Computer Physics Communications 175 (2006) 25–29

www.elsevier.com/locate/cpc

Parallel use of multiplicative congruential random number generators

Pei-Chi Wu a, Kuo-Chan Huang b,∗

a Department of Computer Science and Information Engineering, National Penghu Institute of Technology, 300 Liu-Ho Road, Makung, Penghu 880, Taiwanb Department of Electronic Commerce, Hsing Kuo University, No. 89, Yuying Street, Tainan, Taiwan

Received 6 May 2002; accepted 13 August 2004

Available online 2 May 2006

Abstract

On parallel processors or in distributed computing environments, generating and sharing one stream of random numbers for all parallel process-ing elements is usually impractical. A more attractive method is to allow each processing element to generate random numbers independently.This paper investigates parallel use of multiplicative congruential generators. We analyze the leapfrog, the regular spacing, and the random spac-ing methods. Our results show: (1) The leapfrog method can result in multipliers of low spectral values. (2) In the random spacing method, theminimal distance between n substreams is only 1/n2 of cycle length in average. (3) The regular spacing method can result in strong correlationbetween substreams if the starting points αj x0 (mod m) are poorly selected. We then suggest selecting multiplier a and factor α based on theirk-dimensional spectral values and the minimal distance between substreams of these generators.© 2006 Elsevier B.V. All rights reserved.

Keywords: Multiplicative congruential random number generators; Parallel computing; Spectral test; Monte Carlo simulation

1. Introduction

Various high-performance computing systems now providemore computing power to solve large-scale scientific simula-tions by running one simulation job in parallel. A commonpart of these simulations is generating pseudo-random numbers.This part usually consumes a significant portion of the comput-ing time and should also be done in parallel.

A sequence of random numbers from a generator is usuallyrecursively defined. For example, the sequence of a linear con-gruential generator is defined by

(1)xi = a · xi−1 + c mod m;the sequence of a multiplicative congruential generator is de-fined by

(2)xi = a · xi−1 mod m,

a linear congruential generator with c = 0. A typical selectionof a and m is a = 16807 and m = 231 − 1 [15]; another choice

* Corresponding author.E-mail addresses: pcwu@npit.edu.tw (P.-C. Wu),

kchuang@mail.hku.edu.tw (K.-C. Huang).

0010-4655/$ – see front matter © 2006 Elsevier B.V. All rights reserved.doi:10.1016/j.cpc.2004.08.009

is m being a power of two, e.g., m = 248. Although the abovedefinitions seem to be sequential, highly vectorized codes canbe obtained [1]. All such codes generate one stream (an array)of random numbers, which then are consumed one by one ina simulation job.

On parallel processors or in distributed computing environ-ments, generating and sharing one stream of random numbersfor all parallel processing elements (processors or computers)is usually impractical. The communication cost between twoparallel processing elements may be higher than the cost of gen-erating one random number in one processing element. A moreattractive method is to allow each processing element to gener-ate random numbers independently. Discussions on these alter-natives can be found in the literature [1,7,8]. However, strongcorrelations have been observed in the numbers generated fromparallel uses of random number generators [3,4,6,9]. Durst [7]suggested that for troublesome applications ad hoc improve-ment techniques such as shuffling should be used to improvethe quality of the numbers generated from parallel use of linearcongruential generators.

The parallel use of multiplicative congruential generatorsneeds to be verified carefully. In this paper we analyze theleapfrog [2], the random spacing [7], and the regular spacing [7]

26 P.-C. Wu, K.-C. Huang / Computer Physics Communications 175 (2006) 25–29

methods. Our results show: (1) The leapfrog method can re-sult in multipliers of low spectral values and should be usedwith care. (2) In the random spacing method, the minimal dis-tance is only 1/n2 of the cycle length in average. This methodthus limits the size of n. (3) The regular spacing method resultsin strong correlation between substreams if the starting pointsαjx0 (mod m) are poorly selected. We then suggest selectingmultiplier a and factor α based on their k-dimensional spectralvalues [13] and the minimal distance between n substreams ofthese generators for n = 4,8,16, and 32.

