Reed–Solomon error correction

History

Reed–Solomon codes were developed in 1960 by Irving S. Reed and Gustave Solomon, who were then staff members of MIT Lincoln Laboratory. Their seminal article was titled "Polynomial Codes over Certain Finite Fields." (Reed & Solomon 1960). The original encoding scheme described in the Reed Solomon article used a variable polynomial based on the message to be encoded, which made decoding impractical for all but the simplest of cases. This was resolved by changing the encoding scheme to use a fixed polynomial known to both encoder and decoder. A practical decoder developed by Daniel Gorenstein and Neal Zierler was described in an MIT Lincoln Laboratory report by Zierler in January 1960 and later in a paper in June 1961. During the same period, work was also being done on BCH codes and Reed-Solomon codes were considered as a special class of BCH codes at the time. The Gorenstein-Zierler decoder and the related work on BCH codes are described in a book Error Correcting Codes by W. Wesley Peterson (1961).

An improved decoder was developed in 1969 by Elwyn Berlekamp and James Massey, and is since known as the Berlekamp–Massey decoding algorithm. Another improved decoder was developed in 1975 by Yasuo Sugiyama, based on the extended Euclidean algorithm.

In 1977, Reed–Solomon codes were implemented in the Voyager program in the form of concatenated error correction codes. The first commercial application in mass-produced consumer products appeared in 1982 with the compact disc, where two interleaved Reed–Solomon codes are used. Today, Reed–Solomon codes are widely implemented in digital storage devices and digital communication standards, though they are being slowly replaced by more modern low-density parity-check (LDPC) codes or turbo codes. For example, Reed–Solomon codes are used in the Digital Video Broadcasting (DVB) standard DVB-S, but LDPC codes are used in its successor, DVB-S2.

Data storage

Reed–Solomon coding is very widely used in mass storage systems to correct the burst errors associated with media defects.

Reed–Solomon coding is a key component of the compact disc. It was the first use of strong error correction coding in a mass-produced consumer product, and DAT and DVD use similar schemes. In the CD, two layers of Reed–Solomon coding separated by a 28-way convolutional interleaver yields a scheme called Cross-Interleaved Reed–Solomon Coding (CIRC). The first element of a CIRC decoder is a relatively weak inner (32,28) Reed–Solomon code, shortened from a (255,251) code with 8-bit symbols. This code can correct up to 2 byte errors per 32-byte block. More importantly, it flags as erasures any uncorrectable blocks, i.e., blocks with more than 2 byte errors. The decoded 28-byte blocks, with erasure indications, are then spread by the deinterleaver to different blocks of the (28,24) outer code. Thanks to the deinterleaving, an erased 28-byte block from the inner code becomes a single erased byte in each of 28 outer code blocks. The outer code easily corrects this, since it can handle up to 4 such erasures per block.

The result is a CIRC that can completely correct error bursts up to 4000 bits, or about 2.5 mm on the disc surface. This code is so strong that most CD playback errors are almost certainly caused by tracking errors that cause the laser to jump track, not by uncorrectable error bursts.

DVDs use a similar scheme, but with much larger blocks, a (208,192) inner code, and a (182,172) outer code.

Reed–Solomon error correction is also used in parchive files which are commonly posted accompanying multimedia files on USENET. The Distributed online storage service Wuala (discontinued in 2015) also used to make use of Reed–Solomon when breaking up files.

Bar code

Almost all two-dimensional bar codes such as PDF-417, MaxiCode, Datamatrix, QR Code, and Aztec Code use Reed–Solomon error correction to allow correct reading even if a portion of the bar code is damaged. When the bar code scanner cannot recognize a bar code symbol, it will treat it as an erasure.

Reed–Solomon coding is less common in one-dimensional bar codes, but is used by the PostBar symbology.

Data transmission

Specialized forms of Reed–Solomon codes, specifically Cauchy-RS and Vandermonde-RS, can be used to overcome the unreliable nature of data transmission over erasure channels. The encoding process assumes a code of RS(N, K) which results in N codewords of length N symbols each storing K symbols of data, being generated, that are then sent over an erasure channel.

Any combination of K codewords received at the other end is enough to reconstruct all of the N codewords. The code rate is generally set to 1/2 unless the channel's erasure likelihood can be adequately modelled and is seen to be less. In conclusion, N is usually 2K, meaning that at least half of all the codewords sent must be received in order to reconstruct all of the codewords sent.

Reed–Solomon codes are also used in xDSL systems and CCSDS's Space Communications Protocol Specifications as a form of forward error correction.

Space transmission

One significant application of Reed–Solomon coding was to encode the digital pictures sent back by the Voyager space probe.

