Method and Means for Error Detection and Correction in High Speed Data Transmission Codes

This invention relates generally to error detection and correction in coded data, and more particularly the invention relates to a method and apparatus for use with high speed coded data.

The use of satellite communication links has led to data transmission at increased data rates. As the rate of data transmission increases the need for more powerful and complex data codes increases. However, a limitation on the use of powerful codes at high data rates is the present inability to identify and correct data errors in a timely manner. Thus, specialized codes are now employed which permit correction of only a few errors.

BCH and Goppa are known codes which can be decomposed for error identification and correction. The decoding procedure includes computation of syndromes from received data words, computation of error locator and error evaluator polynomials from the syndromes, computation of error location and magnitude from the polynomials, and then correction of the errors in the data. The relationship defining the error-locator and evaluator polynomials from the syndromes is known as the key equation. Berlekemp, Algebraic Coding Theory, McGraw Hill, New York 1968 discloses the first known procedure for solving the key equation. Berlekemp presents a parallel architecture for implementing the solution, however, because of an inner product operation the architecture does not possess the regularity necessary for rapid implementation.

Massey, "Shift Register Synthesis and BCH Decoding", IEEE Transactions of Information Theory, Vol. IT-15, 1969, pgs. 122-127 gives a new interpretation of Berlekemp's algorithm and also presents a parallel architecture.

Sugiyama et al, "A Method of Solving Key Equation for Decoding Goppa Codes", Information and Control, 27, 1975, pgs. 87-99 shows that Euclid's algorithm for computing the greatest common deviser of two polynomials can be used to solve the key equations. However, no architecture for implementing the computation is given.

Kung, "Multivariable and Multidimensional Systems: Analysis and Design", "PhD Dissertation, Stanford University," 1977 presents a derivation of what is known as the generalized Lanczos algorithm which can be used to solve the key equation. However, the algorithm requires matrix inversions which are difficult to implement in hardware.

The present invention provides a method and processing system which facilitates the rapid error identification and correction of high speed coded data by using parallel, pipeline operation in determining the error-locator and error evaluator polynomials from the syndromes. The regular and highly parallel architecture for performing the second part of the coding procedure results from reformulating the usual algorithm for solving the key equations. The method is faster by a factor of at least log 2t (t being the number of errors the code can correct) than the procedure presented by Berlekemp and Massey. Unlike Kung, the architecture for implementing the method eliminates matrix inversion and provides a much more regular set of recursions, thus resulting in a faster solution and simpler hardware layout.

In accordance with one feature of the invention, parallel structure of the architecture permits the performance of multiplications concurrently, thereby increasing processing speed. While some prior art solutions to the key equation can be made in parallel, these methods require an inner product operation.

In accordance with another feature of the invention, the architecture for implementing the method is pipelineable thereby allowing operation on a new problem while the solution to an old problem is still being completed. The pipeline structure allows several iterations of the same problem to be performed concurrently while also allowing several problems to be processed at the same time. This multiple pipelining increases the rate at which new syndromes can be accepted for processing.

In accordance with yet another feature of the invention the number of iterations required to solve the key equation is a function of the actual number of errors that occur rather than the maximum number of errors that can be corrected. Thus, the architecture can be designed for the average number of errors that occur instead of the worst case, thereby resulting in hardware savings.

Still another feature of the invention is the regular architecture (i.e. a systolic array) in which only local connections between processing elements are required. This property is important when considering an integrated circuit implementation of the architecture. Local interconnections are important in minimizing signal delay, and the regular structure allows easy testability and simplifies the layout of the architecture.

The key equation which defines the relationship of the error locator and evaluator polynomials from the syndromes is given as follows:

where:

S(z)=are the code syndromes for a code word C(z),

.LAMBDA.=is the error-locator polynomial which has roots at the error locations,

.omega.(z)=is an error evaluator

polynomial t is the number of errors in the code word.

The computation of syndromes from the received code word is readily implemented using a Fourier transform of the received vector, and computation of the error locations and magnitudes after the polynomials are identified is readily implemented. Both processes entail a number of operations which can be performed in parallel. The time consuming aspect of the decoding procedure lies in the computation of the error locator and error evaluator polynomials from the syndromes. In accordance with the invention this is accomplished in accordance with the following algorithm where R.sub.i, P.sub.i and T.sub.i are column vectors of length 2t and where t is the number of errors the code can correct: ##EQU1##

Importantly, this algorithm is readily implemented in a systolic processor employing a parallel structure and pipeline techniques and which provides a regular set of recursions which lends itself to fabrication using integrated circuit technology.

The invention and objects and features thereof will be more readily apparent from the following detailed description and appended claims when taken with the drawing, in which:

FIG. 1 is a functional block diagram of the operations in decoding a vector using the key equation.

FIG. 2 is an example of implementing the key equation.

FIG. 3A is a schematic of a generic pipelined multiplier, and FIG. 3B is a schematic of one embodiment of a multiplier algorithm in accordance with the invention.

FIG. 4 is a functional block diagram of another implementation of the algorithm in accordance with the invention.

FIG. 5 is a functional block diagram of another implementation of the algorithm in accordance with the invention.

FIG. 6 is a schematic of a cell in the circuit of FIG. 5.

FIG. 7 is a schematic of another cell in the circuit of FIG. 5.

FIG. 8 is a functional block diagram of implementation of Berlekemp-Massey algorithm.

FIG. 9 is a functional block diagram of a fully pipelined array in accordance with the invention.

FIGS. 10a and 10b are schematics of cells in the array of FIG. 9.

FIG. 11 is a schematic diagram illustrating pipeline operation on the syndrome sets.

FIG. 12 is a schematic of a combined cell structure for implementing the algorithm in accordance with the invention.

FIG. 13 is a schematic of a bottom cell in the array of FIG. 9.

FIG. 14 illustrates the matrix for MP.