This paper uses the spectral and empirical tests commonlyused in the literature to analyze basic statistical properties ofthe random number generators. Generators failing these testssurely should not be used in practical simulations. However,those generators that pass the tests are not guaranteed to besafe. Actually research as in [21] has pointed out that some os-tensibly high quality generators passing a battery of statisticaltests result in systematic errors for some algorithms in practicalsimulations. Since for different simulated problems the ran-dom number sequences may affect the simulations in differentways, there could not be one simple test method to make surea generator’s quality for all possible simulations. Therefore, assuggested in [21], to confidently use a generator in a simulation,it had better being first tested with some cases of the problem tosimulate which have exact answers to compare with, no matterwhat mathematical tests it has passed.

2. Related work

For parallel use of linear congruential generators, there aretwo major alternatives:

(1) A common generator with multiple output substreams:A simple way of doing this is to use a common multiplier a

and n starting points (seeds) [s0, s1, . . . , sn−1]. These startingpoints may be regularly selected. For example, consider themultiplicative generator defined in Eq. (2). Let

(3)sj = αjx0 (mod m), j = 0 . . . n − 1.

The number α can be selected as ad (mod m), where d is thedistance between two starting points. Because the distance d

is fixed, this method is called regular spacing in [7]. Konigesand Leith [14] suggested using d = 320 (mod m) for m = 248.De Matteis and Pagnutti [6] proposed a correlation control es-timator r , computed at the end of each simulation, to guard thecorrelation in the random numbers consumed. Another alterna-tive is the leapfrog method [2]. All substreams of the n-stepleapfrog generator are generated using the following (common)equation

(4)xi = an · xi−1 mod m,

but with n different starting points [x0, ax0, a2x0, . . . , a

n−1x0].Koniges and Leith [14] hinted that the leapfrog method maycontain a lesser number of intersequence correlations. They fo-cused mainly on multiplicative generators with moduli in pow-ers of two.

(2) A separate generator for each processing element. Thisapproach uses many generators that are “good” and mutually

independent. The number of generators needed increases whenthe number of parallel processing elements increases. Freder-ickson et al. [12] introduced the concept of the Lehmer tree.The tree is defined by the two linear congruential generators:

(5)L(x) = aLx + cL mod m and R(x) = aRx + cR mod m.

For m = 2β and proper selections of L(x) and R(x), the leftstream evenly divides the right stream into m/2k disjoint sub-streams. However, many authors [2,8,14] noted that these dis-joint substreams are strongly correlated.

Percus and Kalos [16] proposed a series of linear congruen-tial generators:

(6)xn,i = a · xn−1,i + ci mod m,

where a is a “good” common multiplier for all these gener-ators. They proposed a (modified) spectral test for two linearcongruential generators (for the original spectral test, see [13]).They showed how to obtain a series of ci that passes the mutualtwo-dimensional spectral test. However, De Matteis and Pag-nutti [3] showed that a series of linear congruential generatorswith a common multiplier a and different additive constants ci

produces just one independent stream. Durst [7] discussed ap-plying a different multiplier to each substream. Although thereare many good multipliers for modulus like 248 [11], the diffi-culty of this approach is the lack of theory for the interdepen-dency of a set of multipliers.

Due to the lack of a theoretical base, we will not pursuethe second approach further in this paper. The following sec-tions focuses on the first approach, i.e. Eqs. (3) and (4). Thereare also variations of these methods, e.g., the random spac-ing method [7], which randomly selects starting points, and therandom leaps method [8], which uses a second generator to de-termine the step-size for the next random number. The randomleaps method takes more computation time, but no theoreti-cal analysis that shows its superiority is available. The randomspacing method will be discussed in Section 4.

3. Analysis of the leapfrog method

This section presents an analysis of the leapfrog method formultiplicative generators with moduli in prime or in a power oftwo. Consider the leapfrog method shown in Eq. (4). It providesn separate substreams. The new multiplier an should meet thefollowing typical criteria: (1) the resulting generator producesthe maximal cycle length, and (2) the resulting generator hasgood spectral values. We discuss two types of multiplicativegenerators: prime modulus and powers of two. Our results showthat multipliers an that meet the above criteria are not easy tofind. Thus, the leapfrog method should be used with care.

