An Efficient Parallel Reverse Conversion of Residue Code to Mixed-Radix Representation Based on the Chinese Remainder Theorem

Abstract

In this paper, we deal with the critical problems in residue arithmetic. The reverse conversion from a Residue Number System (RNS) to positional notation is a main non-modular operation, and it constitutes a basis of other non-modular procedures used to implement various computational algorithms. We present a novel approach to the parallel reverse conversion from the residue code into a weighted number representation in the Mixed-Radix System (MRS). In our proposed method, the calculation of mixed-radix digits reduces to a parallel summation of the small word-length residues in the independent modular channels corresponding to the primary RNS moduli. The computational complexity of the developed method concerning both required modular addition operations and one-input lookup tables is estimated as $O\left(k^2/2\right)$, where k equals the number of used moduli. The time complexity is $O\left(⌈{\log }_{2}k⌉\right)$ modular clock cycles. In pipeline mode, the throughput rate of the proposed algorithm is one reverse conversion in one modular clock cycle.

1. Introduction

Along with the improvement of computer technology, the development and implementation of new effective approaches to the organization and realization of computational tasks are some of the main ways to increase the data processing speed. At present, high-performance computing is developing extremely rapidly. These reasons lead to qualitatively new requirements imposed on number-theoretic methods and computational algorithms. Practically, all well-known approaches to high-performance computing use certain parallel forms of data representation and processing. In recent decades, special consideration has been given to the so-called modular computational structures. Their arithmetic foundation is the Residue Number System (RNS), whose ideological roots go back to the classic topics of number theory and abstract algebra. The RNS is a non-positional number system with inherent parallelism and occupies a place of particular importance due to its carry-free properties, which provide a high potential for accelerating arithmetic operations.

As is well known, the RNS has some advantages over a conventional Weighted Number System (WNS) in the design and implementation of high-performance computing applications, devices, and systems. From its appearance in the mid-1950s to the present, RNS arithmetic has attracted the constant attention of researchers in computer technology [1,2], number-theoretic methods [3,4,5], digital signal and image processing [2,5,6,7,8], communications systems [5,9], cryptography [2,8,10,11], and other fields [10].

The main advantage of RNS is its unique ability to decompose the large word-length numbers into a set of smaller word-length residues, which are processed in parallel in the independent modular channels. The inherent parallelism of RNS enables avoiding the carry-overs obtained in addition, subtraction, and multiplication, which are usually time-consuming in the WNS. In this regard, the modularity and carry-free properties make computation fast and efficient. Therefore, the RNS presents one of the most efficient means for increasing data processing speed.

Due to its carry-free property, the residue arithmetic is exceptionally suitable for a broad class of applications in which addition and multiplication are the dominant arithmetic operations. In any case, it has excellent potential for many substantial applications in such areas as digital signal processing, cryptography, distributed information and communication systems, information security systems, fault tolerance, cloud computing, and others. Moreover, these RNS applications may be effectively embedded in processor platforms functioning according to the conventional information-processing approach [2,5,8]. For the reasons mentioned above, residue arithmetic represents an efficient mathematical tool for the high-speed implementation of various computational tasks.

The reverse conversion and base extension are the most critical topics in residue arithmetic. As opposed to conventional WNS, these operations, on a par with other central non-modular procedures such as magnitude comparison, sign determination, overflow detection, general division, scaling, etc., are relatively harder for implementation. They are time consuming and costly due to their more complicated structure compared to modular operations.

As is known, to perform non-modular operations, it is necessary to carry out the binary reconstruction of the integer by its residue code, which in general is hampered by the non-weighted nature of the RNS. This circumstance negates to a substantial extent the main advantages of residue arithmetic.

Therefore, the development of novel approaches and methods for fast number reconstruction by its residue code has significant importance in high-performance computing based on parallel algorithmic structures of RNS, especially for high-speed implementing digital signal processing applications and public-key cryptosystems. That should enable the extensive use of residue arithmetic in many priority areas of science and technology.

In this paper, we present a novel approach to the parallel reverse conversion from the residue code into the mixed-radix representation. In the proposed method, the calculation of mixed-radix digits reduces to a parallel summation of the small word-length residues in the independent modular channels corresponding to the primary RNS moduli.

The paper is structured as follows. Section 2 and Section 3 discuss the basic theoretical concepts of the research. Section 4 describes the mathematical background of the proposed reverse conversion method. Section 5 and Section 6 present a numerical example and an analysis of the computational cost, respectively. Section 7 provides discussion, and Section 8 concludes the paper.

2. The Basic Concepts of the Residue Arithmetic

The abstract algebra and number theory create the theoretical basis of the residue arithmetic [12,13].

An RNS is defined by an ordered set $\left\{m_1,m_2,\cdots ,m_k\right\}$ of k pairwise relatively prime moduli, where each modulus $m_i\ge 2$$(i=1,2,\cdots ,k)$, and the greatest common divisor of $m_i$ and $m_j$ equals 1, i.e., $\gcd \left(m_i,m_j\right)=1$ for $i\ne j$. For convenience, we assume that the default order of moduli is ascending, i.e., $m_1<m_2<\cdots <m_k$.

In the given RNS, it is possible to represent $M_k$ integer numbers, where $M_k$ is the product of all moduli, $M_k={\prod }_{i=1}^k{m}_k$. Therefore, the set ${\mathbf{Z}}_{M_k}=\left\{0,1,\cdots ,M_k-1\right\}$ is usually used as an RNS dynamic range.

Every number $X\in {\mathbf{Z}}_{M_k}$ has a unique representation in the form of a k-tuple of small integers $({\chi }_1,{\chi }_2,\cdots ,{\chi }_k)$, which is called a residue code, where ${\chi }_i$ is a least non-negative remainder of a division of X by $m_i$$\left(i=1,2,\cdots ,k\right)$. We can notationally write this relation as ${\chi }_i={\left|X\right|}_{m_i}$, where ${\chi }_i\in {\mathbf{Z}}_{m_i}=\left\{0,1,\cdots ,m_i-1\right\}$.

The main advantage of the residue arithmetic over conventional binary arithmetic consists of parallel carrying out addition, subtraction, and multiplication at the level of small word-length residues. The modular operations $\circ \in \left\{+,-,\times \right\}$ on integers $A=\left({\alpha }_1,{\alpha }_2,\cdots ,{\alpha }_k\right)$ and $B=\left({\beta }_1,{\beta }_2,\cdots ,{\beta }_k\right)$ are performed independently in each modular channel in compliance with the computational rule:

$$\begin{array}{ll}A\hfill & \circ B=\left({\alpha }_1,{\alpha }_2,\cdots ,{\alpha }_k\right)\circ \left({\beta }_1,{\beta }_2,\cdots ,{\beta }_k\right)=\hfill \\ & =\left({\left|{\alpha }_1\circ {\beta }_1\right|}_{m_1},{\left|{\alpha }_2\circ {\beta }_2\right|}_{m_2},\cdots ,{\left|{\alpha }_k\circ {\beta }_k\right|}_{m_k}\right),\hfill \end{array}$$ (1)

where ${\alpha }_i={\left|A\right|}_{m_i}$ and ${\beta }_i={\left|B\right|}_{m_i},i=1,2,\cdots ,k$.

