Skip to content

Commit 280d3eb

Browse files
authored
Add 'float' note to limitations doc (rust-lang#2050)
1 parent 4e757bc commit 280d3eb

File tree

1 file changed

+13
-1
lines changed

1 file changed

+13
-1
lines changed

docs/src/rust-feature-support.md

+13-1
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ Reference | Feature | Support | Notes |
5454
8.2.18 | Await expressions | No | See [Notes - Concurrency](#concurrency) |
5555
9 | Patterns | Partial | [#707](https://github.com/model-checking/kani/issues/707) |
5656
10.1.1 | Boolean type | Yes | |
57-
10.1.2 | Numeric types | Yes | |
57+
10.1.2 | Numeric types | Yes | | See [Notes - Floats](#floating-point-operations)
5858
10.1.3 | Textual types | Yes | |
5959
10.1.4 | Never type | Yes | |
6060
10.1.5 | Tuple types | Yes | |
@@ -200,3 +200,15 @@ related to [advanced features](#advanced-features).
200200

201201
Please refer to [Intrinsics](rust-feature-support/intrinsics.md) for information
202202
on the current support in Kani for Rust compiler intrinsics.
203+
204+
### Floating point operations
205+
206+
Kani supports floating point numbers, but some supported operations on floats are "over-approximated."
207+
These are the trigonometric functions like `sin` and `cos` and the `sqrt` function as well.
208+
This means the verifier can raise errors that cannot actually happen when the code is run normally.
209+
For instance, ([#1342](https://github.com/model-checking/kani/issues/1342)) the `sin`/`cos` functions basically return a nondeterministic value between -1 and 1.
210+
In other words, they largely ignore their input and give very conservative answers.
211+
This range certainly includes the "real" value, so proof soundness is still preserved, but it means Kani could raise spurious errors that cannot actually happen.
212+
This makes Kani unsuitable for verifying some kinds of properties (e.g. precision) about numerical algorithms.
213+
Proofs that fail because of this problem can sometimes be repaired by introducing "stubs" for these functions that return a more acceptable approximation.
214+
However, note that the actual behavior of these functions can vary by platform/os/architecture/compiler, so introducing an "overly precise" approximation may introduce unsoundness: actual system behavior may produce different values from the stub's approximation.

0 commit comments

Comments
 (0)