Voyager introduced Reed–Solomon coding concatenated with convolutional codes, a practice that has since become very widespread in deep space and satellite (e.g., direct digital broadcasting) communications.

Viterbi decoders tend to produce errors in short bursts. Correcting these burst errors is a job best done by short or simplified Reed–Solomon codes.

Modern versions of concatenated Reed–Solomon/Viterbi-decoded convolutional coding were and are used on the Mars Pathfinder, Galileo, Mars Exploration Rover and Cassini missions, where they perform within about 1–1.5 dB of the ultimate limit, being the Shannon capacity.

These concatenated codes are now being replaced by more powerful turbo codes.

Constructions

The Reed–Solomon code is actually a family of codes, where every code is characterised by three parameters: an alphabet size q, a block length n, and a message length k, with k < n ≤ q. The set of alphabet symbols is interpreted as the finite field of order q, and thus, q has to be a prime power. In the most useful parameterizations of the Reed–Solomon code, the block length is usually some constant multiple of the message length, that is, the rate R = k/n is some constant, and furthermore, the block length is equal to or one less than the alphabet size, that is, n = q or n = q − 1.

Reed & Solomon's original view: The codeword as a sequence of values

There are different encoding procedures for the Reed–Solomon code, and thus, there are different ways to describe the set of all codewords. In the original view of Reed & Solomon (1960), every codeword of the Reed–Solomon code is a sequence of function values of a polynomial of degree less than k. One issue with this view is that decoding and checking for errors is not practical except for the simplest of cases. In order to obtain a codeword of the Reed–Solomon code, the message is interpreted as the description of a polynomial p of degree less than k over the finite field F with q elements. In turn, the polynomial p is evaluated at n distinct points a 1 , … , a n of the field F, and the sequence of values is the corresponding codeword. Formally, the set C of codewords of the Reed–Solomon code is defined as follows:

C = { ( p ( a 1 ) , p ( a 2 ) , … , p ( a n ) ) | p  is a polynomial over  F  of degree  < k } .

Since any two distinct polynomials of degree less than k agree in at most k − 1 points, this means that any two codewords of the Reed–Solomon code disagree in at least n − ( k − 1 ) = n − k + 1 positions. Furthermore, there are two polynomials that do agree in k − 1 points but are not equal, and thus, the distance of the Reed–Solomon code is exactly d = n − k + 1 . Then the relative distance is δ = d / n = 1 − k / n + 1 / n = 1 − R + 1 / n ∼ 1 − R , where R = k / n is the rate. This trade-off between the relative distance and the rate is asymptotically optimal since, by the Singleton bound, every code satisfies δ + R ≤ 1 + 1 / n . Being a code that achieves this optimal trade-off, the Reed–Solomon code belongs to the class of maximum distance separable codes.

While the number of different polynomials of degree less than k and the number of different messages are both equal to q k , and thus every message can be uniquely mapped to such a polynomial, there are different ways of doing this encoding. The original construction of Reed & Solomon (1960) interprets the message x as the coefficients of the polynomial p, whereas subsequent constructions interpret the message as the values of the polynomial at the first k points a 1 , … , a k and obtain the polynomial p by interpolating these values with a polynomial of degree less than k. The latter encoding procedure, while being slightly less efficient, has the advantage that it gives rise to a systematic code, that is, the original message is always contained as a subsequence of the codeword.

In many contexts it is convenient to choose the sequence a 1 , … , a n of evaluation points so that they exhibit some additional structure. In particular, it is useful to choose the sequence of successive powers of a primitive root α of the field F , that is, α is generator of the finite field's multiplicative group and the sequence is defined as a i = α i for all i = 1 , … , q − 1 . This sequence contains all elements of F except for 0 , so in this setting, the block length is n = q − 1 . Then it follows that, whenever p ( a ) is a polynomial over F , then the function p ( α a ) is also a polynomial of the same degree, which gives rise to a codeword that is a cyclic left-shift of the codeword derived from p ( a ) ; thus, this construction of Reed–Solomon codes gives rise to a cyclic code.

Simple encoding procedure: The message as a sequence of coefficients

In the original construction of Reed & Solomon (1960), the message x = ( x 1 , … , x k ) ∈ F k is mapped to the polynomial p x with

p x ( a ) = ∑ i = 1 k x i a i − 1 .

As described above, the codeword is then obtained by evaluating p at n different points a 1 , … , a n of the field F . Thus the classical encoding function C : F k → F n for the Reed–Solomon code is defined as follows:

C ( x ) = ( p x ( a 1 ) , … , p x ( a n ) ) .

