Toward mechanical verification of properties of roundoff error propagationWebb Miller1973STOC 1973Conference paper