The Intel Pentium
Division Flaw
Alan Edelman
Department of Mathematics
Laboratory for Computer Science
Massachusetts Institute of Technology
MIT
Not So Well Known
The bug itself is
(mathematically)
neat!
A Lesson (for me anyway)
So much incomplete
information is out there.
MIT
Interesting Related Topics
(but my topic is the bug)
 Risk
to Pentium owners
 Intel’s chip replacement blunder
 Kahan’s SRT division tester
 Moler, Coe, and Mathisen software
workaround
 Only the lawyers get rich
 Those ubiquitous Pentium jokes
MIT
Outline
 Nicely’s
Discovery
 Computer Science Prerequisites
 Division (SRT=Sweeney,Robertson,Tocher)
 Pentium Lookup Table
 Division Example
 Six Ones Result
Inequality Analysis
“Send More Money” Puzzle
 Always
nearly five good digits
MIT
Nicely’s Twin Prime Bug Discovery
 Twin
primes: (5,7) (11,13) (17,19) (29,31) ...
 Nicely was summing twin prime reciprocals:
 S = 1/5 + 1/ 7 + 1/11 + 1/13 + 1/17 + 1/19 +
...
 S is finite.
 Nicely computed on many platforms.
 Nicely checked his work.
MIT
Computer Science Prerequisites
 Carry
Save Addition.
 One’s vs. Two’s Complement.
MIT
Carry-save Addition
12
21
+ 19
52
MIT
Carry-save Addition
12
21
+ 19
52
20
Answer (mod 32)
MIT
Carry-save Addition
12
21
+ 19
52
20
01100
10101
+ 10011
10100
Answer (mod 32)
MIT
Carry-save Addition
12
21
+ 19
52
20
01100
10101
+ 10011
10100
01100
+ 10101
1 Sum Bits (s)
0 Carry Bits (c)
Answer (mod 32)
MIT
Carry-save Addition
12
21
+ 19
52
20
01100
10101
+ 10011
10100
01100
+ 10101
1 Sum Bits (s)
0 Carry Bits (c)
Answer (mod 32)
s = xyz = x+y+z (mod 2)
c = xy  xz  yz = (x+y+z | 2)
MIT
Carry-save Addition
12
21
+ 19
52
20
01100
10101
+ 10011
10100
01100
+ 10101
01 Sum Bits (s)
00 Carry Bits (c)
Answer (mod 32)
s = xyz = x+y+z (mod 2)
c = xy  xz  yz = (x+y+z | 2)
MIT
Carry-save Addition
12
21
+ 19
52
20
01100
10101
+ 10011
10100
01100
+ 10101
11001 Sum Bits (s)
01000 Carry Bits (c)
Answer (mod 32)
s = xyz = x+y+z (mod 2)
c = xy  xz  yz = (x+y+z | 2)
MIT
Carry-save Addition
12
21
+ 19
52
20
01100
10101
+ 10011
10100
01100
+ 10101
11001 Sum Bits (s)
01000 Carry Bits (c)
+10011
Answer (mod 32)
s = xyz = x+y+z (mod 2)
c = xy  xz  yz = (x+y+z | 2)
MIT
Carry-save Addition
12
21
+ 19
52
20
01100
10101
+ 10011
10100
Answer (mod 32)
01100
+ 10101
11001
01000
+10011
00010
10010
Sum Bits (s)
Carry Bits (c)
Sum Bits (s)
Carry Bits (c)
s = xyz = x+y+z (mod 2)
c = xy  xz  yz = (x+y+z | 2)
MIT
One’s vs. Two’s Complement
Two’s Complement
3
00011
2
1
0
-1
-2
-3
00010
00001
00000
11111
11110
11101
MIT
One’s vs. Two’s Complement
Two’s Complement
One’s Complement
3
00011
00011
2
1
0
-1
-2
-3
00010
00001
00000
11111
11110
11101
00010
00001
00000
11110
11101
11100
MIT
One’s vs. Two’s Complement
Two’s Complement
One’s Complement
3
00011
00011
2
1
0
-1
-2
-3
00010
00001
00000
11111
11110
11101
00010
00001
00000
11110
11101
11100
MIT
 Division Algorithms:
MIT
Long Division Example
1.42857
710.00000
7
30
28
20
14
60
MIT
Long Division Example
q0
q1q2q3q4q5
1.42857
710.00000
7
30
28
20
14
60
Chosen to satisfy
usual inequalities
MIT
Long Division Example
p = 10, d = 7
10d = 70
pk+1 = 10(pk–qkd)
0 ≤ pk+1 < 70
q0
q1q2q3q4q5
1.42857
710.00000
7
30
28
20
14
60
p0
p1
p2
p3
MIT
Long Division Radix 10
Compute q = p / d.
p0 := p
for k=0,1,...
Find the digit qk {0, 1, 2, …, 9} such that
pk+1 := 10(pk - qk d) satisfies pk +1 [0, 10)d
end

