This paper describes algorithms for producing and checking fair-transfer instructions in a heterogeneous pool. It separates the proposed allocation from a numerical error certificate, a conservative feasibility gate and settlement checks linking the accepted weights to a specified death batch.
The mathematical rule remains actuarial fairness: each member's expected incoming credits equal their expected forfeiture under the specified event law. The implementation accepts weights only when it can bound the numerical departure from that equality. The test acceptance limit is £0.001 per member, conditional on the specified death count. This limit is an explicit research setting, not a proposed universal commercial tolerance.
The operating contract
Freeze membership, account values and mortality inputs at the valuation bucket. For each supported death count k, specify the probability law for which members die. For the principal implementation this is independent Bernoulli mortality, conditional on exactly k deaths. This law also covers mixtures of common mortality-odds shifts without changing the conditional identity probabilities.
The workflow has four distinct outcomes:
| Result | Meaning | Action |
|---|---|---|
| Certified | Strict feasibility established and all member errors bounded within tolerance | Release the recorded weights for this snapshot and count |
| Proven infeasible | An identified member set has a rigorously negative Hall slack | Block the allocation and report the obstruction |
| Feasibility inconclusive | Conservative gates do not prove existence; no checked set proves impossibility | Hold the result for a stronger method |
| Numerical audit incomplete or outside tolerance | A proposal is absent, too inaccurate, or beyond the audit's work limits | Hold the result; do not call it economically infeasible |
The solver is a proposal engine. It is not allowed to certify its own answer merely because its iteration residual is small. A second mathematical calculation checks the proposed weights against the original mortality inputs.
Algorithm family
| Component | Implemented method | What is independently checked |
|---|---|---|
| Single-death proposal | Scalar root from w_i(1−w_i)=cθ_i, including a possible dominant root | Direct interval evaluation of each expected credit |
| General fixed-count proposal | Polynomial/Laplace expectation calculation and compressed IPF | Positive moment calculation with explicit remainder and rounding bounds |
| Concentrated-weight audit | Condition on up to three dominant members, then audit each branch | Same original death law and same allocation rule; branches sum back to the full expectation |
| Heterogeneous feasibility | Two conservative Hall bounds plus explicit witness checks | Outward-rounded probability, estate and target intervals |
| Batch coverage | Positive count/estate recursion with an absorbing overflow state | Upper bounds for uncovered count probability and expected deceased capital |
| Cash settlement | Exact integer-pence inputs and budget-balanced dependent rounding | Snapshot, death count, deceased IDs, estate, survivors, allocation and replay |
For a realised death set D, the unrounded rule is unchanged:
Weights are selected for the entire conditional event law, not tailored to the identities that happened to die. A cache may precompute common counts. Any later calculation must use the same frozen pre-event snapshot and count-conditioned law.
A separate certificate for numerical fairness
Normalise the candidate weights so that r_i=w_i/Σw. Let h_D be the sum of the deceased weights. Then the survivor denominator is 1−h_D. If ρ is the sum of the k largest r_i, h_D≤ρ<1.
The geometric expansion gives a nonnegative truncated expected credit
Event by event, the truncated credit is the full credit multiplied by 1−h_D^(R+1). Consequently,
Positive polynomial recursions calculate the moments. Every addition, multiplication, division and reduction is enclosed with outward rounding. Exact rational preprocessing encloses weight normalisation and an exactly equivalent power-of-two mortality-odds shift. That shift prevents rare conditioning events from underflowing without changing the original conditional law.
The result is an interval for each member's expected credit and a separately calculated interval for their expected forfeiture. Their difference supplies an upper bound on the fairness error. This bounds both truncation and arithmetic error; it does not rely on two quadrature answers being close.
Single deaths use a simpler direct sum. The largest weight is separated so that a nearly vanishing denominator does not cause subtraction of two large numbers. For concentrated batches, the audit conditions on the death/survival patterns of up to three dominant members. Each branch includes the fixed estate of deceased dominant members. Minor-member combinations remain in the polynomial recursion. Conditioning changes the evaluation of the expectation, not the economic allocation.
