ArticlePDF Available

Rump's Example Revisited

DOI:10.1023/A:1015569431383
Authors:
Eugene Loh
Eugene Loh
Eugene Loh
  • This person is not on ResearchGate, or hasn't claimed this research yet.
G. William Walster
G. William Walster
Download full-text PDF
Read full-text
Download citation

Abstract

Rump published an example (Algorithms for Verified Inclusions: Theory and Practice, in: Moore, R. E. (ed.), Reliability in Computing: The Role of Interval Methods in Scientific Computing, Academic Press, Boston, 1988, pp. 109–126) in which numerical evaluation of an expression gave a misleading result, even though use of increasing arithmetic precision suggested reliable computation. This oft-cited example happens not to be reproducible on many modern computers. The expression is rewritten so that Rump's result is reproducible using IEEE 754 arithmetic.
Content uploaded by G. William Walster
Author content
All content in this area was uploaded by G. William Walster on Apr 22, 2016
Content may be subject to copyright.
Uxps*v H{dpsoh Uhylvlwhg
Hxjhqh Ork
Vxq Plfurv|vwhpv
J1 Zlooldp Zdovwhu
Vxq Plfurv|vwhpv
Mdqxdu| 53/ 5335
Devwudfw
Lq 4<;;/ Uxps ^7` sxeolvkhg dq h{dpsoh lq zklfk qxphulfdo hydoxdwlrq
ri dq h{suhvvlrq jdyh d plvohdglqj uhvxow/ hyhq wkrxjk xvh ri lqfuhdvlqj
dulwkphwlf suhflvlrq vxjjhvwhg uholdeoh frpsxwdwlrq1 Wklv riw0flwhg h{0
dpsoh kdsshqv qrw wr eh uhsurgxfleoh rq pdq| prghuq frpsxwhuv1 Wkh
h{suhvvlrq lv uhzulwwhq vr wkdw Uxps*v uhvxow lv uhsurgxfleoh xvlqj LHHH
:87 dulwkphwlf1
4Lqwurgxfwlrq
Uxps*v h{dpsoh ^7` lv wr frpsxwh wkh h{suhvvlrq
i@ 666=:8e9.d5+44d5e5e9454e75, . 8=8e;.d
5e>+4,
zlwk d@ ::94: dqg e@ 663<91 Rq dq LEP V26:3 pdlq iudph kh frpsxwhg i
lq +4, xvlqj vlqjoh/ grxeoh/ dqg h{whqghg0suhflvlrq dulwkphwlf/ wr surgxfh wkh
uhvxowv=
Vlqjoh suhflvlrq= i@4=4:5936===
Grxeoh suhflvlrq= i@4=4:5936<733864===
H{whqghg suhflvlrq= i@4=4:5936<733864:;===
Wklv vxjjhvwv d uholdeoh uhvxow ri dssur{lpdwho| 414:5936 ru hyhq
414:5936<7338651 Lq idfw/ krzhyhu/ wkh fruuhfw uhvxow +zlwklq rqh xqlw ri wkh
odvw gljlw, lv
i@3=;5:6<938<<79;5469;4744983<87:<;49=== +5,
Hyhq wkh vljq zdv zurqj1
Wklv h{dpsoh lv riwhq flwhg +iru h{dpsoh/ vhh ^6` dqg ^5`, lq wkh lqwhuydo olw0
hudwxuh wr looxvwudwh wkh idfw wkdw lqfuhdvlqj suhflvlrq grhv qrw dozd|v h{srvh
Wf
?5335 Vxq Plfurv|vwhpv/ Lqf1 Doo uljkwv uhvhuyhg1 Vxq/ Vxq Plfurv|vwhpv/ wkh Vxq