q = p / d =S q i / 10 i
i=0
MIT
SRT Division Radix 4
Compute q = p / d.
p0 := p
for k=0,1,...
Look up a digit qk -2,-1,0,1,2}such that
pk+1 := 4(pk - qk d) satisfies|pk +1|≤ (8/3)d
end

q = p / d =S q i / 4 i
i=0
Such qk exists?
Algorithm correct?
MIT
Such qk exists?
Given 1p,d<2. Compute q=p/d.
p0 := p
for k=0,1,...
Look up a digit qk -2,-1,0,1,2}such that
pk+1 := 4(pk - qk d) satisfies|pk +1|≤ (8/3)d
end

q = p/d =S i=0
8 d
3
qk := –2
qi / 4i
2d
3
qk := –1
qk := 0
2 d
3
qk := +1
qk := +2
8d
3
MIT
Such qk exists?
Given 1p,d<2. Compute q=p/d.
p0 := p
for k=0,1,...
Look up a digit qk -2,-1,0,1,2}such that
pk+1 := 4(pk - qk d) satisfies|pk +1|≤ (8/3)d
end
q = p/d =S
8 d
3
∞
q i / 4i
i=0
2d
3
qk := 0
4(pk - 0)
-2 / 3d ≤ pk ≤ 2 / 3d
pk+1 := 4(pk - 0)
2 d
3
8d
3
MIT
Such qk exists?
Given 1p,d<2. Compute q=p/d.
p0 := p
for k=0,1,...
Look up a digit qk -2,-1,0,1,2}such that
pk+1 := 4(pk - qk d) satisfies|pk +1|≤ (8/3)d
end
q = p/d =S

qi / 4i
i=0
8 d
3
4 / 3d ≤ pk ≤ 8 / 3d
pk+1 := 4(pk - 2d)
qk := +2
4 d
3
8d
3
MIT
Such qk exists?
Given 1p,d<2. Compute q=p/d.
p0 := p
for k=0,1,...
Look up a digit qk -2,-1,0,1,2}such that
pk+1 := 4(pk - qk d) satisfies|pk +1|≤ (8/3)d
end
q = p/d =S
8 d
3

qi / 4i
i=0
2d
3
4/3 ≤ pk ≤ 8/3
pk+1 := 4(pk - 2d)
pk - 2d
2 d
3
qk := +2
8d
3
MIT
Such qk exists?
Given 1p,d<2. Compute q=p/d.
p0 := p
for k=0,1,...
Look up a digit qk -2,-1,0,1,2}such that
pk+1 := 4(pk - qk d) satisfies|pk +1|≤ (8/3)d
end
q = p/d =S
8 d
3