Referring now to the drawings, FIG. 1 is a functional block diagram of the operations in decoding a vector v, consisting of a code word c, plus error, e. As noted above, errors in the code word can be identified from roots of an error-locator polynomial, .LAMBDA.(z), and an error evaluator polynomial, .omega.(z), both of which are defined from the code syndromes, S, in accordance with the key equation first derived by Berlekemp as follows:

In FIG. 1 the syndromes, S.sub.j, are generated by Fourier transform of the vector, v. The number of syndromes must be at least twice the number of errors, t, in the code vector. Using the syndromes, S.sub.j, the key equation is solved to define the error magnitude polynomial, .omega.(z), and the error locator polynomial, .lambda.(z). Roots of these polynomials are then gated to correct the vector, v, which is passed through a suitable time buffer for error corrections.

The key equation processor is the limiting factor in identifying and correcting errors in code. In accordance with the present invention a regular, pipelined matrix processor is provided which is readily implemented using integrated circuit technology and which can timely operate on high speed code. For example, with satellite code rates of 500 Mbs/second a processor clock rate of only 27.5 MHz is required. The algorithm which permits the systolic processor will first be derived, and then the matrix and cell structures of the processor will be described.

We shall denote by the triple (n,k,t) a primitive BCH code having: block-length n, information length k, and the ability to correct t random errors. The codes is assumed to be q-ary and thus has symbols in GF(q), the Galois field containing q elements. We represent a codeword, [c.sub.0, . . . , c.sub.n-1 ], by its naturally associated polynomial c(z). For BCH codes, every codeword has the property that ##EQU2## where .alpha. is the primitive element of the extension field GF(q.sup.m). m is the smallest integer such that n divides q.sup.m -1. For simplicity, we will take m.sub.0 to be 1.

Given a received word, v(z), we wish to recover the transmitted codeword. This is typically accomplished in three steps. Note that v(z) is the sum of the transmitted codeword, c(z), and some error pattern, r(z). The first decoding step is to compute the code syndromes, S.sub.j. ##EQU3## E is a set specifying the indices of the error locations. Thus, .alpha..sup.i can be thought of as the "location" of one of the errors. (Of course, the error location is actually the log.sub..alpha. of .alpha..sup.i. However, .alpha..sup.i is usually referred to as the error location.) We observe that the syndromes are nonlinear in the error locations. Thus, introduce the error-locator polynomial, .LAMBDA.(z), which has its roots at the error locations. The relationship between the error-locator polynomial and the syndromes is linear. ##EQU4## Equation (3) is known as the key equation. .omega.(z) is the error-evaluator polynomial. The roots of the error-locator polynomial yield the error locations. Error magnitudes are computed using both the error-locator and error-evaluator polynomials as shown in (4). ##EQU5## .LAMBDA.' is the formal derivative of .LAMBDA.. We remark that it is possible to find the error magnitudes from .LAMBDA. alone. For this reason, we will only discuss the computation of .LAMBDA. when deriving our new procedure. It possible, however, to use the new technique to compute .omega. also.

One may observe that the first and last steps of the decoding process are well defined and fairly regular. However, the solution of the key equation is not so easy to see. In fact, the usual bottleneck in decoding is the solution of the key equation. The algorithm and architecture presented here are an attempt to "regularize" the solution to the key equation.

Linear recurrences and the key equation

The key equation may be written, ##EQU6## This formulation suggests that we interpret .LAMBDA.(z) as the tap gains for a feedback shift register. In this sense, the key equation asks that we find the shortest shift register that generates the given syndromes when the shift register is initialized with .omega.(z). Alternatively, using the equation for k>t, we can think .LAMBDA.(z) as the shortest linear recurrence relation which generates S(z).

To demonstrate the simplicity of our new algorithm, consider an example with integers. Let the given sequence be {1,1,2,2,4,3,6,1}. Solving the problem requires 8 iterations since there are eight values to "match". These are displayed in FIG. 2. Note that the algorithm requires that we store two columns of data at every step. Each of these columns has two parts, separated by a dotted line. The right column contains the present estimate of the linear recurrence and sequence it generates. The left column contains a past estimate of the recurrence and its associated sequence. The numbers above the line are modified values of the given sequence and those below are estimates for the linear recurrence. At the i.sup.th iteration, the present estimate of the linear recurrence is the shortest such recurrence which generates the first i values of the sequence.

The objective of each iteration is to use the top element of the left column (call it a) to null the top element of the right column (call it b). Thus, multiply the left column by -b/a and add it to the right column. Then shift the right column up one to remove the zero element. The dotted line also shifts up one. Finally the left column either stays the same or gets the old contents of the right column depending on the value of the control .gamma.. If new top element in the right column is zero, only the shift step is performed. In FIG. 1, -.GAMMA. is the ratio -b/a and, N and N' are controls which determine .gamma..

From FIG. 2, we see that the solution the algorithm provides is {1,-2,-1,5,-3}. Correctness is easily verified.

For any particular solution order, say k, the key equation may be written in matrix form, ##EQU7## where .LAMBDA.(z)=1+.LAMBDA..sub.1 z+ . . . +.LAMBDA..sub.t z.sup.t

.omega.(z)=.omega..sub.1 + . . . +.omega..sub.t z.sup.t-1

=0's as needed to complete the matrix.

From this set of equations, it is clear that .omega.(z) may be easily found via back substitution once .LAMBDA.(z) is known. The crux of the problem is to find .LAMBDA.(z) using the matrix equation ##EQU8## It would seem that our task has been reduced to a Hankel matrix inversion. However, two key properties of this matrix problem preclude the use of typical Hankel or Toeplitz problem solvers. First, the order of the solution is unknown a priori (we don't know how many errors have occurred). Second, the leading minors of this Hankel matrix can be singular.

To solve the key equation from a matrix point of view, we require three steps. Our first assumption will be that the solution order is known and the principle leading minors of M are non-singular. The former assumption makes matrix equivalence quite clear while the latter simplifies the initial algorithm derivation. We next relax the non-singular minor assumption. Under this condition we again derive an efficient algorithm for solving (7). Interestingly, eliminating the non-singular minor assumption does not add tremendous complication. Finally, we will show that solving the matrix problem also leads to a solution of the key equation even when the solution order is unknown.