This function C is a linear mapping, that is, it satisfies C ( x ) = x ⋅ A for the following ( k × n ) -matrix A with elements from F :

A = [ 1 … 1 a 1 … a n a 1 2 … a n 2 ⋮ ⋱ ⋮ a 1 k − 1 … a n k − 1 ]

This matrix is the transpose of a Vandermonde matrix over F . In other words, the Reed–Solomon code is a linear code, and in the classical encoding procedure, its generator matrix is A .

Systematic encoding procedure: The message as an initial sequence of values

As mentioned above, there is an alternative way to map codewords x to polynomials p x . In this alternative encoding procedure, the polynomial p x is the unique polynomial of degree less than k such that

p x ( a i ) = x i holds for all i = 1 , … , k .

To compute this polynomial p x from x , one can use Lagrange interpolation. Once it has been found, it is evaluated at the other points a k + 1 , … , a n of the field. The alternative encoding function C : F k → F n for the Reed–Solomon code is then again just the sequence of values:

C ( x ) = ( p x ( a 1 ) , … , p x ( a n ) ) .

This time, however, the first k entries of the codeword are exactly equal to x , so this encoding procedure gives rise to a systematic code. It can be checked that the alternative encoding function is a linear mapping as well.

Theoretical decoding procedure

Reed & Solomon (1960) described a theoretical decoder that corrected errors by finding the most popular message polynomial. The decoder only knows the set of values a 1 to a n and which encoding method was used to generate the codeword's sequence of values. The original message, the polynomial, and any errors are unknown. A decoding procedure could use a method like Lagrange interpolation on various subsets of n codeword values taken k at a time to repeatedly produce potential polynomials, until a sufficient number of matching polynomials are produced to reasonably eliminate any errors in the received codeword. Once a polynomial is determined, then any errors in the codeword can be corrected, by recalculating the corresponding codeword values. Unfortunately, in all but the simplest of cases, there are too many subsets, so the algorithm is impractical. The number of subsets is the binomial coefficient, ( n k ) = n ! ( n − k ) ! k ! , and the number of subsets is infeasible for even modest codes. For a ( 255 , 249 ) code that can correct 3 errors, the naive theoretical decoder would examine 359 billion subsets. Practical decoding involved changing the view of codewords to be a sequence of coefficients as explained in the next section.

The BCH view: The codeword as a sequence of coefficients

In this view, the sender again maps the message x to a polynomial p x , and for this, any of the two mappings above can be used (where the message is either interpreted as the coefficients of p x or as the initial sequence of values of p x ). Once the sender has constructed the polynomial p x in some way, however, instead of sending the values of p x at all points, the sender computes some related polynomial s of degree at most n − 1 for n = q − 1 and sends the n coefficients of that polynomial. The polynomial s ( a ) is constructed by multiplying the message polynomial p x ( a ) , which has degree at most k − 1 , with a generator polynomial g ( a ) of degree n − k that is known to both the sender and the receiver. The generator polynomial g ( x ) is defined as the polynomial whose roots are exactly α , α 2 , … , α n − k , i.e.,

g ( x ) = ( x − α ) ( x − α 2 ) ⋯ ( x − α n − k ) = g 0 + g 1 x + ⋯ + g n − k − 1 x n − k − 1 + x n − k .

The transmitter sends the n = q − 1 coefficients of s ( a ) = p x ( a ) ⋅ g ( a ) . Thus, in the BCH view of Reed Solomon codes, the set C ′ of codewords is defined for n = q − 1 as follows:

C ′ = { ( s 1 , s 2 , … , s n ) | s ( a ) = ∑ i = 1 n s i a i − 1  is a polynomial that has at least the roots  α 1 , α 2 , … , α n − k } .

With this definition of the codewords, it can be immediately seen that a Reed–Solomon code is a polynomial code, and in particular a BCH code. The generator polynomial g ( a ) is the minimal polynomial with roots α , α 2 , … , α n − k as defined above, and the codewords are exactly the polynomials that are divisible by g ( a ) .

Since Reed–Solomon codes are a special case of BCH codes, the practical decoders designed for BCH codes are applicable to Reed–Solomon codes: The receiver interprets the received word as the coefficients of a polynomial r ( a ) . If no error has occurred during the transmission, that is, if r ( a ) = s ( a ) , then the receiver can use polynomial division to determine the message polynomial p x ( a ) = r ( a ) / g ( a ) . In general, the receiver can use polynomial division to construct the unique polynomials p ( a ) and e ( a ) , such that e ( a ) has degree less than the degree of g ( a ) and

r ( a ) = p ( a ) ⋅ g ( a ) + e ( a ) .