In other words, the arithmetic operations on long-word operands are decomposed into modular channels with operands that are no larger than the corresponding modulus. Moreover, all the modular channels are entirely independent of each other. The carry-free nature of modular operations (1) is one of the most attractive features of residue arithmetic [1,3,8].

Therefore, compared with the conventional WNS, the RNS simplifies and speeds up the addition and multiplication operations. This fundamental advantage of the residue arithmetic strongly appears in the case of implementing computational procedures, which mainly contain long segments consisting of only sequences of modular arithmetic operations. In this case, the primary moduli set is chosen so that the final results of the computational procedure always belong to the used dynamic range for any allowed values of input operands. At the same time, the intermediate results can even exceed the boundaries of the dynamic range.

Along with the carry-free modular operations, there are also the so-called non-modular operations such as residue-to-binary conversion, base extension, magnitude comparison, sign determination, overflow detection, general division, scaling, etc. These operations are complicated and quite time consuming, and their significant computational complexity limits the applications of the residue arithmetic and restricts its widespread usage for high-speed computing.

To perform the non-modular operations, it is required to consider all residues in the k-tuple $\left({\chi }_1,{\chi }_2,\cdots ,{\chi }_k\right)$. Furthermore, it is necessary to determine the integer value of the number by its residue code, which in general is hampered by the non-positional nature of the RNS. The crucial problem of efficient implementation of non-modular operations is constantly receiving considerable attention by modern researchers [2,5,8].

The applicability of residue arithmetic is mainly determined by the computational complexity and feasibility of non-modular operations, which are used as a basis for implementing more complex computational algorithms in RNS. At the same time, the fundamental problem in the residue arithmetic, which unfortunately up to now is yet completely unresolved; it consists of reducing the computational complexity of non-modular operations. Due to a lack of efficient methods and algorithms for non-modular operations implementation, the residue arithmetic is mainly suitable when the modular additions and multiplications make up the bulk of required computations. In this case, the number of used non-modular operations is relatively small. This circumstance bounds the widespread use of the RNS to a narrow class of specific tasks.

3. Reverse Conversion of the Residue Code to Conventional Representation

The root problem of residue arithmetic is that the weighted value of the integer X depends on all the residues ${\chi }_1,{\chi }_2,\cdots ,{\chi }_k$. The reconstruction of an integer by its residue code, i.e., the reverse conversion, is one of the most difficult non-modular operations in residue arithmetic. Moreover, this operation underlies all the other non-modular procedures.

Despite the currently extensive studies on residue arithmetic and its applications, there is a need to develop novel efficient approaches and methods of an integer number reconstruction by its residue code. This should enable us the extensive use of residue arithmetic for high-speed computing in many priority fields, first of all, in various digital signal processing and cryptographic applications.

There are two canonical techniques of reverse conversion: the canonical method based on the Chinese Remainder Theorem (CRT) and the residue code conversion to a weighted representation in the Mixed-Radix System (MRS) [1,2,5,8,14,15,16,17,18]. In general, all other conversion methods represent different variants of these two methods.

Below, we describe the mathematical background of these methods.

3.1. CRT-Base Conversion Method

When the moduli $m_1,m_2,\cdots ,m_k$ are pairwise relatively prime, the integer number X and its residue code $\left({\chi }_1,{\chi }_2,\cdots ,{\chi }_k\right)$ are related by the equation:

$$X={\left|\sum _{i=1}^k{M}_{i,k}{\chi }_{i,k}\right|}_{M_k},$$ (2)

where $M_{i,k}=M_k/m_i$, ${\chi }_{i,k}={\left|M_{i,k}^{-1}{\chi }_i\right|}_{m_i}$ is a normalized residue modulo $m_i$$\left(i=1,2,\cdots ,k\right)$, ${\left|Y^{-1}\right|}_m$ denotes the multiplicative inverse of an integer Y modulo m.

In essence, Equation (2) represents the CRT [10,19,20].

In the last decades, considerable efforts are directed to reducing the complexity of the CRT implementation and the possibility of its application in high-speed computing [2,5,8,21,22,23]. The main idea of these methods is to replace the inner multiplications and additions modulo $M_k$ with simpler operations (see (2)).

Consider the CRT-number

$$X_k=\sum _{i=1}^k{M}_{i,k}{\chi }_{i,k}.$$ (3)

As follows from (2), the difference $X_k-X$ is a multiple of $M_k$. Therefore, the following exact integer equality holds

$$X=X_k-{\rho }_k\left(X\right)M_k.$$ (4)

The unique integer number ${\rho }_k\left(X\right)$ is a normalized rank (or, briefly, rank) of the number X [3,4,7].

Equation (4) is called a rank form of the integer X. In essence, the rank ${\rho }_k\left(X\right)$ is a reconstruction coefficient that indicates how many times the dynamic range $M_k$ is exceeded when converting the residue code $\left({\chi }_1,{\chi }_2,\cdots ,{\chi }_k\right)$ to the integer X.

In contrast to (2), Equation (4) does not contain a very time-consuming reduction modulo $M_k$. Therefore, when we have the efficient method for the rank ${\rho }_k\left(X\right)$ computation, the reverse conversion algorithm constructed on the basis of (4) has a substantial lead over the canonical CRT implementation (2).

3.2. MRS-Base Conversion Method

In the MRS defined by a set $\left\{m_1,m_2,\cdots ,m_k\right\}$ of pairwise relatively prime moduli, the integer $X\in {\mathbf{Z}}_{M_k}$ is represented by the k-tuple $\left(x_k,x_{k-1},\cdots ,x_1\right)$ of mixed-radix digits, resulting in

$$X=x_1+x_2{M}_1+x_3{M}_2+\cdots +x_k{M}_{k-1}=\sum _{i=1}^k{x}_i{M}_{i-1},$$ (5)

where $x_i\in {\mathbf{Z}}_{m_i}$$(i=1,2,\cdots ,k)$ [1,2,8].

It is well known that the MRS surpasses the RNS when performing non-modular operations such as magnitude comparison, sign determination, and overflow detection. Therefore, the mixed-radix representation has received the widest appliance for the implementation of non-modular procedures along with the other generally accepted integral characteristics of the residue code such as the rank of a number, core function, interval index, parity function, diagonal, and quotient functions [3,4,7,24,25,26,27,28,29,30,31,32,33].

