Pseudo random number generation

This module provides Pseudo Random Number Generation and implements a number of base generator algorithms. Most are provided through a plug-in framework that adds essential features to the base generators.

PRNGs in general, and so the algorithms in this module, are mostly used for test and simulation. They are designed for good statistical quality and high generation speed.

A generator algorithm, for each iteration, takes a state as input and produces a raw pseudo random number and a new state to be used for the next iteration.

A particular state always produces the same number and new state. The initial state is produced from a seed. This makes it possible to repeat for example a simulation with the same random number sequence, by re-using the same seed. There are also the functions export_seed/0 and export_seed_s/1 that capture the PRNG state in an export_state/0, that can be used to start from a known state.

This property, and others, make the algorithms in this module unsuitable for cryptographical applications, but in the crypto module there are suitable generators, for this module's plug-in framework. See crypto:rand_seed_s/0 and crypto:rand_seed_alg_s/1.

At the end of this module documentation there are some niche algorithms that do not use this module's normal plug-in framework. They are useful for special purposes like fast generation when quality is not essential, for seeding other generators, and such.

Plug-in framework

The raw pseudo random numbers produced by the base generators are only appropriate in some cases such as power of two ranges less than the generator size, and some have quirks, for example weak low bits. Therefore, the Plug-in Framework implements a common API for all base generators, that add essential or useful funcionality:

• Keeping the generator state in the process dictionary.
• Automatic seeding.
• Seeding support for manual seeding to avoid common pitfalls.
• Generating integers with uniform distribution, in any range, without bias. The range is not limited; it may be larger than the base generator's size (but that costs some performance).
• Generating floating-point numbers with uniform distribution.
• Generating floating-point numbers with normal distribution, standard normal distribution or specified mean and variance.
• Generating any number of bytes.
• Jumping the generator ahead, in algorithms that support that.

Usage and examples

A generator has to be initialized. This is done by one of the seed/1 or seed_s/1 functions, which also select which algorithm to use. The seed/1 functions store the generator and state in the process dictionary, while the seed_s/1 functions only return the state, which requires the calling code to handle the state and updates to it.

The seed functions that do not have a Seed value as an argument create an automatic seed that should be unique to the created generator instance; see seed_s/1.

If an automatic seed is not desired, the seed functions that have a Seed argument can be used. The argument has 3 possible formats; see the seed/0 type description.

Plug-in framework API functions named with the suffix _s take an explicit state as the last argument and return the new state as the last element in the returned tuple. The process dictionary is not used.

Sibling functions without that suffix take an implicit state from and store the new state in the process dictionary, and only return their "interesting " output value. If the process dictionary does not contain a state, seed(default) is implicitly called to create an automatic seed for the default algorithm as initial state.

Usage

First initialize a generator by calling one of the seed functions, which also selects a PRNG algorithm.

Then call a Plug-in framework API function either with an explicit state from the seed function and use the returned new state in the next call, or call an API function without an explicit state argument to operate on the state in the process dictionary.

Shell Examples

%% Generate two uniformly distibuted floating point numbers.
%%
%% By not calling a [seed](`seed/1`) function, this uses
%% the generator state and algorithm in the process dictionary.
%% If there is no state there, [`seed(default)`](`seed/1`)
%% is implicitly called first:
%%
1> R0 = rand:uniform(),
   is_float(R0) andalso 0.0 =< R0 andalso R0 < 1.0.
true
2> R1 = rand:uniform(),
   is_float(R1) andalso 0.0 =< R1 andalso R1 < 1.0.
true

%% Generate a uniformly distributed integer in the range 1 .. 4711:
%%
3> K0 = rand:uniform(4711),
   is_integer(K0) andalso 1 =< K0 andalso K0 =< 4711.
true

%% Generate a binary with 16 bytes, uniformly distributed:
%%
4> B0 = rand:bytes(16),
   byte_size(B0) == 16.
true

