{"id":3852,"date":"2020-03-17T09:12:27","date_gmt":"2020-03-17T08:12:27","guid":{"rendered":"https:\/\/www.prover.com\/?p=3852"},"modified":"2025-01-13T13:23:19","modified_gmt":"2025-01-13T12:23:19","slug":"floating-point-model-checking-put-to-the-test","status":"publish","type":"post","link":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/","title":{"rendered":"Floating point model checking put to the test"},"content":{"rendered":"

In a previous blog post<\/a>, a playful concrete example was given to show off PSL’s newly added support for IEEE 754 floating point calculations. We have tested the performance in real-world industrial examples and in this blog post, we will take a look at the floating point performance of PSL<\/a> on a real-world problem from avionics.<\/p>\n

Triple redundant sensor voter<\/span><\/h3>\n

In order to meet high redundancy requirements in avionics, a common technique is to use triple redundant sensor voters. To create a reliable signal, the outputs of three identical sensors are composed into a single signal by a voting component. The voting mechanism averages\/centers the set of three input values over time to avoid being overly affected by a single faulty sensor.<\/span><\/p>\n

The sensor voter model can be thought of as consisting of a set of floating point latches that are updated at every reading. The output is computed from the input of the three sensors and from these latches. If one disregards the floating point rounding, the latches and the output have piecewise linear definitions. The rounding makes the model non-linear.<\/span><\/p>\n

Depending on the type of sensors (range, measurement uncertainty, etc) a typical voting algorithm needs to be configured by setting different constants(thresholds etc). The resulting behavior of the sensor voter, and checks that it is sufficiently reliable, is traditionally tested by massive simulation, which is very costly. Besides being costly, simulation can only give partial coverage.<\/span><\/p>\n

Examples of typical requirements for the sensor voter implementation are:<\/span><\/p>\n

– Given a bound on sensor errors (for non-faulty sensors), the error of the voter output must be sufficiently bounded.<\/span><\/p>\n

– Given a bound on signal change (between two readings), the change in voter output must be sufficiently bounded.<\/span><\/p>\n

To get full coverage one can instead of simulation, perform formal verification. One efficient way is to analyze the sensor voter with an SMT solver assuming that the arithmetic operations are exact (no rounding), since in this case the system is piecewise linear. The downside is that then additional argumentation is needed to take into account the “errors” introduced by rounding, i.e. handling the difference between operations on real (mathematical) numbers and operations on floating point numbers (which are rounded).<\/span><\/p>\n

Instead of working with real numbers, a better and more complete solution would be to precisely model the floating point numbers and their operations(including rounding) when performing formal verification. A stumbling block for this approach has been performance issues. Modeling floating point arithmetic at bit level requires a significant boost in verification tool performance. This is the problem we have addressed when implementing floating point numbers in PSL.<\/span><\/p>\n

Excellent Results<\/span><\/h3>\n

In order to really test the performance of floating point arithmetic in PSL<\/a> we used double precision (64-bit) IEEE 754 floats in the HLL<\/a> model. Performance often tends to degrade rapidly with increased precision, in particular when models are non-linear.<\/span><\/p>\n

To reach the required performance boost and to fully utilize modern processor architectures, PSL uses powerful parallelization and machine learning to optimize the proof strategy.<\/span><\/p>\n

The two requirements mentioned above were proved together five times, one for each rounding mode defined in IEEE 754. The running time on a modern multi-core processor was <\/span>between 2 and 3 minutes<\/span><\/i>, depending on the rounding mode.<\/span><\/p>\n

Even though these results are impressive, as mentioned in Floating Point Model Checking<\/a>, floating point verification <\/span>is<\/span><\/i> notoriously hard and the performance depends a lot on the complexity of the actual models. Also one needs to be very careful in order to keep the full precision of the verification valid throughout the real system:<\/span><\/p>\n

– One needs control over possible rewritings\/optimizations in the compiler, <\/span>and<\/span><\/p>\n

– one needs to make sure that the platform, on which the software is executed, <\/span>exactly<\/span><\/i> implements the IEEE 754 standard for the functionality which is actually used.<\/span><\/p>\n

That said, PSL sets a high standard for floating point performance, combining precision with power. It gives the required boost to allow efficient floating point verification.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