3.1. Prime modulus

The prime modulus is usually a Mersenne prime, of the form2p −1, and the initial value x0 > 0. Number p must be a prime,e.g., p = 31 (i.e. m = 231 − 1). A multiplier a that has the max-imal cycle length m − 1, is called a primitive root of m (see

P.-C. Wu, K.-C. Huang / Computer Physics Communications 175 (2006) 25–29 27

Table 1Spectral test result on multipliers for modulus 231 − 1

Multiplier minqk, 2 � k � 6

16807 0.3375(16807)5 (mod m) 0.0780

1226874159 0.8255(1226874159)43 (mod m) 0.0741

[13, p. 375] and [15]). Multiplier an (mod m) is also a primi-tive root of m if and only if n is relatively prime to m − 1. Thisproperty can easily be shown: Let n = u · v, u = gcd(n,m− 1),i.e. u|n and u|m − 1. We get

(an)(m−1)/u = av(m−1) = a(m−1) = 1 (mod m),

i.e. the cycle length of an (mod m) is (m − 1)/u, which is notthe maximal if u > 1. In fact, for n < 10, only n = 5 is relativelyprime to m−1. The prime factorization of m−1 is given below:

m − 1 = 231 − 2 = 2 × 32 × 7 × 11 × 13 × 31 × 151 × 331.

Even when an (mod m) is a primitive root, its spectral valuesmay be very bad as shown in Table 1. The qk is a measure of thek-dimensional spectral test, qk ∈ [0,1]. Large values of qk arebest. A complete definition of qk can be found in [1]. The num-ber 1226874159 is one of the five best multipliers from [10].

3.2. Powers of two

For m = 2N , the maximal cycle length is 2N−2, when themultiplier is the form of 8k+3 or 8k+5, and the initial value x0is odd [13, p. 20]. Multipliers of the form 8k + 5 are better [1].The setting used in some vector computers is

m = 248 and a = 44485709377909,

a number of the form 8k + 5. For N > 2, an (mod m) is of theform 8k + 5 only when n is odd. When n is even, an (mod m)is of the form 8k + 1. This is shown by the following simplecalculation:((8k + 5)(8k + 5) mod 2N

)mod 23

= (8k + 5)2 mod 23 = 52 mod 8 = 1,((8k + 1)(8k + 5) mod 2N

)mod 23

= (8k + 1)(8k + 5) mod 23 = 5 mod 8 = 5.

Thus, half of the multipliers of leap step n produce the max-imal cycle length. Compared with prime moduli, this ratio isquite high. However, not all of these multipliers have goodspectral values. Table 2 shows the spectral values of somemultipliers for m = 248. For a = 44485709377909 and thestep n = 2i + 1, 1 � i � 6, these multipliers seem to be ad-equate, but the spectral values for n = 37 and 63 are not sogood. The numbers 43272750451645 and 55151000561141,two of the best multipliers from [11], are also tested. Thespectral values for 4327275045164555, 5515100056114123,and 5515100056114143 are very bad. These multipliers shouldnever be used. This shows that although a is good, the spectralvalues of an (mod m) can be very poor for some step n.

Table 2Spectral test results on multipliers for modulus 248

Multiplier minqk, 2 � k � 6

44485709377909 0.3983(44485709377909)3 (mod m) 0.3796(44485709377909)5 (mod m) 0.3715(44485709377909)9 (mod m) 0.6376(44485709377909)17 (mod m) 0.5223(44485709377909)33 (mod m) 0.4195(44485709377909)65 (mod m) 0.4349

(44485709377909)37 (mod m) 0.1262(44485709377909)63 (mod m) 0.1230

(43272750451645)55 (mod m) 0.0242(55151000561141)23 (mod m) 0.0113(55151000561141)43 (mod m) 0.0863

4. Analysis of the random spacing method

The random spacing method uses a common multiplier a andn random starting points (seeds) [s0, s1, . . . , sn−1]. This sectionanalyzes the minimal distance between these n substreams.

The distance function d(α) is defined by

(7)α = ad(α) (mod m).

Let [p0,p1, . . . , pn−1] be the ascending (sorted) sequence of[d(s0), d(s1), . . . , d(sn−1)]. The distances between adjacentsubstreams are then [p1 − p0,p2 − p1, . . . , pn−1 − pn−2,m −1−pn−1 +p0]. The minimal distance between the n substreamsis then the minimum of this sequence. Let [d0, d1, . . . , dn−1] =

1m−1 [p1 − p0,p2 − p1, . . . , pn−1 − pn−2,m− 1 − pn−1 + p0].We have

(8)d0 + d1 + · · · + dn−1 = 1.

