What Every Computer Scientist Should Know About Floating-Point Arithmetic

DAVID GOLDBERG

Xerox Palo Alto Research Center, 3333 Coyote Hill Road, Palo Alto, CalLfornLa 94304

Floating-point arithmetic is considered an esotoric subject by many people. This is rather surprising, because floating-point is ubiquitous in computer systems: Almost every language has a floating-point datatype; computers from PCs to supercomputers have floating-point accelerators; most compilers will be called upon to compile floating-point algorithms from time to time; and virtually every operating system must respond to floating-point exceptions such as overflow This paper presents a tutorial on the aspects of floating-point that have a direct impact on designers of computer systems. It begins with background on floating-point representation and rounding error, continues with a discussion of the IEEE floating-point standard, and concludes with examples of how computer system builders can better support floating point,

Categories and Subject Descriptors: (Primary) C.0 [Computer Systems Organization]: General– instruction set design; D.3.4 [Programming Languages]: Processors —compders, optirruzatzon; G. 1.0 [Numerical Analysis]: General—computer arithmetic, error analysis, numerzcal algorithms (Secondary) D. 2.1 [Software Engineering]: Requirements/Specifications– languages; D, 3.1 [Programming Languages]: Formal Definitions and Theory —semantZcs D ,4.1 [Operating Systems]: Process Management—synchronization General Terms: Algorithms, Design, Languages Additional Key Words and Phrases: denormalized number, exception, floating-point, floating-point standard, gradual underflow, guard digit, NaN, overflow, relative error, rounding error, rounding mode, ulp, underflow

INTRODUCTION tions of addition, subtraction, multiplication, and division. It also contains Builders of computer systems often need background information on the two information about floating-point arith- methods of measuring rounding error, metic. There are however, remarkably ulps and relative error. The second part few sources of detailed information about discusses the IEEE floating-point stand- it. One of the few books on the subject, ard, which is becoming rapidly accepted Floating-Point Computation by Pat Ster- by commercial hardware manufacturers. benz, is long out of print. This paper is a Included in the IEEE standard is the tutorial on those aspects of floating-point rounding method for basic operations; arithmetic ( floating-point hereafter) that therefore, the discussion of the standard have a direct connection to systems draws on the material in Section 1. The building. It consists of three loosely con- third part discusses the connections be- nected parts. The first (Section 1) dis- tween floating point and the design of cusses the implications of using different various aspects of computer systems. rounding strategies for the basic opera- Topics include instruction set design,

Permission to copy without fee all or part of this material is granted provided that the copies are not made or distributed for direct commercial advantage, the ACM copyright notice and the title of the publication and its data appear, and notice is given that copying is by permission of the Association for Computing Machinery. To copy otherwise, or to republish, requires a fee and/or specific permission. @ 1991 ACM 0360-0300/91/0300-0005 $01.50

ACM Computing Surveys, Vol 23, No 1, March 1991 6 . David Goldberg

1 CONTENTS fit back into its finite representation. The resulting rounding error is the character- istic feature of floating-point computation. Section 1.2 describes how it is INTRODUCTION measured. 1 ROUNDING ERROR Since most floating-point calculations 1 1 Floating-Point Formats have rounding error anyway, does it 12 Relatlve Error and Ulps 1 3 Guard Dlglts matter if the basic arithmetic operations 14 Cancellation introduce a bit more rounding error than 1 5 Exactly Rounded Operations necessary? That question is a main theme 2 IEEE STANDARD throughout Section 1. Section 1.3 dis- 2 1 Formats and Operations cusses guard digits, a means of reducing 22 S~eclal Quantltles 23 Exceptions, Flags, and Trap Handlers the error when subtracting two nearby 3 SYSTEMS ASPECTS numbers. Guard digits were considered 3 1 Instruction Sets sufficiently important by IBM that in 32 Languages and Compders 1968 it added a guard digit to the double 33 Exception Handling 4 DETAILS precision format in the System/360 ar- 4 1 Rounding Error chitecture (single precision already had a 42 Bmary-to-Decimal Conversion guard digit) and retrofitted all existing 4 3 Errors in Summatmn machines in the field. Two examples are 5 SUMMARY APPENDIX given to illustrate the utility of guard ACKNOWLEDGMENTS digits. REFERENCES The IEEE standard goes further than just requiring the use of a guard digit. It gives an algorithm for addition, subtrac- optimizing compilers, and exception tion, multiplication, division, and square handling. root and requires that implementations All the statements made about float- produce the same result as that algo- ing-point are provided with justifications, rithm. Thus, when a program is moved but those explanations not central to the from one machine to another, the results main argument are in a section called of the basic operations will be the same The Details and can be skipped if de- in every bit if both machines support the sired. In particular, the proofs of many of IEEE standard. This greatly simplifies the theorems appear in this section. The the porting of programs. Other uses of end of each m-oof is marked with the H this precise specification are given in symbol; whe~ a proof is not included, the Section 1.5. ❑ appears immediately following the statement of the theorem. 2.1 Floating-Point Formats Several different representations of real 1. ROUNDING ERROR numbers have been proposed, but by far Squeezing infinitely many real numbers the most widely used is the floating-point into a finite number of bits requires an representation.’ Floating-point represen- approximate representation. Although tations have a base O (which is always there are infinitely many integers, in assumed to be even) and a precision p. If most programs the result of integer com- 6 = 10 and p = 3, the number 0.1 is rep- putations can be stored in 32 bits. In resented as 1.00 x 10-1. If P = 2 and contrast, given any fixed number of bits, P = 24, the decimal number 0.1 cannot most calculations with real numbers will produce quantities that cannot be exactly represented using that many bits. There- lExamples of other representations are floatzng fore, the result of a floating-point calcu- slas;, aud szgned logan th m [Matula and Kornerup lation must often be rounded in order to 1985; Swartzlander and Alexopoulos 1975]

ACM Computing Surveys, Vol 23, No 1, March 1991 Floating-Point Arithmetic ● 7

100X22 101X22 11 O X221.11X22 [,!,1 I I , , I r \ c r I i

o 1 2 3 4 5 6 7

Figure 1. Normalized numbers when (3 = 2, p = 3, em,n = – 1, emax = 2.

be represented exactly but is approxi- o‘m= or smaller than 1.0 x ~em~. Most of mately 1.10011001100110011001101 x this paper discusses issues due to the 2-4. In general, a floating-point num- first reason. Numbers that are out of ber will be represented as ~ d. dd “ . . d range will, however, be discussed in Sec- x /3’, where d. dd . . . d is called the tions 2.2.2 and 2.2.4. significand2 and has p digits. More pre- Floating-point representations are not cisely, kdO. dld2 “.” dp_l x b’ repre- necessarily unique. For example, both sents the number 0.01 x 101 and 1.00 x 10-1 represent 0.1. If the leading digit is nonzero [ do # O in eq. (1)], the representation is said to + ( do + dl~-l + ““. +dP_l&(P-l))&, be normalized. The floating-point num- o<(il <~. (1) ber 1.00 x 10-1 is normalized, whereas 0.01 x 101 is not. When ~ = 2, p = 3, The term floating-point number will e~i~ = – 1, and e~~X = 2, there are 16 be used to mean a real number that can normalized floating-point numbers, as be exactly represented in the format un- shown in Figure 1. The bold hash marks der discussion. Two other parameters correspond to numbers whose significant associated with floating-point represen- is 1.00. Requiring that a floating-point tations are the largest and smallest al- representation be normalized makes the lowable exponents, e~~X and e~,~. Since representation unique. Unfortunately, there are (3P possible significands and this restriction makes it impossible to emax — e~i. + 1 possible exponents, a represent zero! A natural way to repre - floating-point number can be encoded in sent O is with 1.0 x ~em~- 1, since this L(1°g2 ‘ma. – ‘m,. + 1)] + [log2((3J’)] + 1 preserves the fact that the numerical or- its, where the final + 1 is for the sign dering of nonnegative real numbers cor- bit. The precise encoding is not impor- responds to the lexicographical ordering tant for now. of their floating-point representations. 3 There are two reasons why a real num- When the exponent is stored in a k bit ber might not be exactly representable as field, that means that only 2 k – 1 values a floating-point number. The most com- are available for use as exponents, since mon situation is illustrated by the deci- one must be reserved to represent O. mal number 0.1. Although it has a finite Note that the x in a floating-point decimal representation, in binary it has number is part of the notation and differ- an infinite repeating representation. ent from a floating-point multiply opera- Thus, when D = 2, the number 0.1 lies tion. The meaning of the x symbol strictly between two floating-point num- should be clear from the context. For bers and is exactly representable by nei- example, the expression (2.5 x 10-3, x ther of them. A less common situation is (4.0 X 102) involves only a single float- that a real number is out of range; that ing-point multiplication. is, its absolute value is larger than f? x

2This term was introduced by Forsythe and Moler [196’71and has generally replaced the older term 3This assumes the usual arrangement where the mantissa. exponent is stored to the left of the significant

ACM Computing Surveys, Vol. 23, No 1, March 1991 8* David Goldberg

1.2 Relative Error and Ulps x /3’/~’+1. That is,

Since rounding error is inherent in floating-point computation, it is important to :(Y’ s ;Ulp s ;6-’. (2) 2 have a way to measure this error. Con- sider the floating-point format with ~ = ~n particular, the relative error corre - 10 and p = 3, which will be used spending to 1/2 ulp can vary by a factor throughout this section. If the result of a of O. This factor is called the wobble. floating-point computation is 3.12 x 10’2 Setting E = (~ /2)~-P to the largest of and the answer when computed to infi- the bounds in (2), we can say that when a nite precision is .0314, it is clear that real number is rounded to the closest this is in error by 2 units in the last floating-point number, the relative error place. Similarly, if the real number is always bounded by c, which is referred .0314159 is represented as 3.14 x 10-2, to as machine epsilon then it is in error by .159 units in the In the example above, the relative er- last place. In general, if the floating-point ~or was .oo159i3, ~4159 = 0005. To avoid number d. d . . . d x fle is used to repre- such small numbers, the relative error is sent z, it is in error by Id. d . . . d– normally written as a factor times 6, ( z//3’) I flp - 1 units in the last place.4 The which in this case is c = (~/2)P-P = term ulps will be used as shorthand for 5(10) -3 = .005. Thus, the relative error “units in the last place. ” If the result of would be expressed as ((.00159/ a calculation is the floating-point num - 3.14159) /.oo5)e = O.l E. ber nearest to the correct result, it still To illustrate the difference between might be in error by as much as 1/2 ulp. ulps and relative error, consider the real Another way to measure the difference number x = 12.35. It is approximated by between a floating-point number and the Z = 1.24 x 101. The error is 0.5 ulps; the real number it is approximating is rela- relative error is 0.8 e. Next consider the tive error, which is the difference be- computation 8x. The exact value is 8 x = tween the two numbers divided by the 98.8, whereas, the computed value is 81 real number. For example, the relative = 9.92 x 101. The error is now 4.0 ulps, error committed when approximating but the relative error is still 0.8 e. The 3.14159 by 3.14 x 10° is .00159 /3.14159 error measured in ulps is eight times = .0005. larger, even though the relative error is To compute the relative error that cor- the same. In general, when the base is (3, responds to 1/2 ulp, observe that when a a fixed relative error expressed in ulps real number is approximated by the can wobble by a factor of up to (3. Con- closest possible floating-point number P versely, as eq. (2) shows, a fixed error of 1/2 ulps results in a relative error that d dd ~. dd X ~e, the absolute error can be u can wobble by (3. as large as ‘(Y x /3’ where & is The most natural way to measure the digit ~/2. This error is ((~/2)&P) x rounding error is in ulps. For example, /3’ Since numb... of the form d. dd --- rounding to the neared flo~ting.point dd x /3e all have this same absolute error number corresponds to 1/2 ulp. When but have values that range between ~’ analyzing the rounding error caused by and O x fle, the relative error ranges be- various formulas, however, relative error tween ((&/2 )~-’) x /3’//3’ and ((~/2)&J’) is a better measure. A good illustration of this is the analysis immediately following the proof of Theorem 10. Since ~ can overestimate the effect of rounding to the nearest floating-point number b; 4Un1ess the number z is larger than ~em=+ 1 or the wobble factor of (3, error estimates of smaller than (lem~. Numbers that are out of range in this fashion will not be considered until further formulas will be tighter on machines with notice. a small p.

ACM Computmg Surveys, Vol. 23, No 1, March 1991 Floating-Point Arithmetic g 9

When only the order of magnitude of wrong in every digit! How bad can the rounding error is of interest, ulps and e error be? may be used interchangeably since they differ by at most a factor of ~. For exam- Theorem 1 ple, when a floating-point number is in error by n ulps, that means the number Using a floating-point format with pa- of contaminated digits is logD n. If the rameters /3 and p and computing differ- relative error in a computation is ne, ences using p digits, the relative error of then the result can be as large as b – 1. Proofi A relative error of 13– 1 in contaminated digits = log,n. (3) the expression x – y occurs when x = 1.00””” Oandy=. pp. ””p, wherep= 1.3 Guard Digits @– 1. Here y has p digits (all equal to One method of computing the difference Q). The exact difference is x – y = P‘p. between two floating-point numbers is to When computing the answer using only compute the difference exactly, then p digits, however, the rightmost digit of round it to the nearest floating-point y gets shifted off, so the computed differ- number. This is very expensive if the ence is P–p+l. Thus, the error is p-p – @-P+l = ~-P(~ – 1), and the relative er- operands differ greatly in size. Assuming P = 3, 2,15 X 1012 – 1.25 X 10-5 would ror is $-P((3 – l)/O-p = 6 – 1. H be calculated as When f? = 2, the absolute error can be x = 2.15 X 1012 as large as the result, and when 13= 10, it can be nine times larger. To put it y = .0000000000000000125 X 1012 another way, when (3 = 2, (3) shows that X – y = 2.1499999999999999875 X 1012, the number of contaminated digits is log2(l/~) = logJ2 J’) = p. That is, all of which rounds to 2.15 x 1012. Rather than the p digits in the result are wrong! using all these digits, floating-point Suppose one extra digit is added to hardware normally operates on a fixed guard against this situation (a guard number of digits. Suppose the number of digit). That is, the smaller number is digits kept is p and that when the truncated to p + 1 digits, then the result smaller operand is shifted right, digits of the subtraction is rounded to p digits. are simply discarded (as opposed to With a guard digit, the previous example rounding). Then, 2.15 x 1012 – 1.25 x becomes 10-5 becomes x = 1.010 x 101 x = 2.15 X 1012 y = 0.993 x 101 ‘y = 0.00 x 1012 x–y= .017 x 101, x–y =2.15x1012. and the answer is exact. With a single The answer is exactly the same as if the guard digit, the relative error of the re - difference had been computed exactly suit may be greater than ~, as in 110 – then rounded. Take another example: 8.59: 10.1 – 9.93. This becomes x= 1.1OX 102 x= 1.01 x 101 y = .085 X 102 ‘y = 0.99 x 101 z–y= 1.015 x 102 X–yz .02 x 101. This rounds to 102, compared with the The correct answer is .17, so the com- correct answer of 101.41, for a relative puted difference is off by 30 ulps and is error of .006, which is greater than

ACM Computing Surveys, Vol 23, No. 1, March 1991 10 “ David Goldberg e = .005. In general, the relative error of to .1. The subtraction did not introduce the result can be only slightly larger than any error but rather exposed the error c. More precisely, we have Theorem 2. introduced in the earlier multiplications. Benign cancellation occurs when sub- Theorem 2 tracting exactly known quantities. If x and y have no rounding error, then by If x and y are floating-point numbers in a Theorem 2 if the subtraction is done with format with 13 and p and if subtraction is a guard digit, the difference x – y has a done with p + 1 digits (i. e., one guard very small relative error (less than 2 e). digit), then the relative rounding error in A formula that exhibits catastrophic the result is less than 2 ~. cancellation can sometimes be rear- ranged to eliminate the problem. Again This theorem will be proven in Section consider the quadratic formula 4.1. Addition is included in the above theorem since x and y can be positive –b+ ~b2–4ac or negative.