The audit has explicit degree and work limits. If it cannot produce sufficiently narrow intervals within those limits, it declines. The arithmetic guarantee assumes IEEE-754 binary64 basic operations, gradual underflow and no unsafe reassociation. It establishes numerical fairness under the supplied mortality law, not the empirical accuracy of that law.
Feasibility before calibration
Let a_i be member i's expected forfeiture, A=Σa_i, and B(U) the expected estate in events where every member of U dies. Exact survivor-only fairness requires, for every member set U,
Listing every U is unnecessary for a broad class of practical cases. Two safe bounds are
where S_k sums the k largest balances and r_m is the probability that the m highest-mortality members all die, conditional on count k. An elementary swapping argument shows that those members maximise inclusion probability. The first relaxed bound is maximised by sorting singleton estate moments and maintaining the largest relevant target sums.
Together these give an O(nk+n log n) sufficient gate. The gate is conservative. Its failure is not proof of infeasibility. In that case the implementation checks candidate member sets directly and reports a negative interval only when that set proves an obstruction. The witness search is incomplete and says so.
The accompanying checks compare the gates with exhaustive exact-rational Hall calculations in 33 small heterogeneous cases. The pair example with balances (41,41,6,6,6) correctly passes singleton tests and fails on the largest pair. A boundary case returns inconclusive.
Mortality-calibrated scenarios
The input rates are the ONS UK National Life Tables, 2022–2024, released 10 December 2025. The calculations use the published six-decimal qx values.
The tests use synthetic member ages, sex and balances. Annual qx is converted to a daily probability using q_day=1−(1−qx)^(1/365), a constant-force interpolation within an attained-age year. These are population period rates. Pensioner selection, mortality improvements, socioeconomic effects and any bespoke underwriting basis remain calibration decisions; no actual pension population is represented by these synthetic cases.
| Pool | Assets | Counts actually tested | Largest certified expected member error |
|---|---|---|---|
| 1,000 members aged 55–100 | £131.72m | Every count 1–6 | £2.05×10^−7 |
| 1,000 members aged 30–100 | £134.86m | Every count 1–6 | £9.13×10^−8 |
| 10,000 members aged 55–100 | £1.360bn | Counts 1, 5, 10 and 13 | £2.10×10^−7 |
Every listed layer passed both strict feasibility and the independent numerical audit. The larger pool was a representative scale test, not a claim that all intervening counts were precomputed. The complete records identify every tested count.
The 1,000-member layers took approximately 1.5–3 seconds each in the reported runs. The 10,000-member layers took approximately 13–25 seconds, including feasibility, proposal and audit. These are local observations on specified cases, not worst-case performance guarantees.
The daily expected death counts were approximately 0.134, 0.123 and 1.393. A cutoff of six deaths in the first pool leaves a modelled expected deceased estate above the cutoff bounded by £0.0001191 per day. For the 10,000-member pool, thirteen is the corresponding cutoff at the chosen £0.001 expected-estate budget; its upper bound is £0.0006169 per day.
These tail numbers measure exposure outside a precomputation range. They do not make an uncertified tail allocation fair, and they do not remove the all-dead event. A full operating contract still needs a response to an unusually large or infeasible batch. The current adapter executes only a certified count.
The 5% account cap is insufficient
Published annual male qx is 0.005320 at age 55 and 0.402489 at age 100. Under the daily interpolation, the mortality probabilities are approximately 0.0000146141 and 0.0014099163.
In the stress pool, one age-100 member owns 5% of assets and 999 age-55 members share the rest. The old member accounts for approximately 83.57% of the expected forfeiture conditional on one death. Fairness is impossible because their expected claim exceeds the total estate available when someone else dies. The engine returns an interval-verified singleton obstruction before trying to calibrate weights. The one-death expected-credit shortfall is approximately £372,459; the two-death shortfall is approximately £685,297 in the stated £105.16m pool.