qi / 4i
i=0
2d
3
pk - 2d
4(pk - 2d)
4 / 3d ≤ pk ≤ 8 / 3d
pk+1 := 4(pk - 2d)
2 d
3
qk := +2
8d
3
MIT
A qk For Every Point
8 d
3
qk := –2
2d
3
qk := –1
qk := 0
2 d
3
qk := +1
qk := +2
8d
3
MIT
Algorithm Correct?
Claim:
p
q1
qk-1 pk -k
— = q0 + — + . . . + –––
+ –— 4
k-1
d
4
4
d
Proof by Induction:
pk+1 = 4(pk - qkd) 
pk -k qk pk+1 -(k+1)
— 4 = —k + —— 4
d
4
d
MIT
Algorithm Correct?
Claim:
p
q1
qk-1 qk pk+1 -(k+1)
— = q0 + — + . . . + –––
+ —k + ––— 4
k-1
d
4
4
4
d
Proof by Induction:
pk+1 = 4(pk - qkd) 
pk -k qk pk+1 -(k+1)
— 4 = —k + —— 4
d
4
d
MIT
Algorithm Correct?
Claim:
p
q1
qk-1 qk pk+1 -(k+1)
— = q0 + — + . . . + –––
+ —k + ––— 4
k-1
d
4
4
4
d
Proof by Induction:
pk+1 = 4(pk - qkd) 
pk -k qk pk+1 -(k+1)
— 4 = —k + —— 4
d
4
d
Letting k proves
p
q1 q2
— = q0 + — + —2 + . . .
d
4
4
MIT
Pentium Lookup Table (P-d plot)
0101.000
Green
q := 2
1/16
0011.000
Blue
q := 1
0010.000
0001.000
0000.000
q := 0
1111.000
1110.000
q := -1
1101.000
1100.000
q:= -2
1011.000
1.0000
1.0001
1.0010
1.0011
1.0100
1.0101
1.0110
1.0111
1.1000
1.1001
1.1010
1.1011
1.1100
1.1101
1.1110
1.1111
1/8
Shifted Partial Remainder
0100.000
Divisor
MIT
Pentium Lookup Table (P-d plot)
0101.000
Green
q := 2
1/16
0011.000
Blue
q := 1
0010.000
0001.000
0000.000
q := 0
1111.000
1110.000
q := -1
1101.000
1100.000
q:= -2
1011.000
1.0000
1.0001
1.0010
1.0011
1.0100
1.0101
1.0110
1.0111
1.1000
1.1001
1.1010
1.1011
1.1100
1.1101
1.1110
1.1111
1/8
Shifted Partial Remainder
0100.000
Divisor
MIT
A Close-up Look at One Column (D=1.0001)
P
2.875
1.5
1.375
0.375
0.25
-0.5
-0.625
-1.625
-1.75
-3
2
1
0
-1
-2
MIT
A Close-up Look at One Column (D=1.0001)
P
2.875
1.5
1.375
0.375
0.25
-0.5
-0.625
-1.625
-1.75
-3
2
1
0
-1
-2
0
0
0
0
2
2
2
2
2
2
2
2
2
2
3.375
3.25
3.125
3
2.875
2.75
Off the Chart
Off the Chart
Off the Chart
Off the Chart
Buggy Entry
Foothold
MIT
Pentium Division Example: 1.875/1.000
1.875 =
{
0001.111 00000000000 S
0000.000 00000000000 C
qk:=–2
qk:=0
qk:=+2
qk:=–1
qk:=+1
pk+1 := 4(pk – qkd)
MIT
Pentium Division Example: 1.875/1.000
0001.111
1.875 = 0000.000
– 21 = 1101.111
qk:=–2
qk:=0
qk:=+2
qk:=–1
qk:=+1
1100.000
-0.125 = 0011.110
{
{
pk+1 := 4(pk – qkd)
00000000000
00000000000
11111111111
11111111111
00000000001
S
C
S
C
MIT
Pentium Division Example: 1.875/1.000
0001.111
1.875 = 0000.000
– 21 = 1101.111
qk:=–2
qk:=0
qk:=+2
qk:=–1
qk:=+1
0000.011
-0.1254 = -0.5 = 1111.000
{
{
pk+1 := 4(pk – qkd)
00000000000
00000000000
11111111111
11111111100
00000000100
S
C
S
C
MIT
Pentium Division Example: 1.875/1.000
0001.111
1.875 = 0000.000
–21 = 1101.111
0000.011
1111.000
– –11 = 0001.000
1001.111
1000.000
{
qk:=–2
qk:=0
qk:=+2
qk:=–1
qk:=+1
pk+1 := 4(pk – qkd)
00000000000
00000000000
11111111111
11111111100
00000000100
00000000000
11111100000
00000100000
S
C
S
C
S
C
MIT
Pentium Division Example: 1.875/1.000
1.875 =
qk:=–2
qk:=0
qk:=+2
qk:=–1
qk:=+1
{
–21 =
– –11 =
–21 =
–01 =
0001.111
0000.000
1101.111
0000.011
1111.000
0001.000
1001.111
1000.000
1101.111
0000.000
1111.111
0000.000
1111.111
0000.000
00000000000
00000000000
11111111111
11111111100
00000000100
00000000000
11111100000
00000100000
11111111111
00011111100
11100000100
00000000000
11111100000
00000100000
2/1 + –1/4 + 2/16 + 0/64 = 1.875/1.000
S
C
S
C
S
C
S
C
S
C
MIT
Inequality Analysis
Pk ≤ pk ≤ Pk + 1/4
D ≤ d ≤ D+  D + 1/16
Pk+1 = 4(Pk – qkD+) + Rk