Orjr dqg Iruwh duh wudghpdunv ru uhjlvwhuhg wudghpdunv ri Vxq Plfurv|vwhpv/ Lqf1 lq wkh
Xqlwhg Vwdwhv dqg rwkhu frxqwulhv1
4
qxphulfdo lqvwdelolw|/ zkhuhdv lqwhuydo dulwkphwlf pxvw1 Rwkhu vlplodu h{dp0
sohv duh qrw nqrzq wr wkh dxwkruv1 Dv qrwhg lq ^5`4/ wkh vwulnlqj uhvxowv uh0
sruwhg e| Uxps duh qrw gxsolfdwhg rq d ydulhw| ri prghuq frpsxwhuv1 Iru
wkh suhvhqw sdshu/ wkh dxwkruv yhulhg wkdw Uxps*v uhvxow duh qrw gxsolfdwhg
xvlqj LHHH :87 dulwkphwlf dqg dq| urxqglqj prgh lqfoxglqj wkh prvw frpprq/
urxqg0wr0qhduhvw1 Wkh uhvxowv xvlqj vlqjoh/ grxeoh/ dqg txdguxsoh suhflvlrq uhdo
dulwkphwlf lq wkh Iruwh Ghyhorshu 9 Xsgdwh 5 Iruwudq <8 frpslohu iurp Vxq
Plfurv|vwhpv Lqf1 ^4` duh=
650elw= i@9=66;586H .5<
970elw= i@4=4;38<4953:4:7446H .54
45;0elw= i@.4=4:5936<733864:;964;8;;67<378534;6;
+6,
Wkhvh uhvxowv duh hyhq ohvv fruuhfw wkdq Uxps*v ruljlqdo1 Qhyhuwkhohvv/ xvh
ri lqfuhdvlqj suhflvlrq zduqv wkdw wkh frpsxwdwlrq lv xqvwdeoh1 Wklv vxjjhvwv
wkdw shukdsv LHHH dulwkphwlf/ xqolnh wkdw rq LEP*v V26:3/ h{srvhv qxphulfdo
lqvwdelolw|1 Zkloh lq pdq| fdvhv lqfuhdvlqj rdwlqj0srlqw suhflvlrq +zkhwkhu
LHHH :87 ru qrw, fdq h{srvh qxphulfdo lqvwdelolw|/ frxqwhu h{dpsohv h{lvw1 Iru
h{dpsoh/ wkh iroorzlqj uhduudqjhphqw ri Uxps*v h{suhvvlrq surgxfhv klv ruljlqdo
hhfw rq LHHH0:87 frpsxwhuv=
i@ +666=:8 d5,e9.d5+44d5e5454e75, . 8=8e;.d
5e=+7,
Xvlqj 650elw/ 970elw/ dqg 45;0elw urxqg0wr0qhduhvw LHHH0:87 dulwkphwlf/ +7, sur0
gxfhv=
650elw= i@4=4:5937
970elw= i@4=4:5936<733864:;9
45;0elw= i@4=4:5936<733864:;964;8;;67<378534;6;
+8,
Hyhq wklv uhirupxodwhg h{suhvvlrq lv qrw frpsohwho| vwdeoh1 Zlog yduldwlrqv lq
uhvxowv pd| rffxu iru dowhuqdwlyh urxqglqj prghv/ urxqglqj suhflvlrqv/ dulwk0
phwlf irupdwv +vxfk dv <90elw zrugv,/ ru h{srqhqwldo hydoxdwlrq phwkrgv1
5Dqdo|vlv
Wkh ydoxhv ri ddqg elq +4, vdwlvi| wkh htxdwlrq=
d5@8=8e5.4=+9,
Dqdo|vlv xvlqj +9, vkrzv wkdw wkh kljk rughu whupv lq +4, dqg +7, fdqfho wr
surgxfh
i@d
5e
5+:,
@3=;5:6<938<<79;5469;4744983<87:<;49===
4Wkh dxwkruv ohduqhg ri wklv sdshu dv wkh suhvhqw sdshu zdv jrlqj wr suhvv1 Qhlwkhu wkh
frqwhqw qru wkh frqfoxvlrqv wkdw iroorz kdyh fkdqjhg dv d frqvhtxhqfh1
5
Wkh whup d
5elv hylghqw lq Uxps*v ruljlqdo h{suhvvlrq dqg lq +7,1 Wkh whup 5
rqo| hphujhv diwhu fdqfhoolqj whupv lqyroylqj d5dqg e51 Wklv vxjjhvwv d pruh
wudqvsduhqw irup ri wkh h{suhvvlrqv lq +4, dqg +7,=
i@8=8e;58=8e;.d
5e=+;,
Xqghu doo irxu LHHH urxqglqj prghv/ wkh LHHH rdwlqj0srlqw uhvxowv iurp +;,