The RNS-to-MRS reverse conversion establishes an association between the residue code $\left({\chi }_1,{\chi }_2,\cdots ,{\chi }_k\right)$ of the number X and its mixed-radix representation $\left(x_k,x_{k-1},\cdots ,x_1\right)$. The mixed-radix digits $x_i$$(i=1,2,\cdots ,k)$ in (5) are computed according to the following calculation relations [1]:

$$\begin{array}{c}\hfill x_1={\chi }_1,\end{array}$$

$$\begin{array}{c}\hfill x_2={\left|\left({\chi }_2-x_1\right){\left|m_1^{-1}\right|}_{m_2}\right|}_{m_2},\end{array}$$

$$\begin{array}{c}\hfill x_3={\left|\left(\left({\chi }_3-x_1\right){\left|m_1^{-1}\right|}_{m_3}-x_2\right){\left|m_2^{-1}\right|}_{m_3}\right|}_{m_3},\end{array}$$

$$\begin{array}{c}\hfill \cdots \end{array}$$

$$\begin{array}{c}\hfill x_k={\left|\left(\cdots \left(\left({\chi }_k-x_1\right){\left|m_1^{-1}\right|}_{m_k}-x_2\right){\left|m_2^{-1}\right|}_{m_k}-\cdots -x_{k-1}\right){\left|m_{k-1}^{-1}\right|}_{m_k}\right|}_{m_k}.\end{array}$$

This sequential calculation procedure called a chained algorithm can be written in the general form

$$x_i={\left|X^{\left(i\right)}\right|}_{m_i},$$ (6)

where

$$X^{\left(i\right)}=\left\{\begin{array}{c}X,\mathrm{if}i=1,\hfill \\ \left(X^{(i-1)}-x_{i-1}\right)m_{i-1}^{-1},\mathrm{if}i=2,3,\cdots ,k.\hfill \end{array}\right.$$ (7)

From (6) and (7), it follows that the considered computational process requires two modular operations: subtraction and multiplication by the multiplicative inverse. Thus, the most crucial advantage of this algorithm is its high modularity. However, its strictly sequential nature prevents general use for the construction of appropriate high-performance parallel computing procedures.

4. A Novel CRT-Base RNS-to-MRS Reverse Conversion Method

Now, we describe a proposed new method for calculating mixed-radix digits $x_1,x_2,\cdots ,x_k$ of the number X by its residue code $({\chi }_1,{\chi }_2,\cdots ,{\chi }_k)$.

Consider the CRT-number $X_k$. According to (3), we have

$$X_k=\sum _{i=1}^{k-1}{M}_{i,k-1}{m}_k{\chi }_{i,k}+M_{k-1}{\chi }_{k,k}.$$ (8)

By Euclid’s Division Lemma, the integer $m_k{\chi }_{i,k}$ can be written as

$$m_k{\chi }_{i,k}={\chi }_{i,k-1}+⌊\frac{m_k{\chi }_{i,k}}{m_i}⌋m_i,$$ (9)

where

$$\begin{array}{c}\hfill {\chi }_{i,k-1}={\left|m_k{\chi }_{i,k}\right|}_{m_i}={\left|m_k{\left|M_{i,k}^{-1}{\chi }_i\right|}_{m_i}\right|}_{m_i}={\left|m_k{M}_{i,k}^{-1}{\chi }_i\right|}_{m_i}={\left|M_{i,k-1}^{-1}{\chi }_i\right|}_{m_i},\end{array}$$

$⌊x⌋$ denotes the largest integer less than or equal to x.

Substituting (9) into (8), we obtain

$$X_k=X_{k-1}+M_{k-1}{S}_k\left(X\right),$$ (10)

where

$$X_{k-1}=\sum _{i=1}^{k-1}{M}_{i,k-1}{\chi }_{i,k-1},$$ (11)

$$S_k\left(X\right)=\sum _{i=1}^k{R}_{i,k}\left({\chi }_i\right),$$ (12)

$$R_{i,k}\left({\chi }_i\right)=⌊\frac{m_k{\chi }_{i,k}}{m_i}⌋\left(i=1,2,\cdots ,k\right).$$ (13)

Taking into account (9), we have

$$\begin{array}{c}\hfill R_{i,k}\left({\chi }_i\right)=\frac{m_k{\chi }_{i,k}-{\chi }_{i,k-1}}{m_i}.\end{array}$$

Since $R_{i,k}\left({\chi }_i\right)\in {\mathbf{Z}}_{m_k}$, we can reduce the right side of equality modulo $m_k$.

Hence, the residue $R_{i,k}\left({\chi }_i\right)$ can be calculated as

$$R_{i,k}\left({\chi }_i\right)={\left|-\frac{{\chi }_{i,k-1}}{m_i}\right|}_{m_k}={\left|-\frac{{\left|M_{i,k-1}^{-1}{\chi }_i\right|}_{m_i}}{m_i}\right|}_{m_k}\left(i=1,2,\cdots ,k-1\right).$$ (14)

At the same time, from (13) it follows that

$$R_{k,k}\left({\chi }_k\right)={\chi }_{k,k}={\left|M_{k,k}^{-1}{\chi }_k\right|}_{m_k}={\left|M_{k-1}^{-1}{\chi }_k\right|}_{m_k}.$$ (15)

Similarly, taking into account Equations (10)–(13), the numbers $X_i$$(i=k-1,k-2,\cdots ,1)$ can be written by turns as

$$\begin{array}{c}\hfill X_{k-1}=X_{k-2}+M_{k-2}{S}_{k-1}\left(X\right),\end{array}$$

$$\begin{array}{c}\hfill X_{k-2}=X_{k-3}+M_{k-3}{S}_{k-2}\left(X\right),\end{array}$$

$$\begin{array}{c}\hfill \cdots \end{array}$$

$$\begin{array}{c}\hfill X_2=X_1+M_1{S}_2\left(X\right),\end{array}$$

$$\begin{array}{c}\hfill X_1=M_0{S}_1\left(X\right),\end{array}$$

where $M_0=1$, $S_1\left(X\right)={\chi }_1$, the integers $S_l\left(X\right)$$\left(l=2,3,\cdots ,k\right)$ are calculated according to (12)–(15) in the case when the index k is replaced by l.

Finally, substituting the above equations for $X_l$$(l=k-1,k-2,\cdots ,1)$ by turns into (10), we obtain

$$X_k=\sum _{i=1}^k{M}_{l-1}{S}_l\left(X\right).$$ (16)

At the same time, according to Euclid’s Division Lemma, we have

$$S_l\left(X\right)=R_l\left(X\right)+m_l{Q}_l\left(X\right),$$ (17)

where $R_l\left(X\right)={\left|S_l\left(X\right)\right|}_{m_l}$ and $Q_l\left(X\right)=⌊S_l\left(X\right)/m_i⌋$ are the remainder and quotient of the division $S_l\left(X\right)$ by the modulus $m_l$, respectively.

