A floating point calculation precision analysis method and system of a C language program verifier

Abstract

The application discloses a floating point calculation precision analysis method and system of a C language program verifier, and the method comprises the following steps: generating floating point precision verification mark information in the form of annotation for a C language program to be subjected to formal verification; performing mark analysis based on the C language program carrying the floating point precision verification mark information, and generating an abstract syntax tree; performing sentence-by-sentence calculation based on the abstract syntax tree, obtaining interval information of program variables of each program point, generating verification conditions of floating point precision defect checking and floating point precision constraint checking, and calling an SMT solver to solve and prove. The application effectively improves the analysis precision of floating point calculation and enhances the usability of a verification tool.

Description

Technical Field

[0001] This invention relates to the field of computer software verification technology, specifically to a method and system for analyzing the floating-point calculation precision of a C language program verifier. Background Technology

[0002] With the increasingly widespread and in-depth application of computers, computer software, as the soul of computers and the carrier of applications, undertakes increasingly important functions. Software reliability has become a focal point of modern software quality issues. Computer programs generate errors when performing floating-point calculations, and these errors accumulate in subsequent floating-point calculations, causing the final result to deviate from the expected real value. This severely affects the accuracy of the calculated solution, thus undermining the reliability of the software.

[0003] Two existing techniques for verifying floating-point calculations are: Gappa: Gappa uses an interval algorithm to calculate the precision of floating-point expressions and provides proofs. PRECiSA: PRECiSA verifies rounding errors in programs through static analysis; it is an automatic analysis tool used to estimate rounding errors in floating-point expressions.

[0004] However, Gappa cannot directly verify C programs; it can only serve as a low-level floating-point analysis tool for other verification tools. To use Gappa to verify C programs, support from other verification platforms and tools is required. Furthermore, in the current version (v-3.1.0), PRECISA only accepts a subset of Prototype Verification System (PVS) languages, including LET expressions, IF-THEN-ELSE constructs, non-recursive function calls, and floating-point operations; it does not support direct verification of C floating-point programs. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention provides a method and system for analyzing the floating-point calculation precision of a C language program verifier, which effectively improves the analysis precision of floating-point calculations and enhances the usability of the verification tool.

[0006] Firstly, this application provides a method for analyzing the precision of floating-point calculations in a C language program verifier, comprising the following steps:

[0007] For C language programs that need to be formally verified, generate floating-point precision verification annotation information in the form of comments;

[0008] Based on a C language program carrying floating-point precision verification annotation information, annotation parsing is performed to generate an abstract syntax tree;

[0009] The abstract syntax tree is used to perform statement-by-statement calculations to obtain the interval information of program variables at each program point. Verification conditions for floating-point precision defect checks and floating-point precision constraint checks are generated, and the SMT solver is called to solve and prove the results.

[0010] In one implementation, generating floating-point precision verification annotation information in the form of annotations includes:

[0011] Before the declaration or definition of a C program function, a function protocol annotation is generated, including a function protocol precondition (requires) clause and a function protocol aftercondition (ensures) clause. The requires clause is used to characterize the floating-point precision constraints that program variables must satisfy when the function is called, and the ensures clause is used to characterize the floating-point precision constraints that program variables satisfy after the function is executed.

[0012] Statement comments between statements in a C program include:

[0013] a. Loop count annotation: loop max_unroll UNROLL_NUM;

[0014] b. Binary control precision annotation: check_limits "result interval constraint predicate";

[0015] c. Built-in predicates for floating-point precision constraints, including:

[0016] The built-in predicates `\real_range(x,a,b)` describe the real range of values ​​for variable `x`, `\error_range(x,a,b)` describe the error range of values ​​for variable `x`, and `\roundingmode(m)` describe the rounding mode of a program point. Here, `x` is a program variable, `a` and `b` are real constants, and `m` is the rounding mode label.

[0017] In one implementation, the step of performing statement-by-statement calculus based on an abstract syntax tree to obtain the interval information of program variables at each program point includes: performing operations on parameters in interval form using arithmetic rules to obtain the operation results in interval form, and denoting the first interval as... The second interval is The interval obtained after processing the first and second intervals using the algorithm is:

[0018] like If is a rational number, then:

[0019] Addition operation:

[0020] Subtraction operation:

[0021] Multiplication operations:

[0022] Division operation: calculated based on multiplication operation;

[0023] like For floating-point numbers, If Δ is for rounding down and Δ is for rounding up, then:

[0024] Addition operation:

[0025] Subtraction operation:

[0026] Multiplication operation:

[0027] Division operation: Calculated based on multiplication operation.

[0028] In one implementation, the step of performing statement-by-statement calculus based on an abstract syntax tree to obtain the interval information of program variables at each program point includes: for multiplication operations, performing operations on parameters in interval form using an optimized multiplication rule to obtain the operation result in interval form, wherein the optimized multiplication rule includes:

[0029] (301) Let the first interval be... The second interval is Based on the relationship between the upper and lower bounds of the first and second intervals and 0, the first and second intervals are divided into several types;

[0030] (302) Based on the type of the first interval and the type of the second interval in the multiplication operation, at least one candidate value that is not the minimum value is excluded from the four candidate values ​​of the upper and lower bound values ​​of the interval of the multiplication operation result. At least one candidate value that is not the maximum value is excluded from the four candidate values ​​of the lower bound value of the interval of the multiplication operation result. The remaining lower bound value candidate value and upper bound value candidate value are used as the interval of the operation result after the multiplication operation is optimized.

[0031] In one implementation, step (301) divides the first and second intervals into multiple types based on the relationship between the upper and lower bounds of the first and second intervals and 0, including:

[0032] The first interval is divided into three types: u >=0、 u <= 0;

[0033] The second interval is divided into three types: v >=0、

[0034] The (302) includes:

[0035] (3021) If If the number is rational, then the four candidate values ​​for the upper and lower bounds are: Correspondingly, the optimized multiplication rules include:

[0036] when u >=0, v When >= 0: (u*v).inf = u * v ,

[0037] when u >=0, hour:

[0038] when u >=0, hour:

[0039] when v When >=0:

[0040] when hour:

[0041] when hour: (u*v).sup= u * v ;

[0042] when v When >=0:

[0043] when hour: (u*v).sup= u * v ;

[0044] when hour: (u*v).sup= u * v ;

[0045] (3022) If For floating-point numbers: the four candidate values ​​for the upper bound are Δ( u * v ), The four candidate values ​​for the lower bound are For rounding down, Δ is for rounding up. Correspondingly, the optimized multiplication rules include:

[0046] when u >=0, v When >=0:

[0047] when u >=0, hour:

[0048] when u >=0, hour:

[0049] when v When >=0:

[0050] when hour:

[0051] when hour: (u*v).sup=Δ u * v ;

[0052] when v When >=0:

[0053] when hour: (u*v).sup=Δ u * v ;

[0054] when hour: (u*v).sup=Δ u * v .

