A Complete Axiómatization of Computer Arithmetic

We define an axiom system for rounded arithmetic to be complete if we can recover from any model of the axioms the exact algebra from whence it came. A complete set of axioms is given for rounded addition and multiplication. In some circles of numerical analysis, there is a deep suspicion that some of the scientific and engineering calculations being done by computer do not correspond to external reality. One cause of this unease is that computer arithmetic itself can be inexact. For example, we all know that ((a + b)2 (a2 + 2ab))/b2 is one, yet, in IBM single precision with a = 100 and b = .01, the result is around 39. In addition to this unavoidable consequence of rounding, it is also a sad fact that not all floating-point packages are free of mistakes. The addition routines on both the UNIVAC mainframe and the TRS-80 Color Computer (and probably many more) contain serious bugs. It is depressing that commerical incentives do not exist for manufacturers and firmware suppliers to improve their product. One method for dealing with some of these problems is to establish mathematical definitions of just what floating-point arithmetic should do. The IEEE has proposed standards incorporating such definitions, thus providing the computer industry with a scale against which it can measure its efforts. It is also hoped that, by formulating mathematical laws concerning computer arithmetic, we can produce a theory which will allow a greater degree of justified confidence in actual computations. The theory has not as yet progressed to the stage of having such useful implications. Knuth [1, p. 214] has given some laws for the algebra of computer arithmetic. Kulisch and Miranker [2] have carried out the project in more detail. Kulisch and Miranker also give efficient algorithms conforming to the IEEE standards. Neither of these sources consider the problem of giving a complete axiómatization. There are two causes of inaccuracy in computer arithmetic, rounding and overflow. In this preliminary research, I propose to simplify the problem by pretending that overflow does not exist. One justification for this is that overflow generally occurs rarely and when it does happen, the programmer is usually informed with a warning message. Rounding, on the other hand, occurs silently and invidiously on nearly every step of a numerical calculation. Future research will deal with combining the two sources of error. Within this limitation we will produce a complete axiómatization of rounded floating-point arithmetic. Of course, if any of this work is to be useful, the axioms should be simple enough for each comprehension. I am Received April 19, 1983; revised June 14, 1983. 1980 Mathematics Subject Classification. Primary 68B99, 68C99, 08A99, 03C99, 65G05. © 1984 American Mathematical Society 0025-5718/84 $1.00 + $.25 per page 623 License or copyright restrictions may apply to redistribution; see http://www.ams.org/journal-terms-of-use 624 RICHARD MANSFIELD afraid that this goal has not yet been achieved. We are instead bound by Einstein's maxim, "Be as simple as possible, but no simpler." Let R be an ordered field. A rounding function on R is a monotone projection, i.e., a function O mapping R into itself such that 0(0(x)) = 0(x), x^y implies O(x) < O(y), O(0) = 0: 0(1) = 1: 0(-x)= -0(x). Let S be the range of O and let + + and * * be the field operations of addition and multiplication. We can define corresponding operations on S by means of the equations, x+y = 0(x++y), x*y = 0(x* * y), for all x and y in S. The field R also bequeaths its order relation to S. The goal of this research is to give a complete set of axioms for the ordered algebra S. In logic the word complete has two standard meanings. In one sense, an axiom system is complete if it either proves or refutes every formula in a given language. This is not what is meant here. In our sense, an axiom set is complete for a given concept if it completely defines the concept as, for instance, the group axioms define the concept group. Some concepts such as "finite" or "Archimedian" are not axiomatizable. Our axioms will be complete in the sense that any model S for the theory can be extended to an ordered field with a rounding function as defined above. In other words, the above paragraphs define a model class, the class of rounded algebras, and we propose to axiomatize that class. Actually we start with a method for reconstructing the field from the algebra and then invent axioms to prove theorems we already know to be true. Our decision to sweep overflow under the rug determines our choice of the standard model for the theory. The intended model is to let 5 be the set of real numbers expressible with a mantissa of some fixed finite precision but an arbitrary integer exponent, e.g., all reals of the form m * 2" where n is an arbitrary integer but m is an integer of absolute value less than 224. The rounding function O is the standard rounding to the nearest screen point with the proviso that a number exactly half way between two screen points will not be hung up like the famous donkey but will round to the nearest odd mantissa. This condition is given in order to simplify some of our axioms. Using the convention, " When in doubt round up" would better conform to actual hardware but would further complicate an already complicated axiom set without requiring any new ideas. It is commonly believed that IBM uses truncation rather than rounding, but I am convinced that this is not so, at least for addition and subtraction. If hex 8 is used for the padded guard digit, IBM's method gives ordinary rounding. The role of the standard model in the ensuing theory is the central one of guarding the consistency of the axioms. All the axioms are meant to be true of this model. Of course this can easily be considered more of a hope than a guarantee. So far all the false axioms have proved to be correctable, some with more difficulty than others. In any list of over forty axioms there is bound to be some errors. License or copyright restrictions may apply to redistribution; see http://www.ams.org/journal-terms-of-use A COMPLETE