PPA correctness of carry