[0055] In one implementation, the step of performing statement-by-statement calculus based on the abstract syntax tree to obtain the interval information of the program variables at each program point includes: the calculation of the division operation u / v adopts the following steps:

[0056] (501) Interval based on v Determine the upper and lower bounds of the interval for 1 / v;

[0057] (502) The interval information based on u and the interval information of 1 / v is calculated in the form of multiplication operation u*(1 / v);

[0058] The (501) interval based on v Determine the upper and lower bounds of the interval for 1 / v, including:

[0059] like For rational numbers:

[0060] exist v >0 or When, the upper bound of the interval 1 / v is (1 / v).sup = 1 / v , the lower bound of the interval (1 / v). exist When , the interval of 1 / v is [-∞, ∞];

[0061] like For floating-point numbers:

[0062] exist v >0 or When, the upper bound of the interval for 1 / v is (1 / v).sup=Δ1 / v , the lower bound of the interval (1 / v). exist When , the interval of 1 / v is [-∞, ∞];

[0063] In one implementation, the step of performing statement-by-statement calculus based on the abstract syntax tree to obtain the interval information of the program variables at each program point includes:

[0064] Determine whether there is a dependency effect on the parameters. If so, subdivide the original interval of the parameters in the calculation formula using an interval bisection strategy to obtain multiple corresponding sub-intervals.

[0065] Based on multiple subintervals of the original interval, the parameters in interval form are operated on using the algorithm to obtain the operation result in interval form.

[0066] In one implementation, determining whether the parameter has a dependency effect includes:

[0067] The interval of the variable that appears multiple times in the expression is bisected once and then calculated. The resulting interval is compared with the interval calculated without bisecting. If the resulting interval decreases, it is determined that the variable has a dependency effect and the bisecting strategy is activated. Otherwise, the bisecting strategy is not activated.

[0068] In one embodiment, the interval bisection strategy includes a method for controlling the depth of the bisection processing, the method for controlling the depth of the bisection processing including:

[0069] The binary search depth is controlled based on the check_limits annotation data or the default value MAX_BISECTION_TIMES for binary search depth, with the check_limits annotation data having a higher priority than the default value for binary search depth.

[0070] The check_limits annotation data is in the following format:

[0071] / *@check_limits\real_range(z,a,b);* / means that the binary search result must satisfy the constraint that the real number range of z is greater than or equal to a and less than or equal to b; if the constraint is satisfied, the binary search process stops; otherwise, the binary search process continues.

[0072] In one implementation, controlling the binary search processing depth based on the default value MAX_BISECTION_TIMES includes:

[0073] When a single variable in an expression has a dependency effect, the interval binary search depth of that variable is controlled based on the default value MAX_BISECTION_TIMES.

[0074] When multiple variables in an expression have a dependency effect, the interval binary search depth of multiple variables is synchronously controlled based on the default binary search depth MAX_BISECTION_TIMES / n, where n is the number of variables with a dependency effect, and the result is rounded up.

[0075] In one implementation, the step of performing statement-by-statement calculus based on the abstract syntax tree to obtain the interval information of the program variables at each program point includes: performing operations on parameters in interval form using arithmetic rules, while considering error accumulation based on ULP theory to obtain the calculation result considering error accumulation, and recording the first number f. x The real number range is r. x The error range is e x The second number f y The real number range is r. y The error range is e y Then we have:

[0076] f x +f y =f x+y =r x+y +e x+y =r x +r y +e x +e y +(0.5||1)*\ulp(r x +r y+e x +e y );

[0077] f x -f y =f x-y =r x-y +e x-y =r x -r y +e x -e y +(0.5||1)*\ulp(r x -r y +e x -e y );

[0078] f x *f y =r x *r y +r x *e x +e x *r y +e x *e y +(0.5||1)*\ulp(r x *r y +r x *e x +e x *r y +e x *e y );

[0079]

[0080] The choice between 0.5 and 1 is determined by the floating-point rounding mode.

[0081] In one implementation, the step of performing statement-by-statement calculus based on the abstract syntax tree to obtain the interval information of the program variables at each program point includes:

[0082] (901) For a conditional statement of the form “x⊙a”, where ⊙ is any one of <=, <, >, >=, x is a variable name, and a is a constant expression, the calculation of the interval information of the program variables includes the following steps:

[0083] Let the real range of x be \real_range(x,e,f); the error range of x be \error_range(x,m,n); the real range of a be \real_range(p,a1,a2); and the error range of a be \error_range(p,a3,a4).

[0084] Get the intermediate variable new.a:

[0085] new.a=(\real_range(p,a1,a2)+\error_range(p,a3,a4)-\error_range(x,m,n));

[0086] Determine whether x⊙a holds true based on the relationship between the upper and lower bounds of the intermediate variable new.a and the upper and lower bounds f and e of the real value range of x.

[0087] In one implementation, the step of performing statement-by-statement calculus based on the abstract syntax tree to obtain the interval information of the program variables at each program point includes:

[0088] (902) For loop statements involving floating-point calculations, the loop process is determined based on the annotation parameter loop max_unrollUNROLL_NUM, including:

[0089] (1) Expand the loop body and calculate line by line until the end of the loop body;

[0090] (2) Verify whether the loop condition is true. If it is true, proceed to step (3); otherwise, proceed to step (4).

[0091] (3) Determine if the number of expansions is less than UNROLL_NUM. If it is less, proceed to step (1); otherwise, proceed to step (4).

[0092] (3) Jump to the next statement after the loop exit and continue the calculation.

[0093] In one implementation, the verification conditions for generating floating-point precision defect checks and floating-point precision constraint checks include: large number eating small number defect checks, floating-point overflow defect checks, division by zero defect checks, and not-number defect checks.

[0094] The defect check for large numbers consuming small numbers includes:

[0095] For parameters in addition and subtraction binary operations, determine whether the minimum absolute value of one floating-point variable is smaller than 0.5 or 1 times the maximum absolute value of the other floating-point variable (ulp). If so, there is a case where the larger number eats the smaller number. The values ​​of 0.5 and 1 are related to the rounding mode.

[0096] The floating-point overflow defect check includes:

[0097] The floating-point interval fx is obtained by adding the real number of variable x to the error;

[0098] Determine if the maximum value of fx, fx.max, is greater than the maximum value of the floating-point type, fmax. If so, the variable x has an overflow defect.

[0099] Determine if the minimum value of fx, fx.min, is less than the minimum value of the floating-point type, fmin. If so, the variable x has an underflow defect.

[0100] The defect inspection with a divisor of zero includes:

[0101] For the divisor x in the division operation, determine whether the floating-point interval fx of the divisor x satisfies fx.min<=0<=fx.max. If it does, then there is a defect of division by zero.