This is a classic topic, sometimes called random division orspacing, in order statistics [18]. The minimal distance betweenthese n substreams is (m − 1) · min[d0, d1, . . . , dn−1]. Let D =min[d0, d1, . . . , dn−1]. The probability density function of D

was derived to be P(D) = n(n − 1)(1 − nD)n−2 in [19]. It isclear that the range of the values of D is from 0 to 1/n. Thefollowing are the mean and the variance of D:

(9)E(D) =1/n∫

0

DP(D)dD = 1

n2,

(10)E(D2) =1/n∫

0

D2P(D)dD = 2

n3(n + 1),

(11)

V (D) = E(D2) − E(D)2 = 2

n3(n + 1)− 1

n4= n − 1

n4(n + 1).

Table 3 lists the exact numbers of the mean and the vari-ance for some of n. These results are also verified by simulationexperiments. These results indicate that the minimal distancebetween n substreams is 1/n2 of cycle length in average. Thisdistance is only 1/n of the distance with equal partition. Thevariance is also small, so there is not much chance to obtain

28 P.-C. Wu, K.-C. Huang / Computer Physics Communications 175 (2006) 25–29

Table 3The mean and variance for n = 2,3,4, and 8

n E(D) V (D)

2 1/4 1/483 1/9 1/1624 1/16 3/12808 1/64 7/36864

n substreams that are separated with a distance greatly largerthan the mean distance. In addition, multiplicative congruen-tial generators usually have very limited cycle length, suchas m = 231 − 1. This method thus limits the size of n. An-other solution is using generators with larger modulus such asm = 261 − 1 and the multipliers of the form recently proposedin [20].

5. Analysis of the regular spacing method

This section proposes an analysis of the regular spacingmethod as given in Eq. (3). The random numbers generatedfrom all n substreams can be tabulated as follows:

S0: x0, ax0, a2x0, . . . ,

S1: αx0, αax0, αa2x0, . . . ,

S2: α2x0, α2ax0, α

2a2x0, . . . ,

. . .

Sn−1: αn−1x0, αn−1ax0, α

n−1a2x0, . . . .

Statistical properties of all Sj are identical. If a is a good mul-tiplier, all Sj are also good. However, interdependencies mayexist between some elements of Sj . For example, the n-tuple(xi, αxi, α

2xi, . . . , αn−1xi ) may be far from random.

De Matteis and Pagnutti [6] showed that strong correla-tion exists between (xi, αxi ) for a = 16807, m = 231 − 1,and α ∈ {±2,±4,±8,±16,±32,±64} (mod m). The correla-tion was observed in the empirical tests conducted (integralsof simple functions) using the proposed correlation controlestimator r . To investigate the strength of the estimator r ,we conducted the frequency test and the serial test [13] onthe sequences of tuple (xi, αxi ), α ∈ {±2,±4,±8,±16,±32,

±64} (mod m). All these sequences passed the frequency testbut failed in the serial test. In addition, generators with α =ad (mod m), d ∈ {107,2 × 107,5 × 107,108,2 × 108,5 × 108},all passed the frequency test, the serial test, and the control es-timator r . This shows that the estimator r , when used as anempirical test for multiplicative generators, is about as strongas the serial test.

The spectral test [13] is stronger than empirical tests. It maybe better to choose α based on its spectral values. Selecting α

based on its k-dimensional spectral values guarantees that thek-tuple (xi, αxi, α

2xi, . . . , αk−1xi ) is randomly distributed on

the k-dimensional space, usually 2 � k � 8. However, thereis no guarantee of the randomness of the distribution of thetuples such as the 4-tuple (xi, axi, αxi, αaxi ) and the 6-tuple(xi, axi, αxi, αaxi, α

2xi, α2axi ). Durst [7, Section 2] showed

that the theory for analyses of these tuples of random numbers

directly follows the original spectral test [13, pp. 92–94]. Se-lecting α based on spectral values thus has a strong theoreticalbasis.

Another criterion is that the distance between the substreamsgenerated using α must be long enough for the given simula-tion job. We define s(α,n) as the minimal distance betweenn substreams with factor α. The sequence of random num-bers is a cycle of 1 . . . m − 1. When d(α) > m/2, we takem− 1 − d(α) as the distance between two adjacent substreams.Because 0 � s(α,n) � (m − 1)/n, we define the utilization ra-tio

(12)u(α,n) = n · s(α,n)/(m − 1)

and have 0 � u(α,n) � 1. The ratio u(α,n) is thus a measureof the distance relative to the maximal distance m/n.