duh zlwklq 4 xos ri ehlqj wkh vdph dv wkrvh lq +8,1 Krzhyhu/ +;, h{srvhv wkh
fdwdvwursklf fdqfhoodwlrq wkdw lv klgghq lq Uxps*v ruljlqdo h{dpsoh1
Qrwh wkdw wkh qdo uhvxow lq +4,/ +7, dqg +;, lv ri rughu 4/ exw wkh odujhvw whupv
duh ri vl}h 8=8e;@:1<4:4438H.69/ zklfk lv qhduo| htxdo wr 5456=Wkxv/ Uxps*v
vwulnlqj h{dpsoh uhtxluhv rdwlqj0srlqw dulwkphwlf wkdw kdv d g|qdplf udqjh ri
dw ohdvw 5456 wr dyrlg ryhu rz/ exw suhflvlrq wkdw lv ohvv wkdq 456 elwv wr fdxvh
wkh huurqhrxv fdqfhoodwlrq1 Wkhvh frqglwlrqv duh vdwlvhg e| LHHH dulwkphwlf
zlwk 650/ 970/ dqg 45;0elw suhflvlrq/ dv lqglfdwhg lq Wdeoh 41 Qhyhuwkhohvv/
LHHH Zrug Ohqjwk G|qdplf Udqjh Suhflvlrq
65 elwv 545: 56 elwv
97 elwv 54356 85 elwv
45; elwv 5496;6 445 elwv
Wdeoh 4= LHHH :87 Iordwlqj0Srlqw Frpsrqhqw Ydoxhv
dv phqwlrqhg lq wkh glvfxvvlrq iroorzlqj +8,/ wkh deryh frqglwlrqv duh rqo|
qhfhvvdu| dqg qrw vx!flhqw wr surgxfh wkh Uxps uhvxow1
Dv dgyhuwlvhg/ hydoxdwlqj +4,/ +7,/ dqg +;, xvlqj lqwhuydo dulwkphwlf lq wkh
i<8 frpslohu ^8`/ surgxfhv zlgh lqwhuydov wkdw frqwdlq wkh fruuhfw dqvzhu/ dqg
wkhuhe| h{srvh wkh lqvwdelolw|1 Dv h{shfwhg/ lqfuhdvlqj suhflvlrq qduurzv wkh
zlgwk ri wkh uhvxowlqj lqwhuydov1 Vhh Wdeoh 51
H{suhvvlrq
+4, +7, +;, +:,
650elw= 916H.63 717H.63 615H.63 415H03:
970elw= 414H.55 :14H.54 81<H.54 515H049
45;0elw= 814H.36 614H.36 814H.36 41<H067
Wdeoh 5= Lqwhuydo Zlgwkv
Dfnqrzohgjhphqw 4 Wkdqnv wr Uxxg Ydq ghu Sdvv iru fkhfnlqj Uxps*v rulj0
lqdo h{dpsoh xvlqj LHHH dulwkphwlf dqg glvfryhulqj wkdw wkh h{shfwhg uhvxowv duh
qrw surg xfhg 1
Dfnqrzohgjhphqw 5 Wkdqnv wr Doh{hl Djdirqry iru shuiruplqj ydulrxv whvwv
rq glhuhqw suhflvlrq rdwlqj0srlqw qxpehuv1
Dfnqrzohgjhphqw 6 Wkdqnv wr wkh uhihuhhv iru wkhlu khosixo frpphqwv dqg
vxjjhvwlrqv1
6
Uhihuhqfhv
^4` Iruwh
wp
Ghyhorshu 9 Iruwudq <8 Xsgdwh 51 Vxq Plfurv|vwhpv/ Mxo| 53341
^5` D1 Fx|w/ E1 Yhugrqn/ V Ehfxzh/ dqg S1 Nxwhuqd1 D uhpdundeoh h{dpsoh ri
fdwdvwursklf fdqfhoodwlrq xqudyhohg1 Frpsxwlqj/ 99=63<653/ 53341
^6` H1U1Kdqvhq1Joredo Rswlpl}dwlrq Xvlqj Lqwhuydo Dqdo|vlv1 Pdufho Ghnnhu/
Lqf1/ Qhz \run/ 4<<51
^7` V1 P1 Uxps1 Dojrulwkpv iru yhulhg lqfoxvlrqv= Wkhru| dqg sudfwlfh1 Lq
U1 H1 Prruh/ hglwru/ Uholdelolw| lq Frpsxwlqj= Wkh Uroh ri Lqwhuydo Phwkrgv
lq Vflhqwlf Frpsxwlqj/ fkdswhu 41 Frpsxwhu Dulwkphwlf dqg Pdwkhpdwlfdo
Vriwzduh/ sdjhv 43<4591 Dfdghplf Suhvv/ Ervwrq/ PD/ 4<;;1