So, for the moment, let us assume that the solution order is known, say t. How do we proceed? The matrix equation can be solved iteratively by recursively factoring the matrix M(t,t+1) into upper and lower triangular matrices of the form, ##EQU9## From this equation we see that the last column of P satisfies (7). Thus, .LAMBDA..sub.i =.alpha..sub.i. Recursively factoring M yields the desired solution vector. Because we assume that the principle leading minors of M are non-singular, the x's on Q's diagonal are non-zero.

To generate the desired recursion, suppose that p.sub.k-1 and p.sub.k, the k and k+1 columns of P, are known. Thus, ##EQU10## where Q=[.beta..sub.0 . . . .beta..sub.t ]

.beta..sub.i [0 . . . 0.beta..sub.i.sup.(0). . . .beta..sub.i.sup.(t-i) ]

p=[p.sub.0 . . . p.sub.t ]

As a trial solution for p.sub.k+1, consider zp.sub.k where z is a downward shift operator. Because of the shift invariance of Hankel matrices, the result of multiplying M(t,t+1) by zp.sub.k is ##EQU11## zp.sub.k causes .beta..sub.k to shift up one (zp.sub.k .fwdarw.z.sup.-1 .beta..sub.k). Recall that our objective is to triangularize M. Thus P.sub.k+1 can be computed using the circled pivot elements.

The recursion for generating P can be written ##EQU12## An analogous polynomial formulation can be obtained by making a natural association between p.sub.k and p.sub.k (z). Namely, the ith element (from top) of p.sub.k is the coefficient of z.sup.t-i+1 in p.sub.k (z). Hence,

This is the polynomial version of an algorithm developed by Lanczos for inverting Hankel matrices with non-singular leading minors. In a sense, this is a parallel algorithm. That is, if we interpret vector scaling and addition as parallel operations. The real trick is to obtain the pivots at the proper time.

How do we put (11) in a form suitable for hardware implementation? It seems natural to divide the process into two steps. First, triangularize M(n,n+1) to obtain .delta..sub.i and .gamma..sub.i. Then using these values, compute the columns of P. Parallelism can be introduced by performing vector scaling and addition in parallel.

The algorithm which we propose will operate on the augmented matrix M. ##EQU13## The reason for using M becomes clear by examining (10). As a result of iteration k-1, .beta..sub.k-1.sup.(0) . . . .beta..sub.k-1.sup.(t-k) and .beta..sub.k.sup.(0) . . . .beta..sub.k.sup.(t-k-1) have been computed. However, in order to complete iteration k we need .beta..sub.k.sup.(t-k). One could form .beta..sub.k.sup.(t-k) by taking the inner product of p.sub.k and [S.sub.t+1 . . . S.sub.2t 0]. Yet, an inner product is an undesirable operation because it introduces a global sum. By using M this inner product is eliminated. All the necessary .beta.'s appear as a natural result at every step.

To begin the algorithm derivation assume that we have p.sub.k-1 and p.sub.k, and wish to find p.sub.k+1. Although, the new algorithm stores z.sup.k-1 p.sub.k-1 and z.sup.k-1 p.sub.k. By doing so the pivot values always appear at the top of each column. This simplifies hardware implementation. ##EQU14## It is easy to verify that .beta..sub.k.sup.(0), . . . , .beta..sub.k.sup.(t-k-1) are that same as in (9).

p.sub.k+1 can be obtained by forcing two zeros as in (9). The first step is to align the columns of R. ##EQU15## Then the first zero is forced using .beta..sub.k-1.sup.(0) as a pivot. Note that .beta.k.sup.(0) will be used as the pivot in the next step. Thus we place .beta..sub.k in the first column of R ##STR1## .alpha..sub.k is an intermediate result. Once again we align the columns of R ##EQU16## The second zero is force using .alpha..sub.k.sup.(0) /.beta..sub.k.sup.(0) which is .gamma..sub.k. Thus, the new second column of R is ##EQU17## This leaves us ready to compute p.sub.k+2. We note that the last step of the overall algorithm will provide us with z.sup.t-1 p.sub.t. The multiplier z.sup.t-1 is simply a shift.

To complete the algorithm, an initialization procedure must be specified. Of course we always have p.sub.o equal to 1. Since the leading principle minors are non-singular, S.sub.1 .noteq.0. Thus, ##EQU18## In terms of our algorithm, this can be accomplished by the following steps, ##EQU19##

The entire algorithm is then summarized by ##EQU20## The recursions for computing .LAMBDA.(z) are easily found from (11) and (13). Let P.sub.1.sup.(i) and P.sub.2.sup.(i) be the columns of P corresponding to R.sub.1.sup.(i) and R.sub.2.sup.(i). Then, ##EQU21## The structure of (13) and (14) make a hardware translation of the algorithm very straightforward. We would require two columns of storage registers and a processing node between adjacent elements in each column. Except for the pivot information, only local interconnections are required.

The issue now is, can this method be extended to the more realistic case in which singular minors can occur? The answer can be found by re-examining equation (10). When the k by k principle leading minor of M is singular, some of the .beta..sub.k.sup.(i) will be zero. This would leave us with, ##EQU22## The .eta..sub.k "extra" zeros that appear are the result of some "free" matches. In other words, the recurrence relation for the first k parameters actually generates the first k+.eta..sub.k parameters.