If the remainder polynomial e ( a ) is not identically zero, then an error has occurred during the transmission. The receiver can evaluate r ( a ) at the roots of g ( a ) and build a system of equations that eliminates s ( a ) and identifies which coefficients of r ( a ) are in error, and the magnitude of each coefficient's error. If the system of equations can be solved, then the receiver knows how to modify the received word r ( a ) to get the most likely codeword s ( a ) that was sent.

Systematic encoding procedure

The above encoding procedure for the BCH view of Reed–Solomon codes is classical, but does not give rise to a systematic encoding procedure, i.e., the codewords do not necessarily contain the message as a subsequence.To remedy this fact, instead of sending s ( x ) = p ( x ) g ( x ) , the encoder constructs the transmitted polynomial s ( x ) such that the coefficients of the k largest monomials are equal to the corresponding coefficients of p ( x ) , and the lower-order coefficients of s ( x ) are chosen exactly in such a way that s ( x ) becomes divisible by g ( x ) . Then the coefficients of p ( x ) are a subsequence of the coefficients of s ( x ) . To get a code that is overall systematic, we construct the message polynomial p ( x ) by interpreting the message as the sequence of its coefficients.

Formally, the construction is done by multiplying p ( x ) by x t to make room for the t = n − k check symbols, dividing that product by g ( x ) to find the remainder, and then compensating for that remainder by subtracting it. The t check symbols are created by computing the remainder s r ( x ) :

s r ( x ) = p ( x ) ⋅ x t   mod   g ( x ) .

Note that the remainder has degree at most t − 1 , whereas the coefficients of x t − 1 , x t − 2 , … , x 1 , x 0 in the polynomial p ( x ) ⋅ x t are zero. Therefore, the following definition of the codeword s ( x ) has the property that the first k coefficients are identical to the coefficients of p ( x ) :

s ( x ) = p ( x ) ⋅ x t − s r ( x ) .

As a result, the codewords s ( x ) are indeed elements of C ′ , that is, they are divisible by the generator polynomial g ( x ) :

s ( x ) ≡ p ( x ) ⋅ x t − s r ( x ) ≡ s r ( x ) − s r ( x ) ≡ 0 mod g ( x ) .

Duality of the two views - discrete Fourier transform

At first sight, the two views of Reed–Solomon codes above seem very different. In the first definition, codewords in the set C are values of polynomials, whereas in the second set C ′ , they are coefficients. Moreover, the generator polynomials in the first definition are of degree less than k , are variable, and unknown to the decoder, whereas those in the second definition are of degree n − k , are required to have specific roots, and are known to both encoder and decoder. Although the codewords as produced by the above encoder schemes are not the same, there is a duality between the coefficients of polynomials and their values that would allow the same codeword to be considered as a set of coefficients or a set of values.

The equivalence of the two definitions can be proved using the discrete Fourier transform. This transform, which exists in all finite fields as well as the complex numbers, establishes a duality between the coefficients of polynomials and their values. This duality can be approximately summarized as follows: Let p ( x ) and q ( x ) be two polynomials of degree less than n . If the values of p ( x ) are the coefficients of q ( x ) , then (up to a scalar factor and reordering), the values of q ( x ) are the coefficients of p ( x ) . For this to make sense, the values must be taken at locations x = α i , for i = 0 , … , n − 1 , where α is a primitive n th root of unity.

To be more precise, let

p ( x ) = v 0 + v 1 x + v 2 x 2 + ⋯ + v n − 1 x n − 1 , q ( x ) = f 0 + f 1 x + f 2 x 2 + ⋯ + f n − 1 x n − 1

and assume p ( x ) and q ( x ) are related by the discrete Fourier transform. Then the coefficients and values of p ( x ) and q ( x ) are related as follows: for all i = 0 , … , n − 1 , f i = p ( α i ) and v i = 1 n q ( α n − i ) or in the case of a binary field where addition is effectively xor, v i = q ( α n − i ) .

Using these facts, we have: ( f 0 , … , f n − 1 ) is a code word of the Reed–Solomon code according to the first definition

if and only if p ( x ) is of degree less than k (because f 0 , … , f n − 1 are the values of p ( x ) ),

if and only if v i = 0 for i = k , … , n − 1 ,

if and only if q ( α i ) = 0 for i = 1 , … , n − k (because q ( α i ) = n v n − i or for binary field q ( α i ) = v n − i ),

if and only if ( f 0 , … , f n − 1 ) is a code word of the Reed–Solomon code according to the second definition.

This shows that the two definitions are equivalent. However, the practical decoders described below require a generator polynomial known to the decoder, and view a codeword as a set of coefficients.