%% Select and initialize a specified algorithm,
%% with an automatic default seed, then generate
%% a floating point number:
%%
5> rand:seed(exro928ss).
6> R2 = rand:uniform(),
   is_float(R2) andalso 0.0 =< R2 andalso R2 < 1.0.
true

%% Select and initialize a specified algorithm
%% with a specified seed, then generate
%% a floating point number:
%%
7> rand:seed(exro928ss, 123456789).
8> R3 = rand:uniform().
0.48303622772415256

%% Select and initialize a specific algorithm,
%% with an automatic default seed, using the functional API
%% with explicit generator state, then generate
%% two floating point numbers.
%%
9>  S0 = rand:seed_s(exsss).
10> {R4, S1} = rand:uniform_s(S0),
    is_float(R4) andalso 0.0 =< R4 andalso R4 < 1.0.
true
11> {R5, S2} = rand:uniform_s(S1),
    is_float(R5) andalso 0.0 =< R5 andalso R5 < 1.0.
true
%% Repeat the first after seed
12> {R4, _} = rand:uniform_s(S0).

%% Generate a standard normal distribution number
%% using the built-in fast Ziggurat Method:
%%
13> {SND0, S3} = rand:normal_s(S2),
    is_float(SND0).
true

%% Generate a normal distribution number
%% with mean -3 and variance 0.5:
%%
14> {ND0, S4} = rand:normal_s(-3, 0.5, S3),
    is_float(ND0).
true

%% Generate a textbook basic form Box-Muller
%% standard normal distribution number, which has the same
%% distribution as the built-in Ziggurat method above,
%% but is much slower:
%%
15> R6 = rand:uniform_real(),
    is_float(R6) andalso 0.0 < R6 andalso R6 < 1.0.
true
16> R7 = rand:uniform(),
    is_float(R7) andalso 0.0 =< R7 andalso R7 < 1.0.
true
%% R6 cannot be equal to 0.0 so math:log/1 will never fail
17> SND1 = math:sqrt(-2 * math:log(R6)) * math:cos(math:pi() * R7).

%% Shuffle a deck of cards from a fixed seed,
%% with a cryptographically unpredictable algorithm:
18> Deck0 = [{Rank,Suit} ||
     Rank <- lists:seq(2, 14),
     Suit <- [clubs,diamonds,hearts,spades]]
19> S5 = crypto:rand_seed_alg(crypto_aes, "Nothing up my sleeve")
20> {Deck, S6} = rand:shuffle_s(Deck0, S5).
21> Deck.
[{2,spades},    {12,spades},   {14,diamonds}, {11,clubs},
 {6,spades},    {2,hearts},    {13,diamonds}, {12,hearts},
 {10,clubs},    {7,diamonds},  {2,diamonds},  {9,diamonds},
 {4,hearts},    {9,hearts},    {6,clubs},     {3,spades},
 {3,diamonds},  {14,clubs},    {9,spades},    {10,hearts},
 {3,hearts},    {4,spades},    {13,hearts},   {5,hearts},
 {7,hearts},    {7,clubs},     {8,spades},    {14,spades},
 {11,spades},   {12,clubs},    {5,diamonds},  {12,diamonds},
 {4,diamonds},  {9,clubs},     {14,hearts},   {2,clubs},
 {10,diamonds}, {13,spades},   {6,hearts},    {4,clubs},
 {7,spades},    {5,spades},    {10,spades},   {5,clubs},
 {8,diamonds},  {6,diamonds},  {8,clubs},     {11,hearts},
 {13,clubs},    {11,diamonds}, {3,clubs},     {8,hearts}]

Algorithms

The base generator algorithms implement the Xoroshiro and Xorshift algorithms by Sebastiano Vigna. During an iteration they generate an integer (at least 58-bit) and operate on a state of several integers. The size of these integers is chosen to not require bignum arithmetic on 64-bit platforms, which facilitates fast integer operations, in particular when handled by the JIT VM.