In a previous blog post, a playful concrete example was given to show off PSL’s newly added support for IEEE […]<\/p>\n","protected":false},"author":20,"featured_media":15797,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","inline_featured_image":false,"footnotes":""},"categories":[152],"tags":[],"class_list":["post-3852","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-formal-methods"],"yoast_head":"\nFloating point model checking put to the test - Prover - Engineering a Safer World<\/title>\n<meta name=\"description\" content=\"In this blog post we will take a look at the floating point performance of PSL on a real world problem from avionics.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Floating point model checking put to the test - Prover - Engineering a Safer World\" \/>\n<meta property=\"og:description\" content=\"In this blog post we will take a look at the floating point performance of PSL on a real world problem from avionics.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/\" \/>\n<meta property=\"og:site_name\" content=\"Prover - Engineering a Safer World\" \/>\n<meta property=\"article:published_time\" content=\"2020-03-17T08:12:27+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-01-13T12:23:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.prover.com\/wp-content\/uploads\/2020\/03\/Floating-Point-Model-Checking-Put-to-the-Test.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"676\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Olav Bandmann\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Olav Bandmann\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/\"},\"author\":{\"name\":\"Olav Bandmann\",\"@id\":\"https:\/\/prover.com\/#\/schema\/person\/5b0b504a4a20db66bd813c00afce129c\"},\"headline\":\"Floating point model checking put to the test\",\"datePublished\":\"2020-03-17T08:12:27+00:00\",\"dateModified\":\"2025-01-13T12:23:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/\"},\"wordCount\":667,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/prover.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.prover.com\/wp-content\/uploads\/2020\/03\/Floating-Point-Model-Checking-Put-to-the-Test.jpg\",\"articleSection\":[\"Formal methods\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/\",\"url\":\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/\",\"name\":\"Floating point model checking put to the test - Prover - Engineering a Safer World\",\"isPartOf\":{\"@id\":\"https:\/\/prover.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.prover.com\/wp-content\/uploads\/2020\/03\/Floating-Point-Model-Checking-Put-to-the-Test.jpg\",\"datePublished\":\"2020-03-17T08:12:27+00:00\",\"dateModified\":\"2025-01-13T12:23:19+00:00\",\"description\":\"In this blog post we will take a look at the floating point performance of PSL on a real world problem from avionics.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#primaryimage\",\"url\":\"https:\/\/www.prover.com\/wp-content\/uploads\/2020\/03\/Floating-Point-Model-Checking-Put-to-the-Test.jpg\",\"contentUrl\":\"https:\/\/www.prover.com\/wp-content\/uploads\/2020\/03\/Floating-Point-Model-Checking-Put-to-the-Test.jpg\",\"width\":1200,\"height\":676},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.prover.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Formal methods\",\"item\":\"https:\/\/www.prover.com\/categories\/formal-methods\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Floating point model checking put to the test\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/prover.com\/#website\",\"url\":\"https:\/\/prover.com\/\",\"name\":\"Prover - Engineering a Safer World\",\"description\":\"Interlocking Design Automation to meet demand for complex digital train control\",\"publisher\":{\"@id\":\"https:\/\/prover.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/prover.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/prover.com\/#organization\",\"name\":\"Prover - Engineering a Safer World\",\"url\":\"https:\/\/prover.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/prover.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.prover.com\/wp-content\/uploads\/2023\/01\/prover-logo.svg\",\"contentUrl\":\"https:\/\/www.prover.com\/wp-content\/uploads\/2023\/01\/prover-logo.svg\",\"width\":222,\"height\":22,\"caption\":\"Prover - Engineering a Safer World\"},\"image\":{\"@id\":\"https:\/\/prover.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/prover.com\/#\/schema\/person\/5b0b504a4a20db66bd813c00afce129c\",\"name\":\"Olav Bandmann\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/9929e4c9e95d03a0c15ad1c570bb198ad4b9098639e4fabe6b37be5cd9c95a85?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/9929e4c9e95d03a0c15ad1c570bb198ad4b9098639e4fabe6b37be5cd9c95a85?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/9929e4c9e95d03a0c15ad1c570bb198ad4b9098639e4fabe6b37be5cd9c95a85?s=96&d=mm&r=g\",\"caption\":\"Olav Bandmann\"},\"url\":\"https:\/\/www.prover.com\/author\/olav-bandmann\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Floating point model checking put to the test - Prover - Engineering a Safer World","description":"In this blog post we will take a look at the floating point performance of PSL on a real world problem from avionics.