^8` J1 Z1 Zdovwhu1 Lqwhuydo Dulwkphwlf Surjudpplqj Uhihuhqfh= Iruwhwp Zrun0
Vkrs 9 Xsgdwh 5 Iruwudq <81 Vxq Plfurv|vwhpv/ Mxo| 53341
7
View
The Complexity of LTL Rational Synthesis
Chapter
Full-text available
  • Mar 2022
In rational synthesis , we automatically construct a reactive system that satisfies its specification in all rational environments, namely environments that have objectives and act to fulfill them. We complete the study of the complexity of LTL rational synthesis. Our contribution is threefold. First, we tighten the known upper bounds for settings that were left open in earlier work. Second, our complexity analysis is parametric, and we describe tight upper and lower bounds in each of the problem parameters: the game graph, the objectives of the system components, and the objectives of the environment components. Third, we generalize the definition of rational synthesis, combining the cooperative and non-cooperative approaches studied in earlier work, and extend our complexity analysis to the general definition.
View
Formal Verification of the Ethereum 2.0 Beacon Chain
Chapter
Full-text available
  • Jan 2022
We report our experience in the formal verification of the reference implementation of the Beacon Chain. The Beacon Chain is the backbone component of the new Proof-of-Stake Ethereum 2.0 network: it is in charge of tracking information about the validators , their stakes , their attestations (votes) and if some validators are found to be dishonest, to slash them (they lose some of their stakes). The Beacon Chain is mission-critical and any bug in it could compromise the whole network. The Beacon Chain reference implementation developed by the Ethereum Foundation is written in Python, and provides a detailed operational description of the state machine each Beacon Chain’s network participant (node) must implement. We have formally specified and verified the absence of runtime errors in (a large and critical part of) the Beacon Chain reference implementation using the verification-friendly language Dafny. During the course of this work, we have uncovered several issues, proposed verified fixes. We have also synthesised functional correctness specifications that enable us to provide guarantees beyond runtime errors. Our software artefact with the code and proofs in Dafny is available at https://github.com/ConsenSys/eth2.0-dafny .