Therefore, taking into account (12), when the index k is replaced by l, the integers $R_l\left(X\right)$ and $Q_l\left(X\right)$ can be computed as

$$R_l\left(X\right)={\left|\sum _{i=1}^l{R}_{i,l}\left({\chi }_i\right)\right|}_{m_l},$$ (18)

$$Q_l\left(X\right)=⌊\frac{1}{m_l}\sum _{i=1}^l{R}_{i,l}\left({\chi }_i\right)⌋.$$ (19)

From (19), it follows that $Q_l\left(X\right)$ equals the number of occurred overflows when calculating the sum $R_l\left(X\right)$ of residues $R_{1,l}\left({\chi }_1\right),R_{2,l}\left({\chi }_2\right),\cdots ,R_{l,l}\left({\chi }_l\right)$ modulo $m_l$$\left(l=2,3,\cdots ,k\right)$.

Note that $R_1\left(X\right)={\chi }_1$ and $Q_1\left(X\right)=0$ since $S_1\left(X\right)={\chi }_1$.

Substituting (17) into (16), we obtain

$$X_k=X_k^{\left(R\right)}+X_{k-1}^{\left(Q\right)}+M_k{Q}_k\left(X\right),$$ (20)

where

$$X_k^{\left(R\right)}=\sum _{l=1}^k{M}_{l-1}{R}_l\left(X\right),$$ (21)

$$X_{k-1}^{\left(Q\right)}=\sum _{l=1}^{k-1}{M}_l{Q}_l\left(X\right).$$ (22)

Let us draw attention to Equations (21) and (22). It is evident that the number $X_k^{\left(R\right)}$ is represented by the k-tuple $\left(x_k^{\left(R\right)},x_{k-1}^{\left(R\right)},\cdots ,x_1^{\left(R\right)}\right)$ of mixed-radix digits, where $x_l^{\left(R\right)}=R_l\left(X\right)$, $l=1,2,\cdots ,k$ (see Equation (5)). At the same time, $x_l^{\left(R\right)}\in {\mathbf{Z}}_{m_l}$ and $X_k^{\left(R\right)}\le M_k-1$.

Bearing in mind that $Q_1\left(X\right)=0$, the number $X_{k-1}^{\left(Q\right)}$ can be written as

$$X_{k-1}^{\left(Q\right)}=\sum _{l=1}^{k-1}{M}_{l-1}{Q}_l^{{}^{\prime }}\left(X\right),$$ (23)

where $Q_1^{{}^{\prime }}\left(X\right)=0$, $Q_2^{{}^{\prime }}\left(X\right)=Q_1\left(X\right)=0$, and $Q_l^{{}^{\prime }}\left(X\right)=Q_{l-1}\left(X\right)$ for $l\ge 3$. Therefore, taking into account (19), the integer $Q_l^{{}^{\prime }}\left(X\right)$ can be calculated as

$$Q_l^{{}^{\prime }}\left(X\right)=⌊\frac{1}{m_{l-1}}\sum _{i=1}^{l-1}{R}_{i,l-1}\left({\chi }_i\right)⌋\left(l=3,4,\cdots ,k\right).$$ (24)

Hence, $Q_l^{{}^{\prime }}\left(X\right)<l-1$ since $R_{i,l-1}\left({\chi }_i\right)\le m_{l-1}-1$.

Thus, the integer $X_{k-1}^{\left(Q\right)}$ (see Equations (23) and (5)) can be represented by a k-tuple $\left(x_k^{\left(Q\right)},x_{k-1}^{\left(Q\right)},\cdots ,x_1^{\left(Q\right)}\right)$ of mixed-radix digits under the condition that $x_l^{\left(Q\right)}\in {\mathbf{Z}}_{m_l}\left(l=1,2,\cdots ,k\right)$, where $x_1^{\left(Q\right)}=x_2^{\left(Q\right)}=0,x_l^{\left(Q\right)}=Q_l^{{}^{\prime }}\left(X\right)$ for $l>2$. Consequently, that entails the fulfillment of the condition ${\mathbf{Z}}_{l-1}\subset {\mathbf{Z}}_{m_l}$, which leads to inequality

$$m_l\ge l-1\left(l=1,2,\cdots ,k\right).$$ (25)

Thus, when the moduli set $\left\{m_1,m_2,\cdots ,m_k\right\}$ meets the conditions (25), we have that $X_{k-1}^{\left(Q\right)}<M_k$.

Note that the integer $X_{k-1}^{\left(Q\right)}$ is a multiple of the number $M_2=m_1{m}_2$ because of $x_1^{\left(Q\right)}=x_2^{\left(Q\right)}=0$ (see Equation (5)).

Now, let us return to Equation (20). According to Euclid’s Division Lemma, the sum of two mixed-radix numbers $X_k^{\left(R\right)}$ and $X_{k-1}^{\left(Q\right)}$ results in

$$X_k^{\left(R\right)}+X_{k-1}^{\left(Q\right)}={\left|X_k^{\left(R\right)}+X_{k-1}^{\left(Q\right)}\right|}_{M_k}+M_k⌊\frac{X_k^{\left(R\right)}+X_{k-1}^{\left(Q\right)}}{M_k}⌋.$$ (26)

Hence, substituting (26) into (20), we obtain

$$X_k={\left|X_k^{\left(R\right)}+X_{k-1}^{\left(Q\right)}\right|}_{M_k}+M_k\left(Q_k\left(X\right)+⌊\frac{X_k^{\left(R\right)}+X_{k-1}^{\left(Q\right)}}{M_k}⌋\right).$$ (27)

Taking into account the rank form of the number X (4), from (27) we have

$$X={\left|X_k^{\left(R\right)}+X_{k-1}^{\left(Q\right)}\right|}_{M_k}.$$ (28)

From (28), it follows that the mixed-radix representation of the number X, i.e., k-tuple $\left(x_k,x_{k-1},\cdots ,x_1\right)$, can be calculated as a result of the addition of two mixed-radix numbers $X_k^{\left(R\right)}=\left(x_k^{\left(R\right)},x_{k-1}^{\left(R\right)},\cdots ,x_1^{\left(R\right)}\right)$ and $X_{k-1}^{\left(Q\right)}=\left(x_k^{\left(Q\right)},x_{k-1}^{\left(Q\right)},\cdots ,x_1^{\left(Q\right)}\right)$ (see (21) and (23)) in the basis $\left\{m_1,m_2,\cdots ,m_k\right\}$. Note that $x_1^{\left(R\right)}={\chi }_1$, $x_1^{\left(Q\right)}=x_2^{\left(Q\right)}=0$. At the same time, the digits $x_2^{\left(R\right)},x_3^{\left(R\right)},\cdots ,x_k^{\left(R\right)}$ and $x_3^{\left(Q\right)},x_4^{\left(Q\right)},\cdots ,x_k^{\left(Q\right)}$ are calculated as the sum of the residues $R_{1,l}\left({\chi }_1\right),R_{2,l}\left({\chi }_2\right),\cdots ,R_{l,l}\left({\chi }_l\right)$ modulo $m_l$ along with the counting of occurred overflows according to (18) and (24) $\left(l=2,3,\cdots ,k\right)$.