1.4 Cancellation –b–~ r2 = (4) Section 1.3 can be summarized by saying 2a “ that without a guard digit, the relative error committed when subtracting two When b2 P ac, then b2 – 4 ac does not nearby quantities can be very large. In involve a cancellation and ~ = other words, the evaluation of any ex- \ b 1. But the other addition (subtraction) pression containing a subtraction (or an in one of the formulas will have a catas- addition of quantities with opposite signs) trophic cancellation. To avoid this, mul- could result in a relative error so large tiply the numerator and denominator of that all the digits are meaningless (The- r-l by – b – ~ (and similarly orem 1). When subtracting nearby quan- for r2 ) to obtain tities, the most significant digits in the operands match and cancel each other. 2C rl = There are two kinds of cancellation: –b–~’ catastrophic and benign. Catastrophic cancellation occurs when 2C rz = (5) the operands are subject to rounding er- –b+~” rors. For example, in the quadratic formula, the expression bz – 4 ac occurs. If b2 % ac and b >0, then computing rl The quantities 62 and 4 ac are subject to using formula (4) will involve a cancella- rounding errors since they are the re- tion. Therefore, use (5) for computing rl sults of floating-point multiplications. and (4) for rz. On the other hand, if Suppose they are rounded to the nearest b <0, use (4) for computing rl and (5) floating-point number and so are accu- for r2. rate to within 1/2 ulp. When they are The expression X2 – y2 is another for- subtracted, cancellation can cause many mula that exhibits catastrophic cancella- of the accurate digits to disappear, leav- tion. It is more accurate to evaluate it as ing behind mainly digits contaminated ( x – y)( x + y). 5 Unlike the quadratic by rounding error. Hence the difference might have an error of many ulps. For example, consider b = 3.34, a = 1.22, 5Although the expression ( x – .Y)(x + y) does not and c = 2.28. The exact value of b2 -- cause a catastrophic cancellation, it IS shghtly less 4 ac is .0292. But b2 rounds to 11.2 and accurate than X2 – y2 If x > y or x < y In this case, ( x – -Y)(x + y) has three rounding errors, but 4 ac rounds to 11.1, hence the final an- X2 – y2 has only two since the rounding error com- swer is .1, which is an error by 70 ulps mitted when computing the smaller of x 2 and y 2 even though 11.2 – 11.1 is exactly equal does not affect the final subtraction.

ACM Computmg Surveys, Vol 23, No 1, March 1991 Floating-Point Arithmetic 8 11 formula, this improved form still has a replaced with a benign one. We next pre- subtraction, but it is a benign cancella- sent more interesting examples of formu- tion of quantities without rounding er- las exhibiting catastrophic cancellation ror, not a catastrophic one. By Theorem that can be rewritten to exhibit only 2, the relative error in x – y is at most benign cancellation. 2 e. The same is true of x + y. Multiply- The area of a triangle can be expressed ing two quantities with a small relative directly in terms of the lengths of its error results in a product with a small sides a, b, and c as relative error (see Section 4.1). To avoid confusion between exact and A = ~s(s - a)(s - b)(s - c) , computed values, the following notation a+b+c is used. Whereas x – y denotes the exact where s = . (6) difference of x and y, x @y denotes the 2 computed difference (i. e., with rounding Suppose the triangle is very flat; that is, error). Similarly @, @, and @ denote a = b + c. Then s = a, and the term computed addition, multiplication, and (s – a) in eq. (6) subtracts two nearby division, respectively. All caps indicate numbers, one of which may have round- the computed value of a function, as in ing error. For example, if a = 9.0, b = c LN( x) or SQRT( x). Lowercase functions = 4.53, then the correct value of s is and traditional mathematical notation 9.03 and A is 2.34. Even though the denote their exact values as in ln( x) computed value of s (9.05) is in error by and &. only 2 ulps, the computed value of A is Although (x @y) @ (x @ y) is an ex- 3.04, an error of 60 ulps. cellent approximation of x 2 – y2, the There is a way to rewrite formula (6) floating-point numbers x and y might so that it will return accurate results themselves be approximations to some even for flat triangles [Kahan 1986]. It is true quantities 2 and j. For example, 2 and j might be exactly known decimal A= [(la+ (b+c))(c - (a-b)) numbers that cannot be expressed exactly in binary. In this case, even though X(C+ (a– b))(a+ (b– c))] ’/’/4, x ~ y is a good approximation to x – y, a? b?c. (7) it can have a huge relative error compared to the true expression 2 – $, and If a, b, and c do not satisfy a > b > c, so the advantage of ( x + y)( x – y) over simply rename them before applying (7). X2 – y2 is not as dramatic. Since comput - It is straightforward to check that the ing ( x + y)( x – y) is about the same right-hand sides of (6) and (7) are alge- amount of work as computing X2 – y2, it braically identical. Using the values of is clearly the preferred form in this case. a, b, and c above gives a computed area In general, however, replacing a catas- of 2.35, which is 1 ulp in error and much trophic cancellation by a benign one is more accurate than the first formula. not worthwhile if the expense is large Although formula (7) is much more because the input is often (but not al- accurate than (6) for this example, it ways) an approximation. But eliminat - would be nice to know how well (7) per- ing a cancellation entirely (as in the forms in general. quadratic formula) is worthwhile even if the data are not exact. Throughout this Theorem 3 paper, it will be assumed that the floating-point inputs to an algorithm are ex - The rounding error incurred when using .aGt and Qxat the results are computed as (T) #o compuie the area of a t.icqqle ie at accurately as possible. most 11 e, provided subtraction is per- The expression X2 – y2 is more accu- formed with a guard digit, e <.005, and rate when rewritten as (x – y)( x + y) square roots are computed to within 1/2 because a catastrophic cancellation is Ulp.

ACM Computing Surveys, Vol. 23, No. 1, March 1991 12 “ David Goldberg

The condition that c s .005 is met in The troublesome expression (1 + i/n)’ virtually every actual floating-point sys- can be rewritten as exp[ n ln(l + i / n)], tem. For example, when 13= 2, p >8 where now the problem is to compute ensures that e < .005, and when 6 = 10, In(l + x) for small x. One approach is to p z 3 is enough. use the approximation ln(l + x) = x, in In statements like Theorem 3 that dis- which case the payment becomes cuss the relative error of an expression, $37617.26, which is off by $3.21 and even it is understood that the expression is less accurate than the obvious formula. computed using floating-point arith- But there is a way to compute ln(l + x) metic. In particular, the relative error is accurately, as Theorem 4 shows actually of the expression [Hewlett-Packard 1982], This formula yields $37614.07, accurate to within 2

(sQRT(a @(b @c))@ (C @(a @b)) cents!Theorem 4 assumes that LN( x) approximate ln( x) to within 1/2 ulp. The F3(c @(a @b))@ (a @(b @c))) problem it solves is that when x is small, LN(l @ x) is not close to ln(l + x) be- @4. (8) cause 1 @ x has lost the information in the low order bits of x. That is, the com- Because of the cumbersome nature of (8), puted value of ln(l + x) is not close to its in the statement of theorems we will actual value when x < 1. usually say the computed value of E rather than writing out E with circle Theorem 4 notation. Error bounds are usually too pes- If ln(l – x) is computed using the for- simistic. In the numerical example given mula above, the computed value of (7) is 2.35, ln(l + x) compared with a true value of 2.34216 for a relative error of O.7c, which is much x forl~x=l less than 11 e. The main reason for com- I — xln(l + x) puting error bounds is not to get precise forl G3x#l bounds but rather to verify that the (1 +X)-1 formula does not contain numerical 1 problems. the relative error is at most 5 c when O < A final example of an expression that x < 3/4, provided subtraction is per- can be rewritten to use benign cancella- formed with a guard digit, e <0.1, and tion is (1 + x)’, where x < 1. This ex- in is computed to within 1/2 ulp. pression arises in financial calculations. Consider depositing $100 every day into This formula will work for any value of a bank account that earns an annual x but is only interesting for x + 1, which interest rate of 6~o, compounded daily. If is where catastrophic cancellation occurs n = 365 and i = ,06, the amount of in the naive formula ln(l + x) Although money accumulated at the end of one the formula may seem mysterious, there year is 100[(1 + i/n)” – 11/(i/n) dol- is a simple explanation for why it works. lars. If this is computed using ~ = 2 and Write ln(l + x) as x[ln(l + x)/xl = P = 24, the result is $37615.45 compared XV(x). The left-hand factor can be com- to the exact answer of $37614.05, a puted exactly, but the right-hand factor discrepancy of $1.40. The reason for P(x) = ln(l + x)/x will suffer a large the problem is easy to see. The expres- rounding error when adding 1 to x. How- sion 1 + i/n involves adding 1 to ever, v is almost constant, since ln(l + .0001643836, so the low order bits of i/n x) = x. So changing x slightly will not are lost. This rounding error is amplified introduce much error. In other words, if when 1 + i / n is raised to the nth power. z= x, computing XK( 2) will be a good

ACM Computmg Surveys, Vol 23, No 1, March 1991 Floating-Point Arithmetic 8 13

approximation to xp( x) = ln(l + x). Is Equipment Corporation’s VAXG comput - there a value for 5 for which 2 and ers. Another school of thought says that 5 + 1 can be computed accurately? There since numbers ending in 5 are halfway is; namely, 2 = (1 @ x) e 1, because between two possible roundings, they then 1 + 2 is exactly equal to 1 @ x. should round down half the time and The results of this section can be sum- round up the other half. One way of ob - marized by saying that a guard digit taining this 50’%0behavior is to require guarantees accuracy when nearby pre- that the rounded result have its least cisely known quantities are subtracted significant digit be even. Thus 12.5 (benign cancellation). Sometimes a for- rounds to 12 rather than 13 because 2 is mula that gives inaccurate results can be even. Which of these methods is best, rewritten to have much higher numeri - round up or round to even? Reiser and cal accuracy by using benign cancella- Knuth [1975] offer the following reason tion; however, the procedure only works for preferring round to even. if subtraction is performed using a guard digit. The price of a guard digit is not Theorem 5 high because is merely requires making the adder 1 bit wider. For a 54 bit double Let x and y be floating-point numbers, precision adder, the additional cost is less and define X. = x, xl=(xOey)O than 2%. For this price, you gain the y,...,=(x(ley)@y)If@If@ and ability to run many algorithms such as e are exactly rounded using round to formula (6) for computing the area of a even, then either x. = x for all n or x. = xl ❑ triangle and the expression in Theorem 4 foralln >1. for computing ln(l + ~). Although most modern computers have a guard digit, To clarify this result, consider ~ = 10, there are a few (such as Crays) that p = 3 and let x = 1.00, y = –.555. do not. When rounding up, the sequence becomes X. 9 Y = 1.56, Xl = 1.56 9 .555 = 1.01, xl e y ~ LO1 Q .555 = 1.57, 1.5 Exactly Rounded Operations and each successive value of x. in- When floating-point operations are done creases by .01. Under round to even, x. with a guard digit, they are not as accu- is always 1.00. This example suggests rate as if they were computed exactly that when using the round up rule, com- then rounded to the nearest floating-point putations can gradually drift upward, number. Operations performed in this whereas when using round to even the manner will be called exactly rounded. theorem says this cannot happen. The example immediately preceding Throughout the rest of this paper, round Theorem 2 shows that a single guard to even will be used. digit will not always give exactly rounded One application of exact rounding oc- results. Section 1.4 gave several exam- curs in multiple precision arithmetic. ples of algorithms that require a guard There are two basic approaches to higher digit in order to work properly. This sec- precision. One approach represents float - tion gives examples of algorithms that ing-point numbers using a very large sig- require exact rounding. nificant, which is stored in an array of So far, the definition of rounding has words, and codes the routines for manip- not been given. Rounding is straightfor- ulating these numbers in assembly lan- ward, with the exception of how to round guage. The second approach represents halfway cases; for example, should 12.5 higher precision floating-point numbers mnnd to 12 OP12? Ofie whool of thought as an array of ordinary floating-point divides the 10 digits in half, letting {0, 1,2,3,4} round down and {5,6,’7,8,9} round up; thus 12.5 would round to 13. ‘VAX is a trademark of Digital Equipment This is how rounding works on Digital Corporation.

ACM Computmg Surveys, Vol 23, No. 1, March 1991 14 “ David Goldberg numbers, where adding the elements of ulps. Using Theorem 6 to write b = 3.5 the array in infinite precision recovers – .024, a = 3.5 – .037, and c = 3.5 – the high precision floating-point number. .021, b2 becomes 3.52 – 2 x 3.5 x .024 It is this second approach that will be + .0242. Each summand is exact, so b2 discussed here. The advantage of using = 12.25 – .168 + .000576, where the an array of floating-point numbers is that sum is left unevaluated at this point. it can be coded portably in a high-level Similarly, language, but it requires exactly rounded arithmetic. ac = 3.52 – (3.5 x .037 + 3.5 x .021) The key to multiplication in this sys- + .037 x .021 tem is representing a product xy as a = 12.25 – .2030 + .000777. sum, where each summand has the same precision as x and y. This can be done Finally, subtracting these two series term by splitting x and y. Writing x = x~ + xl by term gives an estimate for b2 – ac of and y = y~ + yl, the exact product is xy O @ .0350 e .04685 = .03480, which is = xhyh + xhyl + Xlyh + Xlyl. If X and y identical to the exactly rounded result. have p bit significands, the summands To show that Theorem 6 really requires will also have p bit significands, pro- exact rounding, consider p = 3, P = 2, vided XI, xh, yh? Y1 carI be represented and x = 7. Then m = 5, mx = 35, and using [ p/2] bits. When p is even, it is m @ x = 32. If subtraction is performed easy to find a splitting. The number with a single guard digit, then ( m @ x) can be written as the sum Xo. xl ““” xp_l e x = 28. Therefore, x~ = 4 and xl = 3, of Xo. xl ““” xp/2–l and O.O.. .OXP,Z ~~e xl not representable with \ p/2] = . . . XP ~. When p is odd, this simple splitting method will not work. An extra As a final example of exact rounding, bit can, however, be gained by using neg- consider dividing m by 10. The result is ative numbers. For example, if ~ = 2, a floating-point number that will in gen- P = 5, and x = .10111, x can be split as eral not be equal to m /10. When P = 2, x~ = .11 and xl = – .00001. There is however, multiplying m @10 by 10 will more than one way to split a number. A miraculously restore m, provided exact splitting method that is easy to compute rounding is being used. Actually, a more is due to Dekker [1971], but it requires general fact (due to Kahan) is true. The more than a single guard digit. proof is ingenious, but readers not inter- ested in such details can skip ahead to Theorem 6 Section 2. Let p be the floating-point precision, with the restriction that p is even when D >2, Theorem 7 and assume that fl;ating-point operations When O = 2, if m and n are integers with are exactly rounded. Then if k = ~p /2~ is ~m ~ < 2p-1 and n has the special form half the precision (rounded up) and m = n=2z+2J then (m On)@n=m, fik + 1, x can je split as x = Xh + xl, provided fi?~ating-point operations where xh=(m Q9x)e (m@ Xe x), xl are — x e Xh, and each x, is representable exactly rounded. using ~p/2] bits of precision. Proof Scaling by a power of 2 is harmless, since it changes only the expo- To see how this theorem works in an nent not the significant. If q = m /n, example, let P = 10, p = 4, b = 3.476, then scale n so that 2P-1 s n < 2P and a = 3.463, and c = 3.479. Then b2 – ac scale m so that 1/2 < q < 1. Thus, 2P–2 rounded to the nearest floating-point < m < 2P. Since m has p significant number is .03480, while b @ b = 12.08, bits, it has at most 1 bit to the right of a @ c = 12.05, and so the computed value the binary point. Changing the sign of m of b2 – ac is .03. This is an error of 480 is harmless, so assume q > 0.