[0102] The non-numerical defect inspection includes:

[0103] Determine the floating-point interval f of variable x x For infinite cases, for f x =r x +e x If r x and e x If neither value is infinite, then x.infinite == 0. If the two values ​​contain only -infinite, then x.infinite == 1. If the two values ​​contain only infinite, then x.infinite == 2. If the two values ​​contain both -infinite and infinite, then x.infinite == 3. The cases with the NOT defect are as follows:

[0104] For addition, if any one of the following four assertions is true, then a not-number defect is determined:

[0105] x.infinite==1&&y.infinite==2;

[0106] x.infinite==3&&y.infinite! =0;

[0107] x.infinite==2&&y.infinite==1;

[0108] x.infinite! =0&&y.infinite==3;

[0109] For subtraction, if any one of the following four assertions is true, then a not-number defect is determined:

[0110] x.infinite==1&&y.infinite==1;

[0111] x.infinite==3&&y.infinite! =0;

[0112] x.infinite==2&&y.infinite==2;

[0113] x.infinite! =0&&y.infinite==3;

[0114] For multiplication, a not-number defect is determined to exist if either of the following two assertions is true:

[0115] x.infinite! =0&&fy.min<=0<=fy.max;

[0116] y.infinite! =0&&fx.min<=0<=fx.max;

[0117] For division operations, if either of the following two assertions is true, then a not-number defect is determined:

[0118] x.infinite! =0&&y.infinite! =0;

[0119] fx.min<=0<=fx.max&&fy.min<=0<=fy.max.

[0120] Secondly, this application provides a floating-point calculation precision analysis system for a C language program verifier, the system comprising:

[0121] The floating-point precision verification annotation generation module is used to generate floating-point precision verification annotation information in the form of comments for C language programs that are to be formally verified.

[0122] The floating-point precision verification annotation parsing module is used to parse annotations based on C language programs that carry floating-point precision verification annotation information and generate abstract syntax trees.

[0123] The interval calculation module is used to perform statement-by-statement calculations based on the abstract syntax tree to obtain the interval information of the program variables at each program point and generate verification conditions for floating-point precision defect checks and floating-point precision constraint checks.

[0124] The proof module is used to call the SMT solver to perform the proof.

[0125] The floating-point calculation precision analysis method and system for a C language program verifier of the present invention have the following beneficial effects:

[0126] 1. By adding formal annotations and using deductive reasoning, we achieved direct verification of floating-point precision in C program source code.

[0127] 2. A binary search strategy for interval computation with controllable accuracy is proposed to reduce the dependency effect caused by dependent variables and improve the accuracy of interval computation.

[0128] 3. By expanding loop statements, verification support for C programs containing loop statements is achieved.

[0129] 4. The floating-point error is calculated using the ULP theory in the floating-point calculation rounding mode of the program, which improves the accuracy of error calculation.

[0130] 5. This invention effectively improves the analytical accuracy of floating-point calculations and enhances the usability of verification tools. Attached Figure Description

[0131] Figure 1 This is a flowchart illustrating the floating-point calculation precision analysis method for a C language program verifier according to an embodiment of this application;

[0132] Figure 2 This is a schematic diagram of the processing flow of the two-part strategy in the embodiments of this application;

[0133] Figure 3 This is a schematic diagram illustrating the determination of dependency effect in the dichotomy strategy in the embodiments of this application;

[0134] Figure 4 This is a schematic diagram of the calculation process for interval bisection processing when there are auxiliary labels before the expression in the bisection strategy of this application embodiment;

[0135] Figure 5 This is a schematic diagram of a binary strategy in this application where multiple variables have a dependency effect, and interval binary processing is performed simultaneously.

[0136] Figure 6 This is a schematic diagram of the floating-point calculation precision analysis system used for C language program verifier in an embodiment of this application. Detailed Implementation

[0137] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0138] In the following description, the term "one implementation" refers to a subset of all possible implementations, but it is understood that "one implementation" may be the same subset or a different subset of all possible implementations and may be combined with each other without conflict.

[0139] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0140] 1. Interval Algorithm: This algorithm uses intervals to record the numerical properties of variables and calculates the result interval of an expression using interval calculation rules. It is primarily used for analyzing computational accuracy and error control. In the following text, 'inf' represents the lower bound of the interval, and 'sup' represents the upper bound.

[0141] 2. Floating-point numbers: These are numerical representations of numbers belonging to a specific subset of rational numbers. In computers, they are used to approximate any real number. In a computer, they mainly consist of three parts: the sign bit, the exponent bit, and the mantissa bit. Their numerical representation is (-1). s ×M×2 E .

[0142] 3. ulp: an abbreviation for unit in the last place, which is the smallest unit of the last position of a floating-point number when representing a real number using floating-point numbers.

[0143] 4. Dependency effect: In interval algorithms, due to the dependency relationship between variables a and b (i.e., a changes as b changes), and the dependency relationship is not recorded in the calculation, the intervals of a and b in the calculation are independent of each other. Therefore, the calculated result interval may be larger than the actual interval. This situation is called the dependency effect.

[0144] 5. Floating-point rounding mode: The approximation method used by the computer after floating-point calculation. The IEEE 754 standard specifies four rounding schemes: round-to-even (RNE), round-to-zero (RTZ), round-to-positive (RTP), and round-to-negative (RTN).

[0145] 6. Larger number eats smaller number: In floating-point addition and subtraction calculations, if the magnitudes of the two variables are too different, the calculation result will keep the larger number unchanged and the smaller number will be ignored. This is called the larger number eating smaller number.

[0146] 7. Bisection Strategy: For interval calculations with dependency effects, using smaller intervals yields more accurate results and reduces the impact of dependency effects. Therefore, the strategy of continuously bisecting intervals with dependency effects, calculating each sub-interval separately, and then merging the calculated intervals to obtain an interval with a specific precision is called the bisection strategy.

[0147] 8. Absolute error: The difference between the result of a variable being operated on in a floating-point environment and in a real-number environment is the absolute error of the variable.

[0148] 9. Floating-point precision annotation: An assertion added to a C program in the form of a comment to describe the floating-point precision constraints that the C program should meet.

[0149] 10. SMT: Satisfiability Modulo Theories.

[0150] 11. SMT Solver: An automated tool used to solve SMT problems.

[0151] 12. Hoare Calculus: Verifying C programs based on Hoare program logic.

[0152] See Figure 1 This application provides a method for analyzing the precision of floating-point calculations in a C language program verifier, comprising the following steps:

[0153] Step 1: For the C language program to be formally verified, generate floating-point precision verification annotation information in the form of comments;

[0154] Step 2: Based on the C language program carrying floating-point precision verification annotation information, perform annotation parsing to generate an abstract syntax tree;

[0155] Step 3: Perform statement-by-statement calculations based on the abstract syntax tree to obtain the interval information of the program variables at each program point, and generate verification conditions for floating-point precision defect checks and floating-point precision constraint checks.

[0156] Step 4: Call the SMT solver to solve and prove.

[0157] In this embodiment, floating-point precision verification of the C program source code is achieved directly by adding formal annotations and employing deductive reasoning. Specifically, in step 1, floating-point precision annotations are added to the C program in the form of comments ( / *@…* / or / / @…) to describe the floating-point precision constraints that the C program should satisfy. Step 2 involves annotation parsing to resolve the annotation information.