View
A Sorted Datalog Hammer for Supervisor Verification Conditions Modulo Simple Linear Arithmetic
Chapter
Full-text available
  • Jan 2022
In a previous paper, we have shown that clause sets belonging to the Horn Bernays-Schönfinkel fragment over simple linear real arithmetic (HBS(SLR)) can be translated into HBS clause sets over a finite set of first-order constants. The translation preserves validity and satisfiability and it is still applicable if we extend our input with positive universally or existentially quantified verification conditions (conjectures). We call this translation a Datalog hammer. The combination of its implementation in SPASS-SPL with the Datalog reasoner VLog establishes an effective way of deciding verification conditions in the Horn fragment. We verify supervisor code for two examples: a lane change assistant in a car and an electronic control unit of a supercharged combustion engine. In this paper, we improve our Datalog hammer in several ways: we generalize it to mixed real-integer arithmetic and finite first-order sorts; we extend the class of acceptable inequalities beyond variable bounds and positively grounded inequalities; and we significantly reduce the size of the hammer output by a soft typing discipline. We call the result the sorted Datalog hammer. It not only allows us to handle more complex supervisor code and to model already considered supervisor code more concisely, but it also improves our performance on real world benchmark examples. Finally, we replace the before file-based interface between SPASS-SPL and VLog by a close coupling resulting in a single executable binary.
View
Automated Translation of Natural Language Requirements to Runtime Monitors
Chapter
Full-text available
  • Mar 2022
Runtime verification (RV) enables monitoring systems at runtime, to detect property violations early and limit their potential consequences. This paper presents an end-to-end framework to capture requirements in structured natural language and generate monitors that capture their semantics faithfully. We leverage NASA’s Formal Requirement Elicitation Tool ( fret ), and the RV system Copilot . We extend fret with mechanisms to capture additional information needed to generate monitors, and introduce Ogma , a new tool to bridge the gap between fret and Copilot . With this framework, users can write requirements in an intuitive format and obtain real-time C monitors suitable for use in embedded systems. Our toolchain is available as open source.
View
HOLL: Program Synthesis for Higher Order Logic Locking
Chapter
Full-text available
  • Jan 2022
Logic locking “hides” the functionality of a digital circuit to protect it from counterfeiting, piracy, and malicious design modifications. The original design is transformed into a “locked” design such that the circuit reveals its correct functionality only when it is “unlocked” with a secret sequence of bits—the key bit-string. However, strong attacks, especially the SAT attack that uses a SAT solver to recover the key bit-string, have been profoundly effective at breaking the locked circuit and recovering the circuit functionality. We lift logic locking to Higher Order Logic Locking (HOLL) by hiding a higher-order relation , instead of a key of independent values, challenging the attacker to discover this key relation to recreate the circuit functionality. Our technique uses program synthesis to construct the locked design and synthesize a corresponding key relation . HOLL has low overhead and existing attacks for logic locking do not apply as the entity to be recovered is no more a value. To evaluate our proposal, we propose a new attack ( SynthAttack ) that uses an inductive synthesis algorithm guided by an operational circuit as an input-output oracle to recover the hidden functionality. SynthAttack is inspired by the SAT attack, and similar to the SAT attack, it is verifiably correct , i.e., if the correct functionality is revealed, a verification check guarantees the same. Our empirical analysis shows that SynthAttack can break HOLL for small circuits and small key relations, but it is ineffective for real-life designs.
View
LinSyn: Synthesizing Tight Linear Bounds for Arbitrary Neural Network Activation Functions
Chapter
Full-text available
  • Mar 2022
The most scalable approaches to certifying neural network robustness depend on computing sound linear lower and upper bounds for the network’s activation functions. Current approaches are limited in that the linear bounds must be handcrafted by an expert, and can be sub-optimal, especially when the network’s architecture composes operations using, for example, multiplication such as in LSTMs and the recently popular Swish activation. The dependence on an expert prevents the application of robustness certification to developments in the state-of-the-art of activation functions, and furthermore the lack of tightness guarantees may give a false sense of insecurity about a particular model. To the best of our knowledge, we are the first to consider the problem of automatically synthesizing tight linear bounds for arbitrary n-dimensional activation functions. We propose the first fully automated method that achieves tight linear bounds while only leveraging the mathematical definition of the activation function itself. Our method leverages an efficient heuristic technique to synthesize bounds that are tight and usually sound , and then verifies the soundness (and adjusts the bounds if necessary) using the highly optimized branch-and-bound SMT solver, dReal . Even though our method depends on an SMT solver, we show that the runtime is reasonable in practice, and, compared with state of the art, our method often achieves 2-5X tighter final output bounds and more than quadruple certified robustness.
