Reversible Arithmetic

Synthesis stops being an abstract art the moment somebody asks for an adder. Addition is the workhorse of all computation — and it is also, at first glance, a reversibility disaster: (a, b) \mapsto a + b throws a whole operand away. Yet reversible adders exist, they are elegant, and they are arguably the most-built reversible circuits in the world, because one sits inside every implementation of Shor's factoring algorithm. This page builds them: first the trick that makes addition legal at all, then the two classic designs — the VBE ripple-carry adder and the sleeker Cuccaro adder — and then the payoff that only reversible hardware gets: subtraction for free, by running the adder backwards.

Add in place: the legal bijection

The fix for addition's information loss is to keep one operand. Map

(a, b) \;\longmapsto\; (a,\; a + b)

(with the sum taken modulo 2^n on n-bit registers, or with a carry-out wire catching the overflow bit). This is a genuine bijection: from the output (a, s) you recover the input as (a, s - a) — nothing is forgotten. Notice the shape: it is exactly the XOR-accumulate pattern of the CNOT, (a,b) \to (a, b \oplus a), promoted from single bits to whole registers — indeed for 1-bit numbers the in-place adder is a CNOT (plus a Toffoli computing the carry ab — the very reason the Toffoli is sometimes drawn as "the carry gate"). Everything below is about doing this on multi-bit binary numbers with the carries handled reversibly.

Design 1: the VBE ripple-carry adder

The first quantum-era adder, by Vedral, Barenco and Ekert (1996), is a direct reversible port of the ripple-carry adder you know from classical hardware — with one reversible twist. It runs in three sweeps:

The bill: roughly 4n Toffolis (the ladder is paid twice) and n ancilla wires for an n-bit addition. Correct, historic — and wide. The carries only exist as scaffolding, yet each one occupies its own wire.

Design 2: the Cuccaro adder

In 2004 Cuccaro, Draper, Kutin and Moulton showed the carries never need wires of their own: the carry can ride along the a register itself. Their adder uses one ancilla in total (holding the incoming carry c_0 = 0) and two three-gate building blocks acting on the wire triple (c, b, a) at each bit position:

The full adder is a V: MAJ blocks ripple up the register, one CNOT tips the final carry onto the carry-out wire, and UMA blocks come back down, cleaning as they go. Here it is for 2-bit numbers:

Each bit position costs one MAJ and one UMA — one Toffoli each — so about 2n Toffolis, 2n-ish CNOTs, and a single ancilla: half the Toffolis and a fraction of the width of VBE. The cost-metric habits of this module are exactly how you compare such designs at a glance:

Adder (n-bit, in place)Toffolis (approx.)AncillasIdea
VBE (1996)\sim 4nncarry wire per position, computed then uncomputed
Cuccaro (2004)\sim 2n1carry rides the a register via MAJ/UMA

Subtraction and comparison, free of charge

Now the magic that irreversible hardware simply cannot copy. The adder is a bijection (a, b) \to (a, a+b); every reversible circuit run backwards (same gates, reverse order — they are all self-inverse) computes the inverse map:

(a, s) \;\longmapsto\; (a,\; s - a).

A subtractor is the adder, read right to left. No new design, no new verification — reversibility means every arithmetic circuit you build is two circuits. And a comparator comes almost as cheaply: run the subtract direction just far enough to produce the borrow/sign bit of b - a, copy that single bit onto an output wire with a CNOT, then uncompute the subtraction. The registers emerge untouched, plus one clean bit answering "is a > b?" — the standard pattern for every reversible predicate: compute, copy out one bit, uncompute.

Why did quantum-computing people write papers about something as pedestrian as a ripple-carry adder? Because Shor's factoring algorithm spends nearly all of its time computing modular exponentiations — built from modular multiplications, built from additions — on quantum superpositions of numbers. Quantum mechanics only permits reversible logic, so the arithmetic core of the most famous quantum algorithm is precisely the classical reversible adders of this page, run on qubits: VBE was designed for exactly that purpose, and Cuccaro-style adders are what modern resource estimates for factoring actually count. When headlines quote "so-many-thousand logical qubits to break RSA", a good chunk of that number is adder ancillas and Toffoli counts — the quantum module picks this story up in detail.

The seductive wrong design: two registers in, one register out, holding the sum. It cannot be built — not with NCT gates, not with any reversible gates, ever. From the output 7 alone you cannot tell 3 + 4 from 5 + 2: many inputs share one output, the map destroys a, and a permutation it is not. (Wire-count bookkeeping catches it instantly, too: reversible circuits never lose wires.) In-place addition keeps one operand(a, b) \to (a, a+b) — and that retained a is precisely the information that lets the circuit run backwards. If you ever truly need to erase a afterwards, that is not the adder's job: it is an explicit uncompute step, paid for separately, exactly as Landauer and Bennett taught.