For one outlier with balance s and mortality odds λ, alongside n−1 identical members each with balance t and odds μ, the necessary singleton condition for count k simplifies to
For this particular pool, the corresponding necessary account ceilings are approximately £1.034m for one death and £1.033m for two deaths, against an initial outlier account of about £5.258m. They are not universal contribution limits and do not replace the full gate.
Reducing the outlier's share to 0.5% produced a strictly feasible two-death layer with a certified numerical error below £0.00000102. A 1% share was also strictly feasible and certified for one and two deaths. In the two-death case, one candidate weight was approximately 97.68% of the weight total. The ordinary geometric audit would need too many terms; conditioning on that member gave two branches with maximum geometric parameter about 0.001001, and certified the member errors below £0.00000182.
That near-boundary two-death solve took approximately 74 seconds: about 72 seconds for 482 IPF iterations, and 1.3 seconds for the independent audit. The certificate is therefore no longer the limiting step in that example; accelerating proposal convergence is a distinct remaining task. The admission rule must consider mortality and balances jointly and leave a numerical margin; merely labelling every account below 5% as diversified is insufficient.
Mortality changes and recalibration
The same six-death weights were subjected to two changes in mortality:
| Change | Existing weights | Required response |
|---|---|---|
| Every member's mortality odds tripled | Remained within the audit tolerance | Increase the count coverage; the selected cutoff moved from six to eight |
| Only age-85-and-over mortality odds tripled | Failed the audit | Recalibrate; the new weights passed |
In the second test, the largest absolute expected member error was enclosed between £10,244.57066635 and £10,244.57066646. Recalibration reduced the certified maximum error below £0.000000088. The error is conditional on the six-death layer, not a statement that this amount would be lost on an average day.
Common mortality-odds changes preserve the identity law conditional on death count. Relative mortality changes generally do not. The test supports retaining death-count stratification as a practical design choice while making the circumstances requiring recalibration explicit.
Exact cash instructions and audit evidence
The cash entry point takes integer pence, so ordinary decimal account balances do not pass through an inexact pounds conversion. Each account is required to be exactly representable in the chosen numerical unit. The audit scales its tolerance consistently and reports a GBP error bound.
The execution adapter checks the record and snapshot digests, the accepted status, the feasibility and fairness certificates, matching dimensions and cash units, and the actual unique deceased IDs. Their number must equal the certified count. It derives the estate and surviving recipients from the frozen snapshot; a caller cannot substitute a different estate or survivor list.
If cash must be allocated in pennies, systematic dependent rounding preserves every member's expected fractional entitlement and conserves the estate exactly. Each recipient gets either the floor or ceiling of their fractional penny entitlement. The common random ticket is recorded for replay. Tests exhaust every possible ticket in small examples to verify the expected allocations exactly.
Randomised settlement is an optional implementation choice. An accounting system that retains fractional unit entitlements can postpone rounding. If randomised pennies are used, replay proves what followed from a ticket; it does not prove that the ticket was chosen impartially. Hashes detect changes to a record, not authenticate its author. The code emits settlement instructions rather than posting a ledger or verifying death reports.
Seventeen malformed-instruction tests were rejected, including wrong death counts, unknown or duplicate decedents, changed weights, altered snapshot digests, unaccepted certificates and inconsistent monetary units. A four-member test with balances of 101, 102, 103 and 104 pennies certified and distributed the deceased member's exact 101-penny estate to survivors.
Results and limitations
The implementation separates proposal, feasibility, numerical fairness and execution checks. It handles the tested heterogeneous population scenarios, rejects a real balance/mortality obstruction, detects relative mortality-basis changes and prevents several classes of mismatched payment instructions.
It is not a deployed pension ledger or a validated pensioner mortality model. The remaining substantive operating work includes repeated-event state transitions, correlated identity shocks not captured by a common mortality-odds factor, source-asset-unit settlement, and the contractual treatment of uncertifiable or terminal events. General batch IPF can also become slow near a feasibility boundary; the independent audit permits alternative proposal solvers without changing the acceptance standard.
The companion paper, Fair tontine transfers for arbitrary death batches, develops the mathematical formulation. The present paper concerns implementation and numerical verification under that formulation; it makes no claim of academic priority.