Subtract with carry

The subtract-with-carry algorithm's state is defined by a list of R numbers and a "carry" value, where R is the "long lag". The initial values for this state, known as the "seed," can be chosen arbitrarily.

To generate the next number in the sequence, the algorithm uses two values from its state list: the value at the "short lag" position (S steps ago) and the value at the "long lag" position (R steps ago). The new number is calculated by subtracting the long-lag value and the current carry bit from the short-lag value.^[3]

If this subtraction results in a negative number (a "borrow"), the result is adjusted by adding a large constant M (the modulus), and the carry for the next step is set to 1. Otherwise, the carry is set to 0. The newly generated number replaces the oldest number in the list, and the process repeats.

A simple example can illustrate the process. Let the parameters be:

• Modulus M = 10
• Long lag R = 3
• Short lag S = 1
• Initial state (seed): a list of 3 numbers ${\displaystyle x=(x_{0},x_{1},x_{2})=(6,8,3)}$ and an initial carry ${\displaystyle c_{2}=0}$.

To generate the next number, ${\displaystyle x_{3}}$:

1. Identify the short-lag value ${\displaystyle x_{3-S}=x_{2}=3}$ and the long-lag value ${\displaystyle x_{3-R}=x_{0}=6}$.
2. Perform the subtraction: ${\displaystyle x_{2}-x_{0}-c_{2}}$ → ${\displaystyle 3-6-0=-3}$.
3. Since the result is negative, a borrow occurs. The new carry ${\displaystyle c_{3}}$ becomes 1.
4. The new number ${\displaystyle x_{3}}$ is the result modulo M: ${\displaystyle -3\mod 10=7}$.
5. The state is updated. The list becomes ${\displaystyle (x_{1},x_{2},x_{3})=(8,3,7)}$, and the carry is now 1 for the next step.

This process can be repeated to generate a long sequence of pseudorandom numbers.

The sequence generated by the subtract-with-carry engine is described by the recurrence relation:

${\displaystyle x(i)=(x(i-S)-x(i-R)-cy(i-1))\ {\bmod {\ }}M}$

where the new carry, ${\displaystyle cy(i)}$, is defined as:

${\displaystyle cy(i)={\begin{cases}1,&{\text{if }}x(i-S)-x(i-R)-cy(i-1)<0\\0,&{\text{otherwise}}\end{cases}}}$

The lags must satisfy the condition ${\displaystyle 0<S<R}$. The modulus M is typically a power of 2, such as ${\displaystyle M=2^{W}}$, where W is the word size of the state sequence in bits.^[1]