Consequently, the next step is to find p.sub.k+.eta.k. Because of the free matches, zp.sub.k will not suffice as a trial solution. Instead, we require zp.sub.k . . . z.sup..eta. P.sub.k. ##EQU23## The necessary pivot elements are circled. From (15), the update recursion is easily found,

where

.delta..sub.k =.beta..sub.k.sup.(O) /.beta..sub.k-1.sup.(O) ##EQU24## This is known as the Generalized Lanczos Recursion and was developed by S. Y. Kung. A remark is necessary here. In the non-singular case, Lanczos' algorithm computed every column of P. However, the singular case requires that we compute only those columns which correspond to non-singular minors. The other columns of P are simply shifted versions of the computed columns (this results from free matches). To label the computed columns, let .nu..sub.k be the index corresponding to the k.sup.th non-singular minor. Also, .eta..sub.k =.nu..sub.k+1 -.nu..sub.k. The Generalized Lanczos Algorithm computes {P.sub..nu.t :k=1, . . . , T}. T is the number of non-singular principle leading minors. Thus, P has the form,

In general, the algorithm will start each interation with p.sub..nu.k-l and p.sub..nu.k in order to computer p.sub..nu.k+i.

The Generalized Lanczos Algorithm tells us how to computer p.sub..nu.k+l, but it is not really suitable for hardware implementation. At every step of algorithm requires us to invert a matrix that has variable dimensions. Yet it is possible to obtain a new formulation of the algorithm which looks very similar to the parallel algorithm that we developed for Lanczos' recursion. From above we may observe that the matrix inversion is required because we are trying to force the requisite zeros all at once. Another point is the matrix that has to be inverted possesses a great deal of structure. Each column is a shifted copy of a later column. These facts lead one to believe that by forcing zeros one at a time a certain amount of complexity can be removed. In fact, by doing so the new algorithm will require only 2t iterations with same hardware described previously. The only additional burden is an increased control complexity. Thus, the more general case (singular minors) does not require drastically more hardware.

To generate the new algorithm, we again start with the augmented matrix M. Assume that we have p.sub..nu..sbsb.k-1 and p.sub..nu..sbsb.k and wish to find p.sub..nu..sbsb.k+1. Thus, ##EQU25## The first step is the algorithm is to align the columns of R. This requires .eta..sub.k shifts. ##EQU26## Then the first zero is forced using .beta..sub..nu..sbsb.k-1.sup.(0). From (15) note that .beta..sub..nu..sbsb.k.sup.(0) will be needed as the next pivot. Thus, we place .beta..sub..nu..sbsb.k in the first column of R. Note that .nu..sub.k+1 =.nu..sub.k +.eta..sub.k. ##EQU27##

The remaining .eta..sub.k iterations all use .beta..sub..nu..sbsb.k.sup.(0) as a pivot. In the non-singular case, only one additional iteration was required. Each iteration consists of two steps:

(1) shift the right column up until a nonzero element appears at the top and (2) use the left column to annihilate the the top element in the right column. After .eta..sub.k iterations we obtain ##EQU28## It is intuitively obvious from (15) that p.sub..nu..sbsb.k+1 is in fact p.sub..nu..sbsb.k+1. This follows because our procedure is simply using the pivots in (15) one at a time. Hence, ##EQU29## This leaves us ready to compute p.sub..nu..sbsb.k+2. We remark here that is is possible to verify the correctness of the algorithm by showing the solution conicides with (16).

The new algorithm for computing p.sub..nu..sbsb.k+1 is summarized in (17). ##EQU30## where it is assumed that R.sub.1 and R.sub.2 have already been aligned (see initialization). Of course, our true desire is to factor the Hankel matrix M, ergo the need to compute p.sub..nu..sbsb.k for all k. This could be accomplished by invoking an "outer" recursion which called (17) for each value of k. Each iteration would consist of: (1) initialize the recursions on (17) with p.sub..nu..sbsb.k-1, p.sub..nu..sbsb.k, .beta..sub..nu..sbsb.k-1 and .beta..sub..nu..sbsb.k, then (2) run the recursions in (17) for .eta..sub.k +1 steps. After T iterations of the outer recursion, p.sub.T would have been computed. As described (17) can be thought of as an "inner" recursion of the overall algorithm. In comparison with the Generalized Lanczos, this new procedure possesses two important advantages. First, the matrix inversion has been eliminated. Second, all the necessary pivot information is available as a natural result at each step. These improvements greatly simplify hardware implementation.

Further gains would be achieved if it were feasiable to simply initialize (17) and let it run. However, this is not immediately possible. The root cause is that .gamma..sub.i is determined using an index which is measured with respect to p.sub..nu..sbsb.k. Hence the need for the inner and outer recursions outlined above. The outer recursion marks the points where p.sub..nu..sbsb.k has been computed. To eliminate the outer recursion, we need a control law which does this automatically.

We note that the initialization responsibility of the outer recursion also includes aligning R.sub.1 and R.sub.2, i.e. shifting R.sub.2 by .theta..sub.k. This task is easily absorbed into the inner recursion. A modified set of equations is shown in (18). ##EQU31## The recursions for P are similar. Since .rho..sub.i is zero for i=1, . . . , .eta..sub.k -1, the extra .eta..sub.k -1 steps simply shift R.sub.2. .eta..sub.k can be determined by observing that it corresponds to the number of times we must shift R.sub.2 in order to make .rho..sub.i nonzero.

The sole remaining purpose of the outer recursion is to re-initialize the index for .gamma.. To automate this, we need to examine the correspondences between .gamma..sub.i =1, the inner recursion and the outer recursion. This is done in Table 1.

The inner and outer columns list the iteration number of the respective recursions. The column labeled "total inner" specifies the total number of inner recursions that have occurred. Our goal make .gamma..sub.i independent of the outer recursion. By doing so the outer recursion would become superfluous. Observe that while computing p.sub..nu..sbsb.1, .gamma..sub.1 is turned on when R.sub.1 and R.sub.2 have been aligned, i.e. after .eta..sub.1 iterations. .eta..sub.1 is the number of times we must shift in order to make .rho. non-zero. To complete the computation of p.sub..nu..sbsb.1, .eta..sub.1 more steps are required. .gamma..sub.1 is zero during these iterations. Once p.sub..nu..sbsb.1 is complete, .gamma..sub.2 may be turned on as soon as the shifting process brings a non-zero element to the top of R.sub.2. These remarks suggest the following control strategy for .gamma.. ##EQU32## When N.sub.j =0, we have completed the computation of a new column of P. When N.sub.j >0, the algorithm is aligning R.sub.1 and R.sub.2. And when N.sub.i <0, The recursions in (17) are being implemented. The point where N changes sign is where .gamma. becomes 1. By using this control, the outer recursion becomes unnecessary. We need only perform initialization and then let (18) run (with the control) until the data is exhausted. The contents of P.sub.2 will be the solution to matrix problem given in (7).

To start the algorithm, we require knowledge of p.sub.0 and p.sub..nu..sbsb.1 ; however, while p.sub.0 is always one, finding p.sub..nu..sbsb.1 is not always so easy. Recall that .nu..sub.1 marks the point where the first non-singular minor is found. Thus, if S.sub.1 .noteq.0 then .nu..sub.1 =1; otherwise, .nu..sub.1 >1. Suppose that the former is true and assume that at the beginning of iteration 2 we have, ##EQU33## p.sub..nu..sbsb.1 can be formed in one step since p.sub..nu..sbsb.1 =z-S.sub.2 /S.sub.1. At the beginning of iteration 3 the registers should contain, ##EQU34## From (17) and Table 1 we know that N.sub.3 should be 1. Hence, N.sub.2 =N.sub.2 =0 and N.sub.1 =-1. This is essentially the same initialization that was utilized in the nonsingular case. Note also that the shifting in (20) is consistent with the requirements of page 17.

What if S.sub.1 is zero? This means that the first minor of M is singular causing .nu..sub.1 >1. In the language of linear recurrences , p.sub.0 is giving us some free matches. A method for computing p.sub..nu..sbsb.1 can be derived by returning to the original matrix formulation of the problem. ##EQU35## By definition, .beta..sub..nu..sbsb.1 has at least one more zero at the top than .beta..sub.0. The circled pivot elements can be used to form .beta..sub..nu..sbsb.1 and in the process p.sub..nu..sbsb.1. The technique is similar to that used in (15); however, there are some slight differences. Of course the starting point must be, ##EQU36## Note that p.sub.0 is used as the pivot in all of the .eta..sub.0 steps for computing p.sub..nu..sbsb.1. Hence, we must have N.sub..eta..sbsb.0.sub.+1 =-.eta..sub.0 +1 (because .eta..sub.0 steps must be used to from z.sup.n.sbsp.0.sup.-1 p.sub.0, the index of N is .eta..sub.0 +1). The contents of the register after iteration 2.eta..sub.0 are, ##EQU37## and N.sub.2.eta..sbsb.0 =N.sub.2.eta..sbsb.0 =0 which is the desired result (see Table 1).

Unfortunately, it seems that two different initilization procedures are required with the choice dependent on whether S.sub.1 is zero. To make matters worse, the number of steps required for the initialization procedure varies. How do we combine an automate these procedures? Essentially, we need and automatic procedure for locating the first syndrome. Since the zero test is in the right column, we must start the syndromes there (we always check the top element of z.sup.-1 R.sub.2.sup.(i-1). Thus, ##EQU38## In order to determine the contents of the left column, suppose S.sub.1 .noteq.0. From above we know that after 1 step, the registers should contain, ##EQU39## where x is a don't care. Also, N.sub.1 =-1. Let the left column initially contain [.alpha..sub.1 . . . .alpha..sub.2t+1 ].sup.T. At the end of iteration 1 we will have, ##EQU40## Hence, .alpha..sub.1 .noteq.0 and .alpha..sub.2 = . . . =.alpha..sub.2t+1 =0. For convenience, let .alpha..sub.1 =1. Also, N.sub.0 =0. This yields N.sub.1 =-1 since S.sub.1 .noteq.0.

Will this procedure work if S.sub.1 =0? Note that the algorithm will continue shifting R.sub.2 up until a non-zero element appears at the top of the right-hand column. At the beginning of the .eta..sub.0.sup.th iteration the registers will contain, ##EQU41## and N.sub..eta.0 =-.eta..sub.0. The completion of the .eta..sub.0.sup.th iteration yields, ##EQU42## and N.sub..eta..sbsb.0.sub.+1 =-.eta..sub.0 +1. This is the proper initialization.

One point that we have yet to clarify is the initialization of P.sub.1 and P.sub.2 ! If S.sub.1 .noteq.0, then from (20) P.sub.1.sup.(1) and P.sub.2.sup.(1) should be,

(The extra zero ([0 1 instead of [1 0) arises because the algorithm starts with [OS.sub.1 . . . S.sub.2t ].sup.T in R.sub.2. The extra zero is extraneous (really a place-holder).) (22) can be accomplished using our initialization procedure with, ##EQU43## If S.sub.1 =0, then from (21) ##EQU44## Once again, the initialization in (23) will achieve this.

We remark that the initialization procedure becomes more intuitive when the algorithm is derived in a polynomial setting, i.e. the same algorithm can be derived from Euclid's algorithm. There one initializes the algorithm with z.sup.2t and S(z). Hence, [1 0 . . . 0].sup.T =R.sub.1.sup.(0) is just the matrix equivalent of z.sup.2t. This insight also tells us that the algorithm can also be used on Goppa codes when R.sub.1 is initialized with the coefficients of the Goppa polynomial.

With the initialization specified the complete algorithm becomes, ##EQU45## Conceptually the algorithm can be visualized as follows. At the i.sup.th iteration, the contents of P.sub.2 are the tap gains for a feedback shift register which correctly generates the first i syndromes. Hence, after 2t iterations all the syndromes will have been matched. The new algorithm is a fast, extremely regular procedure for solving the Hankel matrix problem Ax=b (see (7)) even when some of the minors are singular. If vector operation are performed in parallel, the algorithm requires time on the order of t, 0(t). The best previous algorithm required time 0(tlogt).