ACM Computmg Surveys, Vol 23, No 1, March 1991 Floating-Point Arithmetic g 15

If ij = m @ n, to prove the theorem arithmetic operations introduce a little requires showing that more rounding error than necessary? The answer is that it does matter, because accurate basic operations enable us to prove that formulas are “correct” in the sense they have a small relative error. That is because m has at most 1 bit right Section 1.4 discussed several algorithms of the binary point, so nij will round to that require guard digits to produce cor- m. TO deal with the halfway case when rect results in this sense. If the input to I T@– m I = 1/4, note that since the ini- those formulas are numbers representing tial unscaled m had I m I < 2‘- 1, its imprecise measurements, however, the low-order bit was O, so the low-order bit bounds of Theorems 3 and 4 become less of the scaled m is also O. Thus, halfway interesting. The reason is that the be- cases will round to m. nign cancellation x – y can become Suppose q = .qlqz “.. , and & g = catastrophic if x and y are only approxi- . . . qP1. To estimate I nq – m 1, mations to some measured quantity. But ifs? compute I ~ – q I = I N/2p+1 – accurate operations are useful even in m/nl, where N is an odd integer. the face of inexact data, because they Since n=2’+2J and 2P-l

2. IEEE STANDARD (2~-’-k + ~) N- ~p+l-km — n~p+l–k There are two different IEEE standards for floating-point computation. IEEE 754 is a binary standard that requires P = 2, The numerator is an integer, and since p = 24 for single precision and p = 53 N is odd, it is in fact an odd integer. for double precision [IEEE 19871. It also Thus, I ~ – q ] > l/(n2P+l-k). Assume specifies the precise layout of bits in a q < @ (the case q > Q is similar). Then single and double precision. IEEE 854 nij < m, and allows either L?= 2 or P = 10 and unlike Im-n@l= m-nij=n(q-@) 754, does not specify how floating-point numbers are encoded into bits [Cody et = n(q – (~ – 2-P-1)) al. 19841. It does not require a particular 1 value for p, but instead it specifies con- < n 2–P–1 — straints on the allowable values of p for +1–k ( n2 p ) single and double precision. The term IEEE Standard will be used when dis- = (2 P-1 +2’)2-’-’ +2-P-’+’=:. cussing properties common to both standards. This establishes (9) and proves the theo- This section provides a tour of the IEEE rem. ❑ standard. Each subsection discusses one aspect of the standard and why it was The theorem holds true for any base 6, included. It is not the purpose of this as long as 2 z + 2 J is replaced by (3L+ DJ. paper to argue that the IEEE standard is As 6 gets larger. however, there are the best possible floating-point standard fewer and fewer denominators of the but rather to accept the standard as given form ~’ + p’. and provide an introduction to its use. We are now in a position to answer the For full details consult the standards question, Does it matter if the basic [Cody et al. 1984; Cody 1988; IEEE 19871.

ACM Computing Surveys, Vol 23, No 1, March 1991 16 ● David Goldberg

2.1 Formats and Operations precision (as explained later in this section), so the ~ = 2 machine has 23 bits of 2. 1.1 Base precision to compare with a range of 21-24 bits for the ~ = 16 machine. It is clear why IEEE 854 allows ~ = 10. Another possible explanation for Base 10 is how humans exchange and choosing ~ = 16 bits has to do with shift- think about numbers. Using (3 = 10 is ing. When adding two floating-point especially appropriate for calculators, numbers, if their exponents are different, where the result of each operation is dis- one of the significands will have to be played by the calculator in decimal. shifted to make the radix points line up, There are several reasons w~y IEEE slowing down the operation. In the /3 = 854 requires that if the base is not 10, it 16, p = 1 system, all the numbers be- must be 2. Section 1.2 mentioned one tween 1 and 15 have the same exponent, reason: The results of error analyses are so no shifting is required when adding much tighter when ~ is 2 because a any of the 15 = 105 possible pairs of rounding error of 1/2 ulp wobbles by a () factor of fl when computed as a relative distinct numb~rs from this set. In the error, and error analyses are almost al- b = 2, P = 4 system, however, these ways simpler when based on relative er- numbers have exponents ranging from O ror. A related reason has to do with the to 3, and shifting is required for 70 of the effective precision for large bases. Con- 105 pairs. sider fi = 16, p = 1 compared to ~ = 2, In most modern hardware, the perform- p = 4. Both systems have 4 bits of signif- ance gained by avoiding a shift for a icant. Consider the computation of 15/8. subset of operands is negligible, so the When ~ = 2, 15 is represented as 1.111 small wobble of (3 = 2 makes it the x 23 and 15/8 as 1.111 x 2°, So 15/8 is preferable base. Another advantage of exact. When p = 16, however, 15 is rep- using ~ = 2 is that there is a way to gain resented as F x 160, where F is the hex- an extra bit of significance .V Since float- adecimal digit for 15. But 15/8 is repre- ing-point numbers are always normal- sented as 1 x 160, which has only 1 bit ized, the most significant bit of the correct. In general, base 16 can lose up to significant is always 1, and there is no 3 bits, so a precision of p can have an reason to waste a bit of storage repre- effective precision as low as 4p – 3 senting it. Formats that use this trick rather than 4p. are said to have a hidden bit. It was Since large values of (3 have these pointed out in Section 1.1 that this re- problems, why did IBM choose 6 = 16 for quires a special convention for O. The its system/370? Only IBM knows for sure, method given there was that an expo- but there are two possible reasons. The nent of e~,~ – 1 and a significant of all first is increased exponent range. Single zeros represent not 1.0 x 2 ‘mln–1 but precision on the system/370 has ~ = 16, rather O. p = 6. Hence the significant requires 24 IEEE 754 single precision is encoded bits. Since this must fit into 32 bits, this in 32 bits using 1 bit for the sign, 8 bits leaves 7 bits for the exponent and 1 for for the exponent, and 23 bits for the sig- the sign bit. Thus, the magnitude of rep- nificant. It uses a hidden bit, howeve~, resentable numbers ranges from about so the significant is 24 bits (p = 24), 16-2’ to about 1626 = 228. To get a simi- even though it is encoded using only lar exponent range when D = 2 would 23 bits. require 9 bits of exponent, leaving only 22 bits for the significant. It was just pointed out, however, that when D = 16, the effective precision can be as low as ‘This appears to have first been published by Gold- 4p – 3 = 21 bits. Even worse, when B = berg [1967], although Knuth [1981 page 211] at- 2 it is possible to gain an extra bit of tributes this Idea to Konrad Zuse

ACM Computing Surveys, Vol 23, No 1, March 1991 Floating-Point Arithmetic ● 17

2. 1.2 Precision den, the calculator presents a simple model to the operator. The IEEE standard defines four different Extended precision in the IEEE stand- precision: single, double, single ex- ard serves a similar function. It enables tended, and double extended. In 754, sin- libraries to compute quantities to within gle and double precision correspond about 1/2 ulp in single (or double) preci- roughly to what most floating-point sion efficiently, giving the user of those hardware provides. Single precision oc- libraries a simple model, namely, that cupies a single 32 bit word, double preci- each primitive operation, be it a simple sion two consecutive 32 bit words. multiply or an invocation of log, returns Extended precision is a format that offers a value accurate to within about 1/2 ulp. just a little extra precision and exponent When using extended precision, however, range (Table 1). The IEEE standard only it is important to make sure that its use specifies a lower bound on how many is transparent to the user. For example, extra bits extended precision provides. on a calculator, if the internal represen- The minimum allowable double-extended tation of a displayed value is not rounded format is sometimes referred to as 80-bit to the same precision as the display, the format, even though the table shows it result of further operations will depend using 79 bits. The reason is that hard- on the hidden digits and appear unpre- ware implementations of extended preci- dictable to the user. sion normally do not use a hidden bit and To illustrate extended precision fur- so would use 80 rather than 79 bits.8 ther, consider the problem of converting The standard puts the most emphasis between IEEE 754 single precision and on extended precision, making no recom- decimal. Ideally, single precision num- mendation concerning double precision bers will be printed with enough digits so but strongly recommending that that when the decimal number is read Implementations should support the extended back in, the single precision number can format corresponding to the widest basic format be recovered. It turns out that 9 decimal supported, digits are enough to recover a single pre- One motivation for extended precision cision binary number (see Section 4.2). comes from calculators, which will often When converting a decimal number back display 10 digits but use 13 digits inter- to its unique binary representation, a nally. By displaying only 10 of the 13 rounding error as small as 1 ulp is fatal digits, the calculator appears to the user because it will give the wrong answer. ~ } a black box that computes exponen- Here is a situation where extended preci- tial, cosines, and so on, to 10 digits of sion is vital for an efficient algorithm. accuracy. For the calculator to compute When single extended is available, a functions like exp, log, and cos to within straightforward method exists for con- 10 digits with reasonable efficiency, how- verting a decimal number to a single ever, it needs a few extra digits with precision binary one. First, read in the 9 decimal digits as an integer N, ignoring which to work. It is not hard to find a simple rational expression that approxi- the decimal point. From Table 1, p >32, and since 109 < 232 = 4.3 x 109, N can mates log with an error of 500 units in be represented exactly in single ex- the last place. Thus, computing with 13 digits gives an answer correct to 10 dig- tended. Next, find the appropriate power 10P necessary to scale N. This will be a its. By keeping these extra 3 digits hid- combination of the exponent of the decimal number, and the position of the (up until now) ignored decimal point. *According to Kahan, extended precision has 64 Compute 10 I‘l. If \ P I s 13, this is also bits of significant because that was the widest represented exactly, because 1013 = precision across which carry propagation could be done on the Intel 8087 without increasing the cycle 213513 and 513<232. Finally, multiply time [Kahan 19881. (or divide if P < 0) N and 10’ P‘. If this

ACM Computmg Surveys, Vol. 23, No. 1, March 1991 18 - David Goldberg

Table 1. IEEE 754 Format Parameters

Format Parameter Single Single Extended Double Double Extended

P 24 > 32 53 > 64 emax + 127 z + 1023 + 1023 > + 16383 emln – 126 < – 1022 – 1022 < – 163$32 Exponent width in bits 8 > 11 11 2 15 Format width in bits 32 2 43 64 2 79

last operation is done exactly, the closest representation. In the case of single pre- binary number is recovered. Section 4.2 cision, where the exponent is stored in 8 shows how to do the last multiply (or bits, the bias is 127 (for double precisiog divide) exactly. Thus, for I P I s 13, the it is 1023). What this means is that if k use of the single-extended format enables is the value of the exponent bits inter- 9 digit decimal numbers to be converted preted as an unsigned integer, then the to the closest binary number (i. e., ex- exponent of the floating-point number is actly rounded). If I P I > 13, single- ~ – 127. This is often called the biased extended is not enough for the above exponent to di~tinguish from the unbi- algorithm to compute the exactly rounded ased exponent k. An advantage of’ biased binary equivalent always, but Coonen representation is that nonnegative flout- [1984] shows that it is enough to guaran- ing-point numbers can be treated as tee that the conversion of binary to deci- integers for comparison purposes. mal and back will recover the original Referring to Table 1, single precision binary number. has e~~, = 127 and e~,~ = – 126. The If double precision is supported, the reason for having I e~l~ I < e~,X is so that algorithm above would run in double the reciprocal of the smallest number precision rather than single-extended, (1/2 ‘mm)will not overflow. Although it is but to convert double precision to a 17 true that the reciprocal of the largest digit decimal number and back would number will underflow, underflow is usu- require the double-extended format. ally less serious than overflow. Section 2.1.1 explained that e~,~ – 1 is used for representing O, and Section 2.2 will in- 2.1.3 Exponent troduce a use for e~,X + 1. In IEEE single precision, this means that the biased Since the exponent can be positive or negative, some method must be chosen to exponents range between e~,~ – 1 = – 127 and e represent its sign. Two common methods ~.X + 1 = 128 whereas the unbiased exponents range between O of representing signed numbers are and 255, which are exactly the nonneg- sign/magnitude and two’s complement. Sign/magnitude is the system used for ative numbers that can be represented the sign of the significant in the IEEE using 8 bits. formats: 1 bit is used to hold the sign; the rest of the bits represent the magnitude 2. 1.4 Operations of the number. The two’s complement representation is often used in integer The IEEE standard requires that the re- arithmetic. In this scheme, a number sult of addition, subtraction, multiplica- is represented by the smallest nonneg- tion, and division be exactly rounded. ative number that is congruent to it That is, the result must be computed modulo 2 ~. exactly then rounded to the nearest float- The IEEE binary standard does not ing-point number (using round to even). use either of these methods to represent Section 1.3 pointed out that computing the exponent but instead uses a- biased the exact difference or sum of two float-

ACM Computmg Surveys, Vol 23, No 1, March 1991 Floating-Point Arithmetic “ 19 ing-point numbers can be very expensive than proving them assuming operations when their exponents are substantially are exactly rounded. different. That section introduced guard There is not complete agreement on digits, which provide a practical way of what operations a floating-point stand- computing differences while guarantee- ard should cover. In addition to the basic ing that the relative error is small. Com- operations +, –, x, and /, the IEEE puting with a single guard digit, standard also specifies that square root, however, will not always give the same remainder, and conversion between inte- answer as computing the exact result ger and floating point be correctly then rounding. By introducing a second rounded. It also requires that conversion guard digit and a third sticky bit, differ- between internal formats and decimal be ences can be computed at only a little correctly rounded (except for very large more cost than with a single guard digit, numbers). Kulisch and Miranker [19861 but the result is the same as if the differ- have proposed adding inner product to ence were computed exactly then rounded the list of operations that are precisely [Goldberg 19901. Thus, the standard can specified. They note that when inner be implemented efficiently. products are computed in IEEE arith- One reason for completely specifying metic, the final answer can be quite the results of arithmetic operations is to wrong. For example, sums are a special improve the portability of software. When case of inner products, and the sum ((2 x 10-30 + 1030) – 10--30) – 1030 is exactly a .Program IS moved between two ma- chmes and both support IEEE arith- equal to 10- 30 but on a machine with metic, if any intermediate result differs, IEEE arithme~ic the computed result it must be because of software bugs not will be – 10 – 30. It is possible to compute differences in arithmetic. Another ad- inner products to within 1 ulp with less vantage of precise specification is that it hardware than it takes to imple- makes it easier to reason about floating ment a fast multiplier [Kirchner and point. Proofs about floating point are Kulisch 19871.9 hard enough without having to deal with All the operations mentioned in the multiple cases arising from multiple standard, except conversion between dec- kinds of arithmetic. Just as integer pro- imal and binary, are required to be grams can be proven to be correct, so can exactly rounded. The reason is that effi- floating-point programs, although what cient algorithms for exactly rounding all is proven in that case is that the round- the operations, except conversion, are ing error of the result satisfies certain known. For conversion, the best known bounds. Theorem 4 is an example of such efficient algorithms produce results that a proof. These proofs are made much eas- are slightly worse than exactly rounded ier when the operations being reasoned ones [Coonen 19841. about are precisely specified. Once an The IEEE standard does not require algorithm is proven to be correct for IEEE transcendental functions to be exactly arithmetic, it will work correctly on any rounded because of the table maker’s machine supporting the IEEE standard. dilemma. To illustrate, suppose you are Brown [1981] has proposed axioms for making a table of the exponential func- floating point that include most of the tion to four places. Then exp(l.626) = existing floating-point hardware. Proofs 5.0835. Should this be rounded to 5.083 in this system cannot, however, verify or 5.084? If exp(l .626) is computed more the algorithms of Sections 1.4 and 1.5, carefully, it becomes 5.08350, then which require features not present on all hardware. Furthermore, Brown’s axioms are more complex than simply defining

operations to be performed exactly then ‘Some arguments against including inner product rounded. Thus, proving theorems from as one of the basic operations are presented by Brown’s axioms is usually more difficult Kahan and LeBlanc [19851.