Rk ≤ RkMax
3/4 if qk = –2
3/4 if qk = –1
3/4 if qk = 0
1 if qk = 1
5/4 if qk = 2
MIT
Reaching the Flaw is Not Easy!
qk
–2
–1
0
1
P < P
- 1/8
k
bad
2
 Pk = Pbad - 1/8
Pk+1
≤ Pbad - 1/8
≤ Pbad - 1/8
< Pbad - 1/8
< Pbad - 1/8
≤ Pbad - 1/8
≤ Pbad
MIT
buggy entry
foothold
MIT
“Send More Money” Puzzle
intel
22 Mission College Blvd.
Santa Clara, CA 95052
32¢
Massachusetts Institue of Technology
77 Massachusetts Ave.
Cambridge, MA 02139
SEND
+MORE
MONEY
MIT
The Path to Failure



Bad Divisors: d = 1.d1d2d3d4111111d11…
six ones
q = –2
q=2
bug
.. . . 1
.. . . 1
.d2d3d41
.. 1 1 1
.1 1 1 1
.d2d3d40
.. 0 0 0
.1 1 1 .
1
1
1
1
1
0
1 11
111
1 11
1
1
0
MIT
At Least Nine Steps to Failure
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
........................
.00000000000000000000000
........................
........................
........................
........................
........................
........................
........................
........................
........................
........................
........................
........................
........................
....11111...............
....11111...............
.....1111...............
MIT
At Least Nine Steps to Failure
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
...................1....
.00000000000000000000000
...................1....
................1.......
................1.......
................1.......
.............11.........
.............11.........
.............11.........
..........111...........
..........111...........
..........111...........
.......1111.............
.......1111.............
.......1111.............
....11111...............
....11111...............
.....1111...............
MIT
At Least Nine Steps to Failure
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
...................1....
.00000000000000000000000
...................1....
................10......
................11......
................11......
.............110........
.............111........
.............111........
..........1110..........
..........1111..........
..........1111..........
.......11110............
.......11111............
.......11111............
....111110..............
....11111...............
.....1111...............
MIT
At Least Nine Steps to Failure
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
...................11111
.00000000000000000000000
...................11111
................100000..
................11111...
................11111...
.............110000.....
.............11111......
.............11111......
..........111000........
..........11111.........
..........11111.........
.......111100...........
.......11111............
.......11111............
....111110..............
....11111...............
.....1111...............
MIT
Conclusions
 Mathematical
analysis is possible.
 Bug is more subtle and more interesting
than most people realize.
 One should not be so quick to laugh at
Intel’s Expense.
MIT
Thanks to Teddy Slottow for his technical
assistance in preparing this presentation
MIT