In general, computing d(α) is very hard for large m. Thisis known as the problem of computing the index of α, calledalso the discrete logarithm of α over GF(m), and denoted byloga α (mod m). The computing time in the worst case is ex-ponential. Pohlig and Hellman [17] presented an efficient algo-rithm for computing discrete logarithms for modulus m, wherem − 1 contains only small prime factors. The algorithm workswell for m = 231 − 1,248, and 261 − 1, where all the prime fac-tors of m− 1 are small. Note that the maximal prime factors for231 − 2,248 − 1, and 261 − 2 are 330, 673, 1320, respectively.A recent algorithm [5] solved the same problem when the primefactorization of α is known.

Table 4 lists various pairs of a and α for m = 231 − 1:16807, 62089911, 742938285, 950706376, 1226874159, and1343714438. All of them have good spectral values. They arethe best multipliers suggested in the literature [10]. All thesegenerators pass several empirical tests, including the frequencytest, the serial test, the run test, the maximum-of-t test, and thecontrol estimator r . Table 4 shows the distance d(α) and theratio u(α,n) for n = 4,8,16, and 32. The extremely small num-bers in the table are underlined. They indicate that the minimaldistance of the substreams is very small. For example, the gen-erator of pair (16807, 1226874159) has very small ratio u(α,n)

for n = 8,16, and 32. The substreams are overlapped when thelength of substreams > 135266. This indicates that selectinga pair (a,α) with no care can result in overlapped substreams.

6. Conclusions

We have presented analyses of the leapfrog, the randomspacing, and the regular spacing methods. The leapfrog methodcan result in multipliers with low spectral values and shouldbe used with care. In the random spacing method, the minimaldistance between n substreams is only 1/n2 of cycle length inaverage. This method limits the size of n. The regular spac-ing method can result in strong correlation between substreamsif the starting points are poorly selected. We then suggest se-lecting multiplier a and factor α based on their k-dimensionalspectral values and the minimal distance between substreamsof these generators. Moreover, since no methods can guaranteea generator’s quality for all possible simulations, the generatorspassing the mathematical tests still should be used with care. To

P.-C. Wu, K.-C. Huang / Computer Physics Communications 175 (2006) 25–29 29

Table 4Some pairs of (a,α) for m = 231 − 1, the corresponding distance d(α), min(d,m − 1 − d), and the utilization ratio u(α,n), n = 4,8,16,32

a α d(α) min(d,m − 1 − d) u(α,4) u(α,8) u(α,16) u(α,32)

742938285 950706376 2021956789 125526857 0.234 0.468 0.101 0.2021226874159 1254330659 893152987 0.318 0.073 0.146 0.292

62089911 994408519 994408519 0.296 0.158 0.316 0.1631343714438 1653743305 493740341 0.321 0.089 0.178 0.355

16807 2019613109 127870537 0.238 0.476 0.196 0.392

950706376 742938285 1194660403 952823243 0.450 0.054 0.108 0.2161226874159 966284339 966284339 0.400 0.397 0.012 0.025

62089911 183577591 183577591 0.342 0.207 0.413 0.2571343714438 1972312891 175170755 0.326 0.169 0.339 0.098

16807 369253637 369253637 0.561 0.253 0.217 0.433

1226874159 742938285 394463651 394463651 0.326 0.164 0.329 0.020950706376 98012711 98012711 0.183 0.365 0.066 0.13162089911 831612557 831612557 0.255 0.274 0.472 0.152

1343714438 1513095161 634388485 0.455 0.367 0.352 0.06216807 1680490969 466992677 0.349 0.343 0.025 0.051

62089911 742938285 1827741859 319741787 0.596 0.338 0.321 0.067950706376 2140225669 7257977 0.014 0.027 0.054 0.108

1226874159 1910537411 236946235 0.441 0.056 0.112 0.2231343714438 1977986671 169496975 0.316 0.209 0.417 0.023

16807 1563375545 584108101 0.352 0.064 0.129 0.257

1343714438 742938285 738361171 738361171 0.126 0.252 0.465 0.078950706376 84310357 84310357 0.157 0.314 0.296 0.072

1226874159 471321083 471321083 0.390 0.198 0.395 0.04862089911 2072070859 75412787 0.140 0.281 0.268 0.053

16807 899197151 899197151 0.374 0.197 0.394 0.161

16807 742938285 1484870735 662612911 0.297 0.090 0.179 0.358950706376 171352421 171352421 0.319 0.298 0.083 0.166

1226874159 1342194187 805289459 0.500 0.0005 0.001 0.00262089911 1806021989 341461657 0.636 0.368 0.338 0.120

1343714438 13274813 13274813 0.025 0.049 0.099 0.198

confidently use a generator in a simulation, it had better beingfirst tested with some cases of the problem to simulate whichhave exact answers to compare with, no matter what mathemat-ical tests it has passed.