Note that the registers have length 2t+1. This is because initially R.sub.2 contains [0 S.sub.1 . . . S.sub.2t ].sup.T. The first step of the algorithm is a shift and hence the extra zero in R.sub.2. This problem can be eliminated by doing this shift on the last step of each iteration instead of the first. Doing so shortens the registers to 2t. ##EQU46## All other recursions have similar changes. The initial conditions become, ##EQU47##

Recall that we obtained a matrix formulation of the key equation only after assuming that the solution order (# errors) was known. Can we apply the preceding matrix even when the solution order is unknown? Note that the solution to the key equation is the minimum length polynomial which generates the syndromes. With this in mind, recall the form of the P matrix provided by the new algorithm is,

The length of p.sub.T (one plus the degree of the equivalent polynomial) is ##EQU48## Corresponding to P, we have the lower triangular matrix Q as shown in FIG. 14. The vertical drops in Q correspond to points where free matches have been encountered. Lines with slope -1 result from shifting the present solution down. The important fact to garner from (27) is that Q is in echelon form. Since ##EQU49## columns are non-zero, Q is rank ##EQU50## P is a matrix with ones on the diagonal. Thus, M must have rank ##EQU51## We conclude that the minimal polynomial which generates M has length ##EQU52## Hence, p.sub.T is the desired solution. This fact demonstrates that the new algorithm does indeed provide a solution to the key equation. In the next section we will find that the new algorithm is extremely well suited for hardware implementation.

Before examining possible hardware implementations, we need to consider two additions to the algorithm. The first of these additions concerns .omega. which is given a matrix definition in (6). To determine how to compute .omega. recursively, consider a new augmented matrix M'. ##EQU53## It is quite apparent that,

where some of the .omega..sub.i may be zero. To compute .omega. recursively we define the following intermediate results, ##EQU54## An update recursion is easily found, ##EQU55## Of course the real trick is to determine the initial conditions.

Suppose that S.sub.1 .noteq.0. From (20),

Using the same initialization procedure as described above we try, ##EQU56## Note that the vectors now have length 2t.

Now let S.sub.1 =0. From (21), ##EQU57## Since S.sub.1 = . . . =S.sub..eta..sbsb.0.sub.-1 =0, .omega..sub.1 = . . . =.omega..sub..eta..sbsb.0.sub.-1 =0. Let's try the same initialization. ##EQU58##

Hence the recursions for .omega. are, ##EQU59##

The present formulation of the algorithm requires 2t iterations for completion no matter how many errors are present; yet, it seems reasonable to expect some reduction if e.ltoreq.t errors have occurred. In Peterson and Weldon (ERROR CORRECTING CODES, MIT Press, 1972--p. 284) it is shown that any set of 2e consecutive syndromes uniquely determine the error-locator polynomial, .LAMBDA.(z), when e errors are present. This is proven by demonstrating that the Hankel matrix formed from the first 2e syndromes has a non-singular e by e leading minor. Recall from the algorithm description that p.sub.e is the unique vector of P which is consistent with the first 2e syndromes (see (8)). (Since the first e by e minor is non-singular, .nu..sub.i =e for some value of i.) Note also that the contents of P.sub.2.sup.(2e) are equal to p.sub.e (see Table 1).

For this information to be useful, we need some way of determining when only e errors are present. If p.sub.e =.LAMBDA., then from the key equation, ##EQU60## If p.sub.e .noteq..LAMBDA., then some of the relationships in (31) will not be zero. From (17) and Table 1 we have, ##EQU61## We conclude that if the top 2t-2e+1 components of R.sub.2.sup.(2e) are zero then

Using this stopping condition the algorithm requires 2e iterations.

Before describing the architecture, it is important to understand the numerical quantities that we are dealing with. When a code has symbols in GF(q), the Galois field containing q elements, and blocklength n=q.sup.m -1, then it's syndromes can be represented by vectors of length m=log.sub.q n over GF(q). If q=p.sup.r then additional representations are possible. Since GF(p.sup.rm) and GF(q.sup.m) are isomorphic, the syndromes can be represented by vectors of length rm over GF(p). In particular, we remark that if q=2.sup.r then the syndromes can be represented by binary vectors of length rm. Note that the specific representation that we choose depends on the degree of parallelism desired in the syndrome computations.

Addition and multiplication in a finite field are define by polynomial addition and multiplication modulo the polynomial which defines the extension field. Namely, if two syndromes are represented by S.sub.1 =A(z) and S.sub.2 =B(z) (polynomials formed from the vector representation), then

where g(z) generates the extension field.

Various multiplier architectures can be found in Peterson and Weldon. Others can be adapted from Kailath (LINEAR SYSTEMS, Prentice-Hall, 1980). We shall use the generic pipelined multiplier shown in FIG. 3a. All the registers have length log n (base depends on representation). FSR is a feedback shift register which multiples A by B modulo g(z). indicates a transfer of the entire register contents in one step. The number at the register corners indicate the times at which the 1.sup.st symbol appears at the right edge of the register. Note that with minor modifications the VLSI multiplies of Massey and Omura can used to construct the architectures derived below. Also, if pipelined multipliers are not required, some of the shift registers in the multiplier can be removed.

A direct hardware implementation of the algorithm in (25) and (30) takes the form shown in FIG. 3b. The rectangular boxes represent storage elements. The top cell of R.sub.2 has the ability to check if its contents are zero. Because of the way the algorithm was formulated, only the top cell need have this capability. Each iteration consists of two steps. First .rho..sub.i is computed and broadcast to all cells. Using .rho..sub.i the processing nodes perform the specified function. Then, R.sub.2 and T.sub.2 are shifted up one and P.sub.2 down one. (Of course, P could be shifted up by simply turning its architecture upside down.) After 2t iterations, .LAMBDA.(z) will appear in P.sub.2. The top element of P.sub.2 will correspond to the leading coefficient (highest power of z) of .LAMBDA.. This architecture requires 2(2t+2t+2t) storage elements.