[0158] In one implementation, the floating-point precision annotation in step 1 includes:

[0159] (i) Generate function protocol annotations before the declaration or definition of C program functions, including function protocol preconditions (requires) clauses and function protocol afterconditions (ensures) clauses. The requires clause is used to characterize the floating-point precision constraints that program variables (external variables and actual parameters) must satisfy when the function is called, and the ensures clause is used to characterize the floating-point precision constraints that program variables (external variables and function return values) satisfy after the function is executed.

[0160] (ii) Statement annotations between statements in a C program, including:

[0161] a. Loop count annotation: loop max_unroll UNROLL_NUM

[0162] This annotation appears before the loop statement and describes the maximum number of times the loop can be expanded, UNROLL_NUM. The floating-point range calculation module expands the loop body based on the value of UNROLL_NUM and performs calculations on each of the expanded statement sequences.

[0163] b. Binary control precision annotation: check_limits "result interval constraint predicate"

[0164] This annotation appears before the assignment expression and provides a precision constraint in the form of a custom predicate. It describes the precision that the right-hand side of the assignment expression should satisfy when performing interval calculations using binary search. The floating-point interval calculation module controls the number of binary search operations based on this interval constraint precision to improve calculation efficiency.

[0165] c. Built-in predicates

[0166] To describe the floating-point precision constraints satisfied by program variables, this application provides the following built-in predicates:

[0167] 1) `real_range(x,a,b)`, where `x` is a program variable, and `a` and `b` are real constants. It describes the range of real values ​​that the variable `x` can take.

[0168] 2) `error_range(x,a,b)`, where `x` is a program variable, and `a` and `b` are real constants. It describes the range of values ​​for the error of variable `x`.

[0169] 3) `\roundingmode(a)`, where `a` is the rounding mode label. It describes the rounding mode for the current program point. The main rounding mode labels are: `\RNE` (round to nearest), `\RTN` (round down), `\RTZ` (round towards zero), and `\RTP` (round up).

[0170] In one implementation, step 3 above, which involves performing statement-by-statement calculus based on the abstract syntax tree to obtain the interval information of the program variables at each program point, includes: performing operations on the interval-form parameters using arithmetic rules to obtain the interval-form operation results, and denoting the first interval as... The second interval is The interval obtained after processing the first and second intervals using the algorithm is:

[0171] like If is a rational number, then:

[0172] Addition operation:

[0173] Subtraction operation:

[0174] Multiplication operation:

[0175] Division operation: calculated based on multiplication operation;

[0176] like For floating-point numbers, If Δ is for rounding down and Δ is for rounding up, then:

[0177] Addition operation:

[0178] Subtraction operation:

[0179] Multiplication operation:

[0180] Division operation: Calculated based on multiplication operation.

[0181] In one implementation, step 3 above, which involves performing statement-by-statement calculus based on the abstract syntax tree to obtain the interval information of the program variables at each program point, includes: for multiplication operations, using optimized multiplication rules to perform operations on parameters in interval form to obtain the operation results in interval form, wherein the optimized multiplication rules include:

[0182] (301) Let the first interval be... The second interval is Based on the relationship between the upper and lower bounds of the first and second intervals and 0, the first and second intervals are divided into several types;

[0183] (302) Based on the type of the first interval and the type of the second interval in the multiplication operation, at least one candidate value that is not the minimum value is excluded from the four candidate values ​​of the upper and lower bound values ​​of the interval of the multiplication operation result. At least one candidate value that is not the maximum value is excluded from the four candidate values ​​of the lower bound value of the interval of the multiplication operation result. The remaining lower bound value candidate value and upper bound value candidate value are used as the interval of the operation result after the multiplication operation is optimized.

[0184] In one implementation, in step (301), the first interval is divided into three types: u >=0、 u <=0; Divide the second interval into three types as well: v >=0、 Based on this, there are 9 possible combinations of the result types based on the type of the first interval and the type of the second interval in the multiplication operation (see Table 1 and Table 2 below for the 9 possible combination result types).

[0185] Based on dividing the first and second intervals into three categories respectively, the methods for eliminating candidate values ​​include:

[0186] Based on the combined result type of the first and second intervals in the multiplication operation, for the upper bound of the interval, two or three candidate values ​​that are definitely not the maximum value are excluded from the four candidate values. The larger of the remaining two candidate values ​​is selected, or the remaining candidate value is used as the upper bound of the interval. Similarly, for the lower bound of the interval, two or three candidate values ​​that are definitely not the minimum value are excluded from the four candidate values. The smaller of the remaining two candidate values ​​is selected, or the remaining candidate value is used as the lower bound of the interval. Where:

[0187] like If the number is rational, then the four candidate values ​​for the upper and lower bounds are:

[0188] like For floating-point numbers: the four candidate values ​​for the upper bound are... The four candidate values ​​for the lower bound are Δ is for rounding down, and Δ is for rounding up.

[0189] For the upper bound of the interval of the result of a multiplication operation, it can be understood that in conventional calculations, four candidate values ​​are considered. The maximum value is used as the upper bound of the interval of the multiplication result. In this embodiment, the first interval is divided into three types: u >=0、 u If <= 0, the second interval is divided into three types: v >=0、 by u >=0 at the same time v The process of eliminating two or three definite non-maximum candidate values ​​from the four candidate values ​​for the case where >= 0 can determine the four candidate values ​​for the upper bound of the interval u*v. u * v , middle, It is the definite maximum value, while the other three are... u * v , It is a definite non-maximum value, so whenu >=0, v When >= 0, the upper bound (u*v) of the interval can be determined. For the remaining 8 types of the combined result of the types belonging to the first interval and the second interval, the same as above... u >=0, v The case of >=0 is similar; in both cases, two or three candidate values ​​can be eliminated from four candidate values, thereby optimizing the multiplication operation of the interval.

[0190] Specifically, based on dividing the first and second intervals into three types respectively, the optimized multiplication rule includes:

[0191] like For rational numbers:

[0192]

[0193] Table 1 Optimized multiplication rules for rational numbers

[0194] like For floating-point numbers, For rounding down, Δ means rounding up.

[0195]

[0196] Table 2 Optimized multiplication rules for floating-point numbers

[0197] In one implementation, step 3 above involves performing statement-by-statement calculations based on the abstract syntax tree to obtain the range information of program variables at each program point, including: the calculation of the division operation u / v uses the following steps:

[0198] (1) Interval based on v Determine the upper and lower bounds of the interval for 1 / v;

[0199] (2) The interval information based on u and the interval information of 1 / v are calculated in the form of multiplication operation u*(1 / v);

[0200] The interval based on v in (1) Determine the upper and lower bounds of the interval for 1 / v, including:

[0201] like For rational numbers: v >0 or When, the upper bound of the interval 1 / v is (1 / v).sup = 1 / v , the lower bound of the interval (1 / v). exist When , the interval of 1 / v is [-∞, ∞];

[0202] like For floating-point numbers: v >0 or When, the upper bound of the interval for 1 / v is (1 / v).sup=Δ1 / v , the lower bound of the interval (1 / v). exist When , the interval of 1 / v is [-∞, ∞).