Remarks

Designers are not required to use the "natural" sizes of Reed–Solomon code blocks. A technique known as "shortening" can produce a smaller code of any desired size from a larger code. For example, the widely used (255,223) code can be converted to a (160,128) code by padding the unused portion of the source block with 95 binary zeroes and not transmitting them. At the decoder, the same portion of the block is loaded locally with binary zeroes. The Delsarte-Goethals-Seidel theorem illustrates an example of an application of shortened Reed–Solomon codes. In parallel to shortening, a technique known as puncturing allows omitting some of the encoded parity symbols.

Properties

The Reed–Solomon code is a [n, k, n − k + 1] code; in other words, it is a linear block code of length n (over F) with dimension k and minimum Hamming distance n − k + 1. The Reed–Solomon code is optimal in the sense that the minimum distance has the maximum value possible for a linear code of size (n, k); this is known as the Singleton bound. Such a code is also called a maximum distance separable (MDS) code.

The error-correcting ability of a Reed–Solomon code is determined by its minimum distance, or equivalently, by n − k , the measure of redundancy in the block. If the locations of the error symbols are not known in advance, then a Reed–Solomon code can correct up to ( n − k ) / 2 erroneous symbols, i.e., it can correct half as many errors as there are redundant symbols added to the block. Sometimes error locations are known in advance (e.g., "side information" in demodulator signal-to-noise ratios)—these are called erasures. A Reed–Solomon code (like any MDS code) is able to correct twice as many erasures as errors, and any combination of errors and erasures can be corrected as long as the relation 2E + S ≤ n − k is satisfied, where E is the number of errors and S is the number of erasures in the block.

For practical uses of Reed–Solomon codes, it is common to use a finite field F with 2 m elements. In this case, each symbol can be represented as an m -bit value. The sender sends the data points as encoded blocks, and the number of symbols in the encoded block is n = 2 m − 1 . Thus a Reed–Solomon code operating on 8-bit symbols has n = 2 8 − 1 = 255 symbols per block. (This is a very popular value because of the prevalence of byte-oriented computer systems.) The number k , with k < n , of data symbols in the block is a design parameter. A commonly used code encodes k = 223 eight-bit data symbols plus 32 eight-bit parity symbols in an n = 255 -symbol block; this is denoted as a ( n , k ) = ( 255 , 223 ) code, and is capable of correcting up to 16 symbol errors per block.

The Reed–Solomon code properties discussed above make them especially well-suited to applications where errors occur in bursts. This is because it does not matter to the code how many bits in a symbol are in error — if multiple bits in a symbol are corrupted it only counts as a single error. Conversely, if a data stream is not characterized by error bursts or drop-outs but by random single bit errors, a Reed–Solomon code is usually a poor choice compared to a binary code.

The Reed–Solomon code, like the convolutional code, is a transparent code. This means that if the channel symbols have been inverted somewhere along the line, the decoders will still operate. The result will be the inversion of the original data. However, the Reed–Solomon code loses its transparency when the code is shortened. The "missing" bits in a shortened code need to be filled by either zeros or ones, depending on whether the data is complemented or not. (To put it another way, if the symbols are inverted, then the zero-fill needs to be inverted to a one-fill.) For this reason it is mandatory that the sense of the data (i.e., true or complemented) be resolved before Reed–Solomon decoding.

Error correction algorithms

The decoders described below use the BCH view of the codeword as sequence of coefficients.

Peterson–Gorenstein–Zierler decoder

Daniel Gorenstein and Neal Zierler developed a practical decoder that was described in a MIT Lincoln Laboratory report by Zierler in January 1960 and later in a paper in June 1961. The Gorenstein-Zierler decoder and the related work on BCH codes are described in a book Error Correcting Codes by W. Wesley Peterson (1961).

Syndrome decoding

The transmitted message is viewed as the coefficients of a polynomial s(x) that is divisible by a generator polynomial g(x).

s ( x ) = ∑ i = 0 n − 1 c i x i g ( x ) = ∏ j = 1 n − k ( x − α j ) ,

where α is a primitive root.

Since s(x) is divisible by generator g(x), it follows that

s ( α i ) = 0 ,   i = 1 , 2 , … , n − k

The transmitted polynomial is corrupted in transit by an error polynomial e(x) to produce the received polynomial r(x).

r ( x ) = s ( x ) + e ( x ) e ( x ) = ∑ i = 0 n − 1 e i x i

where e_i is the coefficient for the i-th power of x. Coefficient e_i will be zero if there is no error at that power of x and nonzero if there is an error. If there are ν errors at distinct powers i_k of x, then

e ( x ) = ∑ k = 1 ν e i k x i k

The goal of the decoder is to find the number of errors (ν), the positions of the errors (i_k), and the error values at those positions (e_ik). From those, e(x) can be calculated and subtracted from r(x) to get the original message s(x).