Our objective is to combine R, P and T into two registers of length 3t+2. The first step will be to combine R and P. As things are presently structured, R.sub.2 always contains 2t elements; however, not all these values are indispensable. The values that we require are the ones that appear at the top of R.sub.2 for each of the 2t iterations. These values are the pivots that tell us how to update P. Recall that the algorithm shifts R.sub.2 up one at each iteration. Thus, at iteration i, the values below 2t-i will never make to the top of R.sub.2. They are superfluous. As a consequence we need store only 2t-i values of R.sub.1 and 2t-i values of R.sub.2 at iteration i. It is also easy to see that at iteration i we need to store i+1 values of P.sub.1 and i+1 values of P.sub.2 (P.sub.2 has length 1 at iteration 0 ). We conclude that only 2(2t+1) storage elements are required for R and P. The registers in R shrink and those in P lengthen.

Before combining R and P we need to modify the recursions for P so that it shifts up instead of down. This is done by simply flipping the initial condition. ##EQU62##

Let us call the registers containing both R and P, R.sub.1 and R.sub.2. The modified recursions are, ##EQU63## Here R.sub.1.sup.(i) (m) indicates that the m.sup.th element of R.sub.1.sup.(i). The purpose of this statement is to clear the lower part of the register for use by P (corresponds to the shifting dotted line in the linear recurrence example). The algorithm shown here is exactly the one used in FIG. 2.

Now we will combine R, P and T. Note that the maximum number of errors the code can correct is t. This means that if .LAMBDA. is longer than t+1, more than t errors have occurred. Because of this, we need store only the first t+1 elements of .LAMBDA.. Even so, we can still detect a decoding failure. If N.sub.2t is negative then .LAMBDA. would have been longer than t+1 (even though that is all we are storing). This follows from Table 1. If .LAMBDA. is longer than t+1 it can't be uniquely determined since only 2t syndromes are known. A non-unique .LAMBDA. is indicated by a negative N.sub.2t. The combined recursions are, ##EQU64## where x is a don't care. The new architecture is shown in FIG. 4.

Two last changes greatly improve the performance of the architecture. The first change involves the removal of the division from the algorithm. As we shall see in the cell implementations, this greatly increases throughput. Let

Using this notation, we re-write the recursions. ##EQU65## How does this affect the algorithm? Let R'.sub.1 and R'.sub.2 be the registers in the original version of the algorithm. Suppose that some point we have,

Let a'.sub.i+1 be the top element of R'.sub.1.sup.(i) and b'.sub.i+1 be the top element of R'.sub.2.sup.(i). Then, ##EQU66## Can c.sub.1 or c.sub.2 ever be zero? No, since we always pull a.sub.i out of the division and a.sub.i .noteq.0. Therefore,

Thus we recover c.LAMBDA.(z) and c.omega.(z); but, since we only need the roots of .LAMBDA.(z) and the ratio, .omega.(z)/.LAMBDA.'(z), the constant is unimportant.

The final algorithm modification deals with the control variables. At the moment we have to test the condition,

However, testing for N.sub.i >0 is not convenient for hardware implementation. Suppose that instead we had a flag which indicated when N.sub.i was non-negative. ##EQU67## We set .gamma..sub.i and set N.sub.i negative if z.sub.i is 1 and the top element of R.sub.2 is not zero. ##EQU68## If .gamma..sub.i is set to one, then z must be reset. ##EQU69## N.sub.i is set negative if .gamma..sub.i =1. By changing the way the zero test words, the number of gates reqired to implement this logic can be optimized.

The new version of the architecture is displayed in FIG. 5. Note that it is a systolic array and hence simple to implement. This conclusion is further strengthened by examining the implementations of the cells in FIG. 5. The computing array of FIG. 5 has two types of cells. The top cell on each column is special because it computes control and pivot information. The remaining cells, all of the same form, use this information to perform an update. A possible top cell implementation is shown in FIG. 6. The top two lines compute control information for .gamma..sub.i. A slightly modified version of the previously described control was used. N is an integer which is transmitted serially. The box checks if N is zero (1 is yes). The cell is a length log n shift register. The cell performs a complement operation (the exact way a negative number is formed depends on the number system being used). The bottom two lines are the top elements of R.sub.1 and R.sub.2 . These values are shifted and then stored and transmitted down to the rest of the cells. After the iteration is complete, the values are be exchanged according .gamma..sub.i.

The rest of the processing blocks have the form shown in FIG. 7. The cell implements the operation given in (32). The top line is for an element of R.sub.1 and the bottom for R.sub.2. Shift registers "store" the output of the previous multiplications. Note that each multiplier picks up the appropriate set of log n lines from the bus The XCH box exchanges R.sub.1 and R.sub.2 according to .gamma..sub.i. Note that the elements of R.sub.2 are shifted up automatically. We note that if the broadcasting of the pivot becomes a problem, some extra stages can be added to the left-hand shift registers to allow more leeway. A more robust solution to this problem will be discussed later.

At this point it is instructive to compare this architecture with the best previous solution. One candidate for this accolade is a parallel architecture for implementing the Berlekamp-Massey algorithm which was suggested by Massey (see FIG. 8). The Massey architecture can be thought of in two pieces. The upper half of the architecture is used to update .LAMBDA., the error-locator polynomial. .DELTA. is essentially a prediction error--a check whether any "free matches" have occurred. B is some previous value of .LAMBDA.. Except for broadcasting .DELTA., all communication is local. The lower half is a different story. This section computes .DELTA. from an inner product of .LAMBDA. and some segment of the syndromes. Note the possibly long wires. More importantly, the inner product requires a t-input adder. Since a typical adder has only a few inputs, this t-component addition requires time log t. Additionally, the next iteration can't begin until the inner product is completed. This prevents efficient pipelining of the architecture. In the form shown, the Massey architecture requires 2t log 2t iterations to find the solution to the key equation.

The major difference between the Massey architecture and the algorithm we propose is that removal of the inner product operation. This leads to a simplification that is apparent from comparing FIGS. 5 and 8. Except for broadcasting pivot information, the new architecture requires only local communication between processing elements. This helps increase processing speed. In fact, even the pivot information can be pipelined making communication completely local (we omit the details for now). Because of the inner product operation, the Massey architecture can't achieve this. We remark that the new algorithm requires time min(2t,2e) as opposed to 2t log 2t which is required by the Massey architecture.

Another advantage of the new architecture is the ease with which it can be pipelined. The idea behind pipelining is the following. At each iteration in the new architecture, the various processing elements fetch information from the storage elements and then compute some function. The new results are put back in essentially the same storage elements once the computation is complete. Suppose, however, that we had another copy of the architecture lying next to the original. Then instead of placing the results in the old storage elements we could place them in the new circuit. This leaves the original circuit ready to accept a new problem. Taking this idea to the limit, assume that we had as many circuits as iterations, i.e. 2t. The overall architecture would then be able to accept a new set syndromes (a new codeword) after each iteration. Using a single architecture, one must wait 2t iterations before a new set of syndromes can be entered. The effect of this pipelining or replication is to increase throughput. Because of the inner product operation, this is not easy to do with the Massey architecture.

An example of a fully pipelined array is shown in FIG. 9. Here t is taken to be 2. We remark that FIG. 9 has the structure of a systolic array and hence is extremely easy to construct. Each column corresponds to the architecture depicted in FIG. 5. The diagonal connections between cells perform the shifting of R.sub.2. The architecture can be considered as three pieces: an upper triangular part, a middle strip and a lower triangular part. While the upper triangle works on the syndromes and generates the pivots, the middle strip updates the estimate of .LAMBDA.. The lower triangle updates the estimate of .omega.. The outputs of the last stage given the error-locator and evaluator polynomials as shown in FIG. 9. The pipeline period of the array (time between successive syndromes) is the time required to perform one iteration. We remark that there are other ways to pipeline the array. Instead of performing one iteration, each column of processors could perform m iterations. Then only 2t/m columns would be required and the pipeline period would be m iterations. Depending on the hardware before and after the key equation solver, a particular degree of pipelining might be advantageous.

We note that slightly modified cells are used to implement the pipelined array. These are shown in FIG. 10.

Consider once again the architecture in FIG. 6. One possibly significant drawback is that it requires us to broadcast the pivot information (a.sub.i and b.sub.i) to all the computation cells. Essentially we require the broadcast to be completed in one shift register clock cycle. For large values of t this would require driving a long wire with associated area and time delay penalties; hence, a large and slower architecture. A more ideal situation would result if we were only required to send pivot information to adjacent cells.

To show how the architecture can be appropriately modified, we introduce the following notation, ##EQU70## Let t=2, What would happen if a.sub.i and b.sub.i were only allowed to propagate down one level at each iteration? (we ignore .omega.for now)

In Table 2, the notation j.dwnarw..sup.k j indicates that pivots corresponding to iteration k are now available for updating the registers. We observe from the table that each one of the iterations from the algorithm is spread out in time. Each .dwnarw..sup.k can be thought of as a computational wavefront which is propagating the associated iteration. Note that we can't begin the second wavefront until step 2 (recall that r.sub.22.sup.(1) is computed from r.sub.13.sup.(0) and r.sub.23.sup.(0)). As a result, the separation between wavefronts is 2 steps. From the table we can deduce that 6t-2 steps are required to complete the algorithm when only local communication is allowed.

This seems like a rather drastic penalty! We can trace the separation of the wavefronts back to the fact that we don't begin computing r.sub.22.sup.(1) until step 1; yet, this means that we are allotting a full step for the pivots to propagate down from level 2 to level 3. A more realistic assumption is that this propagation takes only a new shift register clock cycles. Using this assumption the computation of r.sub.22.sup.(1) can begin while r.sub.21.sup.(1) is still being completed. Of course, doing this blurs the separation between the steps in Table 2. If we call the time for propagation .DELTA., then the time between wavefronts becomes 1+.DELTA. where .DELTA. is fractional. The total time required to compute R.sub.2.sup.(2t) becomes,

The first wavefront takes one step to initiate while the remaining wavefronts are separated by 1+.DELTA.. Completing the tail (see FIG. 11) takes time (2t-1).DELTA. since there are 2t-1 elements of R.sub.2.sup.(2t) left to compute. The total time is

As long as .DELTA. is small, the expense associated with local communication is not too high.

The effective computation time can be reduced even further by making the following observation: we can begin computation with the next set of syndromes before completing the tail of the computations involving the previous set. To see this, consider FIG. 11. In Table 2, all the data was sitting in the processors at time 0; yet, we could only process the first and second syndromes. The third syndrome was not required until time .DELTA., and the fourth at 2.DELTA.. Thus, we could enter the data staggered in time as shown in FIG. 11. We also note that the first and second processors have finished their required computations at time 1+(2t-1)(1+.DELTA.) They are ready to accept new syndromes. These facts suggest the pipelining scheme shown in FIG. 11. The time between successive sets of syndromes is,

To implement the algorithm with local communication, new cell descriptions are required. The top two cells become one and are shown in FIG. 12. The .DELTA. shift register has length .DELTA.. The difference between these cells and the ones they replace becomes apparent when examining the bottom cells (see FIG. 13). Note the additional storage unit on the pivot lines. This gates the pivot information and determines the propagation. Additional shift register are present on some output lines to align data. As done previously, we can also replicate the architecture in space to increase throughput. An example of this is shown in FIG. 14.

Using these cell implementations of FIG. 10 it is possible to estimate the processing speed of the new architecture. Suppose that we use a fully pipelined array, i.e. 2t columns. Thus, the pipeline period is one iteration. Since the multipliers require log n shift cycles, the time per iteration is approximately log n shift cycles (the multipliers are pipelined). Consider a numerical example. Let the desired bit rate be 500 Mb/s. How fast must the shift registers be clocked in order to support this data rate? Assume the blocklength is 127. The time between codewords is n/500. Let T.sub..phi. be the shift register clock period. Thus, ##EQU71## This clock rate seems very reasonable. Hence, pipelining can make high data rates achievable.

While the invention has been described with reference to specific embodiments, the description is illustrative of the invention and is not to be construed as limiting the invention. Various mdifications and applications may occur to those skilled in the art without departing from the true spirit and scope of the invention as defined by the appended claims.