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/","og_locale":"en_US","og_type":"article","og_title":"Floating point model checking put to the test - Prover - Engineering a Safer World","og_description":"In this blog post we will take a look at the floating point performance of PSL on a real world problem from avionics.","og_url":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/","og_site_name":"Prover - Engineering a Safer World","article_published_time":"2020-03-17T08:12:27+00:00","article_modified_time":"2025-01-13T12:23:19+00:00","og_image":[{"width":1200,"height":676,"url":"https:\/\/www.prover.com\/wp-content\/uploads\/2020\/03\/Floating-Point-Model-Checking-Put-to-the-Test.jpg","type":"image\/jpeg"}],"author":"Olav Bandmann","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Olav Bandmann","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#article","isPartOf":{"@id":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/"},"author":{"name":"Olav Bandmann","@id":"https:\/\/prover.com\/#\/schema\/person\/5b0b504a4a20db66bd813c00afce129c"},"headline":"Floating point model checking put to the test","datePublished":"2020-03-17T08:12:27+00:00","dateModified":"2025-01-13T12:23:19+00:00","mainEntityOfPage":{"@id":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/"},"wordCount":667,"commentCount":0,"publisher":{"@id":"https:\/\/prover.com\/#organization"},"image":{"@id":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#primaryimage"},"thumbnailUrl":"https:\/\/www.prover.com\/wp-content\/uploads\/2020\/03\/Floating-Point-Model-Checking-Put-to-the-Test.jpg","articleSection":["Formal methods"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/","url":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/","name":"Floating point model checking put to the test - Prover - Engineering a Safer World","isPartOf":{"@id":"https:\/\/prover.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#primaryimage"},"image":{"@id":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#primaryimage"},"thumbnailUrl":"https:\/\/www.prover.com\/wp-content\/uploads\/2020\/03\/Floating-Point-Model-Checking-Put-to-the-Test.jpg","datePublished":"2020-03-17T08:12:27+00:00","dateModified":"2025-01-13T12:23:19+00:00","description":"In this blog post we will take a look at the floating point performance of PSL on a real world problem from avionics.","breadcrumb":{"@id":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#primaryimage","url":"https:\/\/www.prover.com\/wp-content\/uploads\/2020\/03\/Floating-Point-Model-Checking-Put-to-the-Test.jpg","contentUrl":"https:\/\/www.prover.com\/wp-content\/uploads\/2020\/03\/Floating-Point-Model-Checking-Put-to-the-Test.jpg","width":1200,"height":676},{"@type":"BreadcrumbList","@id":"https:\/\/www.prover.com\/formal-methods\/floating-point-model-checking-put-to-the-test\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.prover.com\/"},{"@type":"ListItem","position":2,"name":"Formal methods","item":"https:\/\/www.prover.com\/categories\/formal-methods\/"},{"@type":"ListItem","position":3,"name":"Floating point model checking put to the test"}]},{"@type":"WebSite","@id":"https:\/\/prover.com\/#website","url":"https:\/\/prover.com\/","name":"Prover - Engineering a Safer World","description":"Interlocking Design Automation to meet demand for complex digital train control","publisher":{"@id":"https:\/\/prover.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/prover.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/prover.com\/#organization","name":"Prover - Engineering a Safer World","url":"https:\/\/prover.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/prover.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.prover.com\/wp-content\/uploads\/2023\/01\/prover-logo.svg","contentUrl":"https:\/\/www.prover.com\/wp-content\/uploads\/2023\/01\/prover-logo.svg","width":222,"height":22,"caption":"Prover - Engineering a Safer World"},"image":{"@id":"https:\/\/prover.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/prover.com\/#\/schema\/person\/5b0b504a4a20db66bd813c00afce129c","name":"Olav Bandmann","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/9929e4c9e95d03a0c15ad1c570bb198ad4b9098639e4fabe6b37be5cd9c95a85?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9929e4c9e95d03a0c15ad1c570bb198ad4b9098639e4fabe6b37be5cd9c95a85?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9929e4c9e95d03a0c15ad1c570bb198ad4b9098639e4fabe6b37be5cd9c95a85?s=96&d=mm&r=g","caption":"Olav Bandmann"},"url":"https:\/\/www.prover.com\/author\/olav-bandmann\/"}]}},"_links":{"self":[{"href":"https:\/\/www.prover.com\/wp-json\/wp\/v2\/posts\/3852","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.prover.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.prover.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.prover.com\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/www.prover.com\/wp-json\/wp\/v2\/comments?post=3852"}],"version-history":[{"count":4,"href":"https:\/\/www.prover.com\/wp-json\/wp\/v2\/posts\/3852\/revisions"}],"predecessor-version":[{"id":20970,"href":"https:\/\/www.prover.com\/wp-json\/wp\/v2\/posts\/3852\/revisions\/20970"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.prover.com\/wp-json\/wp\/v2\/media\/15797"}],"wp:attachment":[{"href":"https:\/\/www.prover.com\/wp-json\/wp\/v2\/media?parent=3852"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.prover.com\/wp-json\/wp\/v2\/categories?post=3852"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.prover.com\/wp-json\/wp\/v2\/tags?post=3852"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}