Therefore, the mixed-radix digits $x_l^{\left(R\right)}$ and $x_l^{\left(Q\right)}$ are computed as

$$x_1^{\left(R\right)}={\chi }_1,x_l^{\left(R\right)}={\left|\sum _{i=1}^l{R}_{i,l}\left({\chi }_i\right)\right|}_{m_l}\left(l=2,3,\cdots ,k\right),$$ (29)

$$x_1^{\left(Q\right)}=x_2^{\left(Q\right)}=0,x_l^{\left(Q\right)}=⌊\frac{1}{m_{l-1}}\sum _{i=1}^{l-1}{R}_{i,l-1}\left({\chi }_i\right)⌋\left(l=3,4,\cdots ,k\right),$$ (30)

where

$$R_{i,l}\left({\chi }_i\right)={\left|-\frac{{\left|M_{i,l-1}^{-1}{\chi }_i\right|}_{m_i}}{m_i}\right|}_{m_l}\left(i\ne l\right),$$ (31)

$$R_{l,l}\left({\chi }_l\right)={\left|M_{l-1}^{-1}{\chi }_l\right|}_{m_l}\left(l=2,3,\cdots ,k\right).$$ (32)

Furthermore, in the MRS with the bases $m_1,m_2,\cdots ,m_k$, we calculate the sum of two numbers $X_k^{\left(R\right)}$ and $X_{k-1}^{\left(Q\right)}$. As a result, we obtain the mixed-radix representation $\left(x_k,x_{k-1},\cdots ,x_1\right)$ of the number X.

Table 1 given below presents the pre-calculation components (see Equations (31) and (32)). It should be recalled that $〈R_{1,1}\left({\chi }_1\right)〉={\chi }_1$. The abbreviation LUT means lookup table. The bit-length of residues is $b_l=⌈{\log }_2{m}_l⌉$$\left(l=1,2,\cdots ,k\right)$. Here, and further, $⌈x⌉$ denotes the smallest integer greater than or equal to x.

Table 1.

The pre-calculation components.

Input Residue	Number and Skope of LUTs	Output Residue Set
${\chi }_1$	$k-1$,   $2^{b_1}\times b_l$ $\left(l=2,3,\cdots ,k\right)$	$〈R_{1,2}\left({\chi }_1\right),R_{1,3}\left({\chi }_1\right),\cdots ,R_{1,k}\left({\chi }_1\right)〉$
${\chi }_2$	$k-1$,   $2^{b_2}\times b_l$ $\left(l=2,3,\cdots ,k\right)$	$〈R_{2,2}\left({\chi }_2\right),R_{2,3}\left({\chi }_2\right),\cdots ,R_{2,k}\left({\chi }_2\right)〉$
⋯	⋯	⋯
${\chi }_{k-1}$	2,   $2^{b_{k-1}}\times b_l$ $\left(l=k-1,k\right)$	$〈R_{k-1,k-1}\left({\chi }_{k-1}\right),R_{k-1,k}\left({\chi }_{k-1}\right)〉$
${\chi }_k$	1,   $2^{b_k}\times b_k$	$〈R_{k,k}\left({\chi }_k\right)〉$

Table 2 presents the results of calculations in the modular channels according to Equations (29) and (30). It should be reminded that in the first modular channel corresponding to the modulus $m_1$, the calculations are not carried out, so $x_1^{\left(R\right)}={\chi }_1$ and $x_2^{\left(Q\right)}=0$.

Table 2.

The results of calculations in the modular channels.

Modular Channel	Input Data	Output Data
$m_2$	$〈R_{1,2}\left({\chi }_1\right),R_{2,2}\left({\chi }_2\right)〉$	$x_2^{\left(R\right)}$,   $x_3^{\left(Q\right)}$
$m_3$	$〈R_{1,3}\left({\chi }_1\right),R_{2,3}\left({\chi }_2\right),R_{3,3}\left({\chi }_3\right)〉$	$x_3^{\left(R\right)}$,   $x_4^{\left(Q\right)}$
⋯	⋯	⋯
$m_{k-1}$	$〈R_{1,k-1}\left({\chi }_1\right),R_{2,k-1}\left({\chi }_2\right),\cdots ,R_{k-1,k-1}\left({\chi }_{k-1}\right)〉$	$x_{k-1}^{\left(R\right)}$,   $x_k^{\left(Q\right)}$
$m_k$	$〈R_{1,k}\left({\chi }_1\right),R_{2,k}\left({\chi }_2\right),\cdots ,R_{k,k}\left({\chi }_k\right)〉$	$x_k^{\left(R\right)}$

The stated above allows us to formulate the following substantial theorem.

Theorem 1.

(About RNS-to-MRS reverse conversion).

Let an arbitrary RNS be defined by an ascending-ordered set of k pairwise relatively prime moduli $m_1,m_2,\cdots ,m_k$ ($m_l\ge l-1$, $l=1,2,\cdots ,k$, $k\ge 2$), and let the residue code $\left({\chi }_1,{\chi }_2,\cdots ,{\chi }_k\right)$ of the number $X\in {\mathbf{Z}}_{M_k}$ be given. Then, the mixed-radix representation $\left(x_k,x_{k-1},\cdots ,x_1\right)$ of the number X can be computed as a result of the summation of two mixed-radix numbers, namely, the appropriate number $X_k^{\left(R\right)}=\left(x_k^{\left(R\right)},x_{k-1}^{\left(R\right)},\cdots ,x_1^{\left(R\right)}\right)$ and the correction number $X_{k-1}^{\left(Q\right)}=\left(x_k^{\left(Q\right)},x_{k-1}^{\left(Q\right)},\cdots ,x_1^{\left(Q\right)}\right)$, where the digits $x_l^{\left(R\right)}$ and $x_l^{\left(Q\right)}$$\left(l=1,2,\cdots ,k\right)$ are calculated according to (29) and (30), respectively, taking into account (31) and (32).

5. A Numerical Example of the Proposed Conversion Method

The main idea of the proposed approach to reverse conversion is illustrated below by a simple numerical example. For convenience, we consider a four-moduli RNS.

Example 1.

Let the RNS moduli-set be $\left\{m_1,m_2,m_3,m_4\right\}$ = $\left\{5,7,9,11\right\}$. Suppose that we wish to calculate the digits of the mixed-radix representation $\left(x_4,x_3,x_2,x_1\right)$ of the given number X by its residue code $\left({\chi }_1,{\chi }_2,{\chi }_3,{\chi }_4\right)=(3,6,4,2)$.

Step 1 . The calculation of the primitive constants in a given RNS.

$M_4=3465,M_3=315,M_2=35,M_1=5,M_0=1,$

$M_{1,4}=693,M_{2,4}=495,M_{3,4}=385,M_{4,4}=315,$

${\left|M_{1,4}^{-1}\right|}_{m_1}=2,{\left|M_{2,4}^{-1}\right|}_{m_2}=3,{\left|M_{3,4}^{-1}\right|}_{m_3}=4,{\left|M_{4,4}^{-1}\right|}_{m_4}=8,$

${\left|m_1^{-1}\right|}_{m_4}=9,{\left|m_2^{-1}\right|}_{m_4}=8,{\left|m_3^{-1}\right|}_{m_4}=5,{\left|M_3^{-1}\right|}_{m_4}=8,$

$M_{1,3}=63,M_{2,3}=45,M_{3,3}=35,$

${\left|M_{1,3}^{-1}\right|}_{m_1}=2,{\left|M_{2,3}^{-1}\right|}_{m_2}=5,{\left|M_{3,3}^{-1}\right|}_{m_3}=8,$

${\left|m_1^{-1}\right|}_{m_3}=2,{\left|m_2^{-1}\right|}_{m_3}=4,{\left|M_2^{-1}\right|}_{m_3}=8,$

$M_{1,2}=7,M_{2,2}=5,$

${\left|M_{1,2}^{-1}\right|}_{m_1}=3,{\left|M_{2,2}^{-1}\right|}_{m_2}=3,$

${\left|m_1^{-1}\right|}_{m_2}=3,{\left|M_1^{-1}\right|}_{m_2}=3.$

Step 2 . The calculation of the residue sets $〈R_{1,l}\left({\chi }_1\right),R_{2,l}\left({\chi }_2\right),\cdots ,R_{l,l}\left({\chi }_l\right)〉$ according to (31) and (32) $\left(l=1,2,3,4\right)$.

We obtain

$R_{1,1}\left({\chi }_1\right)={\chi }_1=3,$

$R_{1,2}\left({\chi }_1\right)={\left|-{\left|1·3\right|}_5·3\right|}_7=5,$

$R_{2,2}\left({\chi }_2\right)={\left|3·6\right|}_7=4,$

$R_{1,3}\left({\chi }_1\right)={\left|-{\left|3·3\right|}_5·2\right|}_9=1,$

$R_{2,3}\left({\chi }_2\right)={\left|-{\left|3·6\right|}_7·4\right|}_9=2,$

$R_{3,3}\left({\chi }_3\right)={\left|8·4\right|}_9=5,$

$R_{1,4}\left({\chi }_1\right)={\left|-{\left|2·3\right|}_5·9\right|}_{11}=2,$

$R_{2,4}\left({\chi }_2\right)={\left|-{\left|5·6\right|}_7·8\right|}_{11}=6,$

$R_{3,4}\left({\chi }_3\right)={\left|-{\left|8·4\right|}_9·5\right|}_{11}=8,$

$R_{4,4}\left({\chi }_4\right)={\left|8·2\right|}_{11}=5.$

As a result, the following sets of residues occur

$〈R_{1,1}\left({\chi }_1\right)〉=〈3〉,$

$〈R_{1,2}\left({\chi }_1\right),R_{2,2}\left({\chi }_2\right)〉=〈5,4〉,$

$〈R_{1,3}\left({\chi }_1\right),R_{2,3}\left({\chi }_2\right),R_{3,3}\left({\chi }_3\right)〉=〈1,2,5〉,$

$〈R_{1,4}\left({\chi }_1\right),R_{2,4}\left({\chi }_2\right),R_{3,4}\left({\chi }_3\right),R_{4,4}\left({\chi }_4\right)〉=〈2,6,8,5〉.$

Step 3. The summation of the residues $R_{1,l}\left({\chi }_1\right),R_{2,l}\left({\chi }_2\right),\cdots ,R_{l,l}\left({\chi }_l\right)$ modulo $m_l$ along with the counting of occurring overflows according to (18) and (19), respectively $\left(l=2,3,4\right)$.

Recall that $R_1\left(X\right)=R_{1,1}\left({\chi }_1\right)=3$, and $Q_1\left(X\right)=0$. We have

$R_2\left(X\right)={\left|5+4\right|}_7={\left|9\right|}_7=2,$

$R_3\left(X\right)={\left|1+2+5\right|}_9={\left|8\right|}_9=8,$

$R_4\left(X\right)={\left|2+6+8+5\right|}_{11}={\left|21\right|}_{11}=10,$

$Q_2\left(X\right)=⌊\left(5+4\right)/7⌋=⌊9/7⌋=1,$

$Q_3\left(X\right)=⌊\left(1+2+5\right)/9⌋=⌊8/9⌋=0,$

$Q_4\left(X\right)=⌊\left(2+6+8+5\right)/11⌋=⌊21/11⌋=1.$

Therefore, the mixed-radix representations of the numbers $X_4^{\left(R\right)}$ and $X_3^{\left(Q\right)}$ (see (21) and (23)) are computed:

$\left(x_4^{\left(R\right)},x_3^{\left(R\right)},x_2^{\left(R\right)},x_1^{\left(R\right)}\right)=\left(R_4\left(X\right),R_3\left(X\right),R_2\left(X\right),R_1\left(X\right)\right)=\left(10,8,2,3\right),$

$\left(x_4^{\left(Q\right)},x_3^{\left(Q\right)},x_2^{\left(Q\right)},x_1^{\left(Q\right)}\right)=\left(Q_3\left(X\right),Q_2\left(X\right),0,0\right)=\left(0,1,0,0\right)$.

Step 4. The calculation of the mixed-radix digits $\left(x_4,x_3,x_2,x_1\right)$.

The addition of two numbers $X_4^{\left(R\right)}=\left(10,8,2,3\right)$ and $X_3^{\left(Q\right)}=\left(0,1,0,0\right)$ according to (28) gives the mixed-radix representation $\left(0,0,2,3\right)$ of the number X.

Let us now verify the obtained result. According to (5), we have

$$X=\left(0,0,2,3\right)=0·315+0·35+2·5+3=13.$$

This result holds because the residue code of the integer number $X=13$ is $3,6,4,2$, since ${\left|13\right|}_5=3$, ${\left|13\right|}_7=6$, ${\left|13\right|}_9=4$, ${\left|13\right|}_{11}=2$. Thus, this result coincides with the condition of the example.

6. The Computational Cost of the Reverse Conversion Method

As it follows from the results mentioned above, the calculation of the mixed-radix digits $x_1$, $x_2$, ⋯, $x_k$ reduces to the independent and parallel summation of small residues $R_{1,l}\left({\chi }_1\right)$, $R_{2,l}\left({\chi }_2\right)$, ⋯, $R_{l,l}\left({\chi }_l\right)$ modulo $m_l$ in lth modular channel $\left(l=1,2,\cdots ,k\right)$, taking into account the number of the overflows occuring during the modular addition operations (see (29)–(32)).

Let us evaluate the time required to perform the parallel reverse conversion.

First, we consider the calculation of mixed-radix digits of the numbers $X_k^{\left(R\right)}=\left(x_k^{\left(R\right)},x_{k-1}^{\left(R\right)},\cdots ,x_1^{\left(R\right)}\right)$ and $X_{k-1}^{\left(Q\right)}=\left(x_k^{\left(Q\right)},x_{k-1}^{\left(Q\right)},\cdots ,x_1^{\left(Q\right)}\right)$ (see (29) and (30)). As can be seen, there are no modular addition operations in the first modular channel corresponding to the modulus $m_1$. In the second channel, we have only one addition operation modulo $m_2$. Furthermore, two additions modulo $m_3$ are performed in the third channel and so on. Thus, in the lth modular channel, we have $l-1$ additions modulo $m_l$$\left(l=2,3,\cdots ,k\right)$. These calculations are easily parallelized and pipelined. Therefore, the required computation time for calculating digits $x_l^{\left(R\right)}$ and $x_l^{\left(Q\right)}$ is $T_l=⌈{\log }_{2}l⌉$ modular clock cycles.

Thus, the time for obtaining the mixed-radix representations of the numbers $X_k^{\left(R\right)}$ and $X_{k-1}^{\left(Q\right)}$ is determined by the time in the kth modular channel and equals $T_k=⌈{\log }_{2}k⌉$ modular clock cycles.

The summation of $X_k^{\left(R\right)}$ and $X_{k-1}^{\left(Q\right)}$ on the bases $\left\{m_1,m_2,\cdots ,m_k\right\}$ involves two additional modular clock cycles taking into account the inter-digit carries. Therefore, the execution time of the reverse conversion equals $T_{conv}=T_k+2$ modular clock cycles. Thus, the overall time is $t_{conv}=T_{conv}{t}_{mod}$, where $t_{mod}$ denotes the modular clock cycle time. At the same time, when pipelined, the throughput rate of the proposed conversion method is one conversion in one modular clock cycle.

Consider now the evaluation of the required computational cost. Due to the small word-length of residues in the k-tuple $({\chi }_1,{\chi }_2,\cdots ,{\chi }_k)$, the pre-computation and lookup table techniques are suitable for reverse conversion implementation. So, we can use one-input lookup tables depending on the residues word-length in each modular channel.

At the beginning stage of the reverse conversion, in the lth channel corresponding to the modulus $m_l$, the number of lookup tables required to store the residue set $〈R_{1,l}\left({\chi }_1\right),R_{2,l}\left({\chi }_2\right),\cdots ,R_{l,l}\left({\chi }_l\right)〉$ equals $N_{lut}\left(l\right)=l$. At the same time, the word length of recorded residues is $b_l=⌈{\log }_2{m}_l⌉$ bits $\left(l=2,3,\cdots ,k\right)$. In the first modular channel, $N_{lut}\left(1\right)=0$ since $S_1\left(X\right)={\chi }_1$.

Then, the overall number of one-input lookup tables in all modular channels is equal to

$$\begin{array}{c}\hfill N_{lut}=\sum _{l=2}^k{N}_{lut}\left(l\right)=\frac{k^2+k-2}{2}.\end{array}$$

The summation of the residues $R_{1,l}\left({\chi }_1\right),R_{2,l}\left({\chi }_2\right),\cdots ,R_{l,l}\left({\chi }_l\right)$ modulo $m_l$ requires $N_{add}\left(l\right)=l-1$ modular addition operations $\left(l=2,3,\cdots ,k\right)$. At the same time, all independent calculations are realized in parallel in corresponding modular channels.

Taking into account that $x_1^{\left(Q\right)}=x_2^{\left(Q\right)}=0$, the summation of two numbers $X_k^{\left(R\right)}=\left(x_k^{\left(R\right)},x_{k-1}^{\left(R\right)},\cdots ,x_1^{\left(R\right)}\right)$ and $X_{k-1}^{\left(Q\right)}=\left(x_k^{\left(Q\right)},x_{k-1}^{\left(Q\right)},\cdots ,x_1^{\left(Q\right)}\right)$ on the final stage of the reverse conversion requires $2\left(k-2\right)$ modular addition operations.

Hence, the overall number of modular addition operations in all modular channels is equal to

$$\begin{array}{c}\hfill N_{add}=\sum _{l=2}^k{N}_{add}\left(l\right)+2\left(k-2\right)=\frac{k^2+3k-8}{2}.\end{array}$$

When pipelined, the throughput rate of the proposed method is one reverse conversion in one modular clock cycle.

7. Discussion

As it follows from [1], the calculation of the mixed-radix digits $x_1,x_2,\cdots ,x_k$ (see (6) and (7)) requires $k-1$ both addition and multiplication operations; in this case, the overall conversion time is $k\left(k-1\right)/2·\left(t_{add}+t_{mul}\right)$, where $t_{add}$ and $t_{mul}$ denote an execution time of addition/subtraction and multiplication, respectively. The computational cost of the pipelined implementation of this algorithm is $k\left(k-1\right)/2$, both multiplication and addition operations, while the conversion time is $\left(k-1\right)\left(t_{add}+t_{mul}\right)$. The main drawback of this method is its strictly sequential nature.

The parallel conversion method circumscribed in [16] uses the additional lookup tables. At the same time, $k(k+1)/2$ lookup tables and $k(k+1)/2$ adders are required. The conversion time is $t_{lut}+\left(k-1\right)t_{add}$ due to the need to generate the inter-digit carries when performing addition operations. As noted in [34], the method proposed in [16] does not allow obtaining the claimed depth of $O\left({\log }_{2}k\right)$ in terms of RNS processing elements. In this regard, an improved method was proposed by adding extra $k(k+1)/2$ multipliers to hardware resources used in [16]. The implementation time is $t_{lut}+t_{mul}+\left(2{\log }_{2}k+1\right)t_{add}$. Hence, the time complexity of this conversion algorithm is $O\left({\log }_{2}k\right)$.

In [15], the mixed-radix conversion is realized by the cascaded scheme of lookup tables and adders. The computational cost for the sequential implementation is $k(k-2)/4$ double-size lookup tables and $k(k-2)/4$ adders, while the conversion time equals $\left(k/2\right)·$$\left(t_{lut}+t_{add}\right)$. When pipelined, the throughput rate is determined by the time equals $t_{lut}+t_{add}$. This method works well when the used moduli do not have a very large word-length, since the size of lookup tables increases significantly with a word-length growth.

