Test instability in a floating-point program occurs when the control flow of the program diverges from its ideal execution assuming real arithmetic. This phenomenon is caused by the presence of round-off errors that affect the evaluation of arithmetic expressions occurring in conditional statements. Unstable tests may lead to significant errors in safety-critical applications that depend on numerical computations. Writing programs that take into consideration test instability is a difficult task that requires expertise on finite precision computations and rounding errors. This paper presents a toolchain to automatically generate and verify a provably correct test-stable floating-point program from a functional specification in real arithmetic. The input is a real-valued program written in the Prototype Verification System (PVS) specification language and the output is a transformed floating-point C program annotated with ANSI/ISO C Specification Language (ACSL) contracts. These contracts relate the floating-point program to its functional specification in real arithmetic. The transformed program detects if unstable tests may occur and, in these cases, issues a warning and terminate. An approach that combines the Frama-C analyzer, the PRECiSA round-off error estimator, and PVS is proposed to automatically verify that the generated program code is correct in the sense that, if the program terminates without a warning, it follows the same computational path as its real-valued functional specification.

中文翻译：

---

自动生成和验证测试稳定的浮点代码

当程序的控制流偏离其假设实数运算的理想执行时，就会出现浮点程序中的测试不稳定。这种现象是由于存在影响条件语句中发生的算术表达式求值的舍入错误造成的。在依赖于数值计算的安全关键应用中，不稳定的测试可能会导致重大错误。编写考虑测试不稳定性的程序是一项艰巨的任务，需要有关有限精度计算和舍入误差的专业知识。本文提出了一个工具链，用于根据实际算法中的功能规范自动生成和验证可证明正确的测试稳定浮点程序。输入是用原型验证系统 (PVS) 规范语言编写的实值程序，输出是用 ANSI/ISO C 规范语言 (ACSL) 合同注释的转换后的浮点 C 程序。这些契约将浮点程序与其实际算术中的功能规范联系起来。转换后的程序检测是否可能发生不稳定的测试，在这些情况下，发出警告并终止。提出了一种结合 Frama-C 分析器、PRECiSA 舍入误差估计器和 PVS 的方法来自动验证生成的程序代码是否正确，因为如果程序在没有警告的情况下终止，它遵循相同的计算路径作为其实值功能规范。转换后的程序检测是否可能发生不稳定的测试，在这些情况下，发出警告并终止。提出了一种结合 Frama-C 分析器、PRECiSA 舍入误差估计器和 PVS 的方法来自动验证生成的程序代码是否正确，因为如果程序在没有警告的情况下终止，它遵循相同的计算路径作为其实值功能规范。转换后的程序检测是否可能发生不稳定的测试，在这些情况下，发出警告并终止。提出了一种结合 Frama-C 分析器、PRECiSA 舍入误差估计器和 PVS 的方法来自动验证生成的程序代码是否正确，因为如果程序在没有警告的情况下终止，它遵循相同的计算路径作为其实值功能规范。