[0203] In one implementation, step 3 above involves performing statement-by-statement calculus based on the abstract syntax tree to obtain the range information of program variables at each program point, including:

[0204] Step 31: Determine whether there is a dependency effect on the parameters. If so, subdivide the original interval of the parameters in the calculation formula using the interval bisection strategy to obtain multiple corresponding sub-intervals.

[0205] Step 32: Based on multiple sub-intervals of the original interval, perform operations on the parameters in interval form using the arithmetic rules to obtain the operation results in interval form.

[0206] Furthermore, step 31 above, determining whether the parameter has a dependency effect, includes:

[0207] Step 311: Divide the interval of the variable that appears multiple times in the expression into two parts and calculate. Compare the result interval with the interval calculated without division. If the result interval decreases, it is determined that the variable has a dependency effect and the division strategy is enabled. Otherwise, the division strategy is not enabled.

[0208] Furthermore, the interval bisection strategy in step 31 above includes a method for controlling the depth of the bisection processing, wherein the method for controlling the depth of the bisection processing includes:

[0209] The binary search depth is controlled based on the check_limits annotation data or the default value of the binary search depth MAX_BISECTION_TIMES, with the check_limits annotation data having a higher priority than the default value of the binary search depth;

[0210] The check_limits annotation data is in the following format:

[0211] / *@check_limits\real_range(z,a,b);* / means that the binary search result must satisfy the constraint that the real number range of z is greater than or equal to a and less than or equal to b; if the constraint is satisfied, the binary search process stops; otherwise, the binary search process continues.

[0212] Furthermore, when controlling the binary search processing depth based on the default value MAX_BISECTION_TIMES, the following is included:

[0213] When a single variable in an expression has a dependency effect, the interval binary search depth of that variable is controlled based on the default value MAX_BISECTION_TIMES.

[0214] When multiple variables in an expression have a dependency effect, the interval binary search depth of multiple variables is synchronously controlled based on the default binary search depth MAX_BISECTION_TIMES / n, where n is the number of variables with a dependency effect, and the result is rounded up.

[0215] Specifically, considering that the interval abstraction domain can effectively record the range properties of variables but cannot track the dependencies between variables, the dependency effect caused by this dependency can lead to the calculated interval range being larger than the actual interval. To optimize this situation, this application considers that the implementation of interval calculation usually has an equivalence property, that is, a smaller input interval leads to a smaller output interval. If the input interval is a point interval, the output interval will also be a point interval (ignoring rounding errors). Therefore, using a smaller input interval often reduces the impact of dependency effects. In a preferred embodiment, this application uses a bisection strategy to subdivide the input interval into two sub-intervals for calculation to reduce the impact of dependency effects. For example, for the expression x+1 / x, if the interval range of x is [1,2], the interval range of the result is [2,2.5]. The calculation process of the interval algorithm is as follows:

[0216] x+1 / x=[1,2]+[1,1] / [1,2]=[1,2]+[0.5,1]=[1.5,3]

[0217] The obtained interval range is [1.5, 3]. Due to the dependency effect, the calculated interval is larger than the actual interval.

[0218] If we divide the range of x into two parts, namely [1, 1.5] and [1.5, 2], and then use the interval algorithm to calculate:

[0219] x+1 / x=[1,1.5]+[1,1] / [1,1.5]=[1,1.5]+[2 / 3,1]=[5 / 3,2.5]

[0220] x+1 / x=[1.5,2]+[1,1] / [1.5,2]=[1.5,2]+[0.5,2 / 3]=[2,8 / 3]

[0221] In summary, the resulting interval is x+1 / x=[5 / 3,8 / 3]≈[1.7,2.7]. Compared to the result interval [1.5,3] before the binary search, the result calculated after the binary search is closer to the true value [2,2.5].

[0222] like Figure 2 As shown, the processing flow of the binary search strategy used in this application is as follows:

[0223] a. Determination of dependency effect

[0224] The expression performs a binary search on the interval containing the variable that appears multiple times. The resulting interval is then compared to the interval calculated without binary search. If the resulting interval decreases, the binary search strategy is activated. Otherwise, the binary search strategy is not activated. See [link to documentation]. Figure 3 .

[0225] b. Are there any auxiliary annotations before the expression?

[0226] b1. Does the expression have an auxiliary annotation, such as / *@check_limits\real_range(z,a,b);* / , to control the depth of the interval bisection process? When the calculated result z satisfies the condition that the real number range of z is greater than or equal to a and less than or equal to b, the interval bisection process stops; otherwise, it continues. For example, the expression z = x + 1 / x, with the auxiliary annotation: / *@check_limits\real_range(z,1.5001,2.5001);* / , its interval bisection calculation process is as follows: Figure 4 As shown, when the result of the operation satisfies that the real number of z is in the range of 1.5001 to 2.5001, the interval bisection process of x is stopped.

[0227] It's understandable that when multiple variables in an expression have a dependency effect, the variables are simultaneously bisected (i.e., the bisection depth of each variable is consistent), and then combined for calculation. For example, in the expression x+1 / x+y+1 / y, where the intervals of x and y are both [1,2], the variables x and y are simultaneously bisected (e.g., ...). Figure 5 As shown), according to Figure 5 Given four possible combinations of x and y intervals, calculate the interval result of x+1 / x+y+1 / y, and then merge the four results to obtain an interval result with higher precision than the original interval calculation.

[0228] b2. No auxiliary annotation is provided before the expression. The depth of the interval bisection processing of the variable is controlled based on the default value MAX_BISECTION_TIMES. Usually, MAX_BISECTION_TIMES is 20. Specifically, when there is a single variable in the expression with a dependency effect, the depth of the interval bisection processing of that single variable is MAX_BISECTION_TIMES. When there are multiple variables in the expression with a dependency effect, the depth of the interval bisection processing of those multiple variables is MAX_BISECTION_TIMES / n.

[0229] In this embodiment of the application, in view of the technical problem that Gappa has poor ability to handle the dependency effect of variables, resulting in inaccurate interval calculation results and large errors, a binary strategy for interval calculation with controllable accuracy is adopted to reduce the dependency effect caused by dependent variables and improve the accuracy of interval calculation.