The paper [17] presents the parallel reverse conversion method, which uses the lookup table technique and requires no arithmetic or logical units. As reported, this algorithm is better than the ones presented in [15,16]. It is based on solving $k(k-1)/2$ linear Diophantine Equations and requires $k(k-1)/2$ lookup tables of size $m_i\times m_j$, while a conversion time is $\left(k-1\right)t_{lut}$. When pipelined, its effective conversion rate is one conversion per $t_{lut}$. So, this method is attractive for DSP implementation. However, it is not suitable for implementing cryptographic applications because of the enormous size of the required lookup tables, especially when processing large numbers.

In the paper [9], the reverse conversion method is based on modular reduction by a modified canonic CRT algorithm. This enables minimizing the bit-width of intermediate data processing. The lookup tables translate the $b_i$-bit input residues $\left(i=1,2,\cdots ,k\right)$ into $b_{out}$-bit output integers, where $b_i=⌈{\log }_2{m}_i⌉$, $b_{out}=⌈\frac{1}{2}{\log }_2\left({\sum }_{i=1}^k{b}_i\right)⌉$, and k is the number of RNS moduli. As a result, the modular reduction of the modified k-tuple of $b_{out}$-bits integers is carried out over a ring of size $2b_{out}$ such that only the $b_{out}$ least significant bits of the binary representation are maintained. In this case, all the $b_{out}$-bit outputs in the modified k-tuple are added together by adder tree without regard to overflow, propagating the $b_{out}$ least significant bits to the output. The reverse conversion requires k lookup tables and $k-1$ adders. The scope of used lookup tables is $2^b\times 2^{b_{out}}$, $b\in \{b_1,b_2,\cdots ,b_k\}$. The overall conversion time is $t_{lut}+⌈{\log }_{2}k⌉t_{add}$.

Some reverse conversion methods use the special moduli sets with a limited number of moduli, such as $m=2^n+d$$\left(d\in \left\{-1,0,1\right\}\right)$ [2,8,35,36,37,38,39,40]. Their main drawback consists in a small number of the selected moduli, typically from three to five. These moduli sets are suitable for the efficient implementations of DSP algorithms but completely not applicable for large numbers processing widely used in cryptography. For example, to represent 1024-bit word-length cryptographic numbers using four RNS moduli, each modular channel must have residues of 256-bit length, which is not qualified for high-performance computing.

Table 3 compares the results across multiple techniques of the reverse conversion. Here, we use the following abbreviations: LUT—lookup table, ADD–adder, MUL—multiplier. The bit length $b\in \left\{b_1,b_2,\cdots ,b_k\right\}$, $b_l=⌈{\log }_2{m}_l⌉$$\left(l=1,2,\cdots ,k\right)$.

Table 3.

RNS-to-MRS reverse conversion methods.

Method	Number and Scope of LUTs	ADD	MUL	Conversion Time
[1],
sequential	–	$k-1$	$k-1$	$\frac{k\left(k-1\right)}{2}\left(t_{mul}+t_{add}\right)$
[1],
sequential,
pipelined	$\frac{k\left(k-1\right)}{2}$;  $2^{\left(b+1\right)}\times b$	$\frac{k\left(k-1\right)}{2}$	–	$\left(k-1\right)\left(t_{lut}+t_{add}\right)$
[16],
parallel	$\frac{k\left(k+1\right)}{2}$;  $2^b\times b$	$\frac{k\left(k+1\right)}{2}$	–	$t_{lut}+\left(k-1\right)t_{add}$
[34],
parallel	$\frac{k\left(k+1\right)}{2}$;  $2^b\times b$	$\frac{k\left(k+1\right)}{2}$	$\frac{k\left(k+1\right)}{2}$	$t_{lut}+t_{mul}+\left(2{\log }_{2}k+1\right)t_{add}$
[15],
sequential	$\frac{k\left(k-2\right)}{4}$;  $2^{2b}\times 2b$	$\frac{k\left(k-1\right)}{4}$	–	$\frac{k}{2}\left(t_{lut}+t_{add}\right)$
[15],
parallel	$\frac{k\left(k-2\right)}{4}+k-1$;  $2^{2b}\times 2b$	$\frac{k\left(k+2\right)}{4}-3$	–	$t_{lut}+\frac{k}{2}{t}_{add}$
[17],
parallel	$\frac{k\left(k-1\right)}{2}$;  $2^{2b}\times b$	–	–	$\left(k-1\right)t_{lut}$
[9]	k;  $2^b\times 2^{⌈\frac{1}{2}{\log }_2\left(kb\right)⌉}$	$k-1$	–	$t_{lut}+\left(⌈{\log }_{2}k⌉\right)t_{add}$
Our method,
parallel	$\frac{k^2+k-2}{2}$;  $2^b\times b$	$\frac{k^2+3k-8}{2}$	–	$\left(⌈{\log }_{2}k⌉+2\right)t_{mod}$

As seen from above, the proposed parallel reverse conversion method has time complexity of the order $O\left(⌈{\log }_{2}k⌉\right)$. In pipelined mode, it enables the high throughput rate and has one reverse conversion in one modular clock cycle. At the same time, the computational complexity is of the order of $O(k^2/2)$ in terms of the number of both required arithmetic operations and one-input lookup tables.

8. Conclusions

In this paper, a novel approach to parallel reverse conversion of the residue code $\left({\chi }_1,{\chi }_2,\cdots ,{\chi }_k\right)$ of the number X to mixed-radix representation $\left(x_k,x_{k-1},\cdots ,x_1\right)$ is described.

The calculation of the mixed-radix digits $\left(x_k,x_{k-1},\cdots ,x_1\right)$ is reduced to a parallel summation of the small word-length residues $R_{1,l}\left({\chi }_1\right)$, $R_{2,l}\left({\chi }_2\right)$, ⋯, $R_{l,l}\left({\chi }_l\right)$ modulo $m_l$ in lth modular channel $\left(l=1,2,\cdots ,k\right)$, taking into account the number of the overflows occuring during the modular addition operations. These modular operations are performed fast and independently in each modular channel and easily pipelined.

The computational cost of the proposed reverse conversion method is presented. In all modular channels, the general number of modular addition operations is equal to $N_{add}=\left(k^2+3k-8\right)/2$. At the same time, the summary number of reqiured one-input lookup tables makes up $N_{lut}=\left(k^2+k-2\right)/2$.

The execution time of the reverse conversion equals $T_{conv}=⌈{\log }_{2}k⌉+2$ modular clock cycles. At the same time, when pipelined, the throughput rate of the proposed conversion method is one conversion in one modular clock cycle.

The proposed parallel reverse conversion method coincides with the development vector of modern high-performance computing using residue arithmetic. It can find a widespread application for implementing a broad class of tasks in various areas of science and technology, first of all, in digital signal processing and cryptography.

Author Contributions

Conceptualization, M.S.; investigation, Y.P.; methodology, M.S.; writing—original draft preparation, M.S.; writing—review and editing, Y.P. All authors have read and improved the final version of the manuscript.

Funding

This research received no external funding.

Data Availability Statement

Not applicable.

Conflicts of Interest

The authors declare no conflict of interest.