For most algorithms, jump functions are provided for generating non-overlapping sequences. A jump function perform a calculation equivalent to a large number of repeated state iterations, but execute in a time roughly equivalent to one regular iteration per generator bit.

By using a jump function instead of starting several generators from different seeds it is assured that the generated sequences do not overlap. The alternative of using different seeds may accidentally start the generators in sequence positions that are close to each other, but a jump function jumps to a sequence position very far ahead.

To create numbers with normal distribution the Ziggurat Method by Marsaglia and Tsang is used on the output from a base generator.

The following algorithms are provided:

• exsss, the default algorithm (Since OTP 22.0)
  Xorshift116**, 58 bits precision and period of 2^116-1.

  Jump function: equivalent to 2^64 calls.

  This is the Xorshift116 generator combined with the StarStar scrambler from the 2018 paper by David Blackman and Sebastiano Vigna: Scrambled Linear Pseudorandom Number Generators

  The generator does not use 58-bit rotates so it is faster than the Xoroshiro116 generator, and when combined with the StarStar scrambler it does not have any weak low bits like exrop (Xoroshiro116+).

  Alas, this combination is about 10% slower than exrop, but despite that it is the default algorithm thanks to its statistical qualities.

• exro928ss (Since OTP 22.0)
  Xoroshiro928**, 58 bits precision and a period of 2^928-1.

  Jump function: equivalent to 2^512 calls.

  This is a 58 bit version of Xoroshiro1024**, from the 2018 paper by David Blackman and Sebastiano Vigna: Scrambled Linear Pseudorandom Number Generators that on a 64 bit Erlang system executes only about 40% slower than the default exsss algorithm but with much longer period and better statistical properties, but on the flip side a larger state.

  Many thanks to Sebastiano Vigna for his help with the 58 bit adaption.

• exrop (Since OTP 20.0)
  Xoroshiro116+, 58 bits precision and period of 2^116-1.

  Jump function: equivalent to 2^64 calls.

• exs1024s (Since OTP 20.0)
  Xorshift1024*, 64 bits precision and a period of 2^1024-1

  Jump function: equivalent to 2^512 calls.

  Since this generator operates on 64-bit integers that are bignums on 64 bit platforms, it is much slower than exro928ss above.

• exsp (Since OTP 20.0)
  Xorshift116+, 58 bits precision and period of 2^116-1

  Jump function: equivalent to 2^64 calls.

  This is a corrected version of a previous default algorithm (exsplus, deprecated), that was superseded by Xoroshiro116+ (exrop). Since this algorithm does not use rotate operations it executes a little (say < 15%) faster than exrop (that has to do a 58 bit rotate, for which there is no native instruction). See the algorithms' homepage.

Default Algorithm

The current default algorithm is exsss (Xorshift116**). If a specific algorithm is required, ensure to always use seed/1 to initialize the state.

In many API functions in this module, the atom default can be used instead of an algorithm name, and is currently an alias for exsss. In a future Erlang/OTP release this might be a different algorithm. The default algorithm is selected to be one with high speed, small state and "good enough" statistical properties.

If it is essential to reproduce the same PRNG sequence on a later Erlang/OTP release, use seed/2 or seed_s/2 to select both a specific algorithm and the seed value.

Old Algorithms

Undocumented (old) algorithms are deprecated but still implemented so old code relying on them will produce the same pseudo random sequences as before.

Quality of the Generated Numbers

For all these generators except exro928ss and exsss the lowest bit(s) have got a slightly less random behaviour than all other bits. 1 bit for exrop (and exsp), and 3 bits for exs1024s. See for example this explanation in the Xoroshiro128+ generator source code:

Beside passing BigCrush, this generator passes the PractRand test suite up to (and included) 16TB, with the exception of binary rank tests, which fail due to the lowest bit being an LFSR; all other bits pass all tests. We suggest to use a sign test to extract a random Boolean value.