References

[1] S.L. Anderson, Random number generators on vector supercomputers andother advanced architectures, SIAM Review 32 (2) (1990) 221–251.

[2] K.O. Bowman, M.T. Robinson, Studies of random number generators forparallel processing, in: M.T. Heath (Ed.), Proceedings of 2nd Conferenceon Hypercube Multiprocessors, SIAM, 1987, pp. 445–453.

[3] A. De Matteis, S. Pagnutti, A class of parallel random number generators,Parallel Computing 13 (1990) 193–198.

[4] A. De Matteis, S. Pagnutti, Long-range correlations in linear and non-linear random number generators, Parallel Computing 14 (1990) 207–210.

[5] A. De Matteis, J. Eichenauer-Herrmann, H. Grothe, Computation of crit-ical distances within multiplicative congruential pseudorandom numbersequences, Journal of Computational and Applied Mathematics 39 (1992)49–55.

[6] A. De Matteis, S. Pagnutti, Controlling correlations in parallel MonteCarlo, Parallel Computing 21 (1995) 73–84.

[7] M.J. Durst, Using linear congruential generators for parallel random num-ber generation, in: Proceedings of IEEE 1989 Winter Simulation Confer-ence, 1989, pp. 462–466.

[8] W.F. Eddy, Random number generators for parallel processors, Journal ofComputational and Applied Mathematics 31 (1990) 63–71.

[9] J. Eichenauer-Herrmann, H. Grothe, A remark on long-range correlationsin multiplicative congruential pseudo random number generators, Nu-merische Mathematik 56 (1989) 609–611.

[10] G.S. Fishman, L.R. Moore, An exhaustive analysis of multiplicative con-gruential random number generators with modulus 231 −1, SIAM Journalon Scientific and Statistical Computing 7 (1) (1986) 24–45.

[11] G.S. Fishman, Multiplicative congruential random number generatorswith modulus 2β : An exhaustive analysis for β = 32 and a partial analysisfor β = 48, Mathematics of Computation 54 (1990) 331–344.

[12] P. Frederickson, R. Hiromoto, T.L. Jordan, B. Smith, T. Warnock, Pseudo-random trees in Monte Carlo, Parallel Computing 1 (1984) 175–180.

[13] D.E. Knuth, Seminumerical Algorithms, second ed., The Art of ComputerProgramming, vol. 2, Addison-Wesley, MA, 1981.

[14] A.E. Koniges, C.E. Leith, Parallel processing of random number gener-ation for Monte Carlo turbulence simulation, Journal of ComputationalPhysics 81 (1989) 230–235.

[15] S.K. Park, K.W. Miller, Random number generators: good ones are hardto find, Communications of the ACM 31 (10) (1988) 1192–1201.

[16] O.E. Percus, M.H. Kalos, Random number generators for MIMD parallelprocessors, Journal of Parallel and Distributed Computing 6 (1989) 477–497.

[17] S.C. Pohlig, M.E. Hellman, An improved algorithm for computing loga-rithm over GF(p) and its cryptographic significance, IEEE Transactionson Information Theory 24 (1) (1978) 106–110.

[18] H.A. David, Order Statistics, second ed., John Wiley & Sons, 1981.[19] D.E. Barton, F.N. David, Some notes on ordered random intervals, Journal

of the Royal Statistical Society B 18 (1956) 79–94.[20] P.C. Wu, Multiplicative congruential random number generators with mul-

tiplier ±2k1 ± 2k2 and modulus 2p − 1, ACM Transactions on Mathemat-ical Software 23 (2) (1997) 255–265.

[21] A.M. Ferrenberg, D.P. Landau, Y.J. Wong, Monte Carlo simulations: hid-den errors from good random number generators, Physical Review Let-ters 69 (23) (1992) 3382–3384.