feat: division proof#89
Draft
bollu wants to merge 20 commits into
Draft
Conversation
Mirrors MulUnnormalized.toInt_ex_le; bounds the exponent difference in (-2^e + 1, 2^e - 1) before the post-normalization shift. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Discharge `a.isNaN` case by NaN propagation through ExtRat.div = mul·inv. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Each case uses the same NaN-propagation pattern via ExtRat.div_eq_mul_inv: NaN.inv = NaN, then mul · NaN = NaN, then both branches of the xorSign if/then/else collapse to NaN. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
inv inf = 0, then inf * 0 = NaN closes the inf/inf case via the standard NaN-propagation pipeline. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The 'rounding-stable-under-perturbation' lemma: if two rationals agree on isNaN, isZero, lower, upper, lowerHalf, and tieBreak classifiers, roundRNE returns the same packed float. This is the abstract property the sticky-bit machinery relies on to bridge the gap between the implementation's truncated-quotient toRat and the true rational quotient. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Document remaining sign-convention reconciliation needed for the non-NaN cases (0/num, etc.). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The sign reconciliation for inf/0 is non-trivial because SmtLib's inv(Number 0) returns Infinity false (discarding zero's sign), then the xorSign+neg machinery in SmtLibFunctions.div tries to restore it. Verifying this needs case analysis we defer. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Fix the original `lsb_eq_sticky` statement (which was wrong for the unshifted msb=true case): the lsb of the adjusted significand is `(msb && quot.lsb) || (rem != 0)`. Proved by case-split on quot.msb. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Factor out small helper lemmas: - toNat_divident_eq: divident.toNat = xs.toNat * 2^(s+1) - toNat_divisor_eq: divisor.toNat = ys.toNat (widening) - divisor_ge: divisor.toNat ≥ 2^(s-1) when ys.msb = true - divident_div_divisor_lt: divident / divisor < 2^(s+2) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Replace the user's `< 2^(s+1)` claim in `quot_lt_two_pow` with the actually achievable bound `< 2^(s+2)` (trivial from BitVec width). Add the closed-form `quot_toNat_eq: quot.toNat = (xs * 2^(s+1)) / ys.toNat`, plus the lower bound `quot_ge_pow: 2^s ≤ quot.toNat` when both inputs are normalized — required for `divAdjustMsb_msb_eq_true`. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Factor helpers: - BitVec.msb_iff_toNat_ge: msb=true ↔ toNat ≥ 2^(w-1) - BitVec.msb_false_iff_toNat_lt: msb=false ↔ toNat < 2^(w-1) Then use quot_ge_pow + width-2 BitVec bounds + Nat.left_le_or to close the msb of divAdjustMsb.sig in both shift cases. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Mirror of the inf/inf case: inv(0) = Infinity, 0 * Infinity = NaN. Key insight is to derive `0 < ein` from `1 < ein` for `isZero_getZero` to reduce to `decide_true`. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Documents the sign-of-zero discrepancy: SmtLib's div always produces getZero false when z = Number 0, regardless of xorSign. This makes the zero-result sub-cases of div_eq_div potentially non-provable without weakening to ignore zero-sign. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR proves the correctness of the division operation. I started doing this after feeling a bit stuck in the rounding proof, so I could make forward progress on other parts of
fp.lean.