[0230] In one implementation, considering that the decimal part exceeding the storage value will be rounded after computer floating-point calculation, based on the rounding principle of computer floating-point calculation and the normal accumulation of errors, this embodiment provides a corresponding error interval calculation method for the errors of computer floating-point arithmetic operations. Step 3 above involves performing statement-by-statement calculations based on the abstract syntax tree to obtain the interval information of the program variables at each program point, including: performing operations on parameters in interval form using arithmetic rules, and simultaneously considering error accumulation based on ULP theory to obtain the calculation result considering error accumulation, denoted as the first number f. x The real number range is r. x The error range is e x The second number f y The real number range is r. y The error range is e y Then we have:

[0231] (a)f x +f y =f x+y =r x+y +e x+y =r x +r y +e x +e y +(0.5||1)*\ulp(r x +r y +e x +e y ),

[0232] in:

[0233] r x+y =r x +r y It is fx+y The range of real numbers,

[0234] e x+y =e x +e y +(0.5||1)*\ulp(r x +r y +e x +e y ) is f x+y The range of error values;

[0235] (ii)f x -f y =f x-y =r x-y +e x-y =r x -r y +e x -e y +(0.5||1)*\ulp(r x -r y +e x -e y );

[0236] in:

[0237] r x-y =r x -r y It is f x-y The range of real numbers,

[0238] e x+y =e x -e y +(0.5||1)*\ulp(r x -r y +e x -e y ) is f x-y The range of error values;

[0239] (III) f x *f y =f x*y =r x*y +e x*y =r x *r y +r x *e x +e x *r y +e x *e y +(0.5||1)*\ulp(r x *r y +r x *ex +e x *r y +e x *e y );

[0240] in:

[0241] r x*y =r x *r y It is f x*y The range of real numbers,

[0242] e x*y =r x *e x +e x *r y +e x *e y +(0.5||1)*\ulp(r x *r y +r x *e x +e x *r y +e x *e y ) is f x*y The range of error values;

[0243] (Four)

[0244] in:

[0245] r x / y =r x / r y It is f x / y The range of real numbers,

[0246] It is f x / y The error range.

[0247] The choice of 0.5 and 1 in the above calculation formulas (I), (II), (III), and (IV) is determined by the floating-point rounding mode. If the rounding mode used is RNE, the maximum rounding error is 0.5 times ulp. The maximum rounding error for the other three rounding modes is ulp.

[0248] In one implementation, the above-mentioned interval bisection strategy is organically combined with the error accumulation consideration based on ULP theory, which effectively improves the accuracy of floating-point error calculation.

[0249] In one implementation, step 3 above involves performing statement-by-statement calculus based on the abstract syntax tree to obtain the range information of program variables at each program point, including:

[0250] (901) For a conditional statement of the form "x⊙a", where ⊙ is any one of <=, <, >, >=, x is a variable name, and a is a constant expression, when calculating the interval information of program variables, the following steps are included:

[0251] Denote the real value range of x as \real_range(x, e, f); the error value range of x as \error_range(x, m, n); the real value range of a as \real_range(p, a1, a2); the error value range of a as \error_range(p, a3, a4);

[0252] Obtain the intermediate variable new.a:

[0253] new.a = (\real_range(p, a1, a2) + \error_range(p, a3, a4) - \error_range(x, m, n));

[0254] Determine whether x⊙a holds based on the size relationship between the upper and lower bounds of the intermediate variable new.a and the upper bound f and lower bound e of the real value range of x.

[0255] Taking ⊙ as >, that is, x > a for illustration, to determine whether x > a holds, consider whether the lower bound new.a_inf of new.a < f holds. If it holds, then it is determined that x > a can hold, enter the then statement, and \real_range(x, max(new.a_inf, e), f), \error_range(x, m, n), otherwise the then statement is FALSE;

[0256] Further, consider whether the upper bound new.a_sup of new.a > e holds. If it holds, then the range of the else statement is \real_range(x, e, min(new.a_sup, f)), \error_range(x, m, n), otherwise the else statement is FALSE.

[0257] For the cases where ⊙ is <=, <, >=, the judgment logic is similar to the above case where ⊙ is >. When new.a_sup > e holds, it is determined that x < a can hold, and when new.a_inf < f holds, it is determined that x > a can hold.

[0258] Further, it can be understood that for a conditional statement of the form "x⊙a", when determining whether x⊙a holds, a further conditional variable interval is obtained, and then the variable intervals related to the conditional variable are optimized, and the variables associated with it are recalculated using the calculated conditional variable interval.

[0259] In one implementation, step 3 above involves performing statement-by-statement calculus based on the abstract syntax tree to obtain the range information of program variables at each program point, including:

[0260] (902) For loop statements involving floating-point calculations, the loop process is determined based on the annotation parameter loop max_unrollUNROLL_NUM. The calculation process for loop statements involving floating-point calculations includes:

[0261] (1) Expand the loop body and calculate line by line until the end of the loop body;

[0262] (2) Verify whether the loop condition is true. If it is true, proceed to step (3); otherwise, proceed to step (4).

[0263] (3) Determine if the number of expansions is less than UNROLL_NUM. If it is less, proceed to step (1); otherwise, proceed to step (4).

[0264] (3) Jump to the next statement after the loop exit and continue the calculation.

[0265] In this embodiment of the application, to address the technical problem that Gappa only supports the verification of linear programs and not loops, verification support for C programs containing loop statements is achieved by expanding the loop statements.

[0266] In one implementation, step 3 above generates verification conditions for floating-point precision defect checks and floating-point precision constraint checks, including: large number eating small number defect checks, floating-point overflow defect checks, division by zero defect checks, and not-a-number defect checks.

[0267] (1001) Large number eating small number defect inspection, including:

[0268] For parameters in addition and subtraction binary operations, determine whether the minimum absolute value of one floating-point variable is smaller than 0.5 or 1 times the maximum absolute value of the other floating-point variable ulp. If so, there is a case of larger number consuming smaller number. The values ​​of 0.5 and 1 are related to the rounding mode.

[0269] Specifically, the defect detection of large numbers consuming small numbers includes the following steps:

[0270] Based on the real value range r of variable x x With the error range e x The floating-point interval f obtained after addition x ;

[0271] Then take the absolute value of the floating-point interval to obtain two processed intervals fx and fy;

[0272] And generate verification conditions based on the rounding mode:

[0273] 0.5*ulp(fx.sup)<=fy.inf&&0.5*ulp(fy.sup)<=fx.inf

[0274] If the verification condition is met, the error of large numbers consuming small numbers will not occur; otherwise, the error of large numbers consuming small numbers will occur.

[0275] (1002) Floating-point overflow defect check, including:

[0276] Based on the real value range r of variable x x With the error range e x The floating-point interval f obtained after addition x ;

[0277] Determine f x Maximum value f x Is .max greater than the maximum floating-point value f? max If so, then variable x has an overflow defect;

[0278] Determine f x Minimum value f x Is .min less than the minimum floating-point value f? min If so, then variable x has an underflow defect.

[0279] (1003) Defect inspection with a divisor of zero includes:

[0280] For the divisor x in a division operation, determine the floating-point interval f of the divisor x. x Does f satisfy? x .min<=0<=f x If the condition is satisfied, then there is a division by zero defect.

[0281] (1004) Non-numerical defect inspection, including:

[0282] Generally, the determination of a NOT number is based on the possible occurrences of the NOT number. The possible occurrences of a NOT number are:

[0283] 1) Operations where at least one argument in an expression or function call is NaN.

[0284] 2) Infinitive

[0285] Division operations: 0 / 0, ∞ / ∞, ∞ / -∞, -∞ / ∞, -∞ / -∞

[0286] Multiplication operations: 0×∞, 0×-∞

[0287] Addition operations: ∞ + (-∞), (-∞) + ∞

[0288] Subtraction operations: ∞ - ∞, (-∞) - (-∞)

[0289] 3) Real number operations that produce complex results

[0290] In the embodiments of this application, the non-numerical case of indeterminate calculation is considered, and the floating-point interval is judged.

[0291] Determine the floating-point interval f of variable x x infinite cases, f x =r x +e x If r x and e x If neither value is infinite, then x.infinite == 0. If the two values ​​contain only -infinite, then x.infinite == 1. If the two values ​​contain only infinite, then x.infinite == 2. If the two values ​​contain both -infinite and infinite, then x.infinite == 3. The cases that report NOT are as follows:

[0292]

[0293] Table 3. Cases of non-negative numbers in indeterminate calculations

[0294] See Figure 6 Based on the above-mentioned method for analyzing the floating-point precision of a C language program verifier, this application also provides a system for analyzing the floating-point precision of a C language program verifier, the system comprising:

[0295] The floating-point precision verification annotation generation module is used to generate floating-point precision verification annotation information in the form of comments for C language programs that are to be formally verified.

[0296] The floating-point precision verification annotation parsing module is used to parse annotations based on C language programs that carry floating-point precision verification annotation information and generate abstract syntax trees.

[0297] The interval calculation module is used to perform statement-by-statement calculations based on the abstract syntax tree to obtain the interval information of the program variables at each program point and generate verification conditions for floating-point precision defect checks and floating-point precision constraint checks.

[0298] The proof module is used to call the SMT solver to perform the proof.

[0299] It is understood that the floating-point calculation precision analysis system for C language program verifiers provided in this embodiment and the floating-point calculation precision analysis method for C language program verifiers provided in the above embodiment belong to the same concept. The specific implementation process can be found in the method embodiment, and will not be repeated here.

[0300] Furthermore, the floating-point calculation precision analysis system for C language program verifier provided in this embodiment only illustrates the division of the above-mentioned functional modules when verifying the floating-point calculation precision of C language. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the system can be divided into different functional modules to complete all or part of the functions described above.

[0301] This invention is not limited to the specific embodiments described above. Any modifications made by those skilled in the art based on the above concept without creative effort are within the scope of protection of this invention.

Claims

1. A method for analyzing the precision of floating-point calculations in a C language program verifier, characterized in that, include: For C language programs that need to be formally verified, generate floating-point precision verification annotation information in the form of comments; Based on a C language program carrying floating-point precision verification annotation information, annotation parsing is performed to generate an abstract syntax tree; The abstract syntax tree is used to perform statement-by-statement calculations to obtain the interval information of program variables at each program point. Verification conditions for floating-point precision defect checks and floating-point precision constraint checks are generated, and the SMT solver is called to solve and prove the results.

2. The floating-point calculation precision analysis method for a C language program verifier according to claim 1, characterized in that, The generation of floating-point precision verification annotation information in the form of annotations includes: Before the declaration or definition of a C program function, a function protocol annotation is generated, including a function protocol precondition (requires clause) and a function protocol postcondition (ensure clause). The requires clause is used to characterize the floating-point precision constraints that program variables must satisfy when the function is called, and the ensures clause is used to characterize the floating-point precision constraints that program variables satisfy after the function is executed. Statement comments between statements in a C program include: a. Loop count annotation: loop max_unroll UNROLL_NUM; b. Binary control precision annotation: check_limits"result interval constraint predicate"; c. Built-in predicates for floating-point precision constraints, including: The built-in predicates `\real_range(x,a,b)` describe the real range of values ​​for variable `x`, `\error_range(x,a,b)` describe the error range of values ​​for variable `x`, and `\roundingmode(m)` describe the rounding mode of a program point. Here, `x` is a program variable, `a` and `b` are real constants, and `m` is the rounding mode label.

3. The floating-point calculation precision analysis method for a C language program verifier according to claim 1, characterized in that, The step-by-step calculation based on the abstract syntax tree to obtain the interval information of the program variables at each program point includes: for multiplication operations, using optimized multiplication rules to operate on parameters in interval form to obtain the operation results in interval form. The optimized multiplication rules include: Step 301, let the first interval be u: The second interval is v: Based on the relationship between the upper and lower bounds of the first and second intervals and 0, the first and second intervals are divided into several types. Step 302: Based on the type of the first interval and the type of the second interval in the multiplication operation, at least one candidate value that is not the minimum value is excluded from the four candidate values ​​of the upper and lower bounds of the interval of the multiplication operation result. At least one candidate value that is not the maximum value is excluded from the four candidate values ​​of the lower bound of the interval of the multiplication operation result. The remaining lower bound candidate values ​​and upper bound candidate values ​​are used as the optimized operation result interval of the multiplication operation.

4. The floating-point calculation precision analysis method for a C language program verifier according to claim 3, characterized in that, Step 301 includes: dividing the first interval into three types: >=0、 <0< , <=0; the second interval is divided into three types: >=0、 <0< , <=0; Step 302 includes: based on the combined result type of the first interval and the second interval in the multiplication operation, eliminating 2 or 3 candidate values ​​that are definitely not the maximum value from the 4 candidate values ​​of the upper bound of the interval of the multiplication operation result, and selecting the larger value from the remaining 2 candidate values ​​or using the remaining 1 candidate value as the upper bound of the interval of the multiplication operation result; eliminating 2 or 3 candidate values ​​that are definitely not the minimum value from the 4 candidate values ​​of the lower bound of the interval of the multiplication operation result, and selecting the smaller value from the remaining 2 candidate values ​​or using the remaining 1 candidate value as the lower bound of the interval of the multiplication operation result; if If the integer is rational, then the four candidate values ​​for the upper and lower bounds are: :like If the value is a floating-point number, then the four candidate values ​​for the upper bound are: The four candidate values ​​for the lower bound are , To round down, This is for rounding up.

5. The floating-point calculation precision analysis method for a C language program verifier according to claim 1, characterized in that, The step-by-step calculation based on the abstract syntax tree obtains the range information of program variables at each program point, including: for division operations... The calculations are performed using the following steps: Step 501, based on interval ,Sure The upper and lower bounds of the interval; Step 502, based on interval information and The interval information is obtained through multiplication. Calculations are performed in the form of ; Step 501 is based on interval ,Sure The upper and lower bounds of the interval include: like For rational numbers: exist >0 or When <0, upper bound of the interval ( ).sup=1 / , The lower bound of the interval ( ).inf=1 / ;exist <=0<= hour, The interval is ; like For floating-point numbers: exist >0 or When <0, upper bound of the interval ( ).sup= 1 / , The lower bound of the interval ( ).inf= 1 / ;exist <=0<= hour, The interval is .