AXIÓMATIZATION OF COMPUTER ARITHMETIC 62 5 Our plan is to first introduce axioms for the reconstruction of the additive group. Then further axioms will be introduced for multiplication and division. Our first group of axioms is essentially that of ordered groups without associativity. Remember that in all that follows + and * are the operations on S, and that these axioms refer to S. 1. x + y = y + x, 2. x ^ y implies x + z < y + z, 3. x < y implies —y < -x, A. x < y < z implies x < z, 5. x < y < x implies x = y, 6. x + 0 = x, 1. x + (-x) = 0. A crucial fact about the standard model is that there is a function r+(x, y) mapping S into S such that r+(x, y) + + (x + y) = x + + y. In fact Knuth [1, Theorem B, p. 220] proves that r+(x, y) is definable in the standard model. Let x' = (x + y) y and let y' = (x + y) x'. Then Knuth proves that r+(x,y) = (xx') + (y -y'). Note the lack of symmetry in the definition. In spite of this r+ must be commutative since both + and + + are commutative. We shall use the notation r(x + y) for r+(x, y), i.e., in the expression r(x + y), we consider x, y, and + to be separate variables. The main task before us is to axiomatize this function without reference to any structure external to S. Definition. x O and |u| < \y\ + \z\ implies (u + y) + x > O, 19. m «s u y » z is the weak normal form produced by the above process and that x, y, z are all nonzero. If x ^> y + z, then one application of RX2 produces normal form. The only way that i>»/ + zcan fail is that y is exactly halfway between x and its immediate neighbor and that z has the same sign as y. In that case, after doing RX2, an application of Rox changes x to its neighbor and changes the sign of y + z while decreasing its absolute value. In other words an application of E2 leaves nearly the same situation as we started with except that y is no longer exactly halfway between x and its neighbor. Thus another application of RX2 produces normal form. We can summarize this with an axiom: 20. D2E2RX2R0X = D2E2R]2. By the above discussion, this axiom implies that if (x, y, z) is a weak normal form then (x, y, z)E2Ru is a normal form. In the standard model, the normal form is unique. This implies that RX2D2E2RX2 = D2E2RX2 since s and sRX2 have the same normal form. We also know that if Xj <§e: Xj then Rtj has no effect on the sequence. This follows directly from the definition of r given by Knuth. We have another axiom: 21. RX2D2E2RX2 = D2E2Rn. This implies the uniqueness of normal form for three element sequences. For if sD is a normal form, then sDR = sD. Thus sDD2 = sD. On the other hand, axiom 21 implies that sDD2 = sD2, so we see that sD2 is the only normal form for s. We now turn to the general case, s = (x0,...,x„). The outline of this case is exactly the same as the three element case. To prove the first step that sDn is a weak normal form, it clearly suffices to prove that if (xQ,..., x„) is a weak normal form, then for any xn+x, (xQ,..., xn,xn+x)En+x is also a weak normal form. This easily follows from a Pacman argument. We start with the picture, License or copyright restrictions may apply to redistribution; see http://www.ams.org/journal-terms-of-use 628 RICHARD MANSFIELD This picture will be successively transformed through the following sequence by (See axioms 11, 15, 16, 17.) Let us now examine the process by which weak normal form is converted into normal form. Define D'n similarly to Dn except that in D'n each Ek is done twice, i.e., D'n = EXE2 ■ ■ ■ E2. The next lemma says that if j is a weak normal form of length n, then sD'n is a normal form. Lemma. // (x0,...,xn) is a normal form and xn+x «: xn, then (x0,...,x„,xn+x)En + xEn+x is a normal form. Proof. Let us set xn+x = u, and xn = x, and xn_, = y, and xn_2 = z. If u + x <@c y or even if (u + x) + y <ssc z, the lemma easily follows from the above discussion of three element sequences. In the standard model, the remaining case is somewhat special. We must have that u, x, y all have the same sign and « is a power of two and y is all ones and x, y, z are nestled together as close as possible. In that case we can prove the following two axioms by simple arithmetic. 22. u <: x <&zy; «se z implies (u + x) +y <: z, 23. u «: x <¡s:y <sk z impliesr((m + x) + y) <§£ r(((u + x)+y)+z). These two axioms clearly say that the lemma now follows by induction from the case « = n — 2. There is now a standard method for reducing any sequence to normal form. If í is a sequence of length n + 1, then sDnD'n is a normal form. We must now show that this normal form is unique, i.e., that any other sequence of reductions leading to a normal form must produce exactly the same result. This requires several lemmas. Let us define two weak normal forms, s and t, to be equivalent if there is a sequence of weak normal forms s0,..., sn with s0 = s and sn = t and having the property that for i < n, s i and si+ x differ at only two consecutive places and at those places they have the same sum and same residue, i.e., for /' < n there is ay such that s¡R -+1 = si+lRj J+1. We first show that if s is a one-step reduction of t (i.e. í = tR¡ i+x), then sDn and tD„ are equivalent weak normal forms. Since this proposition is already known to be true in the standard model, we can postulate its truth for sequences of length less than five. 24. R34D4D¡ = DAD¡. Lemma. If x + y = x' + y' and r(x + y) = r(x' + y') and (x0,..., xn) is a weak normal form, then (x0,..., xn, x, y)En+xEn+2 and (xQ,..., x„, x', y')En+xEn+2 are equivalent weak normal forms. License or copyright restrictions may apply to redistribution; see http://www.ams.org/journal-terms-of-use A COMPLETE AXIÓMATIZATION OF COMPUTER ARITHMETIC Proof. The pictoral representation of (x0,..., xn, x, y) is 629 The first step of En+, yields At this point we should add a to b, continuing the application of En+ x, but En+, will never again alter the value of c. Thus we may as well do the first step of E„ + 2 before proceeding with En + X. This gives We must now continue with the next step of En+,, but again this can be immediately followed by the next step of En+2. This advances the double pincer to Continuing, we see that (x0,..., xn, x, y) can be reduced to