View
Learning Model Checking and the Kernel Trick for Signal Temporal Logic on Stochastic Processes
Chapter
Full-text available
  • Jan 2022
We introduce a similarity function on formulae of signal temporal logic (STL). It comes in the form of a kernel function , well known in machine learning as a conceptually and computationally efficient tool. The corresponding kernel trick allows us to circumvent the complicated process of feature extraction, i.e. the (typically manual) effort to identify the decisive properties of formulae so that learning can be applied. We demonstrate this consequence and its advantages on the task of predicting (quantitative) satisfaction of STL formulae on stochastic processes: Using our kernel and the kernel trick, we learn (i) computationally efficiently (ii) a practically precise predictor of satisfaction, (iii) avoiding the difficult task of finding a way to explicitly turn formulae into vectors of numbers in a sensible way. We back the high precision we have achieved in the experiments by a theoretically sound PAC guarantee, ensuring our procedure efficiently delivers a close-to-optimal predictor.
View
cvc5: A Versatile and Industrial-Strength SMT Solver
Chapter
Full-text available
  • Jan 2022
cvc5 is the latest SMT solver in the cooperating validity checker series and builds on the successful code base of CVC4. This paper serves as a comprehensive system description of cvc5 ’s architectural design and highlights the major features and components introduced since CVC4 1.8. We evaluate cvc5 ’s performance on all benchmarks in SMT-LIB and provide a comparison against CVC4 and Z3.
View
Searching for Ribbon-Shaped Paths in Fair Transition Systems
Chapter
Full-text available
  • Jan 2022
Diagnosability is a fundamental problem of partial observable systems in safety-critical design. Diagnosability verification checks if the observable part of system is sufficient to detect some faults. A counterexample to diagnosability may consist of infinitely many indistinguishable traces that differ in the occurrence of the fault. When the system under analysis is modeled as a Büchi automaton or finite-state Fair Transition System, this problem reduces to look for ribbon-shaped paths, i.e., fair paths with a loop in the middle. In this paper, we propose to solve the problem by extending the liveness-to-safety approach to look for lasso-shaped paths. The algorithm can be applied to various diagnosability conditions in a uniform way by changing the conditions on the loops. We implemented and evaluated the approach on various diagnosability benchmarks.
View
A Remarkable Example of Catastrophic Cancellation Unraveled
Article
Full-text available
  • May 2001
In this paper we reinvestigate a well-known expression first published in [7], which is often used to illustrate catastrophic cancellation as well as the fact that identical output in different precisions does not imply reliability. The purpose of revisiting this expression is twofold. First, we show in Section 2 that the effect of the cancellation is very different on different IEEE 754 compliant platforms, and we unravel the underlying (hardware) reasons which are unknown to many numerical analysts. Besides illustrating cancellation, this expression also counters the common misbelief among many numerical analysts that a same program will deliver identical results on all IEEE conforming systems. Second, in Section 3 we use, illustrate and comment upon the cross-platform didactical tool Arithmetic Explorer developed at the University of Antwerp, by means of which we performed the bit level analysis of the expression evaluation under investigation on the different machines. We believe that this tool, which is freely available from the authors, can be of use to all of us teaching a first numerical analysis course.
View
View
Interval Arithmetic Programming Reference: Forte TM WorkShop 6 Update 2 Fortran 95
  • Jan 2001
  • G W Walster
Walster, G. W.: Interval Arithmetic Programming Reference: Forte TM WorkShop 6 Update 2 Fortran 95, Sun Microsystems, 2001.
Algorithms for Verified Inclusions: Theory and Practiceq Reliability in Computing: The Role of Interval Methods in Scientific Computing
  • S M Rump