6. The floating-point calculation precision analysis method for a C language program verifier according to claim 1, characterized in that, The step-by-step calculus based on the abstract syntax tree, which yields the range information of program variables at each program point, includes: Determine whether there is a dependency effect on the parameters. If so, subdivide the original interval of the parameters in the calculation formula using an interval bisection strategy to obtain multiple corresponding sub-intervals. Based on multiple subintervals of the original interval, the parameters in interval form are operated on using the algorithm to obtain the operation result in interval form; The determination of whether the parameter has a dependency effect includes: The interval of the variable that appears multiple times in the expression is bisected once and then calculated. The resulting interval is compared with the interval calculated without bisecting. If the resulting interval decreases, it is determined that the variable has a dependency effect and the bisecting strategy is activated. Otherwise, the bisecting strategy is not activated.

7. The floating-point calculation precision analysis method for a C language program verifier according to claim 6, characterized in that, The interval binary search strategy includes a method for controlling the depth of the binary search process, which includes: The binary search depth is controlled based on the check_limits annotation data or the default value of the binary search depth MAX_BISECTION_TIMES, with the check_limits annotation data having a higher priority than the default value of the binary search depth; The check_limits annotation data is in the following format: / *@check_limits \real_range(z,a,b);* / means that the binary search result must satisfy the constraint that the real number range of z is greater than or equal to a and less than or equal to b; if the constraint is satisfied, the binary search process stops; otherwise, the binary search process continues. The control of the binary search processing depth based on the default value MAX_BISECTION_TIMES includes: When a single variable in an expression has a dependency effect, the interval binary search depth of that variable is controlled based on the default value MAX_BISECTION_TIMES. When multiple variables in an expression have a dependency effect, the interval binary search depth of multiple variables is synchronously controlled based on the default binary search depth MAX_BISECTION_TIMES / n, where n is the number of variables with a dependency effect, and the result is rounded up.

8. The floating-point calculation precision analysis method for a C language program verifier according to claim 1, characterized in that, The step-by-step calculation based on the abstract syntax tree, which obtains the interval information of the program variables at each program point, includes: performing operations on parameters in interval form using arithmetic rules, and considering error accumulation based on ULP theory to obtain the calculation result considering error accumulation, and recording the first number. The range of real numbers is The error range is The second number The range of real numbers is The error range is Then we have: ; ; ; ； The choice between 0.5 and 1 is determined by the floating-point rounding mode.

9. The floating-point calculation precision analysis method for a C language program verifier according to claim 1, characterized in that, The step-by-step calculus based on the abstract syntax tree, which yields the range information of program variables at each program point, includes: Step 901: For a conditional statement of the form "x⊙ a", where ⊙ is any one of <=, <, >, >=, x is a variable name, and a is a constant expression, the calculation of the interval information of the program variables includes the following steps: Let the real range of x be \real_range(x,e,f); the error range of x be \error_range(x,m,n); the real range of a be \real_range(p,a1,a2); and the error range of a be \error_range(p,a3,a4). Get intermediate variables : ； Based on intermediate variables Determine whether x⊙a holds true by considering the relationship between the upper and lower bounds of x and the upper and lower bounds of the real number range of x. Step 902: For loop statements involving floating-point calculations, determine the loop process based on the annotation parameter `loop max_unroll UNROLL_NUM`, including: Sub-step 1: Expand the loop body and calculate line by line until the end of the loop body; Sub-step 2: Verify whether the loop condition is true. If it is true, proceed to sub-step 3; otherwise, proceed to sub-step 4. Sub-step 3: Determine if the number of expansions is less than UNROLL_NUM. If it is less, proceed to sub-step 1; otherwise, proceed to sub-step 4. Sub-step 4: Jump to the next statement after the loop exit to continue the calculation.

10. The floating-point calculation precision analysis method for a C language program verifier according to claim 1, characterized in that, The verification conditions for generating floating-point precision defect checks and floating-point precision constraint checks include: large number eating small number defect checks, floating-point overflow defect checks, division by zero defect checks, and not-a-number defect checks. The defect check for large numbers consuming small numbers includes: For parameters in addition and subtraction binary operations, determine whether the minimum absolute value of one floating-point variable is smaller than 0.5 or 1 times the maximum absolute value of the other floating-point variable ulp. If so, there is a case of larger number consuming smaller number. The values ​​of 0.5 and 1 are related to the rounding mode. The floating-point overflow defect check includes: The floating-point interval fx is obtained by adding the real number of variable x to the error; Determine if the maximum value of fx, fx.max, is greater than the maximum value of the floating-point type, fmax. If so, the variable x has an overflow defect. Determine if the minimum value of fx, fx.min, is less than the minimum value of the floating-point type, fmin. If so, the variable x has an underflow defect. The defect inspection with a divisor of zero includes: For the divisor x in the division operation, determine whether the floating-point interval fx of the divisor x satisfies fx.min <= 0 <= fx.max. If it does, then there is a defect of division by zero. The non-numerical defect inspection includes: Determine the floating-point range of variable x For infinite cases, = + ,if and If neither value is infinite, then x.infinite == 0. If the two values ​​contain only -infinite, then x.infinite == 1. If the two values ​​contain only infinite, then x.infinite == 2. If the two values ​​contain both -infinite and infinite, then x.infinite == 3. The cases with the NOT defect are as follows: For addition, if any one of the following four assertions is true, then a not-number defect is determined: x.infinite==1&&y.infinite==2; x.infinite==3&&y.infinite! =0; x.infinite==2&&y.infinite==1; x.infinite! =0&&y.infinite==3; For subtraction, if any one of the following four assertions is true, then a not-number defect is determined: x.infinite==1&&y.infinite==1; x.infinite==3&&y.infinite! =0; x.infinite==2&&y.infinite==2; x.infinite! =0&&y.infinite==3; For multiplication, a not-number defect is determined to exist if either of the following two assertions is true: x.infinite! =0&&fy.min<=0<=fy.max; y.infinite! =0&&fx.min<=0<=fx.max; For division operations, if either of the following two assertions is true, then a not-number defect is determined: x.infinite! =0&&y.infinite! =0; fx.min<=0<=fx.max&&fy.min<=0<=fy.max.

11. A floating-point calculation precision analysis system for C language program verifiers, characterized in that, include: The floating-point precision verification annotation generation module is used to generate floating-point precision verification annotation information in the form of comments for C language programs that are to be formally verified. The floating-point precision verification annotation parsing module is used to parse annotations based on C language programs that carry floating-point precision verification annotation information and generate abstract syntax trees. The interval calculation module is used to perform statement-by-statement calculations based on the abstract syntax tree to obtain the interval information of the program variables at each program point and generate verification conditions for floating-point precision defect checks and floating-point precision constraint checks. The proof module is used to call the SMT solver to perform the proof.

Images