The syndromes S_j are defined as

S j = r ( α j ) = s ( α j ) + e ( α j ) = 0 + e ( α j ) = e ( α j ) ,   j = 1 , 2 , … , n − k = ∑ k = 1 ν e i k ( α j ) i k

The advantage of looking at the syndromes is that the message polynomial drops out. Another possible way of calculating e(x) is using polynomial interpolation to find the only polynomial that passes through the points ( α j , S j ) (Because S j = e ( α j ) ), however, this is not used widely because polynomial interpolation is not always feasible in the fields used in Reed–Solomon error correction. For example, it is feasible over the integers (of course), but it is infeasible over the integers modulo a prime.

Error locators and error values

For convenience, define the error locators X_k and error values Y_k as:

X k = α i k ,   Y k = e i k

Then the syndromes can be written in terms of the error locators and error values as

S j = ∑ k = 1 ν Y k X k j

The syndromes give a system of n − k ≥ 2ν equations in 2ν unknowns, but that system of equations is nonlinear in the X_k and does not have an obvious solution. However, if the X_k were known (see below), then the syndrome equations provide a linear system of equations that can easily be solved for the Y_k error values.

[ X 1 1 X 2 1 ⋯ X ν 1 X 1 2 X 2 2 ⋯ X ν 2 ⋮ ⋮ ⋮ X 1 n − k X 2 n − k ⋯ X ν n − k ] [ Y 1 Y 2 ⋮ Y ν ] = [ S 1 S 2 ⋮ S n − k ]

Consequently, the problem is finding the X_k, because then the leftmost matrix would be known, and both sides of the equation could be multiplied by its inverse, yielding Y_k

Error locator polynomial

There is a linear recurrence relation that gives rise to a system of linear equations. Solving those equations identifies the error locations.

Define the error locator polynomial Λ(x) as

Λ ( x ) = ∏ k = 1 ν ( 1 − x X k ) = 1 + Λ 1 x 1 + Λ 2 x 2 + ⋯ + Λ ν x ν

The zeros of Λ(x) are the reciprocals X k − 1 :

Λ ( X k − 1 ) = 0 Λ ( X k − 1 ) = 1 + Λ 1 X k − 1 + Λ 2 X k − 2 + ⋯ + Λ ν X k − ν = 0

Multiply both sides by Y k X k j + ν and it will still be zero. j is any number such that 1≤j≤v.

Y k X k j + ν Λ ( X k − 1 ) = 0. Hence  Y k X k j + ν + Λ 1 Y k X k j + ν X k − 1 + Λ 2 Y k X k j + ν X k − 2 + ⋯ + Λ ν Y k X k j + ν X k − ν = 0 , and so  Y k X k j + ν + Λ 1 Y k X k j + ν − 1 + Λ 2 Y k X k j + ν − 2 + ⋯ + Λ ν Y k X k j = 0

Sum for k = 1 to ν

∑ k = 1 ν ( Y k X k j + ν + Λ 1 Y k X k j + ν − 1 + Λ 2 Y k X k j + ν − 2 + ⋯ + Λ ν Y k X k j ) = 0 ∑ k = 1 ν ( Y k X k j + ν ) + Λ 1 ∑ k = 1 ν ( Y k X k j + ν − 1 ) + Λ 2 ∑ k = 1 ν ( Y k X k j + ν − 2 ) + ⋯ + Λ ν ∑ k = 1 ν ( Y k X k j ) = 0

This reduces to

S j + ν + Λ 1 S j + ν − 1 + ⋯ + Λ ν − 1 S j + 1 + Λ ν S j = 0 S j Λ ν + S j + 1 Λ ν − 1 + ⋯ + S j + ν − 1 Λ 1 = − S j + ν  

This yields a system of linear equations that can be solved for the coefficients Λ_i of the error location polynomial:

[ S 1 S 2 ⋯ S ν S 2 S 3 ⋯ S ν + 1 ⋮ ⋮ ⋮ S ν S ν + 1 ⋯ S 2 ν − 1 ] [ Λ ν Λ ν − 1 ⋮ Λ 1 ] = [ − S ν + 1 − S ν + 2 ⋮ − S ν + ν ]

The above assumes the decoder knows the number of errors ν, but that number has not been determined yet. The PGZ decoder does not determine ν directly but rather searches for it by trying successive values. The decoder first assumes the largest value for a trial ν and sets up the linear system for that value. If the equations can be solved (i.e., the matrix determinant is nonzero), then that trial value is the number of errors. If the linear system cannot be solved, then the trial ν is reduced by one and the next smaller system is examined. (Gill n.d., p. 35)

Obtain the error locators from the error locator polynomial

Use the coefficients Λ_i found in the last step to build the error location polynomial. The roots of the error location polynomial can be found by exhaustive search. The error locators are the reciprocals of those roots. Chien search is an efficient implementation of this step.