If this is a problem; to generate a boolean with these algorithms, use something like this:

(rand:uniform(256) > 128) % -> boolean()

((rand:uniform(256) - 1) bsr 7) % -> 0 | 1

For a general range, with N = 1 for exrop, and N = 3 for exs1024s:

(((rand:uniform(Range bsl N) - 1) bsr N) + 1)

The floating point generating functions in this module waste the lowest bits when converting from an integer so they avoid this snag.

Niche algorithms

The niche algorithms API contains special purpose algorithms that do not use the plug-in framework, mainly for performance reasons.

Since these algorithms lack the plug-in framework support, generating numbers in a range other than the base generator's range may become a problem.

There are at least four ways to do this, assuming the Range is less than the generator's range:

• Modulo
  To generate a number V in the range 0 .. Range-1:

  Generate a number X.
  Use V = X rem Range as your value.

  This method uses rem, that is, the remainder of an integer division, which is a slow operation.

  Low bits from the generator propagate straight through to the generated value, so if the generator has got weaknesses in the low bits this method propagates them too.

  If Range is not a divisor of the generator range, the generated numbers have a bias. Example:

  Say the generator generates a byte, that is, the generator range is 0 .. 255, and the desired range is 0 .. 99 (Range = 100). Then there are 3 generator outputs that produce the value 0, these are 0, 100 and 200. But there are only 2 generator outputs that produce the value 99, which are 99 and 199. So the probability for a value V in 0 .. 55 is 3/2 times the probability for the other values 56 .. 99.

  If Range is much smaller than the generator range, then this bias gets hard to detect. The rule of thumb is that if Range is smaller than the square root of the generator range, the bias is small enough. Example:

  A byte generator when Range = 20. There are 12 (256 div 20) possibilities to generate the highest numbers and one more to generate a number V < 16 (256 rem 20). So the probability is 13/12 for a low number versus a high. To detect that difference with some confidence you would need to generate a lot more numbers than the generator range, 256 in this small example.

• Truncated multiplication
  To generate a number V in the range 0 .. Range-1, when you have a generator with a power of 2 range (0 .. 2^Bits-1):

  Generate a number X.
  Use V = X * Range bsr Bits as your value.

  If the multiplication X * Range creates a bignum this method becomes very slow.

  High bits from the generator propagate through to the generated value, so if the generator has got weaknesses in the high bits this method propagates them too.

  If Range is not a divisor of the generator range, the generated numbers have a bias, pretty much as for the Modulo method above.

• Shift or mask
  To generate a number in a power of 2 range (0 .. 2^RBits-1), when you have a generator with a power of 2 range (0 .. 2^Bits):

  Generate a number X.
  Use V = X band ((1 bsl RBits)-1) or V = X bsr (Bits-RBits) as your value.

  Masking with band preserves the low bits, and right shifting with bsr preserves the high, so if the generator has got weaknesses in high or low bits; choose the right operator.

  If the generator has got a range that is not a power of 2 and this method is used anyway, it introduces bias in the same way as for the Modulo method above.

• Rejection

  Generate a number X.
  If X is in the range, use it as your value, otherwise reject it and repeat.

  In theory it is not certain that this method will ever complete, but in practice you ensure that the probability of rejection is low. Then the probability for yet another iteration decreases exponentially so the expected mean number of iterations will often be between 1 and 2. Also, since the base generator is a full length generator, a value that will break the loop must eventually be generated.

These methods can be combined, such as using the Modulo method and only if the generator value would create bias use Rejection. Or using Shift or mask to reduce the size of a generator value so that Truncated multiplication will not create a bignum.

The recommended way to generate a floating point number (IEEE 745 Double, that has got a 53-bit mantissa) in the range 0 .. 1, that is 0.0 =< V < 1.0 is to generate a 53-bit number X and then use V = X * (1.0/((1 bsl 53))) as your value. This will create a value of the form N*2^-53 with equal probability for every possible N for the range.