theorems wasrelated to the forgetting of special or degenerate cases in IEEEfloating-point such as NaNs and negative zeros.After handling the transition from real to floating-point levels,we move to the RTL design. At this point, we use the standardHOL predicate approach to model the floating-point exponentialfunction at the RTL, as developed by Bui et al. [9] usingVHDL and Verilog, within the HOL environment. The laststep is to verify this level using a classical hierarchical proofapproach in HOL [37]. In this way, we hierarchically prove thatthe floating-point exponential function RTL implementationimplies the high-level algorithmic specification that has alreadybeen related to the ideal real specification through the erroranalysis. The verification can be extended in HOL, followinga similar approach, down to gate-level netlist implementation,machine synthesized using the Synopsys tool.The overall modeling and verification process is described inFig. 1, where the white boxes are the material provided by [7–9],while the shaded ones represent those developed in this work.Let X be the input variable and E the corresponding outputof the floating-point exponential function at the gate level; thenour final goal is:⊢ thm ∀ X E. FP_EXP_GAT E (X, E) =⇒valof (float (E)) = exp (valof (f loat (X)))+ error (X,E) ∧ abs (error (X,E))≤ error_bound (X, E) (1)Here FP_EXP_GAT E is a predicate describing the floatingpointexponential function in gate level, and its input and outputsignals X and E are Boolean words. To relate these signalsto the corresponding specifications in floating-point and realdomains, we make use of the bijection function float, and thevaluation function valof . Also, exp is the exponential functionin real domain available in HOL transcendental functions theory(transc). The theorem states that the real value of the floatingpointexponential function in gate level is equal to the real valueof the exponential function in real domain plus an error, andalso the absolute value of the error is bounded to a certain valuethat depends on the range of the input and output numbers.This goal cannot be reached directly, due to the very highabstraction gap between the gate and abstract mathematicslevels as described above. Therefore, the proof scheme waschanged to hierarchically prove that the gate level implies themore abstract RTL. Then this RTL was related, by a formalproof, to the behavioral specification. The latter was proved toimply the high-level real specification plus the error. This canbe formalized as follows in HOL:⊢ thm ∀ X E. FP_EXP_GAT E (X, E) =⇒FP_EXP_RT L (X, E) (2)⊢ thm ∀ X E. FP _ EXP_RT L (X, E) =⇒FP_EXP_ALGORIT H M (f loat (X), f loat (E)) (3)The Computer Journal, 2009