Calculate the error locations

Calculate i_k by taking the log base a of X_k. This is generally done using a precomputed lookup table.

Calculate the error values

Once the error locators are known, the error values can be determined. This can be done by direct solution for Y_k in the error equations given above, or using the Forney algorithm.

Fix the errors

Finally, e(x) is generated from i_k and e_ik and then is subtracted from r(x) to get the sent message s(x).

Berlekamp–Massey decoder

The Berlekamp–Massey algorithm is an alternate iterative procedure for finding the error locator polynomial. During each iteration, it calculates a discrepancy based on a current instance of Λ(x) with an assumed number of errors e:

Δ = S i + Λ 1   S i − 1 + ⋯ + Λ e   S i − e

and then adjusts Λ(x) and e so that a recalculated Δ would be zero. The article Berlekamp–Massey algorithm has a detailed description of the procedure. In the following example, C(x) is used to represent Λ(x).

Example

Consider the Reed–Solomon code defined in GF(929) with α = 3 and t = 4 (this is used in PDF417 barcodes). The generator polynomial is

g ( x ) = ( x − 3 ) ( x − 3 2 ) ( x − 3 3 ) ( x − 3 4 ) = x 4 + 809 x 3 + 723 x 2 + 568 x + 522

If the message polynomial is p(x) = 3 x² + 2 x + 1, then the codeword is calculated as follows.

s r ( x ) = p ( x ) x t mod g ( x ) = 547 x 3 + 738 x 2 + 442 x + 455 s ( x ) = p ( x ) x t − s r ( x ) = 3 x 6 + 2 x 5 + 1 x 4 + 382 x 3 + 191 x 2 + 487 x + 474

Errors in transmission might cause this to be received instead.

r ( x ) = s ( x ) + e ( x ) = 3 x 6 + 2 x 5 + 123 x 4 + 456 x 3 + 191 x 2 + 487 x + 474

The syndromes are calculated by evaluating r at powers of α.

S 1 = r ( 3 1 ) = 3 ⋅ 3 6 + 2 ⋅ 3 5 + 123 ⋅ 3 4 + 456 ⋅ 3 3 + 191 ⋅ 3 2 + 487 ⋅ 3 + 474 = 732 S 2 = r ( 3 2 ) = 637 , S 3 = r ( 3 3 ) = 762 , S 4 = r ( 3 4 ) = 925

To correct the errors, first use the Berlekamp–Massey algorithm to calculate the error locator polynomial.

The final value of C is the error locator polynomial, Λ(x). The zeros can be found by trial substitution. They are x₁ = 757 = 3⁻³ and x₂ = 562 = 3⁻⁴, corresponding to the error locations. To calculate the error values, apply the Forney algorithm.

Ω ( x ) = S ( x ) Λ ( x ) mod x 4 = 546 x + 732 Λ ′ ( x ) = 658 x + 821 e 1 = − Ω ( x 1 ) / Λ ′ ( x 1 ) = − 649 / 54 = 280 × 843 = 74 e 2 = − Ω ( x 2 ) / Λ ′ ( x 2 ) = 122

Subtracting e₁x³ and e₂x⁴ from the received polynomial r reproduces the original codeword s.

Euclidean decoder

Another iterative method for calculating both the error locator polynomial and the error value polynomial is based on Sugiyama's adaptation of the Extended Euclidean algorithm .

Define S(x), Λ(x), and Ω(x) for t syndromes and e errors:

S ( x ) = S t x t − 1 + S t − 1 x t − 2 + ⋯ + S 2 x + S 1 Λ ( x ) = Λ e x e + Λ e − 1 x e − 1 + ⋯ + Λ 1 x + 1 Ω ( x ) = Ω e x e + Ω e − 1 x e − 1 + ⋯ + Ω 1 x + Ω 0

The key equation is:

Λ ( x ) S ( x ) = Q ( x ) x t + Ω ( x )

For t = 6 and e = 3:

[ Λ 3 S 6 x 8 Λ 2 S 6 + Λ 3 S 5 x 7 Λ 1 S 6 + Λ 2 S 5 + Λ 3 S 4 x 6 S 6 + Λ 1 S 5 + Λ 2 S 4 + Λ 3 S 3 x 5 S 5 + Λ 1 S 4 + Λ 2 S 3 + Λ 3 S 2 x 4 S 4 + Λ 1 S 3 + Λ 2 S 2 + Λ 3 S 1 x 3 S 3 + Λ 1 S 2 + Λ 2 S 1 x 2 S 2 + Λ 1 S 1 x S 1 ] = [ Q 2 x 8 Q 1 x 7 Q 0 x 6 0 0 0 Ω 2 x 2 Ω 1 x Ω 0 ]

The middle terms are zero due to the relationship between Λ and syndromes.