ACM Computing Surveys, Vol 23, No 1, March 1991 20 “ David Goldberg

5.083500, then 5.0835000. Since exp is Table 2. IEEE 754 Special Values transcendental, this could go on arbitrar- Exponent Fraction Represents ily long before distinguishing whether ~=~ –1 f=o *O exp(l.626) is 5.083500 “ “ “ Oddd or nun e = ‘ml. -1 f#o O fx 2’mLn 5.0834999 “ “ “ 9 ddd. Thus, it is not prac- e~,n 5 e 5 emax 1 fx2’ tical to specify that the precision of tran- e=emay+l f:o scendental functions be the same as if e=g ~ay + 1 f#o N%; the functions were computed to infinite precision then rounded. Another approach would be to specify transcendental functions algorithmically. But there bit pattern represents a valid num- does not appear to be a single algorithm ber, the return value of square root that works well across all hardware ar- must be some floating-point number. chitectures. Rational approximation, In the case of System/370 FORTRAN, CORDIC,1° and large tables are three ~ = 2 is returned. In IEEE arith- different techniques used for computing metic, an NaN is returned in this transcendental on contemporary ma- situation. chines. Each is appropriate for a differ- The IEEE standard specifies the fol- ent class of hardware, and at present no lowing special values (see Table 2): f O, single algorithm works acceptably over denormalized numbers, + co and NaNs the wide range of current hardware. (there is more than one NaN, as explained in the next section). These

2.2 Special Quantities special values are all encoded with exponents of either e~.X + 1 or e~,~ – 1 On some floating-point hardware every (it was already pointed out that O has an bit pattern represents a valid floating- exponent of e~,. – 1). point number. The IBM System/370 is an example of this. On the other hand, the VAX reserves some bit patterns to 2.2.1 NaNs represent special numbers called re- Traditionally, the computation of 0/0 or served operands. This idea goes back to 4 – 1 has been treated as an unrecover- the CDC 6600, which had bit patterns for able error that causes a computation to the special quantities INDEFINITE and halt. There are, however, examples for INFINITY. which it makes sense for a computation The IEEE standard continues in this to continue in such a situation. Consider tradition and has NaNs (Not a Number, a subroutine that finds the zeros of a pronounced to rhyme with plan) and in- function f, say zero(f). Traditionally, finities. Without special quantities, there zero finders require the user to input an is no good way to handle exceptional sit- interval [a, b] on which the function is uations like taking the square root of a defined and over which the zero finder negative number other than aborting will search. That is, the subroutine is computation. Under IBM System/370 called as zero(f, a, b). A more useful zero FORTRAN, the default action in re- finder would not require the user to in- sponse to computing the square root of a put this extra information. This more negative number like – 4 results in the general zero finder is especially appropri- printing of an error message. Since every ate for calculators, where it is natural to key in a function and awkward to then have to specify the domain. It is easy, 10CORDIC is an acronym for Coordinate Rotation however, to see why most zero finders Digital Computer and is a method of computing require a domain. The zero finder does transcendental funct~ons that uses mostly shifts its work by probing the function f at and adds (i. e., very few multiplications and divi- sions) [Walther 1971], It is the method used on both various values. If it probed for a value the Intel 8087 and the Motorola 68881. outside the domain of f, the code for f

ACM Computmg Surveys, Vol 23. No 1, March 1991 Floating-Point Arithmetic 9 21

Table 3. Operations that Produce an NaN nent e~~X + 1 and nonzero significands. Operation NaN Produced by Implementations are free to put system- dependent information into the signifi- + W+(–w) x Oxw cant. Thus, there is not a unique NaN I 0/0, cO/03 but rather a whole family of NaNs. When REM x REM O, m REM y an NaN and an ordinary floating-point fi(when x < O) number are combined, the result should \ be the same as the NaN operand. Thus, if the result of a long computation is an NaN, the system-dependent information might well compute 0/0 or ~, and in the significant will be the information the computation would halt, unnecessar- generated when the first NaN in the ily aborting the zero finding process. computation was generated. Actually, This problem can be avoided by intro- there is a caveat to the last statement. If ducing a special value called NaN and both operands are NaNs, the result will specifying that the computation of ex- be one of those NaNs but it might not be pressions like 0/0 and ~ produce the NaN that was generated first. NaN rather than halting. (A list of some of the situations that can cause a NaN is 2.2.2 Infinity given in Table 3.) Then, when zero(f) probes outside the domain of f, the code Just as NaNs provide a way to continue for f will return NaN and the zero finder a computation when expressions like 0/0 can continue. That is, zero(f) is not or ~ are encountered, infinities pro- “punished” for making an incorrect vide a way to continue when an overflow guess. With this example in mind, it is occurs. This is much safer than simply easy to see what the result of combining returning to the largest representable a NaN with an ordinary floating-point number. As an example, consider com- number should be. Suppose the final puting ~~, when b = 10, p = 3, statement off is return( – b + sqrt(d))/ and e~~X = 98. If x = 3 x 1070 and (2* a). If d <0, then f should return a y = 4 X 1070, th en X2 will overflow and NaN. Since d <0, sqrt(d) is an NaN, be replaced by 9.99 x 1098. Similarly yz and – b + sqrt(d) will be a NaN if the and X2 + yz will each overflow in turn sum of an NaN and any other number and be replaced by 9.99 x 1098. So the is a NaN. Similarly, if one operand final result will be (9.99 x 1098)112 = of a division operation is an NaN, 3.16 x 1049, which is drastically wrong. the quotient should be a NaN. In The correct answer is 5 x 1070. In IEEE general, whenever a NaN participates arithmetic, the result of X2 is CO,as is in a floating-point operation, the result is another NaN. yz, X2 + yz, and -. SO the final Another approach to writing a zero result is m, which is safer than solver that does not require the user to returning an ordinary floating-point input a domain is to use signals. The number that is nowhere near the correct zero finder could install a signal handler answer.” for floating-point exceptions. Then if f The division of O by O results in an were evaluated outside its domain and NaN. A nonzero number divided by O, raised an exception, control would be re- however, returns infinity: 1/0 = ~, turned to the zero solver. The problem – 1/0 = – co. The reason for the distinc- with this approach is that every lan- tion is this: If f(x) -0 and g(x) + O as guage has a different method of handling signals (if it has a method at all), and so it has no hope of portability. llFine point: Although the default in IEEE arith- In IEEE 754, NaNs are represented as metic is to round overflowed numbers to ~, it is floating-point numbers with the expo- possible to change the default (see Section 2.3.2).

ACM Computing Surveys, Vol 23, No 1, March 1991 22 “ David Goldberg x approaches some limit, then f( x)/g( x) correct value when x = O: 1/(0 + 0-1) = could have any value. For example, 1/(0 + CO)= l/CO = O. Without infinity when f’(x) = sin x and g(x) = x, then arithmetic, the expression 1/( x + x-1) ~(x)/g(x) ~ 1 as x + O. But when ~(x) requires a test for x = O, which not only =l– COSX, f(x)/g(x) ~ O. When adds extra instructions but may also dis- thinking of 0/0 as the limiting situation rupt a pipeline. This example illustrates of a quotient of two very small numbers, a general fact; namely, that infinity 0/0 could represent anything. Thus, in arithmetic often avoids the need for spe - the IEEE standard, 0/0 results in an cial case checking; however, formulas NaN. But when c >0 and f(x) ~ c, g(x) need to be carefully inspected to make ~ O, then ~(x)/g(*) ~ * m for any ana- sure they do not have spurious behavior lytic functions f and g. If g(x) <0 for at infinity [as x/(X2 + 1) did]. small x, then f(x)/g(x) ~ – m; otherwise the limit is + m. So the IEEE stan- 2.2.3 Slgnea Zero dard defines c/0 = & m as long as c # O. The sign of co depends on the signs of c Zero is represented by the exponent

and O in the usual way, so – 10/0 = – co emm – 1 and a zero significant. Since the and –10/–0= +m. You can distin- sign bit can take on two different values, guish between getting m because of over- there are two zeros, + O and – O. If a flow and getting m because of division by distinction were made when comparing O by checking the status flags (which will -t O and – O, simple tests like if (x = O) be discussed in detail in Section 2.3.3). would have unpredictable behavior, de- The overflow flag will be set in the first pending on the sign of x. Thus, the IEEE case, the division by O flag in the second. standard defines comparison so that The rule for determining the result of +0= –O rather than –O< +0. Al- an operation that has infinity as an though it would be possible always to operand is simple: Replace infinity with ignore the sign of zero, the IEEE stan- a finite number x and take the limit as dard does not do so. When a multiplica- x + m. Thus, 3/m = O, because tion or division involves a signed zero, Iim ~+~3/x = O. Similarly 4 – co = – aI the usual sign rules apply in computing and G = w. When the limit does not the sign of the answer. Thus, 3(+ O) = -t O exist, the result is an NaN, so m/co will and +0/– 3 = – O. If zero did not have a be an NaN (Table 3 has additional exam- sign, the relation 1/(1 /x) = x would fail ples). This agrees with the reasoning used to hold when x = *m. The reason is to conclude that 0/0 should be an NaN. that 1/– ~ and 1/+ ~ both result in O, When a subexpression evaluates to a and 1/0 results in + ~, the sign informa- NaN, the value of the entire expression tion having been lost. One way to restore is also a NaN. In the case of & w, how- the identity 1/(1 /x) = x is to have ever, the value of the expression might only one kind of’ infinity; however, be an ordinary floating-point number be- that would result in the disastrous cause of rules like I/m = O. Here is a consequence of losing the sign of an practical example that makes use of the overflowed quantity. rules for infinity arithmetic. Consider Another example of the use of signed computing the function x/( X2 + 1). This zero concerns underflow and functions is a bad formula, because not only will it that have a discontinuity at zero such as overflow when x is larger than log. In IEEE arithmetic, it is natural to fib’”” iz but infinity arithmetic will define log O = – w and log x to be an give the &rong answer because it will NaN whe”n x <0. Suppose” x represents yield O rather than a number near 1/x. a small negative number that has under- However, x/( X2 + 1) can be rewritten as flowed to zero. Thanks to signed zero, x 1/( x + x- l). This improved expression will be negative so log can return an will not overflow prematurely and be- NaN. If there were no signed zero, cause of infinity arithmetic will have the however, the log function could not

ACM Computmg Surveys, Vol 23, No. 1, March 1991 Floating-Point Arithmetic “ 23 distinguish an underflowed negative IEEE committee decided, however, that number from O and would therefore have the advantages of using signed zero out- to return – m. Another example of a weighed the disadvantages. function with a discontinuity at zero is the signum function, which returns the 2.2.4 Denormalized Numbers sign of a number. Probably the most interesting use of Consider normalized floating-point num- signed zero occurs in complex arithmetic. bers with O = 10, p = 3, and e~,. = –98. As an example, consider the equation The numbers % = 6.87 x 10-97 and y = 6.81 x 10-97 appear to be perfectly ordi- ~ = ~/&. This is certainly true when z = O. If z = —1. the obvious com- nary floating-point numbers, which are more than a factor of 10 larger than the putation gives ~~ = ~ = i and smallest floating-point number 1.00 x I/n= I/i = –i. Thus, ~# 10-98. They have a strange property, 1/W ! The problem can be traced to the however: x 0 y = O even though x # y! fact that square root is multivalued, and The reason is that x – y = .06 x 10-97 there is no way to select the values so — 6.0 x 10- ‘g is too small to be repre- they are continuous in the entire com- sented as a normalized number and so plex plane. Square root is continuous, must be flushed to zero. however, if a branch cut consisting of all How important is it to preserve the negative real numbers is excluded from property consideration. This leaves the problem of what to do for the negative real numbers, X=yex–y=o? (lo) which are of the form – x + iO, where x > 0. Signed zero provides a perfect way It is very easy to imagine writing the to resolve this problem. Numbers of the code fragment if (x # y) then z = 1/ form – x + i( + O) have a square root of (x – y) and later having a program fail i&, and numbers of the form – x + due to a spurious division by zero. Track- i( – O) on the other side of the branch cut ing down bugs like this is frustrating have a square root with the other sign and time consuming. On a more philo- (– i ~). In fact, the natural formulas for sophical level, computer science text - computing ~ will give these results. books often point out that even though it is currently impractical to prove large Let us return to ~ = l/fi. If z = programs correct, designing programs –1= –l+iO, then with the idea of proving them often re - 1/2 = 1/(-1 + iO) suits in better code. For example, introducing invariants is useful, even if they 1(-1 -iO) — are not going to be used as part of a (-1+ iO)(-1-iO) proof. Floating-point code is just like any other code: It helps to have provable facts = (-1 - iO)/(( -1)2 - 02) on which to depend. For example, when analyzing formula (7), it will be helpful = –l+i(–0), toknowthat x/2

ACM Computmg Surveys, Vol 23, No, 1, March 1991 24 ● David Goldberg

1! I , , , , I I , , I I r I , t I , 1 t I ~,,.+3

~ o P’-’ P-+’ P.=. +2 P-”+’

Figure 2. Flush to zero compared with gradual underflow.

well as other useful relations. They are Recall the example O = 10, p = 3, e~,. the most controversial part of the stan- — –98, x = 6.87 x 10-97, and y = 6.81 dard and probably accounted for the long x 10-97 presented at the beginning of delay in getting 754 approved. Most this section. With denormals, x – y does high-performance hardware that claims not flush to zero but is instead repre - to be IEEE compatible does not support sented by the denormalized number denormalized numbers directly but .6 X 10-98. This behavior is called rather traps when consuming or produc- gradual underflow. It is easy to verify ing denormals, and leaves it to software that (10) always holds when using to simulate the IEEE standard. 13 The gradual underflow. idea behind denormalized numbers goes Figure 2 illustrates denormalized back to Goldberg [19671 and is simple. numbers. The top number line in the When the exponent is e~,., the signifi- figure shows normalized floating-point cant does not have to be normalized. For numbers. Notice the gap between O and example, when 13= 10, p = 3, and e~,. the smallest normalized number 1.0 x — – 98, 1.00 x 10-98 is no longer the ~em~. If the result of a floating-point cal- smallest floating-point number, because culation falls into this gulf, it is flushed 0.98 x 10 -‘8 is also a floating-point to zero. The bottom number line shows number. what happens when denormals are added There is a small snag when P = 2 and to the set of floating-point numbers. The a hidden bit is being used, since a num- “gulf’ is filled in; when the result of a ber with an exponent of e~,. will always calculation is less than 1.0 x ~’m~, it is have a significant greater than or equal represented by the nearest denormal. to 1.0 because of the implicit leading bit. When denormalized numbers are added The solution is similar to that used to to the number line, the spacing between represent O and is summarized in Table adjacent floating-point numbers varies in 2. The exponent e~,. – 1 is used to rep- a regular way: Adjacent spacings are ei- resent denormals. More formally, if the ther the same length or differ by a factor bits in the significant field are bl, of f3. Without denormals, the spacing b z~...~ bp–1 and the value of the expo- abruptly changes from B‘P+ lflem~ to ~em~, nent is e, then when e > e~,~ – 1, the which is a factor of PP– 1, rather than the number being represented is 1. bl bz . “ . orderly change by a factor of ~, Because b ~ x 2’, whereas when e = e~,~ – 1, of this, many algorithms that can have t~e number being represented is 0.61 bz large relative error for normalized num- . . . b ~_l x 2’+1. The + 1 in the exponent bers close to the underflow threshold are is needed because denormals have an ex- well behaved in this range when gradual ponent of e~l., not e~,~ – 1. underflow is used. Without gradual underflow, the simple expression x + y can have a very large relative error for normalized inputs, as 13This M the cause of one of the most troublesome was seen above for x = 6.87 x 10–97 and aspects of the #,andard. Programs that frequently underilow often run noticeably slower on hardware y = 6.81 x 10-97. L arge relative errors that uses software traps. can happen even without cancellation, as

ACM Computmg Surveys, Vol 23, No 1, March 1991 Floating-Point Arithmetic ● 25 the following example shows [Demmel that once set, they remain set until ex- 1984]. Consider dividing two complex plicitly cleared. Testing the flags is the numbers, a + ib and c + id. The obvious only way to distinguish 1/0, which is a formula genuine infinity from an overflow. Sometimes continuing execution in the a+ib ac + bd be – ad — + i face of exception conditions is not appro- c+id–c2+d2 C2 -F d2 priate. Section 2.2.2 gave the example of suffers from the problem that if either x/(x2 + 1). When x > ~(3e-xf2, the component of the denominator c + id is denominator is infinite, resulting in a larger than fib ‘m= /2, the formula will final answer of O, which is totally wrong. Although for this formula the problem overflow even though the final result may be well within range. A better method of can be solved by rewriting it as 1/ computing the quotients is to use Smith’s (x + x-l), rewriting may not always formula: solve the problem. The IEEE standard strongly recommends that implementa- a + b(d/c) b - a(d/c) tions allow trap handlers to be installed. Then when an exception occurs, the trap c+d(d/c) ‘Zc+d(d/c) handler is called instead of setting the a+ib ifldl

ACM Computing Surveys, Vol. 23, No. 1, March 1991 26 * David Goldberg

Table4. Exceptions mlEEE 754a

Exception Result When Traps Disabled Argument to Trap Handler

Overflow fm or *xmaY Round(x2-”) Underflow O, + 2em~ ordenormal Round(x2”) Divide by zero Operands Invalid ~amN Operands Inexact round(x) round(x)

‘.x Is the exact result of the operation, a = 192 for single precision, 1536 for double, and xm,, = 1.11...11 x23m*. hardware does not have flags of’ its own partial product p~ = H ~=~xi overflows for but instead interrupts the operating sys- some k, the trap handler increments the tem to signal a floating-point exception, counter by 1 and returns the overflowed the cost of inexact exceptions could be quantity with the exponent wrapped prohibitive. This cost can be avoided by around. In IEEE 754 single precision, having the status flags maintained by emax = 127, so if p~ = 1.45 x 2130, it will software. The first time an exception is overflow and cause the trap handler to be raised, set the software flag for the ap - called, which will wrap the exponent back propriate class and tell the floating-point into range, changing ph to 1.45 x 2-62 hardware to mask off that class of excep- (see below). Similarly, if p~ underflows, tions. Then all further exceptions will the counter would be decremented and run without interrupting the operating the negative exponent would get wrapped system. When a user resets that status around into a positive one. When all the flag, the hardware mask is reenabled. multiplications are done, if the counter is zero, the final product is p.. If the 2.3.1 Trap Handlers counter is positive, the product is over- One obvious use for trap handlers is for flowed; if the counter is negative, it un- backward compatibility. Old codes that derflowed. If none of the partial products expect to be aborted when exceptions oc- is out of range, the trap handler is never cur can install a trap handler that aborts called and the computation incurs no ex- the process. This is especially useful for tra cost. Even if there are over/under- codes with a loop like do S until (x > = flows, the calculation is more accurate 100). Since comparing a NaN to a num- than if it had been computed with loga- berwith <,<, >,~, or= (but not rithms, because each pk was computed #) always returns false, this code will go from p~ _ ~ using a full-precision multi- into an infinite loop if x ever becomes ply. Barnett [1987] discusses a formula an NaN. where the full accuracy of over/under- There is a more interesting use for flow counting turned up an error in ear- trap handlers that comes up when com- lier tables of that formula. puting products such as H ~=~x, that could IEEE 754 specifies that when an over- potentially overflow. One solution is to flow or underflow trap handler is called, use logarithms and compute exp(X log x,) it is passed the wrapped-around result as instead. The problems with this ap- an argument. The definition of wrapped proach are that it is less accurate and around for overflow is that the result is costs more than the simple expression computed as if to infinite precision, then IIx,, even if there is no overflow. There is divided by 2”, then rounded to the rele- another solution using trap handlers vant precision. For underflow, the result called over / underfZo w counting that is multiplied by 2a. The exponent a is avoids both of these problems [Sterbenz 192 for single precision and 1536 for dou- 1974]. ble precision. This is why 1.45 x 2130 was The idea is as follows: There is a global transformed into 1.45 x 2-62 in the ex- counter initialized to zero. Whenever the ample above.

ACM Computmg Surveys, Vol. 23, No. 1, March 1991 Floating-Point Arithmetic “ 27

2.3.2 Rounding Modes correct answer could be anywhere in that interval. Interval arithmetic makes more In the IEEE standard, rounding occurs sense when used in conjunction with a whenever an operation has a result that multiple precision floating-point pack- is not exact, since (with the exception of age. The calculation is first performed binary decimal conversion) each opera- with some precision p. If interval arith- tion is computed exactly then rounded. metic suggests that the final answer may By default, rounding means round to- be inaccurate, the computation is redone ward nearest. The standard requires that with higher and higher precision until three other rounding modes be provided; the final interval is a reasonable size. namely, round toward O, round toward + m, and round toward – co. When used 2.3.3 Flags with the convert to integer operation, round toward – m causes the convert to The IEEE standard has a number of flags become the floor function, whereas, round and modes. As discussed above, there is toward + m is ceiling. The rounding mode one status flag for each of the five excep- affects overflow because when round to- tions: underflow, overflow, division by ward O or round toward – m is in effect, zero, invalid operation, and inexact. an overflow of positive magnitude causes There are four rounding modes: round the default result to be the largest repre- toward nearest, round toward + w, round sentable number, not + m. Similarly, toward O, and round toward – m. It is overflows of negative magnitude will strongly recommended that there be an produce the largest negative number enable mode bit for each of the five ex- when round toward + m or round toward ceptions. This section gives some exam- O is in effect. ples of how these modes and flags can be One application of rounding modes oc- put to good use. A more sophisticated curs in interval arithmetic (another is example is discussed in Section 4.2. mentioned in Section 4.2). When using Consider writing a subroutine to com- interval arithmetic, the sum of two num- pute x‘, where n is an integer. When bers x and y is an interval [Z, 21, where n > 0, a simple routine like g is x @ y rounded toward – co and 2 is PositivePower(x,n) { x @ y rounded toward + m. The exact while (n is even) { result of the addition is contained within X=X*X the interval [Z, 21. Without rounding n = n/2 modes, interval arithmetic is usually im- } plemented by computing z = (x @ Y) U.x (1 – c) and Z = (x @ y)(l + e), where ~ while (true) { is machine epsilon. This results in over- n = n/2 estimates for the size of the intervals. if (n = = O)return u X=X*X Since the result of an operation in inter- if(nisodcl)u=u*x val arithmetic is an interval, in general the input to an operation will also be an interval. If two intervals [g, 11 and [y, y] are added, the result is [g, .21,where-g is will compute x n. g @ y with the rounding mode set to If n <0, the most accurate way to roun~ toward – ~, and Z is Z @ 2 with compute x” is not to call Positive- the rounding mode set toward + ~. Power(l /x, – n) but rather 1/Posi- When a floating-point calculation is tivePower(x, – n), because the first performed using interval arithmetic, the expression multiplies n quantities, each final answer is an interval that contains of which has a rounding error from the the exact result of the calculation. This division (i.e., 1/x). In the second expres- is not very helpful if the interval turns sion these are exact (i.e., x) and the final out to be large (as it often does), since the division commits just one additional

ACM Computmg Surveys, Vol 23, No 1, March 1991 28 “ David Goldberg rounding error. Unfortunately, there is a tures usually have floating-point instruc- slight snag in this strategy. If Positive- tions, compilers must generate those Power(x, – n) underflows, then either floating-point instructions, and the oper- the underflow tra~1 handler will be called ating system must decide what to do or the underflow status flag will be set. when exception conditions are raised for This is incorrect, because if x-n under- those floating-point instructions. Com- flow, then x‘ will either overflow or be puter system designers rarely get guid- in range. 14 But since the IEEE standard ance from numerical analysis texts, gives the user access to all the flags, the which are typically aimed at users and subroutine can easilv correct for this. writers of software not at computer It turns off the overflow and underflow designers. trap enable bits and saves the overflow As an example of how plausible design and underflow status bits. It then com- decisions can lead to unexpected behav- tmtes 1 /PositivePower(x. – n). If nei- ior, consider the following BASIC ~her th~ overflow nor underflow status program: bit is set, it restores them together with q = 3.0/7.0 the trap enable bits. If one of the status if q = 3.0/7.0 then print “Equal”: bits is set, it restores the flags and redoes else print “Not Equal” the calculation using PositivePower (1/x, – n), which causes the correct ex- When compiled and run using Borland’s ceptions to occur. Turbo Basic15 on an IBM PC, the pro- Another example of the use of flags gram prints Not Equal! This example occurs when computing arccos via the will be analyzed in Section 3.2.1. formula Incidentally, some people think that the solution to such anomalies is never to compare floating-point numbers for l–x arccos x = 2 arctan — equality but instead to consider them r1+X” equal if they are within some error bound E. This is hardly a cure all, because it If arctan(co) evaluates to m/2, then arc- raises as many questions as it answers. COS(– 1) will correctly evaluate to What should the value of E be? If x <0 2 arctan(co) = r because of infinity arith- and y > 0 are within E, should they re- metic. There is a small snag, however, ally be considered equal, even though because the computation of (1 – x)/ they have different signs? Furthermore, (1 i- x) will cause the divide by zero ex- the relation defined by this rule, a - b & ception flag to be set, even though arc- I a - b I < E, is not an equivalence rela- COS(– 1) is not exceptional. The solution tion because a - b and b - c do not to this problem is straightforward. Sim- imply that a - c. ply save the value of the divide by zero flag before computing arccos, then re- 3.1 Instruction Sets store its old value after the computation. It is common for an algorithm to require a short burc.t of higher precision in order 3. SYSTEMS ASPECTS to produce accurate results. One example The design of almost every aspect of a occurs in the quadratic formula [ – b computer system requires knowledge t ~/2a. As discussed in Sec- about floating point. Computer architec- tion 4.1, when b2 = 4 ac, rounding error can contaminate up to half the digits in the roots computed with the quadratic 141t can be in range because if z <1, n <0, and x –” is just a tiny bit smaller than the underflow threshold 2em,n, then x“ = 2 ‘em~ < 2em= and so may not overflow, since in all IEEE precision, 15Turbo Basic is a registered trademark of Borland – emln < em... International, Inc.

ACM Computmg Surveys, Vol 23, No 1, March 1991 Floating-Point A~ithmetic ● 29 formula. By performing the subcalcula- Suppose a solution x(l) is computed by tion of b2 – 4 ac in double precision, half some method, perhaps Gaussian elimina- the double precision bits of the root are tion. There is a simple way to improve lost, which means that all the single pre- the accuracy of the result called iteratiue cision bits are preserved. improvement. First compute The computation of b2 – 4 ac in double precision when each of the quantities a, b, and c are in single precision is easy if there is a multiplication instruction that Then solve the system takes two single precision numbers and (13) produces a double precision result. To produce the exactly rounded product of Note that if x(l) is an exact solution, two p-digit numbers, a multiplier needs then & is the zero vector, as is y. to generate the entire 2p bits of product, In general, the computation of & and y although it may throw bits away as it will incur rounding error, so Ay = & = proceeds. Thus, hardware to compute a Ax(l) – b = A(x(lJ – x), where x is the double-precision product from single-pre- (unknown) true solution. Then y = cision operands will normally be only a x(l) – x, so an improved estimate for the little more expensive than a single-preci- solution is sion multiplier and much less expensive than a double-precision multiplier. De- X(2) = .Jl) _ Y. (14) spite this, modern instruction sets tend to provide only instructions that produce The three steps (12), (13), and (14) can be a result of the same precision as the repeated, replacing x(l) with X(2), and operands. 16 X(2) with X(3). This argument that x(’ +1) If an instruction that combines two is more accurate than X(L) is only infor- single-precision operands to produce a mal. For more information, see Golub double-precision product were only useful and Van Loan [1989]. for the quadratic formula, it would not be When performing iterative improve- worth adding to an instruction set. This ment, $ is a vector whose elements are instruction has many other uses, how- the difference of nearby inexact floating- ever. Consider the problem of solving a point numbers and so can suffer from system of linear equations: catastrophic cancellation. Thus, iterative improvement is not very useful unless ~ = Ax(l) – b is computed in double precision. Once again, this is a case of computing the product of two single-precision numbers ( A and X(l)), where the full double-precision result is needed. To summarize, instructions that multi- which can be written in matrix form as ply two floating-point numbers and re- Ax = b, where turn a product with twice the precision of the operands make a useful addition to a floating-point instruction set. Some of the implications of this for compilers are discussed in the next section.

3.2 Languages and Compilers IsThis is probably because designers like “orthogo- The interaction of compilers and floating nal” instruction sets, where the precision of a point is discussed in Farnum [19881, and floating-point instruction are independent of the actual operation. Making a special case for multi- much of the discussion in this section is plication destroys this orthogonality, taken from that paper.

ACM Computing Surveys, Vol. 23, No. 1, March 1991 30 “ David Goldberg

3.2.1 Ambiguity numbers. For example, the expression (x + y) + z has a totally different answer Ideally, a language definition should de- than x + (y + z) when x = 1030, fine the semantics of the language pre- y = –1030 and z = 1 (it is 1 in the for- cisely enough to prove statements about mer case, ‘O in the latter). The impor- programs. Whereas this is usually true tance of preserving parentheses cannot for the integer part of a language, lan - be overemphasized. The algorithms pre- guage definitions often have a large gray sented in Theorems 3, 4, and 6 all depend area when it comes to floating point on it. For example, in Theorem 6, the (modula-3 is an exception [Nelson 19911). formula x. = mx – ( mx – x) would re - Perhaps this is due to the fact that many duce to x~”= x if it were not for paren- language designers believe that nothing theses, thereby destroying the entire can be preven about floating point, since algorithm. A language definition that it entails rounding error. If so, the previ- does not require parentheses to be ous sections have demonstrated the fal- honored is useless for floating-point lacy in this reasoning. This section calculations. discusses some common mav areas in Subexpression evaluation is impre- language definitions and “gi~es sugges- cisely defined in many languages. Sup- tions about how to deal with them. pose ds is double precision, but x and y Remarkably enough, some languages are single precision. Then in the expres- do not clearly specify that if x is a float- sion ds + x *y, is the product performed ing-point variable (with say a value of in single or double precision? Here is 3.0/10.0), then every occurrence of (say) another examde:. In x + m h where m 10.0 * x must have the same value. For and n are integers, is the division an example Ada,~7 which is based on integer operatio; or a floating-point one? Brown’s model, seems to imply that There are two ways to deal with this floating-point arithmetic only has to sat- problem, neither of which is completely isfy Brown’s axioms, and thus expres satisfactory. The first is to require that sions can have one of many possible all variables in an expression have the values. Thinking about floating point in same type. This is the simplest solution this fuzzy way stands in sharp contrast but has some drawbacks. First, lan- to the IEEE model, where the result of guages like Pascal that have subrange each floating-point operation is precisely types allow mixing subrange variables defined. In the IEEE model, we can prove with integer variables, so it is somewhat that (3.0/10.0) * 3.0 evaluates to 3 (Theo- bizarre to prohibit mixing single- and rem 7), In Brown’s model, we cannot. double-precision variables. Another prob- Another ambiguity in most language lem concerns constants. In the expres- definitions concerns what happens on sion 0.1 *x, most languages interpret 0.1 overflow, underflow, and other excep- to be a single-precision constant. Now tions. The IEEE standard precisely spec- suppose the programmer decides to ifies the behavior of exceptions, so change the declaration of all the languages that use the standard as a floating-point variables from single to model can avoid any ambiguity on this double precision. If 0.1 is still treated as .Boint. a single-precision constant, there will be Another gray area concerns the inter- a compile time error. The programmer pretation of parentheses. Due to roundoff will have to hunt down and change every errors, the associative laws of algebra do floating-point constant. not necessarily hold for floating-point The second approach is to allow mixed expressions, in which case rules for subexpression evaluation must be provided. There are a number of guiding 17Ada is a registered trademark of the U S. Govern- examples. The original definition of C ment Ada joint program office required that every floating-point expres -

ACM Computing Surveys, Vol. 23, No 1, March 1991 Floating-Point Arithmetic g 31 sion be computed in double precision cause both operands are single precision, [Kernighan and Ritchie 19781. This leads as is the result. to anomalies like the example immedi- A more sophisticated subexpression ately proceeding Section 3.1. The expres- evaluation rule is as follows. First, as- sion 3.0/7.0 is computed in double sign each operation a tentative precision, precision, but if q is a single-precision which is the maximum of the precision of variable, the quotient is rounded to sin- its operands. This assignment has to be gle precision for storage. Since 3/7 is a carried out from the leaves to the root of repeating binary fraction, its computed the expression tree. Then, perform a sec- value in double precision is different from ond pass from the root to the leaves. In its stored value in single precision. Thus, this pass, assign to each operation the the comparison q = 3/7 fails. This sug- maximum of the tentative precision and gests that computing every expression in the precision expected by the parent. In the highest precision available is not a the case of q = 3.0/7.0, every leaf is sin- good rule. gle precision, so all the operations are Another guiding example is inner done in single precision. In the case of products. If the inner product has thou- d = d + x[il * y[il, the tentative precision sands of terms, the rounding error in the of the multiply operation is single preci- sum can become substantial. One way to sion, but in the second pass it gets pro- reduce this rounding error is to accumu- moted to double precision because its late the sums in double precision (this parent operation expects a double-preci- will be discussed in more detail in Sec- sion operand. And in y = x + single tion 3.2. 3). If d is a double-precision (dx – dy), the addition is done in single variable, and X[ 1 and y[ 1 are single preci- precision. Farnum [1988] presents evi- sion arrays, the inner product loop will dence that this algorithm is not difficult look like d = d + x[i] * y[i]. If the multi- to implement. plication is done in single precision, much The disadvantage of this rule is that of the advantage of double-precision ac- the evaluation of a subexpression de- cumulation is lost because the product is pends on the expression in which it is truncated to single precision just before embedded. This can have some annoying being added to a double-precision consequences. For example, suppose you variable. are debugging a program and want to A rule that covers the previous two know the value of a subexpression. You examples is to compute an expression in cannot simply type the subexpression to the highest precision of any variable that the debugger and ask it to be evaluated occurs in that expression. Then q = because the value of the subexpression in 3.0/7.0 will be computed entirely in sin- the program depends on the expression gle precisionlg and will have the Boolean in which it is embedded. A final com- value true, whereas d = d + x[il * y[il ment on subexpression is that since con- will be computed in double precision, verting decimal constants to binary is an gaining the full advantage of double-pre- operation, the evaluation rule also af- cision accumulation. This rule is too sim- fects the interpretation of decimal con- plistic, however, to cover all cases stants. This is especially important for cleanly. If dx and dy are double-preci- constants like 0.1, which are not exactly sion variables, the expression y = x + representable in binary. single(dx – dy) contains a double-preci- Another potential gray area occurs sion variable, but performing the sum in when a language includes exponentia - double precision would be pointless be- tion as one of its built-in operations. Un- like the basic arithmetic operations, the value of exponentiation is not always obvious [Kahan and Coonen 19821. If * * 18This assumes the common convention that 3.0 is a single-precision constant, whereas 3.ODO is a dou- is the exponentiation operator, then ble-precision constant. ( – 3) * * 3 certainly has the value – 27.

ACM Computing Surveys, Vol. 23, No. 1, March 1991 32 “ David Goldberg

However, (–3.0)**3.O is problematical. which means 00 = 1.19 Using this defini- If the * * operator checks for integer pow- tion would unambiguously define the ex- ers, it would compute (–3.0)**3.O as ponential function for all arguments and – 3.03 = –27. On the other hand, if the in particular would define ( – 3.0) * * 3.0 formula x Y = e-Y k x is used to define * * to be –27. for real arguments, then depending on the log function, the result could be a 3.2.2 IEEE Standard NaN (using the natural definition of log(x) = NaN when x < O). If the FOR- Section 2 discussed many of the features TRAN CLOG function is used, however, of the IEEE standard. The IEEE stan- the answer will be – 27 because the ANSI dard, however, says nothing about how FORTRAN standard defines CLOG these features are to be accessed from a ( – 3.0) to be i~ log 3 [ANSI 1978]. The programming language. Thus, there is programming language Ada avoids this usually a mismatch between floating- problem by only defining exponentia- point hardware that supports the stan- tion for integer powers, while ANSI dard and programming languages like C, FORTRAN prohibits raising a negative Pascal, or FORTRAN. Some of the IEEE number to a real power. capabilities can be accessed through a In fact, the FORTRAN standard says library of subroutine calls. For example, that the IEEE standard requires that square root be exactly rounded, and the square Any arithmetic operation whose result M not root function is often implemented di - mathematically defined is prohibited . . rectly in hardware. This functionality is Unfortunately, with the introduction easily accessed via a library square root of + COby the IEEE standard, the mean- routine. Other aspects of the standard, ing of not mathematically defined is no however, are not so easily implemented longer totally clear cut. One definition as subroutines. For example, most com- might be to use the method of Section puter languages specify at most two 2.2.2. For example, to determine the floating-point types, whereas, the IEEE value of ab, consider nonconstant ana- standard has four different precision (al- lytic functions f and g with the property though the recommended configurations that f(x)+ a and g(x)+ b as x~O. If are single plus single extended or single, f’( X)g(’) always approaches the same double, and double extended). Infinity limit, this should be the value of ab. This provides another example. Constants to definition would set 2m = m, which seems represent + co could be supplied by a quite reasonable. In the case of 1. Om, subroutine. But that might make them when f(x) = 1 and g(x) = I/x the limit unusable in places that require constant approaches 1, but when f(x) = 1 – x and expressions, such as the initializer of a g(x) = l/x the limit is e. So l.0~ should constant variable. be an NaN. In the case of 0°, f(x)g(’) = A more subtle situation is manipulat - eg(x)log ~t’). Since f and g are analytical ing the state associated with a computa- and take on the value of O at O, f(x) = tion, where the state consists of the alxl+az x2+ .“” and g(x) = blxl + rounding modes, trap enable bits, trap bzxz+ . . .. Thus. handlers, and exception flags. One approach is to provide subroutines for read- :~g(x)log f(x) ing and writing the state. In addition, a

— limxlog(x(al + CZzx+ .“. )) x-o lgThe conclusion that 00 = 1 depends on the restriction f be nonconstant. If this restriction is removed, then letting ~ be the identically O function gives O as a possible value for lim ~- ~f( x)gt’~, So ~(x)g(’) + e“ = 1 for all f and g, and so 00 would have to be defined to be a NaN.

ACM Computmg Surveys, Vol. 23, No 1, March 1991 Floating-Point Arithmetic “ 33

single call that can atomically set a new cisely, and it depends on the current value and return the old value is often value of the rounding modes. This some- useful. As the examples in Section 2.3.3 times conflicts with the definition of im- showed, a common pattern of modifying plicit rounding in type conversions or the IEEE state is to change it only within explicit round function in languages. the scope of a block or subroutine. Thus, This means that programs that wish the burden is on the programmer to find to use IEEE rounding cannot use the each exit from the block and make sure natural language primitives, and con- the state is restored. Language support versely the language primitives will be for setting the state precisely in the scope inefficient to implement on the ever- of a block would be very useful here. increasing number of IEEE machines. Modula-3 is one language that imple- ments this idea for trap handlers 3.2.3 Optimizers [Nelson 19911. A number of minor points need to be Compiler texts tend to ignore the subject considered when implementing the IEEE of floating point. For example, Aho et al. standard in a language. Since x – x = [19861 mentions replacing x/2.O with +0 for all X,zo (+0) – (+0) = +0. How- x * 0.5, leading the reader to assume that ever, – ( + O) = – O, thus – x should not x/10.O should be replaced by 0.1 *x. be defined as O – x. The introduction of These two expressions do not, however, NaNs can be confusing because an NaN have the same semantics on a binary is never equal to any other number (in- machine because 0.1 cannot be repre- cluding another NaN), so x = x is no sented exactly in binary. This textbook longer always true. In fact, the expres- also suggests replacing x * y – x * z by sion x # x is the simplest way to test for x *(y – z), even though we have seen that a NaN if the IEEE recommended func- these two expressions can have quite dif- tion Isnan is not provided. Furthermore, ferent values when y ==z. Although it NaNs are unordered with respect to all does qualify the statement that any alge- other numbers, so x s y cannot be de- braic identity can be used when optimiz- fined as not z > y. Since the intro- ing code by noting that optimizers should duction of NaNs causes floating-point not violate the language definition, it numbers to become partially ordered, a leaves the impression that floating-point compare function that returns one of semantics are not very important. <,=, > , or unordered can make it Whether or not the language standard easier for the programmer to deal with specifies that parenthesis must be hon- comparisons. ored, (x + -y) + z can have a totally differ- Although the IEEE standard defines ent answer than x -F (y + z), as discussed the basic floating-point operations to re - above. turn a NaN if any operand is a NaN, this There is a problem closely related to might not always be the best definition preserving parentheses that is illus- for compound operations. For example, trated by the following code: when computing the appropriate scale eps = 1 factor to use in plotting a graph, the do eps = 0.5* eps while (eps + 1> 1) maximum of a set of values must be computed. In this case, it makes sense This code is designed to give an estimate for the max operation simply to ignore for machine epsilon. If an optimizing NaNs. compiler notices that eps + 1 > 1 @ eps Finally, rounding can be a problem. >0, the program will be changed com- The IEEE standard defines rounding pre - pletely. Instead of computing the smallest number x such that 1 @ x is still greater than x(x = c = 8-F’), it will com- 20Unless the rounding mode is round toward – m, pute the largest number x for which x/2 in which case x – x = – O. is rounded to O (x = (?em~).Avoiding this

ACM Computing Surveys, Vol. 23, No. 1, March 1991 34 “ David Goldberg kind of “optimization” is so important An optimizer that believed floating- that it is worth presenting one more use- point arithmetic obeyed the laws of alge- ful algorithm that is totally ruined by it. bra would conclude that C = [T – S] – Many problems, such as numerical in- Y = [(S + Y) – S] – Y = O, rendering tegration and the numerical solution of the algorithm completely useless. These differential equations, involve computing examples can be summarized by saying sums with manv. terms. Because each that optimizers should be extremely cau- addition can potentially introduce an er- tious when applying algebraic identities ror as large as 1/2 ulp, a sum involving that hold for the mathematical real num- thousands of terms can have quite a bit bers to expressions involving floating- of rounding error. A simple way to cor- point variables. rect for this is to store the partial sum- Another way that optimizers can mand in a double-precision variable and change the semantics of floating-point to perform each addition using double code involves constants. In the expres- precision. If the calculation is being done sion 1.OE –40 *x, there is an implicit dec- in single precision, performing the sum imal to binary conversion operation that in double precision is easy on most com- converts the decimal number to a binary puter systems. If the calculation is al- constant. Because this constant cannot ready being done in double precision, be represented exactly in binary, the in- however, doubling the precision is not so exact exception should be raised. In addi - simple. One method that is sometimes tion, the underflow flag should to be set advocated is to sort the numbers and add if the expression is evaluated in single them from smallest to largest. There is a precision. Since the constant is inexact, much more efficient method, however, its exact conversion to binary depends on that dramatically improves the accuracy the current value of the IEEE rounding of sums, namely Theorem 8. modes. Thus, an optimizer that converts 1.OE-40 to binary at compile time would be changing the semantics of the pro- Theorem 8 (Kahan Summation Formula) gram. Constants like 27.5, however, that Suppose El: ~XJ is computed using the are exactly representable in the smallest following algorithm available precision can be safely converted at compile time, since they are s = X[l] always exact, cannot raise any exception, C=o and are unaffected by the rounding forj=2to N{ modes. Constants that are intended to be Y.xrjl-c converted at compile time should be done T=S+Y with a constant declaration such as const C=(T– S)– Y S=T pi = 3.14159265. Common subexpression elimination is } another example of an optimization that Then the computed sum S is equal to can change floating-point semantics, as Exj(l + dj) + 0(iVe2)X I xi 1, where I 6, I illustrated by the following code: s 2f. C= A*B; Using the naive formula ~xl, the com- RndMode = Up puted sum is equal to Xx~(l + 6J) where D= A*B; I 6, I < (n - j)e. Comparing this with the error in the Kahan summation form- Although A * B may appear to be a com- ula shows a dramatic improvement. mon subexpression, it is not because the Each summand is perturbed by only 2 e rounding mode is different at the two instead of perturbations as large as n e evaluation sites. Three final examples in the simple formula. Details are in are x = x cannot be replaced by the Section 4.3. Boolean constant true, because it fails

ACM Computmg Surveys, Vol 23, No 1, March 1991 Floating-Point Arithmetic 9 35 when x is an NaN; – x = O – x fails for The implementation of library functions x = + O; and x < y is not the opposite of such as sin and cos is even more difficult, x > y, because NaNs are neither greater because the value of these transcenden- than nor less than ordinary floating-point tal functions are not rational numbers. numbers. Exact integer arithmetic is often pro- Despite these examples, there are use- vided by Lisp systems and is handy for ful optimizations that can be done on some problems. Exact floating-point floating-point code. First, there are alge - arithmetic is, however, rarely useful. braic identities that are valid for float- The fact is there are useful algorithms ing-point numbers. Some examples in (like the Kahan summation formula) that IEEE arithmetic are x + y = y + x, 2 x exploit (x + y) + z # x + (y + z), and x=x+x. lxx=x. and O.5 XX =X12. work whenever the bound Even the’se simple ‘identities, however, can fail on a few machines such as CDC afllb=(a+b)(l+d) and Cray supercomputers. Instruction scheduling and inline procedure substi- holds (as well as similar bounds for –, tution are two other potentially useful 21As a final eXample) cOn- x, and /). Since these bounds hold for optimizations. almost all commercial hardware not just sider the expression dx = x * y, where x machines with IEEE arithmetic, it would and y are single precision variables and be foolish for numerical programmers to dx is double m-ecision. On machines that ignore such algorithms, and it would be have an ins~ruction that multiplies two irresponsible for compiler writers to de- single-precision numbers to produce a stroy these algorithms by pretending that double-precision number, dx = x * y can floating-point variables have real num- get mapped to that instruction rather ber semantics. than compiled to a series of instructions that convert the operands to double then 3.3 Exception Handling perform a double-to-double precision multiply. The topics discussed up to now have pri- Some compiler writers view restric- marily concerned systems implications of tions that prohibit converting (x + y) -t z accuracy and precision. Trap handlers to x + (y + z) as irrelevant, of interest also raise some interesting systems is- only to programmers who use unportable sues. The IEEE standard strongly recom- tricks. Perham thev have in mind that mends that users be able to specify a trap floating-point’ num~ers model real num- handler for each of the five classes of bers and should obey the same laws real exceptions, and Section 2.3.1 gave some numbers do. The problem with real num- applications of user defined trap han- ber semantics is that thev. are extremelv dlers, In the case of invalid operation expensive to implement. Every time two and division by zero exceptions, the han- n bit numbers are multiplied, the prod- dler should be provided with the uct will have 2 n bits. Every time two n operands, otherwise with the exactly bit numbers with widely spaced expo- rounded result. Depending on the pro- nents are added, the sum will have 2 n gramming language being used, the trap bits. An algorithm that involves thou- handler might be able to access other sands of operations (such as solving a variables in the program as well. For all linear system) will soon be operating on exceptions, the trap handler must be able huge numbers and be hopelessly slow. to identify what operation was being performed and the precision of its destination. The IEEE standard assumes that oper- ‘lThe VMS math libraries on the VAX use a weak ations are conceptually serial and that form of inline procedure substitution in that they use the inexpensive jump to subroutine call rather when an interrupt occurs, it is possible to than the slower CALLS and CALLG instructions. identify the operation and its operands.

ACM Computing Surveys, Vol 23, No. 1, March 1991 36 ● David Goldberg

On machines that have pipelining or specifies an exception and a value to be multiple arithmetic units, when an ex- used as the result when the exception ception occurs, it may not be enough sim- occurs. As an example, suppose that in ply to have the trap handler examine the code for computing sin x /x, the user de- program counter. Hardware support for cides that x = O is so rare that it would identifying exactly which operation improve performance to avoid a test for trapped may be necessary. x = O and instead handle this case when Another problem is illustrated by the a 0/0 trap occurs. Using IEEE trap han- following program fragment: dlers, the user would write a handler that returns a value of 1 and installs it x=y*z before computing sin x/x. Using presub - Z=X*W stitution, the user would specify that a=b+c d = a/x when an invalid operation occurs, the value of 1 should be used. Kahan calls Suppose the second multiply raises an this presubstitution because the value to exception, and the trap handler wants to be used must be specified before the ex- use the value of a. On hardware that can ception occurs. When using trap han- do an add and multiply in parallel, dlers, the value to be returned can be an o~timizer would .mobablv move the computed when the trap occurs. addi

ACM Computmg Surveys, Vol 23, No 1, March 1991 Floating-Point Arithmetic ~ 37 subtraction will always be accurate (The- Second, if x – ~ <1, then 6 = O. Since orem 2). We now proceed to verify this the smallest that x – y can be is fact. Theorem 2 has two parts, one for subtraction and one for addition. The part k k for subtraction is as follows: 1.0 – o.r—— o@”””@

Theorem 9 > (P – 1)(8-1 + ... +p-~)

If x and y are positive fZoating-point num- (where Q = ~ – 1), in this case the rela- bers in a format with parameters D and p tive error is bounded by and if subtraction is done with p + 1 digits (i. e., one guard digit), then the relative rounding error in the result is less than [(~/2) + l]~-p = [1 + (2/~)]e = 26.

Proof Interchange x and y is neces- < (6- l)p-p(r’ + . . . +p-k) sary so that x > y. It is also harmless to (/3- 1)(6-’ + . . . +6-’) scale x and y so that x is represented by = /’-P Xo. xl ““” x ~_ ~ x 13°. If y is represented (18) as yo. yl . . . YP. 1, then the difference is exact. If y is represented as O.yl . . c yP, The final case is when x – y <1 but then the guard digit ensures that the x – ~ > 1. The only way this could hap- computed difference will be the exact dif- pen is if x – j = 1, in which case 8 = O. ference rounded to a floating-point num- But if 6 = O, then (18) applies, so again ber, so the rounding error is at most ~. In the relative error is bounded by b ‘p < ❑ general, let y = 0.0 “ . . Oy~+l .00 yh+P p-p(l + 6/2). and let Y be y truncated to p + 1 digits. Then, When P = 2, the bound is exactly 2 e, and this bound is achieved for x = 1 + 22-P and y = 21-P – 21-2P in the limit as p + co. When adding numbers of < (0 – 1)(6-P-1 ““” +p-~-~). the same sign, a guard digit is not neces- (15) sary to achieve good accuracy, as the following result shows. From the definition of guard digit, the computed value of x – y is x–y Theorem 10 rounded to be a floating-point number; that is, (x – J) + 8, where the rounding If x >0 and y >0, the relative error in error 8 satisfies computing x -t y is at most 2 e, even if no guard digits are used.

(16) Proof The algorithm for addition with k guard digits is similar to the The exact difference is x – y, so the er- algorithm for subtraction. If x = y, and roris(x –y)–(x–ji+ ~)= J–y +6. shift y right until the radix points of x There are three cases. If x – y >1, the and y are aligned. Discard any digits relative error is bounded by shifted past the p + k position. Compute the sum of these two p + k digit num- y–j+ti bers exactly. Then round to p digits. 1 We will verify the theorem when no guard digits are used; the general case is similar. There is no loss of generality in ==~-p (~- 1)(~-’+ ““” [ +6-’)+:1 assuming that x z y ~ O and that x is scaled to be of the form d. d 00. d X /3°.

ACM Computing Surveys, Vol 23, No 1, March 1991 38 0 David Goldberg

value less than (3‘p + 1 and the sum is at This relative error is equal to 81 + 62 + least 1, so the relative error is less than t+ + 618Z + 616~ + 6263, which is bounded ~-P+l/l = 2e. If there is a carry out, the by 5e + 8 E2. In other words, the maxi- error from shifting must be added to the mum relative error is about five round- rounding error of (1/2) ~ ‘p’2. The sum is ing errors (since ~ is a small number, C2 at least II, so the relative error is less is almost negligible). than (~-p+l + (1/2) ~-p+2)/~ = (1 + A similar analvsis of ( x B x) e p/2)~-~ s 2,. H (y@ y) cannot result in a small value for the relative error because when two It is obvious that combining these two nearby values of x and y are plugged theorems gives Theorem 2. Theorem 2 into X2 — y2, the relative error will usu- gives the relative error for performing ally be quite large. Another way to see one operation. Comparing the rounding this is to try and duplicate the analysis error of x 2 – y2 and (x+y)(x–y) re- that worked on (x e y) 8 (x O y), quires knowing the relative error of mul- yielding tiple operations. The relative error of xeyis81= [(x0 y)-(x-y)l/ (Xth) e (YC8Y) (x – y), which satisfies I al I s 26. Or to write it another way, = [x’(l +8J - Y2(1 + ‘52)](1 + b)

= ((X2 - y’)(1 + 61) + (6, - 62)Y2) Xey=(x–y)(l+dl), 18, J< 26. (19) (1 + &J.

Similarly, When x and y are nearby, the error term (61 – 82)y2 can be as large as the x@y=(x+y)(l+a2), 182] <2E. result X2 – y2. These computations for- (20) mally justify our claim that ( x – y) (x + y) is more accurate than x’ – y’. Assuming that multiplication is per- We next turn to an analysis of the formula for the area of a triangle. To formed by computing the exact product estimate the maximum error that can then rounding, the relative error is at most 1/2 ulp, so occur when computing with (7), the following fact will be needed.

u@u=uu(l+~3), 18315C (21) Theorem 11

for any floating point numbers u and u. If subtraction is performed with a guard Putting these three equations together digit and y/2 < x< 2y, then x – y is (letting u = x 0 y and v = x Q y) gives computed exactly,

(xey)~(xey) Proof Note that if x and y have the same exponent, then certainly x G y is = (X-y)(l +(!,) exact. Otherwise, from the condition of the theorem, the exponents can differ by X(x+ y)(l + 32)(1 + 63). (22) at most 1. Scale and interchange x and y if necessary so O < y < x and x is repre- So the relative error incurred when com- sented as XO.xl “ . “ puting (x – y)( x + y) is Xp.l and y as O.Yl . . . yP. Then the algorithm for comput - ing x e y will compute x – y exactly (Xey)o(x ey)-(xa-y’) and round to a floating-point number but (Xa-ya) if the difference is of the form O.dl . . . dp, the difference will already be p digits = (1 +6,)( 1+62)(1+8,) -1. (23) long, and no rounding is necessary. Since

ACM Computmg Surveys, Vol 23. No 1. March 1991 Floating-Point Arithmetic “ 39

X= 2y, x– ysy, and since y is of the conditions of Theorem 11. This means form O.dl .” “ ciP, sois x-y. ❑ a – b = a El b is exact, and hence c a (a – b) is a harmless subtraction that When (1 >2, the hypothesis of Theo- can be estimated from Theorem 9 to be rem 11 cannot be replaced by y/~ s x s ~ y; the stronger condition y/2 < x s 2 y (C 0 (a e b)) = (c- (a- b))(l+nJ, is still necessary. The analysis of the error in ( x – y)( x + y) in the previous /q21 s2,. (25) section used the fact that the relative The third term is the sum of two exact error in the basic operations of addition positive quantities, so and subtraction is small [namely, eqs. (19) and (20)]. This is the most common kind of error analysis. Analyzing for- (C @I(a e b))= (c+ (a- b))(l+ v,), mula (7), however, requires something lq31 <2c. (26) more; namely, Theorem 11, as the following proof will show. Finally, the last term is

Theorem 12 (a@ (b 0 c)) = (a+ (b-c) )(l+q4)2,

If subtraction uses a guard digit and if a, IvAI S2E, (27) b, and c are the sides of a triangle, the relative error in computing (a i- (b + using both Theorem 9 and Theorem 10. c))(c – (a – b))(c + (a – b))(a + (b – c)) If multiplication is assumed to be exactly is at most 16 t, provided e < .005. rounded so that x @ y = xy(l + f) with I f I s e, then combining (24), (25), (26), Proof Let us examine the factors one and (27) gives by one. From Theorem 10, b ‘d3 c = (b + c)(1 -i- al), where al is the relative (a d) (b 63 c))(c 0 (a 0 b)) error and I til I s 2 ~. Then the value of the first factor is (a 63 (b ED c)) = (a + (C @ (a 0 b))(a @ (b 0 c)) (b 63 c))(1 + 8,) = (a+ (b + c)(I + 81)) x(1 + ti2), and thus s (a+ (b +c))(c - (a- b)) (a+ b+ C)(l-242 (c+ (a- b)) <[a+ (b+c)(l-2~)](1-2e) (a+(b-c))E ?

=[a+(b+ c)(l+2c)](l+2c) E = (1 + ql)2(l+ q2)(l + q3)(l+ T4)2

s (a+ b+ c)(1 +.2E)2. (1+ ~1)(1+ ~,)(1+ ~,).

This means that there is an VI so that An upper bound for E is (1 + 2C)6(1 + e)3, which expands to 1 + 15c + 0(e2). (a @ (b @ c)) = (a+ b+c)(l+ql)’, Some writers simply ignore the 0(~2) term, but it is easy to account for it. Writing (1 + 26)6(1 + C)3 = 1 + 15e + The next term involves the potentially cl?(e), l?(~) is a polynomial in ~ with catastrophic subtraction of c and a 63 b, positive coefficie~ts, so it is an increasing because a GI h may have rounding er. function of G. Since R(.005) = .505, R(.) ror. Because a, b, and c are the sides of a < 1 for all ~ < .005, and hence E s (1 + triangle, a < b + c, and combining this 2C)6(1 + ~)3 <1 + 166. To get a lower with the ordering c < b < a gives a < b bound on E, note that 1 – 15e – cR(6) < +c<2b~2a. So a– b satisfies the E; so when c <.005, 1 – 166< (1 –

ACM Computing Surveys, Vol. 23, No, 1, March 1991 40 “ David Goldberg

26)6(1 – 6)3. Combining these two Theorem 13 bounds yields 1 – 16c < E < 1 + 16c. If p(x) = ln(l + x)/x, then for O S x < Thus the relative error is at most 16~. 3/4, 1/2 s W(x) < 1 and the derivative E satisfies I K’(x) I < 1/2.

Theorem 12 shows there is no catas- Proof Note that p(x) = 1 – x/2 + trophic cancellation in formula (7). x2/3 –... is an alternating series with Therefore, although it is not necessary to decreasing terms, so for x <1, p(x) >1 show formula (7) is numerically stable, it — x/2 = 1/2. It is even easier to see that is satisfying to have a bound for the en- because the series for p is alternating, tire formula, which is what Theorem 3 of V(x) <1. The Taylor series of M’(x) is Section 1.4 gives. also alternating, and if x = 3/4 has decreasing terms, so – 1/2 < p’(x) < – 1/2 Proof Theorem 3. Let + 2x/3, or – 1/2 s p’(x) s O, thus / p’(%)1 s 1/2. m q=(a+(b +c))(c -(a-b)) Proof Theorem 4. Since the Taylor se- (c+ (a- b))(a+ (b-c)) ries for In,

and X2 X3 ln(l+x)=x–l+~ –...,

Q=(a@(b @c))@ (ce(a Ob)) is an alternating series, O < x – ln(l + x) < X2/2. Therefore, the relative error incurred when approximating ln(l + x) by x is bounded by x/2. If 1 @ x = 1, Then Theorem 12 shows that Q = q(l + then I x I < c, so the relative error is 8), with 6 = 166. It is easy to check that bounded by E/2. When 1 @ x # 1, define 2 via 1 @ x =1+2. Then since O

ACM Computing Surveys, Vol 23, No. 1, March 1991 Floating-Point Arithmetic ● 41 multiplying by x introduces a final 6A, so the fact that ax2 + bx + c = a(x – rl)(x the computed value of xln(l + x)/((1 + — rz), so arlr2 = c. Since b2 = 4ac, then x) – 1) is rl = r2, so the second error term is 4 ac~~ = 4 a2 r~til. Thus, the computed value of ~is~ d + 4 a2 r~~~ . The inequality

X(l +83)(1 +(s4), \tjls E.

It is easy to check that if ~ <0.1, then (1 + 8,)(1 + 82)(1 + 83)(1 + 84) = 1 + 8, shows that ~d -t- 4a2r~8d = ~ + E, with 16\s5e. ❑ where I E I s ~-, so the absolute error in ~/2a is about rl A. An interesting example of error analy- Since 6A = P-’, & = fi-p12, and thus sis using formulas (19), (20), and (21) occurs in the quadratic formula [ – b the absolute error of rl & destroys the bottom half of the bits of the roots rl = ~ ~]/2 a. Section 1.4 explained r2. In other words, since the calculation how rewriting the eauation will elimi - of the roots involves computing with nate the pote~tial can~ellation caused by the ~ operation. But there is another ~/2 a and this expression does not have meaningful bits in the position corre- .~otential cancellation that can occur sponding to the lower order half of r,, the when commtin~. d = bz – 4 ac. This one cannot be elim~nated by a simple rear- lower order bits of r, cannot be meaning- ❑ rangement of the formula. Roughly ful. speaking, when b 2 = 4 ac, rounding error can contaminate up to half the digits in Finally, we turn to the proof of Theo- the roots computed with the quadratic rem 6. It is based on the following fact in formula. Here is an informal proof Theorem 14, which is proven in the (another approach to estimating the er- Appendix. ror in the quadratic formula appears in Kahan [1972]). Theorem 14 Let O.the only way there can be a carrY out 1s lf xp_k_l = ~ – 1. In that case, however, the low-order digit of x~ is 1 + 221n this informal proof, assume (3 = 2 so multipli- x = O, and so again x~ is repre- cation by 4 is exact and does not require a 6,. s&/a~le in ~p/2] digits.

ACM Computmg Surveys, Vol. 23, No 1, March 1991 42 “ David Goldberg

To deal with xl, scale x to be an inte- converting the decimal number to the ger satisfying (3P-1 s x s Bp – 1. Let x closest binary number will recover the = ?ik + it, where ?ifi is the p – k high- original floating-point number. order digits of x and Zl is the k low-order Proof Binary single-precision num- digits. There are three cases to consider. bers lying in the half-open interval If 21< (P/2)/3~-1, then rounding x to [103, 210) = [1000, 1024) have 10 bits to p – k places is the same as chopping and the left of the binary point and 14 bits to X~ = ~h, and xl = Il. Since Zt has at the right of the binary point. Thus, there most k digits, if p is even, then Zl has at 103)214 = 393,216 different bi- most k = ( p/21 = ( p/21 digits. Other- are (210 – nary numbers in that interval. If decimal wise, 13= 2 and it < 2k-~ is repre- numbers are represented with eight dig- sentable with k – 1 < fp/21 significant its, there are (210 – 103)104 = 240,000 bits. The second case is when It > decimal numbers in the same interval. (P/2) 0~- 1; then computing Xk involves There is no way 240,000 decimal num- rounding up, so Xh = 2~ + @k and xl = bers could represent 393,216 different bi- x–xh=x —2h– pk = 21- pk. Once nary numbers. So eight decimal digits again, El has at most k digits, so it is are not enough to represent each single- representable with [ p/21 digits. Finally, precision binary number uniquely. if 2L = (P/2) 6k–1, then xh = ith or 2~ + To show that nine digits are sufficient, f?k depending on whether there is a round it is enough to show that the spacing up. Therefore, xl is either (6/2) L?k-1 or between binary numbers is always (~/2)~k-’ – ~k = –~k/2, both of which greater than the spacing between deci- are represented with 1 digit. H mal numbers. This will ensure that for each decimal number N, the interval [ N Theorem 6 gives a way to express the — 1/2 ulp, N + 1/2 ulp] contains at most product of two single-precision numbers one binary number. Thus, each binary exactly as a sum. There is a companion number rounds to a unique decimal num- formula for expressing a sum exactly. If ber, which in turn rounds to a unique lxl>lyl, then x+y=(x~y) +(x binary number. 0 (x @ y)) @ y [Dekker 1971; Knuth To show that the spacing between bi- 1981, Theorem C in Section 4.2.2]. When nary numbers is always greater than the using exactly rounded operations, how- spacing between decimal numbers, con- ever, this formula is only true for P = 2, sider an interval [10’, 10”+ l]. On this not for /3 = 10 as the example x = .99998, interval, the spacing between consecu- y = .99997 shows. tive decimal numbers is 10(”+ 1)-9. On [10”, 2 ‘1, where m is the smallest inte- 4.2 Binary-to-Decimal Conversion ger so that 10 n < 2‘, the spacing of binary numbers is 2 m-‘4 and the spac- Since single precision has p = 24 and ing gets larger further on in the inter- 2‘4 <108, we might expect that convert- val. Thus, it is enough to check that ing a binary number to eight decimal ~()(72+1)-9 < 2wL-ZA But, in fact, since digits would be sufficient to recover the 10” < 2n, then 10(”+ lJ-g = 10-lO-S < original binary number. This is not the 2n10-s < 2m2-zl ❑ case, however.

The same argument applied to double Theorem 15 precision shows that 17 decimal digits When a binary IEEE single-precision are required to recover a double-precision number is converted to the closest eight number. digit decimal number, it is not always Binary-decimal conversion also pro- possible to recover the binary number vides another example of the use of flags. uniquely from the decimal one. If nine Recall from Section 2.1.2 that to recover decimal digits are used, however, then a binary number from its decimal expan-

ACM Computmg Surveys, Vol 23, No 1, March 1991 Floating-Point Arithmetic . 43 sion, the decimal-to-binary conversion where ~6, ~ < c, and ignoring second- must be computed exactly. That conver- order terms in 6i gives sion is performed by multiplying the quantities N and 10 Ip I (which are both exact if P < 13) in single-extended precision and then rounding this to single precision (or dividing if P < O; both cases are similar). The computation of N . 10 IPI cannot be exact; it is the combined operation round (N “ 10 Ip I) that must be The first eaualitv of (31) shows that exact, where the rounding is from single the computed ~alue”of EXJ is the same as extended to single precision. To see why if an exact summation was performed on it might fail to be exact, take the simple perturbed values of x,. The first term xl case of ~ = 10, p = 2 for single and p = 3 is perturbed by ne, the last term X. by for single extended. If the product is to only e. The second equality in (31) shows be 12.51, this would be rounded to 12.5 that error term is bounded by n~ x I XJ 1. as part of the single-extended multiply Doubling the precision has the effect of operation. Rounding to single precision squaring c. If the sum is being done in would give 12. But that answer is not an IEEE double-precision format, 1/~ = correct, because rounding the product to 1016, so that ne <1 for any reasonable single precision should give 13. The error value of n. Thus, doubling the precision is a result of double rounding. takes the maximum perturbation of ne By using the IEEE flags, the double and changes it to n~z < e. Thus the 2 E rounding can be avoided as follows. Save error bound for the Kahan summation the current value of the inexact flag, then formula (Theorem 8) is not as good as reset it. Set the rounding mode to round using double precision, even though it is to zero. Then perform the multiplication much better than single precision. N .10 Ip 1. Store the new value of the For an intuitive explanation of why inexact flag in ixflag, and restore the the Kahan summation formula works, rounding mode and inexact flag. If ixflag consider the following diagram of proce - is O, then N o 10 I‘1 is exact, so round dure: (N. 10 Ip I) will be correct down to the last bit. If ixflag is 1, then some digits Isl were truncated, since round to zero always truncates. The significant of the product will look like 1. bl “ o“ bzz bz~ “ “ “ b~l. A double-rounding error may occur if bz~ “ . “ b~l = 10 “ “ “ O. A simple way to account for both cases is to perform a logical OR of ixflag with b31. Then round (N “ 10 Ip I) will be computed correctly in all cases. IT I

4.3 Errors in Summation -r=== Section 3.2.3 mentioned the problem of accurately computing very long sums. Yh The simplest approach to improving ac- u curacy is to double the precision. To get a rough estimate of how much doubling - 13___zl the precision improves the accuracy of a sum, let SI = xl, sz = sl @x2,. ... s,= –Yl =C s,_l e x,. Then s, = (1 + 8,)(s,_l + x,), u

ACM Computing Surveys, Vol. 23, No. 1, March 1991 44 “ David Goldberg

Each time a summand is added, there that use features of the standard are be- is a correction factor C that will be ap- coming ever more portable. Section 2 plied on the next loop. So first subtract gave numerous examples illustrating the correction C computed in the previ- how the features of the IEEE standard ous loop from Xj, giving the corrected can be used in writing practical floating- summand Y. Then add this summand to point codes. the running sum S. The low-order bits of Y (namely, Yl) are lost in the sum. Next, APPENDIX compute the high-order bits of Y by com- This Appendix contains two technical puting T – S. When Y is subtracted from proofs omitted from the text. this, the low-order bits of Y will be recovered. These are the bits that were lost in the first sum in the diagram. They Theorem 14 become the correction factor for the next Let O gorithms involving cancellation can be Zz ”.. zzbb ~“ “ bb proven to have small relative errors if the underlying hardware has a guard where x has been partitioned into two digit and there is an efficient algorithm parts. The low-order k digits are marked for binary-decimal conversion that can be b and the high-order p – k digits are proven to be invertible, provided ex- marked a. To compute m @ x from mx tended precision is supported. The task involves rounding off the low-order k of constructing reliable floating-point digits (the ones marked with b) so software is made easier when the underlying computer system is supportive of floating point. In addition to the two m~x= mx– xmod(~k) + r~k. (32) examples just mentioned (guard digits and extended precision), Section 3 of The value of r is 1 if .bb ..0 b is greater this paper has examples ranging from than 1/2 and O otherwise. More pre - instruction set design to compiler opt- cisel y, imization illustrating how to better support floating point. r = 1 ifa.bb ““” broundstoa+l, The increasing acceptance of the IEEE floating-point standard means that codes r = O otherwise. (33)

ACM Computmg Surveys, Vol 23, No 1, March 1991 Floating-Point Arithmetic e 45

Next compute ~~x + ~ looks like this:

aa”. “aabb”””bb m@x–x=mx –xmod((3h)+ r~k–x aa”” .aabb”””bb + = B’(x+r) - xmod(~’). Zzz “ “ “zZbb”””bb

The picture below shows the computation Thus, m @l x = mx – x mod(13k) + w~k, of m @ x – x rounded, that is, (m @ x) where w = – Z if Z < /3/2, but the exact 0 x. The top line is flk(x + r), where B value of w in unimportant. Next m 8 x is the digit that results from adding r to – x = IIkx – xmod(/3k) + wok. In a pic- the lowest order digit b: ture aa ..” aabb. .” bbOO”. .OO aa. ” “aabb”””bBOO. ..OO -bb””. bb -bb”””bb +W Zz”” “ Zzzoo . ..00 Rounding gives (m 8 x) 0 x = (3kx + If.bb.. b < 1/2, then r = O. Subtract- w@ – r(3k, where r=l if.bb”. ”b> ing causes a borrow from the digit 1/2 or if .bb “ “ “b = 1/2 and bO = 1. F’i- marked B, but the difference is rounded nally, up, so the net effect is that the rounded difference equals the top line, which is (m C3x)-(rn@x Ox) /?~x. If .bb “ o“ b > 1/2, then r = 1, and 1 — is subtracted from B because of the bor- — mx – x mod(fik) + w(3k row. So again the result is L?kx. Finally, consider the case .bb “ “ “b=l/2. Ifr= O, then B is even, Z is odd, and the — x – xmod[f?k) + rflk. difference is rounded up giving /3kx. Similarly, when r = 1, B is odd, Z is Once again, r = 1 exactly when rounding even, the difference is rounded down, so a ““” ah”.. b to p – k places involves again the difference is 13kx. To summa- rounding up. Thus, Theorem 14 is proven rize, in all cases. ❑

Theorem 8 (Kahan Summation Formula) (m@x) ex=~kx. (34) Suppose EJ! ~XJ is computed using the Combining eqs. (32) and (34) gives following algorithm (m8x)–(m@x0x)=x– s ==X[ll x mod( 13~)+ rf?k. The result of perform- C=o ing this computation is fm-j=2to N{ Y=xrjl-c rOO”. .OO T=S+Y C=(T– S)– Y aa. ” “aabb. .”bb S=T –bb.. ”bb + } “.”aaOO”. .OO. aa Then the computed sum S is equal to S = xx~(l + 6j) + 0( Nc2)Z I x~ 1, where The rule for computing r, eq. (33), is the 16JJ<2C. same as the rule for rounding a “ “ “ ah””” b to p – k places. Thus, comput- Proof First recall how the error esti- ing mx – ( mx – x) in floating-point mate for the simple formula Xx; went. arithmetic precision is exactly equal to Introduce SI = xl, s, = (1 + 8L)(s, _~ – 1 rounding x to p – k places, in the case + XL). Then the computed sum is s., when x + Okx does not carry out. which is a sum of terms, each of which When x + 13kx does carry out, mx = is an x, multiplied by an expression

ACM Computing Surveys, Vol 23, No 1, March 1991 46 * David Goldberg involving d~’s. The exact coefficient of xl c~= [{s~–sk_l}(l+7J –Yh](l+~k) is(l + 6Z)(1 + d~)... (1 + 3P),.Therefore by renumbering, the coefficient of Xz = [{((%, - %,) - %%,)(1 + u,) must be (1 + 63)(1 + 8A) . . . (1 + a.), and -sk_l}(l + ~k) + ck_l(l + qk)] so on. The proof of Theorem 8 runs along exactly the same lines, only the coeffi - (1+ ak) cients of xl is more complicated. In detail so = co = O and = [{(s&l - ck-,)ffk- ~kck-~(1 + ok) -ck_l}(l + ~,) + ck_l(l + qk)] Yk=xk e %1= (.%– ck.l)(l+qk) (1+ bk) sk=s&~ @ Yk= (s&l +~k)(l ‘ok) = [(sk-, - c&,)ok(l + yk) ck = (Sk e sk.1) e Y, ‘ck-1(~~ + ~k(”k + ?’k + u~d)l = [(sk - ‘k-l)(l +~k) -Y,](I +&) (1+ dk) where all the Greek letters are bounded Sk – Ck by ~. Although the coefficient of xl in s~ = ((Sk-, - Ck-,) - ~kck-,) is the ultimate expression of interest, it turns out to be easier to compute the (1+ C7k) coefficient of xl in sh – Ck and Ck. When k=l, ‘[(Sk-, - c&,)uk(l ‘yk) “k-,(~k + ~k(”k‘y, + ‘k~k))] e,= (%(1 + 7,) - Y,)(1 + L) (1+ dk) = Yl((l + %)(1 + -YJ – 1)(1 + 61) — = (sk-, - ck-l)((l + ak) — %(% + 71 + %71) ‘~k(l + ~k)(l + 6k)) (1 + (3,)(1+ ~,)

+ ck-~(–~k(l + ‘k) SI — c1 = Xl[(l + 01) – (q + ‘)’1 + %71) (1+ ‘-L)](1+%) +(~k + ~k(~k + ~k + uk~k)) = xl [1 – ‘y~ – (7181– a~-y~ (1+ 6k)) –8171 – a171aJ(1 + ~J. = (Sk-l - ck_J

Calling the coefficients of xl in these (1 - u~(~k + 8k + ~k8k)) expressions Ch and Sk, respectively, then “k-l[-qk+~k

c1 = 26 + 0(E2) +~k(~k + uk~k)

S1=1+?7– 71+462+0(,3). +(~k + ‘%(”k + ~k + ‘k~k))dk]

To get the general formula for Sk and Since S~ and Ch are only being computed Ck, expand the definitions of Sk and Ck, up to order ~2, these formulas can be ignoring all terms involving x, with simplified to i > 1.That gives

Sk = (Sk_l +&)(l + ok) Ck = (ok+ o(~2))&-1

= [Sk-, + (Xk- c,-,)(1 ‘~k)] +(–~k + o(e2))Ck_~

(1+ fJk) Sk = ((1 + 2e2 + o(,3))sk_,

= [(Sk-l - Ck-l) - ~kc&l](l + ‘h) +(26 + 0(~2))C&~.

ACM Computing Surveys, Vol, 23, No. 1, March 1991 Floating-Point Arithmetic - 47

Using these formulas gives The Role of Interual Methods on Scientific Com- puting, Ramon E. Moore, Ed. Academic Press, C2 = (JZ+ 0(62) Boston, Mass., pp. 99-107. COONEN, J. 1984, Contributions to a proposed 52 = 1 +ql –’yl + 10E2+ O(C3), standard for binary floating-point arithmetic. PhD dissertation, Univ. of California, Berke- and, in general, it is easy to check by ley. induction that DEKKER, T. J. 1971. A floating-point technique for extending the available precision. Numer. Ck = ok + 0(62) Math. 18, 3, 224-242. S~=l+ql –~l+(4k +2) E2+O(e3). DEMMEL, J. 1984. Underflow and the reliability of numerical software. SIAM J. Sci. Stat. Com- Finally, what is wanted is the coeffi- put. 5, 4, 887-919. cient of xl in Sk. To get this value, let FARNUM, C. 1988. Compiler support for floating- point computation. $of%w. Pratt. Experi. 18, 7, x n+l = O, let all the Greek letters with 701-709. subscripts of n + 1 equal O and compute Then s.+ ~ = s. – c., and the coef- FORSYTHE, G. E., AND MOLER, C. B. 1967. Com- puter Solut~on of Linear Algebraic Systems. &~&t of .xI in s. is less than the coeffi- Prentice-Hall, Englewood Cliffs, N.J. cient in s~+ ~, which is S, = 1 + VI – -yI GOLDBERG, I. B. 1967. 27 Bits are not enough +(4n+2)c2 = 1 +2c + 0(rze2). ❑ for 8-digit accuracy. Commum. ACM 10, 2, 105-106. ACKNOWLEDGMENTS GOLDBERG, D. 1990. Computer arithmetic. In Computer Arch itecture: A Quantitative Ap- This article was inspired by a course given at Sun proach, David Patterson and John L. Hen- Microsystems by W, Kahan, ably organized by David nessy, Eds. Morgan Kaufmann, Los Altos, Hough of Sun, from May through July 1988. Its Calif., Appendix A. aim is to enable others to learn about the interac- GOLUB, G. H., AND VAN LOAN, C. F. 1989. Matrix tion of floating point and computer systems without Computations. The Johns Hopkins University having to get up in time to attend 8:00 am lectures. Press, Baltimore, MD. Thanks are due to Kahan and many of my col- HEWLETT PACKARD 1982. HP-15L’ Advanced leagues at Xerox PARC (especially John Gilbert) Funct~ons Handbook. for reading drafts of this paper and providing many IEEE 1987. IEEE Standard 754-1985 for Binary useful comments, Reviews from Paul Hilfinger and Floating-Point Arithmetic, IEEE. Reprinted in an anonymous referee also helped improve the pre- SIGPLAN 22, 2, 9-25. sentation. KAHAN, W. 1972. A Survey of Error Analysis. In Information Processing 71, (Ljubljana, Yugo- slavia), North Holland, Amsterdam, vol, 2, pp. REFERENCES 1214-1239. AIIO, A. V., SETHI, R., AND ULLMAN, J. D. 1986. KAHAN, W. 1986. Calculating Area and Angle Compders: Princ~ples, Techn~ques and Tools. of a Needle-like Triangle. Unpublished manu- Addison-Wesley, Reading, Mass. script. ANSI 1978. American National Standard Pro- KAHAN, W. 1987. Branch cuts for complex ele- gramming Language FORTRAN, ANSI Stan- mentary functions. In The State of the Art m dard X3.9-1978. American National Standards Numerical Analyszs, M. J. D. Powell and A Institute, New York. Iserles, Eds., oxford University Press, N. Y., 13ARNETT,D. 1987. A portable floating-point envi- Chap. 7. ronment. Unpubhshed manuscript. KAHAN, W, 1988. Unpublished lectures given at BROWN, W. S, 1981. A simple but realistic model Sun Microsystems, Mountain View, Calif. of floating-point computation. ACM Trans. KAHAN, W., AND COONEN, J. T. 1982. The near Math. Softw. 7, 4, 445-480. orthogonality of syntax, semantics, and diag- CARDELLI, L., DONAHUE, J., GLASSMAN, L., JORDAN, nostics in numerical programming environ- M., KASLOW, B,, AND NELSON, G. 1989. Mod- ments. In The Relations Zp between Numerical ula-3 Report (revised). Digital Systems Re- Computation and Programming Languages, J. search Center Report #52, Palo Alto, Calif. K Reid, Ed North-Holland, Amsterdam, pp CoDY, W. J. et al. 1984. A proposed radix- and 103-115. word-length-independent standard for floating- KAHAN, W., AND LEBLANC, E. 1985. Anomalies in point arithmetic. IEEE Micro 4, 4, 86-100. the IBM acrith package. In Proceedings of the CODY, W. J. 1988. Floating-point standards–The- 7th IEEE Symposwm on Computer Arithmetic ory and practice. In Reliability in Computing: (Urbana, Ill.), pp. 322-331.

ACM Computing Surveys, Vol. 23, No. 1, March 1991 48 9 David Goldberg

KERNIGHAN, B. W., AND RITCHIE, D, M, 1978. The Precision Rational Arithmetic: Slash Number C Programmvzg Language. Prentice-Hall, En- Systems. IEEE Trans. Comput. C-34, 1,3-18. glewood Cliffs, NJ. REISER, J. F., AND KNUTH, D E. 1975. Evading KIRCHNER, R , AND KULISCH, U 1987 Arithmetic the drift in floating-point addition Inf. Pro- for vector processors. In Proceedings of the 8th cess. Lett 3, 3, 84-87 IEEE Symposium on Computer Arithmetic STERBETZ, P. H. 1974. Floatmg-Pomt Computa- (Como, Italy), pp. 256-269. tion, Prentice-Hall, Englewood Cliffs, N.J. KNUTH, D. E. 1981. The Art of Computer Pro- SWARTZLANDER, E. E , AND ALEXOPOULOS, G. 1975, gramming Addison-Wesley, Reading, Mass., The sign/logarithm number system, IEEE vol. II, 2nd ed. Trans Comput. C-24, 12, 1238-1242 KULISH, U. W., AND MIRAN~ER W L. 1986. The WALTHER, J, S. 1971. A umfied algorlthm for ele- Arithmetic of the Digital Computer: A new mentary functions. proceedings of the AFIP approach SIAM Rev 28, 1,1–36 Spring Jo,nt Computer Conference, pp. 379- MATULA, D. W., AND KORNERUP, P. 1985. Finite 385,

Received December 1988; final revision accepted March 1990

ACM Computmg Surveys, Vol. 23, No 1, March 1991