The extended Euclidean algorithm can find a series of polynomials of the form

A_i(x) S(x) + B_i(x) x^t = R_i(x)

where the degree of R decreases as i increases. Once the degree of R_i(x) < t/2, then

A_i(x) = Λ(x)

B_i(x) = -Q(x)

R_i(x) = Ω(x).

B(x) and Q(x) don't need to be saved, so the algorithm becomes:

R₋₁ = x^tR₀ = S(x)A₋₁ = 0A₀ = 1i = 0while degree of R_i >= t/2i = i + 1Q = R_i-2 / R_i-1R_i = R_i-2 - Q R_i-1A_i = A_i-2 - Q A_i-1

to set low order term of Λ(x) to 1, divide Λ(x) and Ω(x) by A_i(0):

Λ(x) = A_i / A_i(0)Ω(x) = R_i / A_i(0)

A_i(0) is the constant (low order) term of A_i.

Example

Using the same data as the Berlekamp Massey example above:

Λ(x) = A₂ / 544 = 329 x² + 821 x + 001Ω(x) = R₂ / 544 = 546 x + 732

Decoder using discrete Fourier transform

A discrete Fourier transform can be used for decoding. To avoid conflict with syndrome names, let c(x) = s(x) the encoded codeword. r(x) and e(x) are the same as above. Define C(x), E(x), and R(x) as the discrete Fourier transforms of c(x), e(x), and r(x). Since r(x) = c(x) + e(x), and since a discrete Fourier transform is a linear operator, R(x) = C(x) + E(x).

Transform r(x) to R(x) using discrete Fourier transform. Since the calculation for a discrete Fourier transform is the same as the calculation for syndromes, t coefficients of R(x) and E(x) are the same as the syndromes:

R j = E j = S j = r ( α j ) f o r   1 ≤ j ≤ t

Use R 1 through R t as syndromes (they're the same) and generate the error locator polynomial using the methods from any of the above decoders.

Let v = number of errors. Generate E(x) using the known coefficients E 1 to E t , the error locator polynomial, and these formulas

E 0 = − 1 σ v ( E v + σ 1 E v − 1 + ⋯ + σ v − 1 E 1 ) E j = − ( σ 1 E j − 1 + σ 2 E j − 2 + ⋯ + σ v E j − v ) f o r   t < j < n

Then calculate C(x) = R(x) - E(x) and take the inverse transform of C(x) to produce c(x).

Decoding beyond the error-correction bound

The Singleton bound states that the minimum distance d of a linear block code of size (n,k) is upper-bounded by n − k + 1. The distance d was usually understood to limit the error-correction capability to ⌊d/2⌋. The Reed–Solomon code achieves this bound with equality, and can thus correct up to ⌊(n − k + 1)/2⌋ errors. However, this error-correction bound is not exact.

In 1999, Madhu Sudan and Venkatesan Guruswami at MIT published "Improved Decoding of Reed–Solomon and Algebraic-Geometry Codes" introducing an algorithm that allowed for the correction of errors beyond half the minimum distance of the code. It applies to Reed–Solomon codes and more generally to algebraic geometric codes. This algorithm produces a list of codewords (it is a list-decoding algorithm) and is based on interpolation and factorization of polynomials over G F ( 2 m ) and its extensions.

Soft-decoding

The algebraic decoding methods described above are hard-decision methods, which means that for every symbol a hard decision is made about its value. For example, a decoder could associate with each symbol an additional value corresponding to the channel demodulator's confidence in the correctness of the symbol. The advent of LDPC and turbo codes, which employ iterated soft-decision belief propagation decoding methods to achieve error-correction performance close to the theoretical limit, has spurred interest in applying soft-decision decoding to conventional algebraic codes. In 2003, Ralf Koetter and Alexander Vardy presented a polynomial-time soft-decision algebraic list-decoding algorithm for Reed–Solomon codes, which was based upon the work by Sudan and Guruswami.

Encoder

Here we present a simple Matlab implementation for an encoder.

Decoder

Now the decoding part: